diff --git a/repos/base-foc/include/base/thread_state.h b/repos/base-foc/include/base/thread_state.h
deleted file mode 100644
index 2bcb9c68d..000000000
--- a/repos/base-foc/include/base/thread_state.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * \brief  Thread state
- * \author Stefan Kalkowski
- * \date   2010-01-20
- *
- * This file contains the Fiasco.OC specific part of the thread state.
- */
-
-/*
- * Copyright (C) 2010-2013 Genode Labs GmbH
- *
- * This file is part of the Genode OS framework, which is distributed
- * under the terms of the GNU General Public License version 2.
- */
-
-#ifndef _INCLUDE__BASE__THREAD_STATE_H_
-#define _INCLUDE__BASE__THREAD_STATE_H_
-
-#include <base/capability.h>
-#include <base/lock.h>
-#include <base/thread_state_base.h>
-
-/* Fiasco includes */
-namespace Fiasco {
-#include <l4/sys/types.h>
-}
-
-namespace Genode {
-
-	struct Thread_state : Thread_state_base
-	{
-		Fiasco::l4_cap_idx_t  kcap;         /* thread's gate cap in its pd */
-		int                   id;           /* id of gate capability */
-		addr_t                utcb;         /* thread's utcb in its pd */
-		unsigned              exceptions;   /* counts exceptions raised by the thread */
-		bool                  paused;       /* indicates whether thread is stopped */
-		bool                  in_exception; /* true if thread is in exception */
-		Lock                  lock;
-
-		/**
-		 * Constructor
-		 */
-		Thread_state()
-		: kcap(Fiasco::L4_INVALID_CAP), id(0), utcb(0), exceptions(0),
-		  paused(false), in_exception(false) { }
-	};
-}
-
-#endif /* _INCLUDE__BASE__THREAD_STATE_H_ */
diff --git a/repos/base-foc/include/foc/thread_state.h b/repos/base-foc/include/foc/thread_state.h
new file mode 100644
index 000000000..c8a9fa7fe
--- /dev/null
+++ b/repos/base-foc/include/foc/thread_state.h
@@ -0,0 +1,49 @@
+/*
+ * \brief  Thread state
+ * \author Stefan Kalkowski
+ * \date   2010-01-20
+ *
+ * This file contains the Fiasco.OC specific part of the thread state.
+ */
+
+/*
+ * Copyright (C) 2010-2013 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__FOC__THREAD_STATE_H_
+#define _INCLUDE__FOC__THREAD_STATE_H_
+
+#include <base/capability.h>
+#include <base/lock.h>
+#include <base/thread_state.h>
+
+/* Fiasco includes */
+namespace Fiasco {
+#include <l4/sys/types.h>
+}
+
+namespace Genode { struct Foc_thread_state; }
+
+
+struct Genode::Foc_thread_state : Thread_state
+{
+	Fiasco::l4_cap_idx_t  kcap;         /* thread's gate cap in its pd */
+	int                   id;           /* id of gate capability */
+	addr_t                utcb;         /* thread's utcb in its pd */
+	unsigned              exceptions;   /* counts exceptions raised by the thread */
+	bool                  paused;       /* indicates whether thread is stopped */
+	bool                  in_exception; /* true if thread is in exception */
+	Lock                  lock;
+
+	/**
+	 * Constructor
+	 */
+	Foc_thread_state()
+	: kcap(Fiasco::L4_INVALID_CAP), id(0), utcb(0), exceptions(0),
+	  paused(false), in_exception(false) { }
+};
+
+#endif /* _INCLUDE__FOC__THREAD_STATE_H_ */
diff --git a/repos/base-foc/include/foc_native_cpu/client.h b/repos/base-foc/include/foc_native_cpu/client.h
index c001c93d2..c88f38a67 100644
--- a/repos/base-foc/include/foc_native_cpu/client.h
+++ b/repos/base-foc/include/foc_native_cpu/client.h
@@ -26,14 +26,17 @@ struct Genode::Foc_native_cpu_client : Rpc_client<Foc_native_cpu>
 	explicit Foc_native_cpu_client(Capability<Native_cpu> cap)
 	: Rpc_client<Foc_native_cpu>(static_cap_cast<Foc_native_cpu>(cap)) { }
 
-	void enable_vcpu(Thread_capability cap, addr_t vcpu_state) {
+	void enable_vcpu(Thread_capability cap, addr_t vcpu_state) override {
 		call<Rpc_enable_vcpu>(cap, vcpu_state); }
 
-	Native_capability native_cap(Thread_capability cap) {
+	Native_capability native_cap(Thread_capability cap) override {
 		return call<Rpc_native_cap>(cap); }
 
-	Native_capability alloc_irq() {
+	Native_capability alloc_irq() override {
 		return call<Rpc_alloc_irq>(); }
+
+	Foc_thread_state thread_state(Thread_capability cap) override {
+		return call<Rpc_thread_state>(cap); }
 };
 
 #endif /* _INCLUDE__FOC_NATIVE_CPU__CLIENT_H_ */
diff --git a/repos/base-foc/include/foc_native_cpu/foc_native_cpu.h b/repos/base-foc/include/foc_native_cpu/foc_native_cpu.h
index 9dd8cd05d..7b4cb906e 100644
--- a/repos/base-foc/include/foc_native_cpu/foc_native_cpu.h
+++ b/repos/base-foc/include/foc_native_cpu/foc_native_cpu.h
@@ -17,6 +17,7 @@
 
 #include <base/rpc.h>
 #include <cpu_session/cpu_session.h>
+#include <foc/thread_state.h>
 
 namespace Genode { struct Foc_native_cpu; }
 
@@ -24,8 +25,9 @@ namespace Genode { struct Foc_native_cpu; }
 struct Genode::Foc_native_cpu : Cpu_session::Native_cpu
 {
 	virtual void enable_vcpu(Thread_capability cap, addr_t vcpu_state) = 0;
-	virtual Native_capability native_cap(Thread_capability cap) = 0;
+	virtual Native_capability native_cap(Thread_capability) = 0;
 	virtual Native_capability alloc_irq() = 0;
+	virtual Foc_thread_state thread_state(Thread_capability) = 0;
 
 
 	/*********************
@@ -35,8 +37,9 @@ struct Genode::Foc_native_cpu : Cpu_session::Native_cpu
 	GENODE_RPC(Rpc_enable_vcpu, void, enable_vcpu, Thread_capability, addr_t);
 	GENODE_RPC(Rpc_native_cap, Native_capability, native_cap, Thread_capability);
 	GENODE_RPC(Rpc_alloc_irq, Native_capability, alloc_irq);
+	GENODE_RPC(Rpc_thread_state, Foc_thread_state, thread_state, Thread_capability);
 
-	GENODE_RPC_INTERFACE(Rpc_enable_vcpu, Rpc_native_cap, Rpc_alloc_irq);
+	GENODE_RPC_INTERFACE(Rpc_enable_vcpu, Rpc_native_cap, Rpc_alloc_irq, Rpc_thread_state);
 };
 
 #endif /* _INCLUDE__FOC_NATIVE_CPU__FOC_NATIVE_CPU_H_ */
diff --git a/repos/base-foc/src/core/include/ipc_pager.h b/repos/base-foc/src/core/include/ipc_pager.h
index 1686a0eed..009de3c06 100644
--- a/repos/base-foc/src/core/include/ipc_pager.h
+++ b/repos/base-foc/src/core/include/ipc_pager.h
@@ -23,6 +23,7 @@
 #include <base/thread_state.h>
 #include <util/touch.h>
 #include <foc/native_capability.h>
+#include <foc/thread_state.h>
 
 /* base-internal includes */
 #include <base/internal/native_thread.h>
@@ -192,13 +193,13 @@ namespace Genode {
 			 * Copy the exception registers from the last exception
 			 * to the given Thread_state object.
 			 */
-			void get_regs(Thread_state *state);
+			void get_regs(Foc_thread_state *state);
 
 			/*
 			 * Copy the exception reply registers from the given
 			 * Thread_state object
 			 */
-			void set_regs(Thread_state state);
+			void set_regs(Foc_thread_state state);
 	};
 }
 
diff --git a/repos/base-foc/src/core/include/native_cpu_component.h b/repos/base-foc/src/core/include/native_cpu_component.h
index a64499f69..6304ef19f 100644
--- a/repos/base-foc/src/core/include/native_cpu_component.h
+++ b/repos/base-foc/src/core/include/native_cpu_component.h
@@ -41,6 +41,7 @@ class Genode::Native_cpu_component : public Rpc_object<Foc_native_cpu,
 		void enable_vcpu(Thread_capability, addr_t) override;
 		Native_capability native_cap(Thread_capability) override;
 		Native_capability alloc_irq() override;
+		Foc_thread_state thread_state(Thread_capability) override;
 };
 
 #endif /* _CORE__INCLUDE__NATIVE_CPU_COMPONENT_H_ */
diff --git a/repos/base-foc/src/core/include/pager_object_exception_state.h b/repos/base-foc/src/core/include/pager_object_exception_state.h
new file mode 100644
index 000000000..026ccfec8
--- /dev/null
+++ b/repos/base-foc/src/core/include/pager_object_exception_state.h
@@ -0,0 +1,21 @@
+/*
+ * \brief  Type used to store kernel-specific exception state
+ * \author Norman Feske
+ * \date   2016-12-13
+ */
+
+/*
+ * Copyright (C) 2016 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _CORE__INCLUDE__PAGER_OBJECT_EXCEPTION_STATE_H_
+#define _CORE__INCLUDE__PAGER_OBJECT_EXCEPTION_STATE_H_
+
+#include <foc/thread_state.h>
+
+namespace Genode { typedef Foc_thread_state Pager_object_exception_state; }
+
+#endif /* _CORE__INCLUDE__PAGER_OBJECT_EXCEPTION_STATE_H_ */
diff --git a/repos/base-foc/src/core/include/platform_thread.h b/repos/base-foc/src/core/include/platform_thread.h
index 4c7ff52aa..6cf22afe3 100644
--- a/repos/base-foc/src/core/include/platform_thread.h
+++ b/repos/base-foc/src/core/include/platform_thread.h
@@ -138,7 +138,7 @@ namespace Genode {
 			 *
 			 * \throw Cpu_session::State_access_failed
 			 */
-			Thread_state state();
+			Foc_thread_state state();
 
 			/**
 			 * Set the executing CPU for this thread
diff --git a/repos/base-foc/src/core/native_cpu_component.cc b/repos/base-foc/src/core/native_cpu_component.cc
index b1f6363ff..795f69e04 100644
--- a/repos/base-foc/src/core/native_cpu_component.cc
+++ b/repos/base-foc/src/core/native_cpu_component.cc
@@ -91,6 +91,19 @@ Genode::Native_capability Genode::Native_cpu_component::alloc_irq()
 }
 
 
+Genode::Foc_thread_state
+Genode::Native_cpu_component::thread_state(Genode::Thread_capability cap)
+{
+	using namespace Genode;
+
+	auto lambda = [&] (Cpu_thread_component *thread) {
+		return (!thread) ? Foc_thread_state()
+		                 : thread->platform_thread().state(); };
+
+	return _thread_ep.apply(cap, lambda);
+}
+
+
 Genode::Native_cpu_component::Native_cpu_component(Cpu_session_component &cpu_session, char const *)
 :
 	_cpu_session(cpu_session), _thread_ep(*_cpu_session._thread_ep)
diff --git a/repos/base-foc/src/core/platform_thread.cc b/repos/base-foc/src/core/platform_thread.cc
index 6d6efcc6e..72562aca1 100644
--- a/repos/base-foc/src/core/platform_thread.cc
+++ b/repos/base-foc/src/core/platform_thread.cc
@@ -15,6 +15,7 @@
 #include <base/ipc.h>
 #include <base/log.h>
 #include <util/string.h>
+#include <foc/thread_state.h>
 
 /* core includes */
 #include <platform_thread.h>
@@ -185,13 +186,13 @@ void Platform_thread::pager(Pager_object *pager_obj)
 void Platform_thread::state(Thread_state s)
 {
 	if (_pager_obj)
-		_pager_obj->state = s;
+		*static_cast<Thread_state *>(&_pager_obj->state) = s;
 }
 
 
-Thread_state Platform_thread::state()
+Foc_thread_state Platform_thread::state()
 {
-	Thread_state s;
+	Foc_thread_state s;
 	if (_pager_obj) s = _pager_obj->state;
 
 	s.kcap = _gate.remote;
diff --git a/repos/base-foc/src/core/spec/arm/ipc_pager.cc b/repos/base-foc/src/core/spec/arm/ipc_pager.cc
index 3988a3b3e..e6b72b2ea 100644
--- a/repos/base-foc/src/core/spec/arm/ipc_pager.cc
+++ b/repos/base-foc/src/core/spec/arm/ipc_pager.cc
@@ -32,7 +32,7 @@ void Genode::Ipc_pager::_parse_exception()
 }
 
 
-void Genode::Ipc_pager::get_regs(Thread_state *state)
+void Genode::Ipc_pager::get_regs(Foc_thread_state *state)
 {
 	state->ip   = _regs.pc;
 	state->sp   = _regs.sp;
@@ -54,7 +54,7 @@ void Genode::Ipc_pager::get_regs(Thread_state *state)
 }
 
 
-void Genode::Ipc_pager::set_regs(Thread_state state)
+void Genode::Ipc_pager::set_regs(Foc_thread_state state)
 {
 	_regs.pc    = state.ip;
 	_regs.sp    = state.sp;
diff --git a/repos/base-foc/src/core/spec/x86_32/ipc_pager.cc b/repos/base-foc/src/core/spec/x86_32/ipc_pager.cc
index 6a390047d..4c415964c 100644
--- a/repos/base-foc/src/core/spec/x86_32/ipc_pager.cc
+++ b/repos/base-foc/src/core/spec/x86_32/ipc_pager.cc
@@ -17,7 +17,7 @@
 #include <ipc_pager.h>
 
 
-void Genode::Ipc_pager::get_regs(Genode::Thread_state *state)
+void Genode::Ipc_pager::get_regs(Foc_thread_state *state)
 {
 	state->ip     = _regs.ip;
 	state->sp     = _regs.sp;
@@ -35,7 +35,7 @@ void Genode::Ipc_pager::get_regs(Genode::Thread_state *state)
 }
 
 
-void Genode::Ipc_pager::set_regs(Genode::Thread_state state)
+void Genode::Ipc_pager::set_regs(Foc_thread_state state)
 {
 	_regs.ip     = state.ip;
 	_regs.sp     = state.sp;
diff --git a/repos/base-foc/src/core/spec/x86_64/ipc_pager.cc b/repos/base-foc/src/core/spec/x86_64/ipc_pager.cc
index 1024e3845..cb38c268b 100644
--- a/repos/base-foc/src/core/spec/x86_64/ipc_pager.cc
+++ b/repos/base-foc/src/core/spec/x86_64/ipc_pager.cc
@@ -17,7 +17,7 @@
 #include <ipc_pager.h>
 
 
-void Genode::Ipc_pager::get_regs(Thread_state *state)
+void Genode::Ipc_pager::get_regs(Foc_thread_state *state)
 {
 	state->ip     = _regs.ip;
 	state->sp     = _regs.sp;
@@ -42,7 +42,7 @@ void Genode::Ipc_pager::get_regs(Thread_state *state)
 }
 
 
-void Genode::Ipc_pager::set_regs(Thread_state state)
+void Genode::Ipc_pager::set_regs(Foc_thread_state state)
 {
 	_regs.ip     = state.ip;
 	_regs.sp     = state.sp;
diff --git a/repos/base-foc/src/lib/base/thread_start.cc b/repos/base-foc/src/lib/base/thread_start.cc
index c5785bcaf..2b55d51dd 100644
--- a/repos/base-foc/src/lib/base/thread_start.cc
+++ b/repos/base-foc/src/lib/base/thread_start.cc
@@ -19,6 +19,7 @@
 #include <base/env.h>
 #include <cpu_thread/client.h>
 #include <foc/native_capability.h>
+#include <foc_native_cpu/client.h>
 
 /* base-internal includes */
 #include <base/internal/stack.h>
@@ -79,11 +80,11 @@ void Thread::start()
 {
 	using namespace Fiasco;
 
-	Cpu_thread_client cpu_thread(_thread_cap);
+	Foc_native_cpu_client native_cpu(_cpu_session->native_cpu());
 
 	/* get gate-capability and badge of new thread */
-	Thread_state state;
-	try { state = cpu_thread.state(); }
+	Foc_thread_state state;
+	try { state = native_cpu.thread_state(_thread_cap); }
 	catch (...) { throw Cpu_session::Thread_creation_failed(); }
 
 	/* remember UTCB of the new thread */
@@ -97,6 +98,7 @@ void Thread::start()
 	l4_utcb_tcr_u(foc_utcb)->user[UTCB_TCR_THREAD_OBJ] = (addr_t)this;
 
 	/* register initial IP and SP at core */
+	Cpu_thread_client cpu_thread(_thread_cap);
 	cpu_thread.start((addr_t)_thread_start, _stack->top());
 }
 
diff --git a/repos/base/src/core/include/pager.h b/repos/base/src/core/include/pager.h
index 09b3a5b33..8b012589c 100644
--- a/repos/base/src/core/include/pager.h
+++ b/repos/base/src/core/include/pager.h
@@ -26,6 +26,7 @@
 
 /* core-local includes */
 #include <rpc_cap_factory.h>
+#include <pager_object_exception_state.h>
 
 namespace Genode {
 
@@ -73,7 +74,7 @@ class Genode::Pager_object : public Object_pool<Pager_object>::Entry
 		/**
 		 * Contains information about exception state of corresponding thread.
 		 */
-		Thread_state state;
+		Pager_object_exception_state state;
 
 		/**
 		 * Constructor
diff --git a/repos/base/src/core/include/pager_object_exception_state.h b/repos/base/src/core/include/pager_object_exception_state.h
new file mode 100644
index 000000000..f74556dc0
--- /dev/null
+++ b/repos/base/src/core/include/pager_object_exception_state.h
@@ -0,0 +1,21 @@
+/*
+ * \brief  Type used to store kernel-specific exception state
+ * \author Norman Feske
+ * \date   2016-12-13
+ */
+
+/*
+ * Copyright (C) 2016 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _CORE__INCLUDE__PAGER_OBJECT_EXCEPTION_STATE_H_
+#define _CORE__INCLUDE__PAGER_OBJECT_EXCEPTION_STATE_H_
+
+#include <base/thread_state.h>
+
+namespace Genode { typedef Thread_state Pager_object_exception_state; }
+
+#endif /* _CORE__INCLUDE__PAGER_OBJECT_EXCEPTION_STATE_H_ */
diff --git a/repos/gems/src/server/cpu_sampler/spec/foc/native_cpu.cc b/repos/gems/src/server/cpu_sampler/spec/foc/native_cpu.cc
index 2869e516d..8ad3024fa 100644
--- a/repos/gems/src/server/cpu_sampler/spec/foc/native_cpu.cc
+++ b/repos/gems/src/server/cpu_sampler/spec/foc/native_cpu.cc
@@ -72,6 +72,11 @@ class Cpu_sampler::Native_cpu_component : public Rpc_object<Foc_native_cpu,
 		{
 			return _foc_native_cpu.alloc_irq();
 		}
+
+		Foc_thread_state thread_state(Thread_capability cap) override
+		{
+			return _foc_native_cpu.thread_state(cap);
+		}
 };
 
 
diff --git a/repos/gems/src/server/cpu_sampler/spec/foc/target.mk b/repos/gems/src/server/cpu_sampler/spec/foc/target.mk
index ade4af62d..4b857735d 100644
--- a/repos/gems/src/server/cpu_sampler/spec/foc/target.mk
+++ b/repos/gems/src/server/cpu_sampler/spec/foc/target.mk
@@ -1,6 +1,6 @@
 REQUIRES += foc
-
-SRC_CC += native_cpu.cc
+LIBS     += syscall-foc
+SRC_CC   += native_cpu.cc
 
 vpath native_cpu.cc $(PRG_DIR)
 
diff --git a/repos/gems/src/server/cpu_sampler/target.inc b/repos/gems/src/server/cpu_sampler/target.inc
index 15fbe920a..1dff366c2 100644
--- a/repos/gems/src/server/cpu_sampler/target.inc
+++ b/repos/gems/src/server/cpu_sampler/target.inc
@@ -6,6 +6,6 @@ SRC_CC += main.cc \
 
 INC_DIR = $(REP_DIR)/src/server/cpu_sampler
 
-LIBS    = base
+LIBS   += base
 
 vpath %.cc $(REP_DIR)/src/server/cpu_sampler
diff --git a/repos/ports-foc/src/lib/l4lx/include/vcpu.h b/repos/ports-foc/src/lib/l4lx/include/vcpu.h
index 102e87b39..75649f1ac 100644
--- a/repos/ports-foc/src/lib/l4lx/include/vcpu.h
+++ b/repos/ports-foc/src/lib/l4lx/include/vcpu.h
@@ -19,10 +19,10 @@
 #include <base/sleep.h>
 #include <base/thread.h>
 #include <foc_native_cpu/client.h>
+#include <foc/native_thread.h>
 #include <cpu_session/client.h>
 #include <cpu_thread/client.h>
 #include <timer_session/connection.h>
-#include <foc/native_thread.h>
 
 namespace Fiasco {
 #include <l4/sys/utcb.h>
@@ -47,6 +47,13 @@ namespace L4lx {
 			unsigned                    _cpu_nr;
 			Fiasco::l4_utcb_t   * const _utcb;
 
+			Fiasco::l4_utcb_t *_init_utcb()
+			{
+				using namespace Genode;
+				Foc_native_cpu_client native_cpu(env()->cpu_session()->native_cpu());
+				return (Fiasco::l4_utcb_t *)native_cpu.thread_state(cap()).utcb;
+			}
+
 		public:
 
 			Vcpu(const char                 *str,
@@ -62,7 +69,7 @@ namespace L4lx {
 			  _data(data ? *data : 0),
 			  _vcpu_state(vcpu_state),
 			  _cpu_nr(cpu_nr),
-			  _utcb((Fiasco::l4_utcb_t *)Genode::Cpu_thread_client(cap()).state().utcb)
+			  _utcb(_init_utcb())
 			{
 				start();
 
diff --git a/repos/ports/src/lib/gdbserver_platform/spec/foc/native_cpu.cc b/repos/ports/src/lib/gdbserver_platform/spec/foc/native_cpu.cc
index 1e32a0c32..a8a58d3b1 100644
--- a/repos/ports/src/lib/gdbserver_platform/spec/foc/native_cpu.cc
+++ b/repos/ports/src/lib/gdbserver_platform/spec/foc/native_cpu.cc
@@ -66,6 +66,12 @@ class Gdb_monitor::Native_cpu_component : public Rpc_object<Foc_native_cpu,
 		{
 			return _foc_native_cpu.alloc_irq();
 		}
+
+		Foc_thread_state thread_state(Thread_capability thread_cap) override
+		{
+			Cpu_thread_component *cpu_thread = _cpu_session_component.lookup_cpu_thread(thread_cap);
+			return _foc_native_cpu.thread_state(cpu_thread->parent_thread_cap());
+		}
 };