the fault address of a traced process

[Bruce Janson]

One process traces another.
When the traced process tries to read, write or execute an unmapped
address it is stopped with a SIGSEGV signal.
The tracer now wants to determine the traced process' faulted address.
According to the (2.2.19) kernel source

  .../arch/i386/mm/fault.c:do_page_fault()

such a fault in user mode causes the offending address and error code to
be saved in

  tsk->tss.cr2

and

  tsk->tss.error_code

respectively.  There do not appear to be ptrace() or /proc hooks
to extract this data directly.  In earlier unices extraction of this
data would have required grubbing around in /dev/kmem using the
kernel namelist as a guide.
How should a tracer extract this information under a current
(2.2.*, 2.4.*) Linux?