diff --git a/kernel/app/init-example/app/init.cc b/kernel/app/init-example/app/init.cc
index b2602826..84c0b493 100644
--- a/kernel/app/init-example/app/init.cc
+++ b/kernel/app/init-example/app/init.cc
@@ -208,8 +208,12 @@ void test_tls()
   y = 2*y;
   TEST_EQ(x, 2048);
   TEST_EQ(y, 4096);
+  
+  std::atomic<int> sync(0);
 
   auto threadFun = [] (void *data) -> void* {
+    auto sync = reinterpret_cast<std::atomic<int>*>(data);
+    sync->store(1);
     MLOG_INFO(mlog::app, "main thread TLS:", DVARhex(readFS(0)), DVARhex(readFS(0x28)));
     TEST_EQ(x, 1024);
     TEST_EQ(y, 2048);
@@ -220,20 +224,31 @@ void test_tls()
     y = y*2;
     TEST_EQ(x, 2048);
     TEST_EQ(y, 4096);
+    sync->store(2);
     return nullptr;
   };
 
   mythos::ExecutionContext ec1(capAlloc());
   auto tls = mythos::setupNewTLS();
+  mythos::Frame stateFrame(capAlloc());
+  auto res2 = stateFrame.create(pl, kmem, 4096, 4096).wait();
+  TEST(res2);
   MLOG_INFO(mlog::app, "test_EC: create ec1 TLS", DVARhex(tls));
   ASSERT(tls != nullptr);
   auto res1 = ec1.create(kmem).as(myAS).cs(myCS).sched(mythos::init::SCHEDULERS_START + 1)
-    .prepareStack(thread1stack_top).startFun(threadFun, nullptr, ec1.cap())
+    .state(stateFrame.cap(),0)
+    .prepareStack(thread1stack_top)
+    .startFun(threadFun, &sync, ec1.cap())
     .suspended(false).fs(tls)
     .invokeVia(pl).wait();
   TEST(res1);
   TEST(ec1.setFSGS(pl,(uint64_t) tls, 0).wait());
   mythos::syscall_signal(ec1.cap());
+  MLOG_INFO(mlog::app, "waiting for EC to finish...");
+  while (sync.load() != 2) {} // @todo should call mythos::syscall_yield()
+  // delete ec1, stateFrame; cannot delete the allocated TLS :-/
+  capAlloc.free(stateFrame, pl);
+  capAlloc.free(ec1, pl);
   MLOG_INFO(mlog::app, "End test tls");
 }
 
@@ -331,14 +346,14 @@ void* threadMain(void* arg){
 }
 
 void test_pthreads(){
-  MLOG_INFO(mlog::app, "Test Pthreads");
-	pthread_t p;
- 
-	auto tmp = pthread_create(&p, NULL, &threadMain, NULL);
-  MLOG_INFO(mlog::app, "pthread_create returned", DVAR(tmp));
-	pthread_join(p, NULL);
-
-  MLOG_INFO(mlog::app, "End Test Pthreads");
+    MLOG_INFO(mlog::app, "Test Pthreads");
+    pthread_t p;
+
+    auto tmp = pthread_create(&p, NULL, &threadMain, NULL);
+    MLOG_INFO(mlog::app, "pthread_create returned", DVAR(tmp));
+    pthread_join(p, NULL);
+
+    MLOG_INFO(mlog::app, "End Test Pthreads");
 }
 
 void test_omp(){
@@ -368,12 +383,14 @@ void test_omp(){
 mythos::Mutex mutex;
 void* thread_main(void* ctx)
 {
+  auto sync = reinterpret_cast<std::atomic<int>*>(ctx);
   MLOG_INFO(mlog::app, "hello thread!", DVAR(ctx));
   mutex << [ctx]() {
     MLOG_INFO(mlog::app, "thread in mutex", DVAR(ctx));
   };
   mythos::ISysretHandler::handle(mythos::syscall_wait());
   MLOG_INFO(mlog::app, "thread resumed from wait", DVAR(ctx));
+  sync->store(2);
   return 0;
 }
 
@@ -382,25 +399,34 @@ void test_ExecutionContext()
   MLOG_INFO(mlog::app, "Test ExecutionContext");
   mythos::ExecutionContext ec1(capAlloc());
   mythos::ExecutionContext ec2(capAlloc());
+  mythos::Frame stateFrame(capAlloc());
+  std::atomic<int> sync1(0);
+  std::atomic<int> sync2(0);
   {
     MLOG_INFO(mlog::app, "test_EC: create ec1");
     mythos::PortalLock pl(portal); // future access will fail if the portal is in use already
 
+    auto res3 = stateFrame.create(pl, kmem, 2*4096, 4096).wait();
+    TEST(res3);
     auto tls1 = mythos::setupNewTLS();
     ASSERT(tls1 != nullptr);
-    auto res1 = ec1.create(kmem).as(myAS).cs(myCS).sched(mythos::init::SCHEDULERS_START)
-    .prepareStack(thread1stack_top).startFun(&thread_main, nullptr, ec1.cap())
-    .suspended(false).fs(tls1)
-    .invokeVia(pl).wait();
+    auto res1 = ec1.create(kmem).as(myAS).cs(myCS).sched(mythos::init::SCHEDULERS_START+1)
+        .state(stateFrame.cap(), 0)
+        .prepareStack(thread1stack_top)
+        .startFun(&thread_main, &sync1, ec1.cap())
+        .suspended(false).fs(tls1)
+        .invokeVia(pl).wait();
     TEST(res1);
 
     MLOG_INFO(mlog::app, "test_EC: create ec2");
     auto tls2 = mythos::setupNewTLS();
     ASSERT(tls2 != nullptr);
     auto res2 = ec2.create(kmem).as(myAS).cs(myCS).sched(mythos::init::SCHEDULERS_START+1)
-    .prepareStack(thread2stack_top).startFun(&thread_main, nullptr, ec2.cap())
-    .suspended(false).fs(tls2)
-    .invokeVia(pl).wait();
+        .state(stateFrame.cap(), 4096)
+        .prepareStack(thread2stack_top)
+        .startFun(&thread_main, &sync2, ec2.cap())
+        .suspended(false).fs(tls2)
+        .invokeVia(pl).wait();
     TEST(res2);
   }
 
@@ -408,9 +434,21 @@ void test_ExecutionContext()
     for (volatile int j=0; j<1000; j++) {}
   }
 
-  MLOG_INFO(mlog::app, "sending notifications");
+  MLOG_INFO(mlog::app, "  sending notifications");
   mythos::syscall_signal(ec1.cap());
   mythos::syscall_signal(ec2.cap());
+  MLOG_INFO(mlog::app, "  waiting for EC1 to finish...");
+  while (sync1.load() != 2) {} // @todo should call mythos::syscall_yield()
+  MLOG_INFO(mlog::app, "  waiting for EC2 to finish...");
+  while (sync2.load() != 2) {} // @todo should call mythos::syscall_yield()
+
+  {
+    MLOG_INFO(mlog::app, "test_EC: delete ECs and state frame");
+    mythos::PortalLock pl(portal); // future access will fail if the portal is in use already
+    capAlloc.free(stateFrame, pl);
+    capAlloc.free(ec1, pl);
+    capAlloc.free(ec2, pl);
+  }
   MLOG_INFO(mlog::app, "End Test ExecutionContext");
 }
 
@@ -421,10 +459,15 @@ void test_InterruptControl() {
   mythos::PortalLock pl(portal); // future access will fail if the portal is in use already
 
   mythos::ExecutionContext ec(capAlloc());
+  mythos::Frame stateFrame(capAlloc());
+  auto res2 = stateFrame.create(pl, kmem, 4096, 4096).wait();
+  TEST(res2);
   auto tls = mythos::setupNewTLS();
   ASSERT(tls != nullptr);
   auto res1 = ec.create(kmem).as(myAS).cs(myCS).sched(mythos::init::SCHEDULERS_START + 2)
-    .prepareStack(thread3stack_top).startFun(&thread_main, nullptr, ec.cap())
+    .state(stateFrame.cap(), 0)
+    .prepareStack(thread3stack_top)
+    .startFun(&thread_main, nullptr, ec.cap())
     .suspended(false).fs(tls)
     .invokeVia(pl).wait();
   TEST(res1);
diff --git a/kernel/boot/init-loader-amd64/boot/load_init.cc b/kernel/boot/init-loader-amd64/boot/load_init.cc
index d7fe9e31..13ee544f 100644
--- a/kernel/boot/init-loader-amd64/boot/load_init.cc
+++ b/kernel/boot/init-loader-amd64/boot/load_init.cc
@@ -47,9 +47,9 @@
 
 
 namespace mythos {
-    
+
 Event<boot::InitLoader&> event::initLoader;
-    
+
 namespace boot {
 
 InitLoader::InitLoader(char* image)
@@ -140,6 +140,10 @@ optional<void> InitLoader::initCSpace()
   res = memMapper.installPML4(init::PML4);
   if (!res) RETHROW(res);
 
+  MLOG_INFO(mlog::boot, "... create state frame for init thread in cap", init::STATE_FRAME);
+  auto stateFrameCap = memMapper.createFrame(init::STATE_FRAME, 4096, 4096);
+  if (!stateFrameCap) RETHROW(stateFrameCap);
+
   MLOG_INFO(mlog::boot, "... create example factory in cap", init::EXAMPLE_FACTORY);
   res = optional<void>(Error::SUCCESS);
   if (res) res = csSet(init::EXAMPLE_FACTORY, factory::example);
@@ -277,8 +281,9 @@ optional<void> InitLoader::createEC(uintptr_t ipc_vaddr)
   if (res) res = ec->setCapSpace(capAlloc.get(init::CSPACE));
   if (res) res = ec->setAddressSpace(capAlloc.get(init::PML4));
   if (res) res = ec->setSchedulingContext(capAlloc.get(init::SCHEDULERS_START));
+  if (res) res = ec->setStateFrame(capAlloc.get(init::STATE_FRAME), 0, true);
   if (!res) RETHROW(res);
-  ec->getThreadState().rdi = ipc_vaddr;
+  ec->setRegParams(ipc_vaddr); // will be in rdi
   ec->setEntryPoint(_img.header()->entry);
   ec->setTrapped(false);
   RETURN(Error::SUCCESS);
diff --git a/kernel/cpu/fpu-amd64/cpu/fpu.cc b/kernel/cpu/fpu-amd64/cpu/fpu.cc
index 227340c2..0bbdcaee 100644
--- a/kernel/cpu/fpu-amd64/cpu/fpu.cc
+++ b/kernel/cpu/fpu-amd64/cpu/fpu.cc
@@ -41,7 +41,7 @@ static uint32_t xstate_sizes[x86::XFeature::MAX];
 static uint32_t xstate_comp_offsets[x86::XFeature::MAX];
 
 enum FpuMode { FSAVE, FXSAVE, XSAVE, XSAVEOPT, XSAVES };
-static char const * const fpuModeNames[] = 
+static char const * const fpuModeNames[] =
   {"FSAVE", "FXSAVE", "XSAVE", "XSAVEOPT", "XSAVES"};
 static FpuMode fpu_mode = FSAVE;
 
@@ -49,7 +49,7 @@ static FpuMode fpu_mode = FSAVE;
 static void fpu_setup_xstate()
 {
   // ask cpuid for supported features
-  xfeatures_mask = x86::getXFeaturesMask(); 
+  xfeatures_mask = x86::getXFeaturesMask();
   mlog::boot.detail("xsave features from cpuid 0xd", DVARhex(xfeatures_mask));
   // and then disable features not supported by the processor
   if (!x86::hasFPU()) xfeatures_mask.fp = false;
@@ -88,7 +88,7 @@ static void fpu_setup_xstate()
   }
   PANIC(fpu_xstate_size <= sizeof(x86::FpuState));
   //do_extra_xstate_size_checks();
-  // for PT: update_regset_xstate_info(fpu_user_xstate_size,	xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR);
+  // for PT: update_regset_xstate_info(fpu_user_xstate_size,    xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR);
 
   // get the offsets and sizes of the state space
   xstate_offsets[0] = 0; // legacy FPU state
@@ -100,7 +100,7 @@ static void fpu_setup_xstate()
   auto last_good_offset = offsetof(x86::XRegs, extended_state_area); // beginnning of the "extended state"
   for (uint8_t idx = 2; idx < x86::XFeature::MAX; idx++) {
     if (!xfeatures_mask.enabled(idx)) continue;
-    xstate_offsets[idx] = (!x86::isXFeatureSupervisor(idx)) ? x86::getXFeatureOffset(idx) : 0; 
+    xstate_offsets[idx] = (!x86::isXFeatureSupervisor(idx)) ? x86::getXFeatureOffset(idx) : 0;
     xstate_sizes[idx] = x86::getXFeatureSize(idx);
     OOPS_MSG(last_good_offset <= xstate_offsets[idx], "cpu has misordered xstate");
     last_good_offset = xstate_offsets[idx];
@@ -132,7 +132,7 @@ static void fpu_setup_xstate()
   char const* names[] = {"x87", "mmx/sse", "ymm", "bndregs", "bndcsr", "opmask", "zmm_hi256", "hi16_zmm", "pt", "pkru"};
   for (uint8_t idx = 0; idx < x86::XFeature::MAX; idx++) {
     if (!xfeatures_mask.enabled(idx)) continue;
-    mlog::boot.detail("we support XSAVE feature", idx, names[idx], 
+    mlog::boot.detail("we support XSAVE feature", idx, names[idx],
       DVARhex(xstate_offsets[idx]), DVAR(xstate_sizes[idx]),
       DVARhex(xstate_comp_offsets[idx]), DVAR(xstate_comp_sizes[idx]));
   }
@@ -144,8 +144,8 @@ void FpuState::initBSP()
 
   mlog::boot.info("has x87 FPU:", DVAR(x86::hasMMX()), DVAR(x86::hasAVX()),
     DVAR(x86::hasAVX()&&x86::hasAVX512F()), DVAR(x86::hasXSAVE()),
-    DVAR(x86::hasXSAVE()&&x86::hasXSAVEC()), 
-    DVAR(x86::hasXSAVE()&&x86::hasXSAVEOPT()), 
+    DVAR(x86::hasXSAVE()&&x86::hasXSAVEC()),
+    DVAR(x86::hasXSAVE()&&x86::hasXSAVEOPT()),
     DVAR(x86::hasXSAVE()&&x86::hasXSAVES()));
 
   // initialise MXCR feature mask for fxsr
@@ -276,6 +276,11 @@ void FpuState::clear()
   memcpy(&state, &fpu_init_state, fpu_xstate_size);
 }
 
+size_t FpuState::size()
+{
+    return fpu_xstate_size;
+}
+
 } // namespace cpu
 } // namespace mythos
 
diff --git a/kernel/cpu/fpu-amd64/cpu/fpu.hh b/kernel/cpu/fpu-amd64/cpu/fpu.hh
index 1760ff10..4c0c0d71 100644
--- a/kernel/cpu/fpu-amd64/cpu/fpu.hh
+++ b/kernel/cpu/fpu-amd64/cpu/fpu.hh
@@ -44,13 +44,14 @@ namespace mythos {
       /** called during bootup on each processor. */
       static void initAP();
 
+      static size_t size();
 
       void clear();
       void save();
       void restore();
 
     public:
-      x86::FpuState state;      
+      x86::FpuState state;
     };
 
   } // namespace cpu
diff --git a/kernel/cpu/kernel-entry-amd64/cpu/irq_entry.S b/kernel/cpu/kernel-entry-amd64/cpu/irq_entry.S
index dee17b06..25b1c665 100644
--- a/kernel/cpu/kernel-entry-amd64/cpu/irq_entry.S
+++ b/kernel/cpu/kernel-entry-amd64/cpu/irq_entry.S
@@ -134,14 +134,16 @@ interrupt_common:
         movq $0, TS_MAYSYSRET(%rax)
 
         // might be on the NMI stack, but everything is stored safely
-	// in the ThreadState, thus we can switch to the bigger kernel
-	// stack now
+        // in the ThreadState, thus we can switch to the bigger kernel
+        // stack now
         /// @todo check whether we actually could end up on the NMI stack when coming from user mode!!!
         mov %gs:kernel_stack, %rsp
         mov %rax, %rdi   // 1. argument: pointer to thread_state
         xor %rbp, %rbp
         pushq   $0 // fake return address
-        jmp irq_entry_user
+        jmp irq_entry_user   // @todo as a call
+        // @todo call try to return to user via scheduler
+        // @todo call sleep if nothing to return to
 
 interrupt_kernel:
         xchg %bx, %bx
@@ -181,40 +183,3 @@ interrupt_kernel:
         pop %rcx
         add $(2*8), %rsp // pop irqno and error code
         iretq
-
-.global irq_return_user
-.type irq_return_user, @function
-irq_return_user:
-        xchg %bx, %bx
-        mov $IA32_FS_BASE, %rcx
-        mov TS_FS_BASE(%rdi), %eax
-        mov (TS_FS_BASE+4)(%rdi), %edx
-        wrmsr   // restore user's FS base
-        mov $IA32_KERNEL_GS_BASE, %rcx
-        mov TS_GS_BASE(%rdi), %eax
-        mov (TS_GS_BASE+4)(%rdi), %edx
-        wrmsr   // prepare user's GS base for swapgs
-        // create fake interrupt frame on the kernel stack
-        pushq $(SEGMENT_USER_DS+3)        // SS - user data segment with bottom 2 bits set for ring 3
-        pushq TS_RSP(%rdi)               // RSP - user stack from 2nd parameter
-        pushq TS_RFLAGS(%rdi)            // RFLAGS
-        pushq $(SEGMENT_USER_CS+3)        // CS  - user code segment with bottom 2 bits set for ring 3
-        pushq TS_RIP(%rdi)               // RIP - Instruction pointer after iretq
-        // restore all other register
-        mov TS_RAX(%rdi), %rax
-        mov TS_RBX(%rdi), %rbx
-        mov TS_RCX(%rdi), %rcx
-        mov TS_RDX(%rdi), %rdx
-        mov TS_RSI(%rdi), %rsi
-        mov TS_RBP(%rdi), %rbp
-        mov TS_R8(%rdi), %r8
-        mov TS_R9(%rdi), %r9
-        mov TS_R10(%rdi), %r10
-        mov TS_R11(%rdi), %r11
-        mov TS_R12(%rdi), %r12
-        mov TS_R13(%rdi), %r13
-        mov TS_R14(%rdi), %r14
-        mov TS_R15(%rdi), %r15
-        mov TS_RDI(%rdi), %rdi
-        swapgs  // restore user's GS base
-        iretq   // return to user mode and enable interrupts via rflags IF field
diff --git a/kernel/cpu/kernel-entry-amd64/cpu/kernel_entry.hh b/kernel/cpu/kernel-entry-amd64/cpu/kernel_entry.hh
index bf2f3f38..011cf523 100644
--- a/kernel/cpu/kernel-entry-amd64/cpu/kernel_entry.hh
+++ b/kernel/cpu/kernel-entry-amd64/cpu/kernel_entry.hh
@@ -71,20 +71,18 @@ namespace mythos {
     /** high-level syscall handler, must be defined by another module, used by syscall_entry.S */
     NORETURN void syscall_entry_cxx(ThreadState*) SYMBOL("syscall_entry_cxx");
 
-    /** return from syscall to user, defined in syscall_entry.S, reads state from thread_state */
-    NORETURN void syscall_return(ThreadState*) SYMBOL("syscall_return");
+    namespace internal {
+        /** return from syscall or interrupt to user, defined in syscall_entry.S, reads state from thread_state */
+        NORETURN void return_to_user_asm(ThreadState*) SYMBOL("return_to_user_asm");
+    } // namespace internal
 
     /** high-level irq handler when entering from user mode, must be
      * defined by another module, used by irq_entry.S */
     NORETURN void irq_entry_user(ThreadState*) SYMBOL("irq_entry_user");
 
-    /** return from interrupt to user, defined in irq_entry.S, reads state from thread_state */
-    NORETURN void irq_return_user(ThreadState*) SYMBOL("irq_return_user");
-
     NORETURN inline void return_to_user() {
-      ThreadState* s = thread_state.get();
-      if (s->maySysret && s->rip < 0x7FFFFFFFFFFF) syscall_return(s);
-      else irq_return_user(s);
+        // @todo handle case of nullptr -> sleep ???
+        internal::return_to_user_asm(thread_state.get());
     }
 
     /** Layout of the kernel's execution state on the interrupted kernel's stack.
diff --git a/kernel/cpu/kernel-entry-amd64/cpu/syscall_entry.S b/kernel/cpu/kernel-entry-amd64/cpu/syscall_entry.S
index c04edcc0..cc969807 100644
--- a/kernel/cpu/kernel-entry-amd64/cpu/syscall_entry.S
+++ b/kernel/cpu/kernel-entry-amd64/cpu/syscall_entry.S
@@ -24,6 +24,7 @@
  * Copyright 2016 Randolf Rotta, Robert Kuban, Maik Krüger, and contributors, BTU Cottbus-Senftenberg
  */
 #include "cpu/thread-state-layout.h"
+#include "cpu/gdt-layout.h"
 
 .extern thread_state
 .extern kernel_stack
@@ -61,11 +62,14 @@ syscall_entry:
         mov %rax, %rdi   // 1. argument: pointer to thread_state
         xor %rbp, %rbp
         pushq   $0 // fake return address
-        jmp syscall_entry_cxx
+        jmp syscall_entry_cxx   // @todo as a call
+        // @todo call try to return to user via scheduler
+        // @todo call sleep if nothing to return to
 
-.global syscall_return
-.type syscall_return, @function
-syscall_return:
+.global return_to_user_asm
+.type return_to_user_asm, @function
+// RDI: ThreadState*
+return_to_user_asm:
         mov $IA32_FS_BASE, %rcx
         mov TS_FS_BASE(%rdi), %eax
         mov (TS_FS_BASE+4)(%rdi), %edx
@@ -74,24 +78,59 @@ syscall_return:
         mov TS_GS_BASE(%rdi), %eax
         mov (TS_GS_BASE+4)(%rdi), %edx
         wrmsr   // prepare user's GS base for swapgs
-        mov TS_RBP(%rdi), %rbp
-        /// @todo may use xor %reg,%reg to zero the unpreserved registers
+
+        // check for save and fast sysret, otherwise do iret
+        // maysysret is nonzero and rip < 0x7FFFFFFFFFFF
+        movabs $0x7ffffffffffe,%rax
+        mov TS_RIP(%rdi), %rcx          // instruction pointer
+        cmp %rax, %rcx
+        setbe %al
+        movzbl %al, %eax
+        test %rax, TS_MAYSYSRET(%rdi)   // flag for "came from syscall"
+        je return_from_irq
+
         /// @todo reorder thread-state-layout to reflect reduced register passing
-        //mov TS_RBX(%rdi), %rbx
-        //mov TS_R12(%rdi), %r12
-        //mov TS_R13(%rdi), %r13
-        //mov TS_R14(%rdi), %r14
-        //mov TS_R15(%rdi), %r15
+        xor %rbx, %rbx
+        xor %r12, %r12
+        xor %r13, %r13
+        xor %r14, %r14
+        xor %r15, %r15
         // skip rcx (rcx contains user's rip)
-        //mov TS_RAX(%rdi), %rax          // may contain a return value now
-        //mov TS_RDX(%rdi), %rdx
-        mov TS_RSI(%rdi), %rsi
-        //mov TS_R8(%rdi), %r8
-        //mov TS_R9(%rdi), %r9
-        //mov TS_R10(%rdi), %r10
-        mov TS_RFLAGS(%rdi), %r11       // rflags
-        mov TS_RIP(%rdi), %rcx          // instruction pointer
-        mov TS_RSP(%rdi), %rsp          // stack
-        mov TS_RDI(%rdi), %rdi
+        xor %rax, %rax
+        xor %rdx, %rdx
+        mov TS_RSI(%rdi), %rsi          // return value: user context
+        xor %r8, %r8
+        xor %r9, %r9
+        xor %r10, %r10
+        mov $0x000200, %r11             // don't trust the user's rflags, enforce interrupt enable flag
+        mov TS_RBP(%rdi), %rbp          // stack frame base pointer
+        mov TS_RSP(%rdi), %rsp          // top of stack
+        mov TS_RDI(%rdi), %rdi          // return value: state or error code
         swapgs                          // restore user's GS base
         sysretq
+
+return_from_irq:
+        // create fake interrupt frame on the kernel stack
+        pushq $(SEGMENT_USER_DS+3)      // SS - user data segment with bottom 2 bits set for ring 3
+        pushq TS_RSP(%rdi)              // RSP - user stack from 2nd parameter
+        pushq $0x000200                 // RFLAGS - don't trust the user's rflags, enforce interrupt enable flag
+        pushq $(SEGMENT_USER_CS+3)      // CS  - user code segment with bottom 2 bits set for ring 3
+        pushq %rcx                      // RIP - Instruction pointer after iretq
+        // restore all other register
+        mov TS_RAX(%rdi), %rax
+        mov TS_RBX(%rdi), %rbx
+        mov TS_RCX(%rdi), %rcx
+        mov TS_RDX(%rdi), %rdx
+        mov TS_RSI(%rdi), %rsi
+        mov TS_RBP(%rdi), %rbp
+        mov TS_R8(%rdi), %r8
+        mov TS_R9(%rdi), %r9
+        mov TS_R10(%rdi), %r10
+        mov TS_R11(%rdi), %r11
+        mov TS_R12(%rdi), %r12
+        mov TS_R13(%rdi), %r13
+        mov TS_R14(%rdi), %r14
+        mov TS_R15(%rdi), %r15
+        mov TS_RDI(%rdi), %rdi
+        swapgs  // restore user's GS base
+        iretq   // return to user mode and enable interrupts via rflags IF field
diff --git a/kernel/mythos/init/mythos/init.hh b/kernel/mythos/init/mythos/init.hh
index 150e8e00..2712ae74 100644
--- a/kernel/mythos/init/mythos/init.hh
+++ b/kernel/mythos/init/mythos/init.hh
@@ -39,6 +39,7 @@ namespace init {
     PML4,
     EC,
     PORTAL,
+    STATE_FRAME,
     EXAMPLE_FACTORY,
     MEMORY_REGION_FACTORY,
     EXECUTION_CONTEXT_FACTORY,
diff --git a/kernel/mythos/invocation/mythos/InvocationBuf.hh b/kernel/mythos/invocation/mythos/InvocationBuf.hh
index 5b95c33b..08574c0b 100644
--- a/kernel/mythos/invocation/mythos/InvocationBuf.hh
+++ b/kernel/mythos/invocation/mythos/InvocationBuf.hh
@@ -48,8 +48,12 @@ namespace mythos{
 
     InvocationBase() : tag(0) {}
     InvocationBase(uint16_t label) : tag(0) { tag.label = label; }
-    InvocationBase(uint16_t label, uint8_t length, unsigned extraCaps=0) 
-      : tag(0) { tag = tag.label(label).length(length).extra_caps(extraCaps); }
+    InvocationBase(uint16_t label, uint8_t length, unsigned extraCaps=0)
+      : tag(0)
+    {
+      tag = tag.label(label).length(length).extra_caps(extraCaps);
+      ASSERT(extraCaps <= 6);
+    }
 
     Tag tag;           // 1x 4byte
     CapPtr dstPtr = null_cap;     // 1x 4byte
diff --git a/kernel/mythos/invocation/mythos/protocol/ExecutionContext.hh b/kernel/mythos/invocation/mythos/protocol/ExecutionContext.hh
index c8d21d44..48a2926c 100644
--- a/kernel/mythos/invocation/mythos/protocol/ExecutionContext.hh
+++ b/kernel/mythos/invocation/mythos/protocol/ExecutionContext.hh
@@ -46,17 +46,21 @@ namespace mythos {
       struct Configure : public InvocationBase {
         typedef InvocationBase response_type;
         constexpr static uint16_t label = (proto<<8) + CONFIGURE;
-        Configure(CapPtr as, CapPtr cs, CapPtr sched)
-          : InvocationBase(label,getLength(this))
+        Configure(CapPtr as, CapPtr cs, CapPtr sched, CapPtr state, uint32_t stateOffset, bool initializeState)
+          : InvocationBase(label,getLength(this)), stateOffset(stateOffset), initializeState(initializeState)
         {
           addExtraCap(as);
           addExtraCap(cs);
           addExtraCap(sched);
+          addExtraCap(state);
         }
 
         CapPtr as() const { return this->capPtrs[0]; }
         CapPtr cs() const { return this->capPtrs[1]; }
         CapPtr sched() const { return this->capPtrs[2]; }
+        CapPtr state() const { return this->capPtrs[3]; }
+        uint32_t stateOffset;
+        bool initializeState;
       };
 
       struct Amd64Registers {
@@ -118,16 +122,23 @@ namespace mythos {
 
       struct Create : public KernelMemory::CreateBase {
         typedef InvocationBase response_type;
-        Create(CapPtr dst, CapPtr factory) 
-          : CreateBase(dst, factory, getLength(this), 3), start(false) { }
+        Create(CapPtr dst, CapPtr factory)
+          : CreateBase(dst, factory, getLength(this), 4)
+        {
+            as(null_cap); cs(null_cap); sched(null_cap); state(null_cap);
+        }
         Amd64Registers regs;
-        bool start;
+        bool start = {false};
+        uint32_t stateOffset = {0};
+        bool initializeState = {true};
         CapPtr as() const { return this->capPtrs[2]; }
         CapPtr cs() const { return this->capPtrs[3]; }
         CapPtr sched() const { return this->capPtrs[4]; }
+        CapPtr state() const { return this->capPtrs[5]; }
         void as(CapPtr c) { this->capPtrs[2] = c; }
         void cs(CapPtr c) { this->capPtrs[3] = c; }
-        void sched(CapPtr c) { this->capPtrs[4] =c; }
+        void sched(CapPtr c) { this->capPtrs[4] = c; }
+        void state(CapPtr c) { this->capPtrs[5] = c; }
       };
 
       template<class IMPL, class... ARGS>
diff --git a/kernel/objects/capability-utils/objects/CapRef.cc b/kernel/objects/capability-utils/objects/CapRef.cc
index d37b9422..643e3e35 100644
--- a/kernel/objects/capability-utils/objects/CapRef.cc
+++ b/kernel/objects/capability-utils/objects/CapRef.cc
@@ -34,7 +34,7 @@ namespace mythos {
     cap::resetReference(this->entry);
   }
 
-  optional<void> CapRefBase::set(void* subject, CapEntry& src, Cap srcCap)
+  optional<void> CapRefBase::set(void* subject, CapEntry& src, Cap srcCap, uint64_t extra)
   {
     this->reset();
     RETURN(cap::setReference(
@@ -43,7 +43,7 @@ namespace mythos {
         src, srcCap,
         [=](){
           this->orig.store(srcCap.asReference().value());
-          this->binding(subject, srcCap.asReference());
+          this->binding(subject, srcCap.asReference(), extra);
         }));
   }
 
diff --git a/kernel/objects/capability-utils/objects/CapRef.hh b/kernel/objects/capability-utils/objects/CapRef.hh
index 119f83ef..b093e891 100644
--- a/kernel/objects/capability-utils/objects/CapRef.hh
+++ b/kernel/objects/capability-utils/objects/CapRef.hh
@@ -36,7 +36,7 @@ namespace mythos {
   /**
    *
    * Subject is the owner of the CapRef instance.
-   */ 
+   */
   class CapRefBase
     : protected IKernelObject
   {
@@ -56,14 +56,14 @@ namespace mythos {
     Cap cap() const { return Cap(this->orig.load()); }
 
   protected:
-    optional<void> set(void* subject, CapEntry& src, Cap srcCap);
+    optional<void> set(void* subject, CapEntry& src, Cap srcCap, uint64_t extra);
 
     /** called during successful write to the reference.
      *
      * Users should override this method in order to set cached values
      * and state flags. Mutual exclusion is ensured by the @c CapRef.
      */
-    virtual void binding(void* subject, Cap obj) = 0;
+    virtual void binding(void* subject, Cap obj, uint64_t extra) = 0;
 
     /** called during the revocation or reset of the reference.
      *
@@ -86,7 +86,7 @@ namespace mythos {
   {
   public:
     template<class Subject, class Object>
-    static void binding(Subject *s, Object const& o) { s->bind(o); }
+    static void binding(Subject *s, Object const& o, uint64_t extra) { s->bind(o, extra); }
 
     template<class Subject, class Object>
     static void unbinding(Subject *s, Object const& o) { s->unbind(o); }
@@ -102,11 +102,11 @@ namespace mythos {
 
     virtual ~CapRef() {}
 
-    optional<void> set(Subject* subject, CapEntry* src, Cap srcCap)
-    { return CapRefBase::set(subject, *src, srcCap); }
+    optional<void> set(Subject* subject, CapEntry* src, Cap srcCap, uint64_t extra=0)
+    { return CapRefBase::set(subject, *src, srcCap, extra); }
 
-    optional<void> set(Subject* subject, CapEntry& src, Cap srcCap)
-    { return CapRefBase::set(subject, src, srcCap); }
+    optional<void> set(Subject* subject, CapEntry& src, Cap srcCap, uint64_t extra=0)
+    { return CapRefBase::set(subject, src, srcCap, extra); }
 
     optional<Object*> get() const {
       Cap obj = Cap(this->orig.load());
@@ -115,9 +115,9 @@ namespace mythos {
     }
 
   protected:
-    void binding(void* subject, Cap orig) override {
+    void binding(void* subject, Cap orig, uint64_t extra) override {
       ASSERT(orig.isUsable());
-      Revoker::binding(static_cast<Subject*>(subject), orig.getPtr()->cast<Object>());
+      Revoker::binding(static_cast<Subject*>(subject), orig.getPtr()->cast<Object>(), extra);
     }
 
     void unbinding(void* subject, Cap orig) override {
diff --git a/kernel/objects/execution-context/objects/ExecutionContext.cc b/kernel/objects/execution-context/objects/ExecutionContext.cc
index 21c21e57..55fae02e 100644
--- a/kernel/objects/execution-context/objects/ExecutionContext.cc
+++ b/kernel/objects/execution-context/objects/ExecutionContext.cc
@@ -38,26 +38,19 @@
 namespace mythos {
 
   ExecutionContext::ExecutionContext(IAsyncFree* memory)
-    : flags(0)
-    , memory(memory)
+    : memory(memory)
   {
-    setFlags(IS_TRAPPED + NO_AS + NO_SCHED
-        + DONT_PREEMPT + NOT_LOADED + NOT_RUNNING);
-    threadState.clear();
-    threadState.rflags = x86::FLAG_IF; // ensure that interrupts are enabled in user mode
-    fpuState.clear();
   }
 
   void ExecutionContext::setFlagsSuspend(flag_t f)
   {
-    auto prev = setFlags(f | DONT_PREEMPT);
+    auto prev = setFlags(f | DONT_PREEMPT); // cleared by resume()
     MLOG_DETAIL(mlog::ec, "set flag", DVAR(this), DVARhex(f), DVARhex(prev),
                 DVARhex(flags.load()), isReady());
-    if (needPreemption(prev) && !isReady()) {
-        auto place = currentPlace.load();
-        ASSERT(place != nullptr);
-        /// @todo is place->preempt() sufficient without waiting?
-        if (place) synchronousAt(place) << [this]() {
+    auto place = currentPlace.load();
+    if (needPreemption(prev) && place != nullptr) {
+        // place->preempt() is insufficient because the synchronous unbind() has to wait until suspending has finished
+        synchronousAt(place) << [this]() {
             MLOG_DETAIL(mlog::ec, "suspended", DVAR(this));
         };
     }
@@ -80,13 +73,16 @@ namespace mythos {
     MLOG_INFO(mlog::ec, "setAddressSpace", DVAR(this), DVAR(pme));
     TypedCap<IPageMap> obj(pme);
     if (!obj) RETHROW(obj);
-    if (!obj->getPageMapInfo(obj.cap()).isRootMap()) THROW(Error::INVALID_CAPABILITY);
-    RETURN(_as.set(this, *pme, obj.cap()));
+    auto info = obj->getPageMapInfo(obj.cap());
+    if (!info.isRootMap()) THROW(Error::INVALID_CAPABILITY);
+
+    RETURN(_as.set(this, *pme, obj.cap(), info.table.physint()));
   }
 
-  void ExecutionContext::bind(optional<IPageMap*>)
+  void ExecutionContext::bind(optional<IPageMap*>, uint64_t tableAddr)
   {
-    MLOG_INFO(mlog::ec, "setAddressSpace bind", DVAR(this));
+    MLOG_INFO(mlog::ec, "setAddressSpace bind", DVAR(this), DVARhex(tableAddr));
+    page_table = PhysPtr<void>(tableAddr);
     clearFlagsResume(NO_AS);
   }
 
@@ -94,6 +90,7 @@ namespace mythos {
   {
     MLOG_INFO(mlog::ec, "setAddressSpace unbind", DVAR(this));
     setFlagsSuspend(NO_AS);
+    page_table = PhysPtr<void>();
   }
 
   optional<void> ExecutionContext::setSchedulingContext(optional<CapEntry*> sce)
@@ -117,7 +114,7 @@ namespace mythos {
     if (place != nullptr) {
         // save my state
         place->run(t->set([this, msg, sce](Tasklet*){
-            this->fpuState.save();
+            this->state->fpuState.save();
             TypedCap<IScheduler> obj(sce);
             if (!obj) {
               msg->replyResponse(obj.state());
@@ -133,13 +130,7 @@ namespace mythos {
     }
   }
 
-  Error ExecutionContext::unsetSchedulingContext()
-  {
-    _sched.reset();
-    return Error::SUCCESS;
-  }
-
-  void ExecutionContext::bind(optional<IScheduler*>)
+  void ExecutionContext::bind(optional<IScheduler*>, uint64_t)
   {
     MLOG_INFO(mlog::ec, "setScheduler bind", DVAR(this));
     clearFlagsResume(NO_SCHED);
@@ -159,13 +150,51 @@ namespace mythos {
     TypedCap<ICapMap> obj(cse);
     if (!obj) RETHROW(obj);
     RETURN(_cs.set(this, *cse, obj.cap()));
+  }
+
+  optional<void> ExecutionContext::setStateFrame(optional<CapEntry*> framecapref, uint32_t offset, bool initializeState)
+  {
+    MLOG_INFO(mlog::ec, "setStateFrame", DVAR(this), DVAR(framecapref));
+    TypedCap<IFrame> obj(framecapref);
+    if (!obj) RETHROW(obj);
+    auto info = obj.getFrameInfo();
+    if (info.device || !info.writable) THROW(Error::INVALID_CAPABILITY);
+    size_t size = round_up(sizeof(cpu::ThreadState), alignof(cpu::FpuState)) + cpu::FpuState::size();
+    if (offset+size >= info.size) THROW(Error::INSUFFICIENT_RESOURCES);
+    auto stateAddr = info.start.logint() + offset;
+    if (initializeState) {
+      auto state = reinterpret_cast<State*>(stateAddr);
+      state->threadState.clear();
+      state->fpuState.clear();
+    }
+    RETURN(_state.set(this, *framecapref, obj.cap(), stateAddr));
+  }
 
+  void ExecutionContext::bind(optional<IFrame*>, uint64_t stateAddr)
+  {
+    MLOG_INFO(mlog::portal, "Portal::setStateFrame bind", DVARhex(stateAddr));
+    state = reinterpret_cast<State*>(stateAddr);
+    clearFlagsResume(NO_STATE);
+  }
+
+  void ExecutionContext::unbind(optional<IFrame*>)
+  {
+    MLOG_INFO(mlog::portal, "Portal::setStateFrame unbind");
+    setFlagsSuspend(NO_STATE); // synchronous, waits until thread has been suspended
+    state = nullptr; // must not happen before the suspend
   }
 
   void ExecutionContext::setEntryPoint(uintptr_t rip)
   {
     MLOG_INFO(mlog::ec, "EC setEntryPoint", DVARhex(rip));
-    threadState.rip = rip;
+    if (!state) return;
+    state->threadState.rip = rip;
+  }
+
+  void ExecutionContext::setRegParams(uint64_t rdi)
+  {
+    if (!state) return;
+    state->threadState.rdi = rdi;
   }
 
   optional<CapEntryRef> ExecutionContext::lookupRef(CapPtr ptr, CapPtrDepth ptrDepth, bool writable)
@@ -191,6 +220,12 @@ namespace mythos {
       if (!err) return err.state();
     }
 
+    if (data.state() == delete_cap) { unsetStateFrame(); }
+    else if (data.state() != null_cap) {
+      auto err = setStateFrame(msg->lookupEntry(data.state()), data.stateOffset, data.initializeState);
+      if (!err) return err.state();
+    }
+
     if (data.sched() == delete_cap) { unsetSchedulingContext(); }
     else if (data.sched() != null_cap) {
       return setSchedulingContext(t, msg, msg->lookupEntry(data.sched())).state();
@@ -221,23 +256,25 @@ namespace mythos {
     monitor.response(t,[=](Tasklet*){
         auto data = msg->getMessage()->read<protocol::ExecutionContext::ReadRegisters>();
         auto respData = msg->getMessage()->write<protocol::ExecutionContext::WriteRegisters>(!data.suspend);
-        respData->regs.rax = threadState.rax;
-        respData->regs.rbx = threadState.rbx;
-        respData->regs.rcx = threadState.rcx;
-        respData->regs.rdx = threadState.rdx;
-        respData->regs.rdi = threadState.rdi;
-        respData->regs.rsi = threadState.rsi;
-        respData->regs.r8  = threadState.r8;
-        respData->regs.r9  = threadState.r9;
-        respData->regs.r10 = threadState.r10;
-        respData->regs.r13 = threadState.r13;
-        respData->regs.r14 = threadState.r14;
-        respData->regs.r15 = threadState.r15;
-        respData->regs.rip = threadState.rip;
-        respData->regs.rsp = threadState.rsp;
-        respData->regs.rbp = threadState.rbp;
-        respData->regs.fs_base = threadState.fs_base;
-        respData->regs.gs_base = threadState.gs_base;
+        if (state) {
+          respData->regs.rax = state->threadState.rax;
+          respData->regs.rbx = state->threadState.rbx;
+          respData->regs.rcx = state->threadState.rcx;
+          respData->regs.rdx = state->threadState.rdx;
+          respData->regs.rdi = state->threadState.rdi;
+          respData->regs.rsi = state->threadState.rsi;
+          respData->regs.r8  = state->threadState.r8;
+          respData->regs.r9  = state->threadState.r9;
+          respData->regs.r10 = state->threadState.r10;
+          respData->regs.r13 = state->threadState.r13;
+          respData->regs.r14 = state->threadState.r14;
+          respData->regs.r15 = state->threadState.r15;
+          respData->regs.rip = state->threadState.rip;
+          respData->regs.rsp = state->threadState.rsp;
+          respData->regs.rbp = state->threadState.rbp;
+          respData->regs.fs_base = state->threadState.fs_base;
+          respData->regs.gs_base = state->threadState.gs_base;
+        }
         clearFlagsResume(REGISTER_ACCESS);
         msg->replyResponse(Error::SUCCESS);
         msg = nullptr;
@@ -278,23 +315,25 @@ namespace mythos {
 
   optional<void> ExecutionContext::setRegisters(const mythos::protocol::ExecutionContext::Amd64Registers& regs)
   {
-    threadState.rax = regs.rax;
-    threadState.rbx = regs.rbx;
-    threadState.rcx = regs.rcx;
-    threadState.rdx = regs.rdx;
-    threadState.rdi = regs.rdi;
-    threadState.rsi = regs.rsi;
-    threadState.r8  = regs.r8;
-    threadState.r9  = regs.r9;
-    threadState.r10 = regs.r10;
-    threadState.r11 = regs.r11;
-    threadState.r12 = regs.r12;
-    threadState.r13 = regs.r13;
-    threadState.r14 = regs.r14;
-    threadState.r15 = regs.r15;
-    threadState.rip = regs.rip;
-    threadState.rsp = regs.rsp;
-    threadState.rbp = regs.rbp;
+    if (state) {
+      state->threadState.rax = regs.rax;
+      state->threadState.rbx = regs.rbx;
+      state->threadState.rcx = regs.rcx;
+      state->threadState.rdx = regs.rdx;
+      state->threadState.rdi = regs.rdi;
+      state->threadState.rsi = regs.rsi;
+      state->threadState.r8  = regs.r8;
+      state->threadState.r9  = regs.r9;
+      state->threadState.r10 = regs.r10;
+      state->threadState.r11 = regs.r11;
+      state->threadState.r12 = regs.r12;
+      state->threadState.r13 = regs.r13;
+      state->threadState.r14 = regs.r14;
+      state->threadState.r15 = regs.r15;
+      state->threadState.rip = regs.rip;
+      state->threadState.rsp = regs.rsp;
+      state->threadState.rbp = regs.rbp;
+    }
     return setBaseRegisters(regs.fs_base, regs.gs_base);
   }
 
@@ -303,10 +342,12 @@ namespace mythos {
       // \TODO don't use PhysPtr because the canonical address belong to the logical addresses
     if (!PhysPtr<void>(fs).canonical() || !PhysPtr<void>(gs).canonical())
       THROW(Error::NON_CANONICAL_ADDRESS);
-    threadState.fs_base = fs;
-    threadState.gs_base = gs;
+    if (state) {
+      state->threadState.fs_base = fs;
+      state->threadState.gs_base = gs;
+    }
     MLOG_DETAIL(mlog::ec, "set fs/gs", DVAR(this), DVARhex(fs), DVARhex(gs));
-    
+
     RETURN(Error::SUCCESS);
   }
 
@@ -325,7 +366,7 @@ namespace mythos {
   Error ExecutionContext::invokeSuspend(Tasklet* t, Cap, IInvocation* msg)
   {
     this->msg = msg;
-    setFlags(IS_TRAPPED + DONT_PREEMPT);
+    setFlags(IS_TRAPPED | DONT_PREEMPT);
 
     auto home = currentPlace.load();
     if (home != nullptr) {
@@ -352,7 +393,8 @@ namespace mythos {
     auto const& data = *msg->getMessage()->cast<protocol::ExecutionContext::SetFSGS>();
     auto res = setBaseRegisters(data.fs, data.gs);
     if (res) { // reschedule the EC in order to load the new values
-      // TODO is FS snd GS saved on suspend? Then async syscall will be overwritten by the suspend code!
+      // luckily FS and GS are not saved on kernel entry,
+      // just restored on kernel exit to user mode
       setFlagsSuspend(IS_TRAPPED);
       clearFlagsResume(IS_TRAPPED);
     }
@@ -373,7 +415,7 @@ namespace mythos {
 
   void ExecutionContext::handleTrap()
   {
-    auto ctx = &threadState;
+    auto ctx = &state->threadState;
     MLOG_ERROR(mlog::ec, "user fault", DVAR(ctx->irq), DVAR(ctx->error),
          DVARhex(ctx->cr2));
     MLOG_ERROR(mlog::ec, "...", DVARhex(ctx->rip), DVARhex(ctx->rflags),
@@ -391,7 +433,8 @@ namespace mythos {
   void ExecutionContext::handleSyscall()
   {
     setFlags(NOT_RUNNING);
-    auto ctx = &threadState;
+    ASSERT(state != nullptr);
+    auto ctx = &state->threadState;
     auto& code = ctx->rdi;
     auto& userctx = ctx->rsi;
     auto portal = ctx->rdx;
@@ -415,9 +458,10 @@ namespace mythos {
 
       case SYSCALL_WAIT: {
         auto prevState = setFlags(IN_WAIT | IS_WAITING);
-        MLOG_INFO(mlog::syscall, "wait", DVARhex(prevState));
-        if (!notificationQueue.empty() || (prevState & IS_NOTIFIED))
+        MLOG_DETAIL(mlog::syscall, "wait", DVARhex(prevState));
+        if (!notificationQueue.empty() || (prevState & IS_NOTIFIED)) {
           clearFlags(IS_WAITING); // because of race with notifier
+        }
         break;
       }
 
@@ -447,7 +491,11 @@ namespace mythos {
         mlog::Logger<mlog::FilterAny> user("user");
         // userctx => address in users virtual memory. Yes, we fully trust the user :(
         // portal => string length
-        mlog::sink->write((char const*)userctx, portal);
+        // It is necessary to make a copy because sink->write can delegate itself to another
+        // processor core that is in a differenc address space!
+        char str[300];
+        memcpy(str, reinterpret_cast<char*>(userctx), (portal<300) ? portal : 300);
+        mlog::sink->write(str, portal);
         code = uint64_t(Error::SUCCESS);
         break;
       }
@@ -510,35 +558,28 @@ namespace mythos {
         if (prevWait & IN_WAIT) {
             // clear IS_NOTIFIED only if the user mode was waiting for it
             // we won't clear it twice without a second wait() system call
-            clearFlags(IS_NOTIFIED); 
+            clearFlags(IS_NOTIFIED);
 
             // return a notification event if any
             auto e = notificationQueue.pull();
             if (e) {
                 auto ev = e->get()->deliver();
-                threadState.rsi = ev.user;
-                threadState.rdi = ev.state;
+                state->threadState.rsi = ev.user;
+                state->threadState.rdi = ev.state;
             } else {
-                threadState.rsi = 0;
-                threadState.rdi = uint64_t(Error::NO_MESSAGE);
+                state->threadState.rsi = 0;
+                state->threadState.rdi = uint64_t(Error::NO_MESSAGE);
             }
-            MLOG_DETAIL(mlog::ec, DVAR(this), "return one notification", 
-                        DVARhex(threadState.rsi), DVAR(threadState.rdi));
+            MLOG_DETAIL(mlog::ec, DVAR(this), "return one notification",
+                        DVARhex(state->threadState.rsi), DVAR(state->threadState.rdi));
         }
 
-        // Reload the address space if it has changed.
-        // It might have been revoked concurrently since we checked the blocking flags.
-        // In that case we abort the resume. The revoke will update NO_AS for us.
-        {
-            TypedCap<IPageMap> as(_as);
-            if (!as) return;
-            auto info = as->getPageMapInfo(as.cap());
-            MLOG_DETAIL(mlog::ec, "load addrspace", DVAR(this), DVARhex(info.table.physint()));
-            getLocalPlace().setCR3(info.table); // without reload if not changed
-        }
+        // Reload the address space and thread state address if they have changed
+        getLocalPlace().setCR3(page_table); // without reload if not changed
+        cpu::thread_state = &state->threadState;
 
         MLOG_DETAIL(mlog::syscall, "resuming", DVAR(this),
-                    DVARhex(threadState.rip), DVARhex(threadState.rsp));
+                    DVARhex(state->threadState.rip), DVARhex(state->threadState.rsp));
         cpu::return_to_user(); // does never return
     }
 
@@ -557,8 +598,9 @@ namespace mythos {
         ASSERT(prev & NOT_LOADED);
         // load registers and fpu, no execution context must be loaded here already
         ASSERT(cpu::thread_state.get() == nullptr);
-        cpu::thread_state = &threadState;
-        fpuState.restore();
+        ASSERT(state != nullptr);
+        cpu::thread_state = &state->threadState;
+        state->fpuState.restore();
         // tell the kernel that this execution context is in charge now
         // and check that no other was loaded.
         ASSERT(current_ec->load() == nullptr);
@@ -576,9 +618,10 @@ namespace mythos {
         auto oldPlace = currentPlace.exchange(nullptr);
         ASSERT(oldPlace == &getLocalPlace());
 
-        ASSERT(cpu::thread_state.get() == &threadState);
+        ASSERT(state != nullptr);
+        ASSERT(cpu::thread_state.get() == &state->threadState);
         cpu::thread_state = nullptr;
-        fpuState.save();
+        state->fpuState.save();
 
         // tell the kernel that nobody is in charge now
         ASSERT(current_ec->load() == this);
@@ -649,26 +692,30 @@ namespace mythos {
       }
       if (data) {// configure according to message
         ASSERT(implies(data, msg));
-        auto regRes = obj->setRegisters(data->regs);
-        if (!regRes) RETHROW(regRes);
-        if (data->as()) {
-          auto res = obj->setAddressSpace(msg->lookupEntry(data->as()));
-          if (!res) RETHROW(res);
-        }
         if (data->cs()) {
           auto res = obj->setCapSpace(msg->lookupEntry(data->cs()));
           if (!res) RETHROW(res);
         }
+        if (data->as()) {
+          auto res = obj->setAddressSpace(msg->lookupEntry(data->as()));
+          if (!res) RETHROW(res);
+        }
         if (data->sched()) {
           auto res = obj->setSchedulingContext(msg->lookupEntry(data->sched()));
           if (!res) RETHROW(res);
         }
-        obj->setEntryPoint(data->regs.rip);
+        if (data->state()) {
+          auto res = obj->setStateFrame(msg->lookupEntry(data->state()), data->stateOffset, data->initializeState);
+          if (!res) RETHROW(res);
+        }
+        // @todo overwriting the registers should be optional!
+        auto regRes = obj->setRegisters(data->regs);
+        if (!regRes) RETHROW(regRes);
+        // @todo %rip should come from the state frame, not the message
+        // obj->setEntryPoint(data->regs.rip); // just writes %rip again, see setRegisters above 
         if (data->start) obj->setTrapped(false);
       }
       return *obj;
     }
 
 } // namespace mythos
-
-
diff --git a/kernel/objects/execution-context/objects/ExecutionContext.hh b/kernel/objects/execution-context/objects/ExecutionContext.hh
index d912da87..f94933fc 100644
--- a/kernel/objects/execution-context/objects/ExecutionContext.hh
+++ b/kernel/objects/execution-context/objects/ExecutionContext.hh
@@ -36,6 +36,7 @@
 #include "objects/IScheduler.hh"
 #include "objects/IFactory.hh"
 #include "objects/IPageMap.hh"
+#include "objects/IFrame.hh"
 #include "objects/INotifiable.hh"
 #include "objects/ISignalable.hh"
 #include "objects/IPortal.hh"
@@ -61,33 +62,41 @@ namespace mythos {
       IS_TRAPPED = 1<<1, // used by suspend/resume invocations and trap/exception handler
       NO_AS      = 1<<2, // set if address space is missing
       NO_SCHED   = 1<<3, // set if scheduler is missing
+      NO_STATE   = 1<<4, // set if frame for the state data is missing
       IN_WAIT    = 1<<5, // EC is in wait() syscall, next sysret should return a KEvent
       IS_NOTIFIED     = 1<<6, // used by notify() syscall for binary semaphore
       REGISTER_ACCESS = 1<<7, // accessing registers
       NOT_LOADED   = 1<<8, // CPU state is not loaded
-      DONT_PREEMPT  = 1<<9, // somebody else will send the preemption
+      DONT_PREEMPT  = 1<<9, // somebody else is sending a preemption already
       NOT_RUNNING  = 1<<10, // EC is not running
-      BLOCK_MASK = IS_WAITING | IS_TRAPPED | NO_AS | NO_SCHED | REGISTER_ACCESS
+      BLOCK_MASK = IS_WAITING | IS_TRAPPED | NO_AS | NO_SCHED | NO_STATE | REGISTER_ACCESS,
+      INIT_FLAGS = IS_TRAPPED | NO_AS | NO_SCHED | NO_STATE | DONT_PREEMPT | NOT_LOADED | NOT_RUNNING
     };
 
     ExecutionContext(IAsyncFree* memory);
     virtual ~ExecutionContext() {}
 
+  public: // only for initial setup
+    optional<void> setSchedulingContext(optional<CapEntry*> sce);
+
+  public:
     optional<void> setAddressSpace(optional<CapEntry*> pagemapref);
     void unsetAddressSpace() { _as.reset(); }
 
-    /// only for initial setup
-    optional<void> setSchedulingContext(optional<CapEntry*> sce);
     optional<void> setSchedulingContext(Tasklet* t, IInvocation* msg, optional<CapEntry*> sce);
-    Error unsetSchedulingContext();
+    void unsetSchedulingContext() { _sched.reset(); }
 
     optional<void> setCapSpace(optional<CapEntry*> capmapref);
     void unsetCapSpace() { _cs.reset(); }
 
+    optional<void> setStateFrame(optional<CapEntry*> framecapref, uint32_t offset, bool initializeState);
+    void unsetStateFrame() { _state.reset(); }
+
     void setEntryPoint(uintptr_t rip);
     void setTrapped(bool val);
 
-    cpu::ThreadState& getThreadState() { return threadState; }
+    //cpu::ThreadState& getThreadState() { return threadState; }
+    void setRegParams(uint64_t rdi);
 
     optional<void> setRegisters(const mythos::protocol::ExecutionContext::Amd64Registers&);
     optional<void> setBaseRegisters(uint64_t fs_base, uint64_t gs_base);
@@ -140,27 +149,36 @@ namespace mythos {
 
   protected:
     friend class CapRefBind;
-    void bind(optional<IPageMap*>);
-    void bind(optional<ICapMap*>) {}
-    void bind(optional<IScheduler*>);
+    void bind(optional<IPageMap*>, uint64_t tableAddr);
+    void bind(optional<ICapMap*>, uint64_t) {}
+    void bind(optional<IScheduler*>, uint64_t);
+    void bind(optional<IFrame*>, uint64_t stateAddr);
     void unbind(optional<IPageMap*>);
     void unbind(optional<ICapMap*>) {}
     void unbind(optional<IScheduler*>);
+    void unbind(optional<IFrame*>);
 
     flag_t setFlags(flag_t f) { return flags.fetch_or(f); }
     flag_t clearFlags(flag_t f) { return flags.fetch_and(flag_t(~f)); }
-    void setFlagsSuspend(flag_t f);
-    void clearFlagsResume(flag_t f);
     bool isBlocked(flag_t f) const { return (f & BLOCK_MASK) != 0; }
     bool needPreemption(flag_t f) const { return (f & DONT_PREEMPT) == 0; }
 
+    /** Sets some flags and suspends the thread if a blocking condition is reached.
+     * Returns synchronously after the thread has suspended independent of
+     * the place that changes the flags and the place where the thread currently runs.
+     */
+    void setFlagsSuspend(flag_t f);
+
+    void clearFlagsResume(flag_t f);
+
   private:
     async::NestedMonitorDelegating monitor;
     INotifiable::list_t notificationQueue;
-    std::atomic<flag_t> flags;
+    std::atomic<flag_t> flags = {INIT_FLAGS};
     CapRef<ExecutionContext,IPageMap> _as;
     CapRef<ExecutionContext,ICapMap> _cs;
     CapRef<ExecutionContext,IScheduler> _sched;
+    CapRef<ExecutionContext,IFrame> _state; // will contain threadState and fpuState
     /// @todo reference/link to exception handler (portal/endpoint?)
 
     // the hardware thread where the fpu state is currently loaded
@@ -175,8 +193,12 @@ namespace mythos {
     async::MSink<ExecutionContext, void, &ExecutionContext::suspendThread>
       sleepResponse = {this};
 
-    cpu::ThreadState threadState;
-    cpu::FpuState fpuState;
+    struct State {
+      cpu::ThreadState threadState;
+      cpu::FpuState fpuState;
+    };
+    State* state = {nullptr}; // cached value from _state+offset
+    PhysPtr<void> page_table; // cached pml4, address space
 
     LinkedList<IKernelObject*>::Queueable del_handle = {this};
     IAsyncFree* memory;
diff --git a/kernel/objects/interrupt-control/objects/InterruptControl.hh b/kernel/objects/interrupt-control/objects/InterruptControl.hh
index 80a88014..9631e074 100644
--- a/kernel/objects/interrupt-control/objects/InterruptControl.hh
+++ b/kernel/objects/interrupt-control/objects/InterruptControl.hh
@@ -44,12 +44,12 @@ public: // IKernelObject interface
     optional<void> deleteCap(CapEntry&, Cap self, IDeleter& del) override;
     void invoke(Tasklet* t, Cap, IInvocation* msg) override;
 public: // for CapRef
-    void bind(optional<ISignalable*>) { }
+    void bind(optional<ISignalable*>, uint64_t) { }
     void unbind(optional<ISignalable*>) {
         // triggered by cap revoke
         // TODO would need to revoke notification if we use INotifiable instead of ISignalable
     }
-public: // protocol 
+public: // protocol
     friend struct protocol::KernelObject;
     Error getDebugInfo(Cap self, IInvocation* msg);
     Error registerForInterrupt(Tasklet *t, Cap self, IInvocation *msg);
diff --git a/kernel/objects/portal/objects/Portal.cc b/kernel/objects/portal/objects/Portal.cc
index 200c709d..1e5964a3 100644
--- a/kernel/objects/portal/objects/Portal.cc
+++ b/kernel/objects/portal/objects/Portal.cc
@@ -40,20 +40,19 @@ namespace mythos {
     auto info = frame.getFrameInfo();
     if (info.device || !info.writable) THROW(Error::INVALID_CAPABILITY);
     if (offset+sizeof(InvocationBuf) >= info.size) THROW(Error::INSUFFICIENT_RESOURCES);
-    ibNew = reinterpret_cast<InvocationBuf*>(info.start.logint()+offset);
-    RETURN(_ib.set(this, *fe, frame.cap()));
+    RETURN(_ib.set(this, *fe, frame.cap(), info.start.logint()+offset));
   }
 
-  void Portal::bind(optional<IFrame*> obj)
+  void Portal::bind(optional<IFrame*>, uint64_t ibAddr)
   {
     MLOG_INFO(mlog::portal, "Portal::setInvocationBuf bind");
-    if (obj) ib = ibNew;
+    ib = reinterpret_cast<InvocationBuf*>(ibAddr);
   }
 
   void Portal::unbind(optional<IFrame*>)
   {
     MLOG_INFO(mlog::portal, "Portal::setInvocationBuf unbind");
-    ib = nullptr; // but do not overwrite ibNew before the bind() method!
+    ib = nullptr;
   }
 
   optional<void> Portal::setOwner(optional<CapEntry*> ece)
diff --git a/kernel/objects/portal/objects/Portal.hh b/kernel/objects/portal/objects/Portal.hh
index efdf2fb2..b0a542e1 100644
--- a/kernel/objects/portal/objects/Portal.hh
+++ b/kernel/objects/portal/objects/Portal.hh
@@ -130,15 +130,14 @@ namespace mythos {
 
   protected:
     friend class CapRefBind;
-    void bind(optional<IFrame*>);
-    void bind(optional<IPortalUser*>) {}
+    void bind(optional<IFrame*>, uint64_t ibAddr);
+    void bind(optional<IPortalUser*>, uint64_t) {}
     void unbind(optional<IFrame*>);
     void unbind(optional<IPortalUser*>);
 
   private:
     CapRef<Portal, IFrame> _ib;
-    InvocationBuf* ib = nullptr;
-    InvocationBuf* ibNew = nullptr;
+    InvocationBuf* ib = nullptr; // cached value from _ib+offset
     CapRef<Portal, IPortalUser> _owner;
     uintptr_t uctx = 0;
     INotifiable::handle_t notificationHandle = {this};
diff --git a/kernel/objects/scheduling-context/objects/SchedulingContext.cc b/kernel/objects/scheduling-context/objects/SchedulingContext.cc
index c94da9cb..b32dcf33 100644
--- a/kernel/objects/scheduling-context/objects/SchedulingContext.cc
+++ b/kernel/objects/scheduling-context/objects/SchedulingContext.cc
@@ -34,10 +34,10 @@
 
 namespace mythos {
 
-    void SchedulingContext::bind(handle_t*) 
+    void SchedulingContext::bind(handle_t*)
     {
     }
-    
+
     void SchedulingContext::unbind(handle_t* ec)
     {
         ASSERT(ec != nullptr);
@@ -51,16 +51,14 @@ namespace mythos {
         ASSERT(ec != nullptr);
         MLOG_INFO(mlog::sched, "ready", DVAR(ec->get()));
 
-        // do nothing if it is the current execution context
-        auto current = current_handle.load();
-        if (current == ec) return; /// @todo can this actually happen? 
-        
         // add to the ready queue
         readyQueue.remove(ec); /// @todo do not need to remove if already on the queue, just do nothing then. This needs additional information in handle_t of LinkedList
         readyQueue.push(ec);
 
         // wake up the hardware thread if it has no execution context running
-        if (current == nullptr) home->preempt();
+        // or if if current ec got ready in case of race with failed ec->resume()
+        auto current = current_handle.load();
+        if (current == nullptr || current == ec) home->preempt();
     }
 
     void SchedulingContext::tryRunUser()
@@ -77,6 +75,7 @@ namespace mythos {
                     current->get()->loadState();
                 }
                 current->get()->resume(); // if it returns, the ec is blocked
+                // note: the ec can become ready again here. Solved in ready()
                 current_handle.store(nullptr);
             }
             MLOG_DETAIL(mlog::sched, "try from ready list");
diff --git a/kernel/runtime/crt-init/runtime/crtbegin.cc b/kernel/runtime/crt-init/runtime/crtbegin.cc
index 507a3e7a..6b1a59fd 100644
--- a/kernel/runtime/crt-init/runtime/crtbegin.cc
+++ b/kernel/runtime/crt-init/runtime/crtbegin.cc
@@ -38,6 +38,7 @@ extern "C" typedef void (*func_t)();
 extern "C" [[noreturn]] void _Exit(int exit_code);
 extern "C" [[noreturn]] void exit(int exit_code=0);
 
+// this stuff is needed when running without musl libc:
 // extern func_t __preinit_array_start[] __attribute__((weak));
 // extern func_t __preinit_array_end[] __attribute__((weak));
 // extern func_t __init_array_start[] __attribute__((weak));
@@ -62,55 +63,42 @@ extern "C" void start_c(long *)
     // init TLS is done by musl libc
     //mythos::setupInitialTLS();
 
-    // TODO make a fake environment structure, which would normally be provided by the process creator
-    // at the bottom of the stack 
-    // see http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html
-    // http://articles.manugarg.com/aboutelfauxiliaryvectors.html
-    
-    // when initialising the stack:
-    // push end marker
-    // push environment and command line strings
-    // push padding
-    // push AT_NULL terminator
-    // push AUXV entries
-    // push nullptr for termination of environment variables
-    // push environment variables
-    // push nullptr for command line termination
-    // push command line arguments
-    // push argc
-    
-    // need AT_PHDR, AT_PHNUM, AT_PHENT, 
-    // maybe AT_RANDOM, AT_HWCAP, AT_SYSINFO, AT_PAGESZ, AT_SECURE
-    
-    // can add own entries with id>AUX_CNT and musl/libc will ignore these    
-    // for example, pointer to capability environment information, which can also be placed on the stack 
-    
     struct Auxv 
     {
         Auxv(uint64_t a_type, uint64_t a_val) : a_type(a_type), a_val(a_val) {}
         uint64_t a_type;              /* Entry type */
         uint64_t a_val;           /* Integer value */
     };
-    
-    mythos::elf64::Elf64Image img(&__executable_start);
 
+    // Make a fake environment structure.
+    // This would normally be provided by the process creator
+    // at the bottom of the stack. 
+    // But it can be anywhere, because we pass it by pointer to the musl libc entry point.
+    // see http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html
+    // http://articles.manugarg.com/aboutelfauxiliaryvectors.html
+    //
+    // The musl libc needs AT_PHDR, AT_PHNUM, AT_PHENT, 
+    // and maybe also AT_RANDOM, AT_HWCAP, AT_SYSINFO, AT_PAGESZ, AT_SECURE.
+    // We can add own entries with id>AUX_CNT and musl/libc will ignore these    
+    // for example, pointer to capability environment information.
     struct ProgEnv 
     {
         ProgEnv() {}
         long argc = 0;
         // here the pointers to command line arguments would come, terminated by nullptr in addition to argc
-        char* argvEnd = nullptr;
+        char* argvEnd = nullptr; // termination of arg vector
         // here the pointers to environment variables would come, terminated by nullptr
-        char* envEnd = nullptr;
+        char* envEnd = nullptr; // termination of env vector
         // here the AUX vector comes
         Auxv phdr={3, 0};
         Auxv phent={4, 0};
         Auxv phnum={5, 0};
         Auxv pagesize={6, 4096};
         Auxv secure={23, 1};
-        Auxv auxvEnd={0,0};
+        Auxv auxvEnd={0,0}; // AT_NULL termination of the aux vector, would be bottom of stack
     };
     
+    mythos::elf64::Elf64Image img(&__executable_start);
     ProgEnv env;
     long* p = (long*)&env;
     
@@ -118,9 +106,9 @@ extern "C" void start_c(long *)
     env.phnum.a_val = img.phnum();
     env.phent.a_val = img.phent();
     
-    int argc = p[0];
-    char **argv = (char **)(p+1);
-    __libc_start_main(&main, argc, argv);
+    // implemented in musl libc: src/env/__libc_start_main.c
+    // uses char **envp = argv+argc+1;
+    __libc_start_main(&main, env.argc, &env.argvEnd-env.argc);
 }
 
 // see also http://stackoverflow.com/a/28981890 :(
diff --git a/kernel/runtime/cxx/runtime/cxxsupport.cc b/kernel/runtime/cxx/runtime/cxxsupport.cc
index 4edf618e..6926d283 100644
--- a/kernel/runtime/cxx/runtime/cxxsupport.cc
+++ b/kernel/runtime/cxx/runtime/cxxsupport.cc
@@ -206,21 +206,34 @@ extern "C" int mprotect(void *addr, size_t len, int prot)
     return 0;
 }
 
-int myclone(
+static int mythos_clone(
     int (*func)(void *), void *stack, int flags, 
     void *arg, int* ptid, void* tls, int* ctid)
 {
-    MLOG_DETAIL(mlog::app, "myclone");
+    MLOG_DETAIL(mlog::app, "mythos_clone");
     ASSERT(tls != nullptr);
 
+    uintptr_t myTLS;
+    asm ("movq %%fs:%1, %0" : "=r" (myTLS) : "m" (*(char*)0));
+    auto& stateFrame = *reinterpret_cast<mythos::Frame*>(
+        uintptr_t(&mythos::pthreadStateFrame) - myTLS + uintptr_t(tls));
+    auto& ec = *reinterpret_cast<mythos::ExecutionContext*>(
+        uintptr_t(&mythos::pthreadExecutionContext) - myTLS + uintptr_t(tls));
+
     mythos::PortalLock pl(portal); // future access will fail if the portal is in use already
-    mythos::ExecutionContext ec(capAlloc());
+    ec.setCap(capAlloc());
+    stateFrame.setCap(capAlloc());
+    auto res2 = stateFrame.create(pl, kmem, 4096, 4096).wait();
     if (ptid && (flags&CLONE_PARENT_SETTID)) *ptid = int(ec.cap());
-    // @todo store thread-specific ctid pointer, which should set to 0 by the OS on the thread's exit
+    // @todo store thread-specific ctid pointer, which should be set to 0 by the OS on the thread's exit
     // @todo needs interaction with a process internal scheduler or core manager in order to figure out where to schedule the new thread
+    
     auto res1 = ec.create(kmem).as(myAS).cs(myCS).sched(mythos::init::SCHEDULERS_START + 1)
-        .prepareStack(stack).startFunInt(func, arg, ec.cap())
-        .suspended(false).fs(tls)
+        .state(stateFrame.cap(), 0)
+        .prepareStack(stack)
+        .startFunInt(func, arg, ec.cap())
+        .suspended(false)
+        .fs(tls)
         .invokeVia(pl).wait();
     MLOG_DETAIL(mlog::app, DVAR(ec.cap()));
     return ec.cap();
@@ -235,7 +248,7 @@ extern "C" int clone(int (*func)(void *), void *stack, int flags, void *arg, ...
     void* tls = va_arg(args, void*);
     int* ctid = va_arg(args, int*);
     va_end(args);
-    return myclone(func, stack, flags, arg, ptid, tls, ctid);
+    return mythos_clone(func, stack, flags, arg, ptid, tls, ctid);
 }
 
 struct dl_phdr_info
diff --git a/kernel/runtime/kobject/runtime/ExecutionContext.hh b/kernel/runtime/kobject/runtime/ExecutionContext.hh
index 3db374cb..57c934b8 100644
--- a/kernel/runtime/kobject/runtime/ExecutionContext.hh
+++ b/kernel/runtime/kobject/runtime/ExecutionContext.hh
@@ -33,11 +33,11 @@
 #include "mythos/init.hh"
 
 namespace mythos {
-    
+
     extern thread_local CapPtr localEC;
 
     template<class MSG> class Msg;
-    
+
     template<> class Msg<protocol::ExecutionContext::Create>
     {
     protected:
@@ -46,64 +46,65 @@ namespace mythos {
     public:
         typedef void* (*StartFun)(void*);
         typedef int (*StartFunInt)(void*);
-        
+
         Msg(CapPtr dst, CapPtr kmem, CapPtr factory) : ib(dst, factory), obj(kmem) {}
-        
+
         Msg& as(CapPtr c) { ib.as(c); return *this; }
         Msg& as(PageMap& c) { ib.as(c.cap()); return *this; }
         Msg& cs(CapPtr c) { ib.cs(c); return *this; }
         Msg& cs(CapMap& c) { ib.cs(c.cap()); return *this; }
         Msg& sched(CapPtr c) { ib.sched(c); return *this; }
+        Msg& state(CapPtr c, uint32_t offset) { ib.state(c); ib.stateOffset = offset; return *this; }
         Msg& rawStack(void* ptr) { ib.regs.rsp = uintptr_t(ptr); return *this; }
         Msg& prepareStack(void* ptr) {
             // \TODO assert alignment
             auto tos = reinterpret_cast<uintptr_t*>(ptr);
             *--tos = 0;                                     // dummy return address
-            ib.regs.rsp = uintptr_t(tos); 
-            return *this; 
+            ib.regs.rsp = uintptr_t(tos);
+            return *this;
         }
-        Msg& startFun(StartFun fun, void* userctx, CapPtr ec) { 
+        Msg& startFun(StartFun fun, void* userctx, CapPtr ec) {
             ib.regs.rdi = uintptr_t(fun);                   // arg 1
             ib.regs.rsi = uintptr_t(userctx);               // arg 2
-            ib.regs.rdx = uintptr_t(ec);               	    // arg 3
+            ib.regs.rdx = uintptr_t(ec);                    // arg 3
             ib.regs.rip = uintptr_t(&start);
-            return *this; 
+            return *this;
         }
 
-        Msg& startFunInt(StartFunInt fun, void* userctx, CapPtr ec) { 
+        Msg& startFunInt(StartFunInt fun, void* userctx, CapPtr ec) {
             ib.regs.rdi = uintptr_t(fun);                   // arg 1
             ib.regs.rsi = uintptr_t(userctx);               // arg 2
             ib.regs.rdx = uintptr_t(ec);                    // arg 3
             ib.regs.rip = uintptr_t(&startInt);
-            return *this; 
+            return *this;
         }
 
         Msg& suspended(bool value) { ib.start = !value; return *this; }
         Msg& fs(void* ptr) { ib.regs.fs_base = uintptr_t(ptr); return *this; }
         Msg& gs(void* ptr) { ib.regs.gs_base = uintptr_t(ptr); return *this; }
-        
+
         // inherited from KernelMemory::CreateBase
         Msg& indirectDest(CapPtr dstCSpace, CapPtrDepth dstDepth) {
             ib.setIndirectDest(dstCSpace, dstDepth);
             return *this;
         }
-        
-        PortalFuture<void> invokeVia(PortalLock pl) { 
-            
-            return std::move(pl.invokeWithMsg(obj,  ib)); 
+
+        PortalFuture<void> invokeVia(PortalLock pl) {
+
+            return std::move(pl.invokeWithMsg(obj,  ib));
         }
 
     protected:
-        static void start(StartFun main, void* userctx, CapPtr ec) { 
+        static void start(StartFun main, void* userctx, CapPtr ec) {
             localEC = ec;
             syscall_exit(uintptr_t(main(userctx)));
         }
 
-        static void startInt(StartFunInt main, void* userctx, CapPtr ec) { 
+        static void startInt(StartFunInt main, void* userctx, CapPtr ec) {
             localEC = ec;
             syscall_exit(main(userctx));
         }
-    };    
+    };
 
 
   class ExecutionContext : public KObject
@@ -114,14 +115,14 @@ namespace mythos {
 
     ExecutionContext() {}
     ExecutionContext(CapPtr cap) : KObject(cap) {}
-    
-    Msg<protocol::ExecutionContext::Create> 
+
+    Msg<protocol::ExecutionContext::Create>
     create(KernelMemory kmem, CapPtr factory = init::EXECUTION_CONTEXT_FACTORY) {
         return {this->cap(), kmem.cap(), factory};
     }
 
-    PortalFuture<void> configure(PortalLock pr, PageMap as, CapMap cs, CapPtr sched) {
-      return pr.invoke<protocol::ExecutionContext::Configure>(_cap, as.cap(), cs.cap(), sched);
+    PortalFuture<void> configure(PortalLock pr, PageMap as, CapMap cs, CapPtr sched, CapPtr state, uint32_t stateOffset, bool initializeState) {
+      return pr.invoke<protocol::ExecutionContext::Configure>(_cap, as.cap(), cs.cap(), sched, state, stateOffset, initializeState);
     }
 
     struct Registers : register_t {
diff --git a/kernel/runtime/memory/runtime/tls.cc b/kernel/runtime/memory/runtime/tls.cc
index 99044f5a..4ba16bea 100644
--- a/kernel/runtime/memory/runtime/tls.cc
+++ b/kernel/runtime/memory/runtime/tls.cc
@@ -13,6 +13,10 @@ extern char __executable_start; //< provided by the default linker script
 
 namespace mythos {
 
+thread_local mythos::ExecutionContext pthreadExecutionContext;
+thread_local mythos::Frame pthreadStateFrame;
+// @todo add a individual thread_local portal for each pthread
+
 /* Dont change! */
 struct TLSControlBlock
 {
diff --git a/kernel/runtime/memory/runtime/tls.hh b/kernel/runtime/memory/runtime/tls.hh
index d8638bdf..42098ba0 100644
--- a/kernel/runtime/memory/runtime/tls.hh
+++ b/kernel/runtime/memory/runtime/tls.hh
@@ -27,10 +27,15 @@
 
 #include <cstdint>
 #include "util/assert.hh"
-
+#include "runtime/ExecutionContext.hh"
+#include "runtime/Frame.hh"
 
 namespace mythos {
 
+extern thread_local mythos::ExecutionContext pthreadExecutionContext;
+extern thread_local mythos::Frame pthreadStateFrame;
+// @todo add a individual thread_local portal for each pthread
+
 void setupInitialTLS();
 
 void* setupNewTLS();