diff --git a/README.adoc b/README.adoc
index 2bf7f3c..26a6a79 100644
--- a/README.adoc
+++ b/README.adoc
@@ -10989,10 +10989,43 @@ This directory has the following structure:
 
 ==== include directory
 
-link:include/[] contains headers that are shared acros both kernel modules and userland structures.
+link:include/[] contains headers that are shared across both kernel modules and userland structures.
 
 They contain data structs and magic constant for kernel to userland communication.
 
+==== userland directory
+
+Userland test programs.
+
+It is possible to build and run those examples directly on your host:
+
+....
+cd userland
+make
+....
+
+For usage in the guest, build with:
+
+....
+./build-userland
+....
+
+Source: link:build-userland[].
+
+This makes them visible immediately on the 9P mount `/mnt/9p/out_root_overlay`.
+
+In order to place them in the root filesystem image itself, you must also run:
+
+....
+./build-buildroot
+....
+
+To force rebuild all examples, pass the `-B` option to `make`:
+
+....
+./build-buildroot --make-args=-B
+....
+
 ==== packages directory
 
 Every directory inside it is a Buildroot package.
diff --git a/build-userland b/build-userland
index 47345e6..f410e4c 100755
--- a/build-userland
+++ b/build-userland
@@ -2,6 +2,7 @@
 
 import os
 import platform
+import shlex
 import shutil
 import subprocess
 
@@ -18,6 +19,10 @@ Indicate that a given package is present in the root filesystem, which
 allows us to build examples that rely on it.
 ''',
         )
+        parser.add_argument(
+            '--make-args',
+            default='',
+        )
         parser.add_argument(
             'targets',
             default=[],
@@ -27,7 +32,6 @@ Default: build all examples that have their package dependencies met.
 For example, an OpenBLAS example can only be built if the target root filesystem
 has the OpenBLAS libraries and headers installed.
 ''',
-            metavar='programs',
             nargs='*',
         )
 
@@ -49,6 +53,7 @@ has the OpenBLAS libraries and headers installed.
                     'OUT_DIR={}'.format(build_dir),
                 ] +
                 ['HAS_{}=y'.format(package.upper()) for package in args.has_package] +
+                shlex.split(args.make_args) +
                 [os.path.join(build_dir, os.path.splitext(os.path.split(target)[1])[0]) + common.executable_ext for target in args.targets]
             ),
             cwd=common.userland_src_dir,
diff --git a/kernel_modules/README.adoc b/kernel_modules/README.adoc
new file mode 100644
index 0000000..3cf2344
--- /dev/null
+++ b/kernel_modules/README.adoc
@@ -0,0 +1 @@
+https://github.com/cirosantilli/linux-kernel-module-cheat#your-first-kernel-module-hack
diff --git a/userland/README.adoc b/userland/README.adoc
new file mode 100644
index 0000000..8f1808c
--- /dev/null
+++ b/userland/README.adoc
@@ -0,0 +1 @@
+https://github.com/cirosantilli/linux-kernel-module-cheat#userland-directory
diff --git a/userland/common.h b/userland/common.h
index 19b2965..b8caee3 100644
--- a/userland/common.h
+++ b/userland/common.h
@@ -34,14 +34,16 @@ int pagemap_get_entry(PagemapEntry *entry, int pagemap_fd, uintptr_t vaddr)
 	size_t nread;
 	ssize_t ret;
 	uint64_t data;
+	uintptr_t vpn;
 
+	vpn = vaddr / sysconf(_SC_PAGE_SIZE);
 	nread = 0;
 	while (nread < sizeof(data)) {
 		ret = pread(
 			pagemap_fd,
 			&data,
-			sizeof(data),
-			(vaddr / sysconf(_SC_PAGE_SIZE)) * sizeof(data) + nread
+			sizeof(data) - nread,
+			vpn * sizeof(data) + nread
 		);
 		nread += ret;
 		if (ret <= 0) {
@@ -61,7 +63,7 @@ int pagemap_get_entry(PagemapEntry *entry, int pagemap_fd, uintptr_t vaddr)
  * @param[out] paddr physical address
  * @param[in]  pid   process to convert for
  * @param[in]  vaddr virtual address to get entry for
- * @return  		 0 for success, 1 for failure
+ * @return           0 for success, 1 for failure
  */
 int virt_to_phys_user(uintptr_t *paddr, pid_t pid, uintptr_t vaddr)
 {