diff --git a/repos/base-fiasco/src/core/include/platform_thread.h b/repos/base-fiasco/src/core/include/platform_thread.h
index 0d753a7fe0..aabf222984 100644
--- a/repos/base-fiasco/src/core/include/platform_thread.h
+++ b/repos/base-fiasco/src/core/include/platform_thread.h
@@ -61,8 +61,9 @@ class Core::Platform_thread : Interface
 		/**
 		 * Constructor
 		 */
-		Platform_thread(Platform_pd &pd, size_t, const char *name,
-		                unsigned, Affinity::Location, addr_t)
+		Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+		                Region_map &, size_t, const char *name, unsigned,
+		                Affinity::Location, addr_t)
 		: _name(name), _pd(pd) { }
 
 		/**
diff --git a/repos/base-fiasco/src/core/pager.cc b/repos/base-fiasco/src/core/pager.cc
index e6c1d9257f..cba6f257af 100644
--- a/repos/base-fiasco/src/core/pager.cc
+++ b/repos/base-fiasco/src/core/pager.cc
@@ -103,3 +103,6 @@ Untyped_capability Pager_entrypoint::_pager_object_cap(unsigned long badge)
 {
 	return Capability_space::import(native_thread().l4id, Rpc_obj_key(badge));
 }
+
+
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
diff --git a/repos/base-fiasco/src/core/thread_start.cc b/repos/base-fiasco/src/core/thread_start.cc
index 48871704ac..53b4302d94 100644
--- a/repos/base-fiasco/src/core/thread_start.cc
+++ b/repos/base-fiasco/src/core/thread_start.cc
@@ -20,7 +20,6 @@
 
 /* core includes */
 #include <platform.h>
-#include <core_env.h>
 
 using namespace Core;
 
diff --git a/repos/base-foc/src/core/include/platform_thread.h b/repos/base-foc/src/core/include/platform_thread.h
index 4d2d94dfd6..e2b2d681e5 100644
--- a/repos/base-foc/src/core/include/platform_thread.h
+++ b/repos/base-foc/src/core/include/platform_thread.h
@@ -75,8 +75,8 @@ class Core::Platform_thread : Interface
 		/**
 		 * Constructor for non-core threads
 		 */
-		Platform_thread(Platform_pd &, size_t, const char *name, unsigned priority,
-		                Affinity::Location, addr_t);
+		Platform_thread(Platform_pd &, Rpc_entrypoint &, Ram_allocator &, Region_map &,
+		                size_t, const char *name, unsigned priority, Affinity::Location, addr_t);
 
 		/**
 		 * Constructor for core main-thread
diff --git a/repos/base-foc/src/core/pager.cc b/repos/base-foc/src/core/pager.cc
index 891967266d..102df00cb3 100644
--- a/repos/base-foc/src/core/pager.cc
+++ b/repos/base-foc/src/core/pager.cc
@@ -153,3 +153,6 @@ Pager_capability Pager_entrypoint::manage(Pager_object &obj)
 		},
 		[&] (Cpu_session::Create_thread_error) { return Pager_capability(); });
 }
+
+
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
diff --git a/repos/base-foc/src/core/platform_thread.cc b/repos/base-foc/src/core/platform_thread.cc
index d24ace8782..b06d35bdb5 100644
--- a/repos/base-foc/src/core/platform_thread.cc
+++ b/repos/base-foc/src/core/platform_thread.cc
@@ -18,7 +18,6 @@
 /* core includes */
 #include <platform_thread.h>
 #include <platform.h>
-#include <core_env.h>
 
 /* Fiasco.OC includes */
 #include <foc/syscall.h>
@@ -278,7 +277,8 @@ void Platform_thread::_finalize_construction()
 }
 
 
-Platform_thread::Platform_thread(Platform_pd &pd, size_t, const char *name, unsigned prio,
+Platform_thread::Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+                                 Region_map &, size_t, const char *name, unsigned prio,
                                  Affinity::Location location, addr_t)
 :
 	_name(name),
diff --git a/repos/base-foc/src/core/thread_start.cc b/repos/base-foc/src/core/thread_start.cc
index 98f731f670..48a8d7afa5 100644
--- a/repos/base-foc/src/core/thread_start.cc
+++ b/repos/base-foc/src/core/thread_start.cc
@@ -22,7 +22,6 @@
 
 /* core includes */
 #include <platform.h>
-#include <core_env.h>
 
 /* Fiasco.OC includes */
 #include <foc/syscall.h>
diff --git a/repos/base-hw/src/core/irq_session_component.cc b/repos/base-hw/src/core/irq_session_component.cc
index 6c33684f91..daa4a71c96 100644
--- a/repos/base-hw/src/core/irq_session_component.cc
+++ b/repos/base-hw/src/core/irq_session_component.cc
@@ -18,7 +18,7 @@
 /* core includes */
 #include <kernel/irq.h>
 #include <irq_root.h>
-#include <core_env.h>
+#include <platform.h>
 
 /* base-internal includes */
 #include <base/internal/capability_space.h>
diff --git a/repos/base-hw/src/core/pager.cc b/repos/base-hw/src/core/pager.cc
index 4fcd3d651e..2fd75b2e0a 100644
--- a/repos/base-hw/src/core/pager.cc
+++ b/repos/base-hw/src/core/pager.cc
@@ -23,6 +23,9 @@
 using namespace Core;
 
 
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
+
+
 /***************
  ** Ipc_pager **
  ***************/
diff --git a/repos/base-hw/src/core/pager.h b/repos/base-hw/src/core/pager.h
index 29f650e187..874dca41d1 100644
--- a/repos/base-hw/src/core/pager.h
+++ b/repos/base-hw/src/core/pager.h
@@ -53,6 +53,8 @@ namespace Core {
 	using Pager_capability = Capability<Pager_object>;
 
 	enum { PAGER_EP_STACK_SIZE = sizeof(addr_t) * 2048 };
+
+	extern void init_page_fault_handling(Rpc_entrypoint &);
 }
 
 
diff --git a/repos/base-hw/src/core/platform_thread.cc b/repos/base-hw/src/core/platform_thread.cc
index fb8f8d1b50..686cf89879 100644
--- a/repos/base-hw/src/core/platform_thread.cc
+++ b/repos/base-hw/src/core/platform_thread.cc
@@ -15,7 +15,6 @@
 /* core includes */
 #include <platform_thread.h>
 #include <platform_pd.h>
-#include <core_env.h>
 #include <rm_session_component.h>
 #include <map_local.h>
 
@@ -30,48 +29,19 @@
 using namespace Core;
 
 
-Ram_dataspace_capability Platform_thread::Utcb::_allocate_utcb(bool core_thread)
+addr_t Platform_thread::Utcb::_attach(Region_map &core_rm)
 {
-	Ram_dataspace_capability ds;
-
-	if (core_thread)
-		return ds;
-
-	try {
-		ds = core_env().pd_session()->alloc(sizeof(Native_utcb), CACHED);
-	} catch (...) {
-		error("failed to allocate UTCB");
-		throw Out_of_ram();
-	}
-
-	return ds;
-}
-
-
-addr_t Platform_thread::Utcb::_core_local_address(addr_t utcb_addr,
-                                                  bool core_thread)
-{
-	if (core_thread)
-		return utcb_addr;
-
-	addr_t ret = 0;
-
 	Region_map::Attr attr { };
 	attr.writeable = true;
-	core_env().rm_session()->attach(_ds, attr).with_result(
-			[&] (Region_map::Range range) {
-				ret = range.start; },
-			[&] (Region_map::Attach_error) {
-				error("failed to attach UTCB of new thread within core"); });
-
-	return ret;
+	return core_rm.attach(_ds, attr).convert<addr_t>(
+		[&] (Region_map::Range range) { return range.start; },
+		[&] (Region_map::Attach_error) {
+			error("failed to attach UTCB of new thread within core");
+			return 0ul; });
 }
 
 
-Platform_thread::Utcb::Utcb(addr_t pd_addr, bool core_thread)
-:
-	_ds(_allocate_utcb(core_thread)),
-	_core_addr(_core_local_address(pd_addr, core_thread))
+static addr_t _alloc_core_local_utcb(addr_t core_addr)
 {
 	/*
 	 * All non-core threads use the typical dataspace/rm_session
@@ -80,27 +50,25 @@ Platform_thread::Utcb::Utcb(addr_t pd_addr, bool core_thread)
 	 * physical and virtual memory allocators to create/attach its
 	 * UTCBs. Therefore, we've to allocate and map those here.
 	 */
-	if (core_thread) {
-		platform().ram_alloc().try_alloc(sizeof(Native_utcb)).with_result(
+	return platform().ram_alloc().try_alloc(sizeof(Native_utcb)).convert<addr_t>(
 
-			[&] (void *utcb_phys) {
-				map_local((addr_t)utcb_phys, _core_addr,
-				          sizeof(Native_utcb) / get_page_size());
-			},
-			[&] (Range_allocator::Alloc_error) {
-				error("failed to allocate UTCB for core/kernel thread!");
-				throw Out_of_ram();
-			}
-		);
-	}
+		[&] (void *utcb_phys) {
+			map_local((addr_t)utcb_phys, core_addr,
+			          sizeof(Native_utcb) / get_page_size());
+			return addr_t(utcb_phys);
+		},
+		[&] (Range_allocator::Alloc_error) {
+			error("failed to allocate UTCB for core/kernel thread!");
+			return 0ul;
+		});
 }
 
 
-Platform_thread::Utcb::~Utcb()
-{
-	/* detach UTCB from core/kernel */
-	core_env().rm_session()->detach((addr_t)_core_addr);
-}
+Platform_thread::Utcb::Utcb(addr_t core_addr)
+:
+	core_addr(core_addr),
+	phys_addr(_alloc_core_local_utcb(core_addr))
+{ }
 
 
 void Platform_thread::_init() { }
@@ -122,23 +90,27 @@ Platform_thread::Platform_thread(Label const &label, Native_utcb &utcb)
 	_label(label),
 	_pd(_kernel_main_get_core_platform_pd()),
 	_pager(nullptr),
-	_utcb((addr_t)&utcb, true),
+	_utcb((addr_t)&utcb),
 	_main_thread(false),
 	_location(Affinity::Location()),
-	_kobj(_kobj.CALLED_FROM_CORE, _label.string()) { }
+	_kobj(_kobj.CALLED_FROM_CORE, _label.string())
+{ }
 
 
 Platform_thread::Platform_thread(Platform_pd              &pd,
+                                 Rpc_entrypoint           &ep,
+                                 Ram_allocator            &ram,
+                                 Region_map               &core_rm,
                                  size_t             const  quota,
                                  Label              const &label,
                                  unsigned           const  virt_prio,
                                  Affinity::Location const  location,
-                                 addr_t             const  utcb)
+                                 addr_t                 /* utcb */)
 :
 	_label(label),
 	_pd(pd),
 	_pager(nullptr),
-	_utcb(utcb, false),
+	_utcb(ep, ram, core_rm),
 	_priority(_scale_priority(virt_prio)),
 	_quota((unsigned)quota),
 	_main_thread(!pd.has_any_thread),
@@ -165,9 +137,6 @@ Platform_thread::~Platform_thread()
 			locked_ptr->flush(user_utcb_main_thread(), sizeof(Native_utcb),
 			                  Address_space::Core_local_addr{0});
 	}
-
-	/* free UTCB */
-	core_env().pd_session()->free(_utcb._ds);
 }
 
 
@@ -185,26 +154,17 @@ void Platform_thread::start(void * const ip, void * const sp)
 	/* attach UTCB in case of a main thread */
 	if (_main_thread) {
 
-		/* lookup dataspace component for physical address */
-		auto lambda = [&] (Dataspace_component *dsc) {
-			if (!dsc) return -1;
-
-			/* lock the address space */
-			Locked_ptr<Address_space> locked_ptr(_address_space);
-			if (!locked_ptr.valid()) {
-				error("invalid RM client");
-				return -1;
-			};
-			Hw::Address_space * as = static_cast<Hw::Address_space*>(&*locked_ptr);
-			if (!as->insert_translation(user_utcb_main_thread(), dsc->phys_addr(),
-			                            sizeof(Native_utcb), Hw::PAGE_FLAGS_UTCB)) {
-				error("failed to attach UTCB");
-				return -1;
-			}
-			return 0;
-		};
-		if (core_env().entrypoint().apply(_utcb._ds, lambda))
+		Locked_ptr<Address_space> locked_ptr(_address_space);
+		if (!locked_ptr.valid()) {
+			error("unable to start thread in invalid address space");
 			return;
+		};
+		Hw::Address_space * as = static_cast<Hw::Address_space*>(&*locked_ptr);
+		if (!as->insert_translation(user_utcb_main_thread(), _utcb.phys_addr,
+		                            sizeof(Native_utcb), Hw::PAGE_FLAGS_UTCB)) {
+			error("failed to attach UTCB");
+			return;
+		}
 	}
 
 	/* initialize thread registers */
@@ -223,7 +183,7 @@ void Platform_thread::start(void * const ip, void * const sp)
 		utcb.cap_add(Capability_space::capid(_pd.parent()));
 		utcb.cap_add(Capability_space::capid(_utcb._ds));
 	}
-	Kernel::start_thread(*_kobj, cpu, _pd.kernel_pd(), *(Native_utcb*)_utcb._core_addr);
+	Kernel::start_thread(*_kobj, cpu, _pd.kernel_pd(), *(Native_utcb*)_utcb.core_addr);
 }
 
 
diff --git a/repos/base-hw/src/core/platform_thread.h b/repos/base-hw/src/core/platform_thread.h
index c02973303a..83fe4269b1 100644
--- a/repos/base-hw/src/core/platform_thread.h
+++ b/repos/base-hw/src/core/platform_thread.h
@@ -19,6 +19,7 @@
 #include <base/ram_allocator.h>
 #include <base/thread.h>
 #include <base/trace/types.h>
+#include <base/rpc_server.h>
 
 /* base-internal includes */
 #include <base/internal/native_utcb.h>
@@ -26,6 +27,7 @@
 /* core includes */
 #include <address_space.h>
 #include <object.h>
+#include <dataspace_component.h>
 
 /* kernel includes */
 #include <kernel/core_interface.h>
@@ -55,17 +57,59 @@ class Core::Platform_thread : Noncopyable
 
 		using Label = String<32>;
 
-		struct Utcb
+		struct Utcb : Noncopyable
 		{
+			struct {
+				Ram_allocator *_ram_ptr     = nullptr;
+				Region_map    *_core_rm_ptr = nullptr;
+			};
+
 			Ram_dataspace_capability _ds { }; /* UTCB ds of non-core threads */
 
-			addr_t const _core_addr; /* UTCB address within core/kernel */
+			addr_t const core_addr; /* UTCB address within core/kernel */
+			addr_t const phys_addr;
 
-			Ram_dataspace_capability _allocate_utcb(bool core_thread);
-			addr_t _core_local_address(addr_t utcb_addr, bool core_thread);
+			/*
+			 * \throw Out_of_ram
+			 * \throw Out_of_caps
+			 */
+			Ram_dataspace_capability _allocate(Ram_allocator &ram)
+			{
+				return ram.alloc(sizeof(Native_utcb), CACHED);
+			}
 
-			Utcb(addr_t pd_addr, bool core_thread);
-			~Utcb();
+			addr_t _attach(Region_map &);
+
+			static addr_t _ds_phys(Rpc_entrypoint &ep, Dataspace_capability ds)
+			{
+				return ep.apply(ds, [&] (Dataspace_component *dsc) {
+					return dsc ? dsc->phys_addr() : 0; });
+			}
+
+			/**
+			 * Constructor used for core-local threads
+			 */
+			Utcb(addr_t core_addr);
+
+			/**
+			 * Constructor used for threads outside of core
+			 */
+			Utcb(Rpc_entrypoint &ep, Ram_allocator &ram, Region_map &core_rm)
+			:
+				_core_rm_ptr(&core_rm),
+				_ds(_allocate(ram)),
+				core_addr(_attach(core_rm)),
+				phys_addr(_ds_phys(ep, _ds))
+			{ }
+
+			~Utcb()
+			{
+				if (_core_rm_ptr)
+					_core_rm_ptr->detach(core_addr);
+
+				if (_ram_ptr && _ds.valid())
+					_ram_ptr->free(_ds);
+			}
 		};
 
 		Label              const _label;
@@ -126,7 +170,8 @@ class Core::Platform_thread : Noncopyable
 		 * \param virt_prio  unscaled processor-scheduling priority
 		 * \param utcb       core local pointer to userland stack
 		 */
-		Platform_thread(Platform_pd &, size_t const quota, Label const &label,
+		Platform_thread(Platform_pd &, Rpc_entrypoint &, Ram_allocator &,
+		                Region_map &, size_t const quota, Label const &label,
 		                unsigned const virt_prio, Affinity::Location,
 		                addr_t const utcb);
 
diff --git a/repos/base-hw/src/core/spec/arm/virtualization/vm_session_component.cc b/repos/base-hw/src/core/spec/arm/virtualization/vm_session_component.cc
index 9eb54ab608..309f059235 100644
--- a/repos/base-hw/src/core/spec/arm/virtualization/vm_session_component.cc
+++ b/repos/base-hw/src/core/spec/arm/virtualization/vm_session_component.cc
@@ -22,7 +22,6 @@
 #include <vm_session_component.h>
 #include <platform.h>
 #include <cpu_thread_component.h>
-#include <core_env.h>
 
 using namespace Core;
 
diff --git a/repos/base-hw/src/core/spec/x86_64/virtualization/vm_session_component.cc b/repos/base-hw/src/core/spec/x86_64/virtualization/vm_session_component.cc
index 1265959696..587a76a5e7 100644
--- a/repos/base-hw/src/core/spec/x86_64/virtualization/vm_session_component.cc
+++ b/repos/base-hw/src/core/spec/x86_64/virtualization/vm_session_component.cc
@@ -23,7 +23,6 @@
 #include <vm_session_component.h>
 #include <platform.h>
 #include <cpu_thread_component.h>
-#include <core_env.h>
 
 using namespace Core;
 
diff --git a/repos/base-hw/src/core/vm_session_component.cc b/repos/base-hw/src/core/vm_session_component.cc
index a1f4b781f9..064d7eb3a4 100644
--- a/repos/base-hw/src/core/vm_session_component.cc
+++ b/repos/base-hw/src/core/vm_session_component.cc
@@ -19,7 +19,6 @@
 #include <vm_session_component.h>
 #include <platform.h>
 #include <cpu_thread_component.h>
-#include <core_env.h>
 
 using namespace Core;
 
diff --git a/repos/base-linux/src/core/include/core_region_map.h b/repos/base-linux/src/core/include/core_region_map.h
index 98954ef094..a132e3beab 100644
--- a/repos/base-linux/src/core/include/core_region_map.h
+++ b/repos/base-linux/src/core/include/core_region_map.h
@@ -25,7 +25,9 @@ namespace Core { class Core_region_map; }
 
 struct Core::Core_region_map : Region_map_mmap
 {
-	Core_region_map(Rpc_entrypoint &) : Region_map_mmap(false) { }
+	static void init(Rpc_entrypoint &);
+
+	Core_region_map(Rpc_entrypoint &ep) : Region_map_mmap(false) { init(ep); }
 };
 
 #endif /* _CORE__INCLUDE__CORE_REGION_MAP_H_ */
diff --git a/repos/base-linux/src/core/include/pager.h b/repos/base-linux/src/core/include/pager.h
index e41adf9ced..6677181e63 100644
--- a/repos/base-linux/src/core/include/pager.h
+++ b/repos/base-linux/src/core/include/pager.h
@@ -29,6 +29,8 @@ namespace Core {
 	struct Pager_entrypoint;
 
 	using Pager_capability = Capability<Pager_object>;
+
+	extern void init_page_fault_handling(Rpc_entrypoint &);
 }
 
 
diff --git a/repos/base-linux/src/core/include/platform_thread.h b/repos/base-linux/src/core/include/platform_thread.h
index c9f2f7e78d..c8c072055d 100644
--- a/repos/base-linux/src/core/include/platform_thread.h
+++ b/repos/base-linux/src/core/include/platform_thread.h
@@ -69,7 +69,8 @@ class Core::Platform_thread : Noncopyable
 		/**
 		 * Constructor
 		 */
-		Platform_thread(Platform_pd &, size_t, auto const &name, auto...)
+		Platform_thread(Platform_pd &, Rpc_entrypoint &, Ram_allocator &, Region_map &,
+		                size_t, auto const &name, auto...)
 		: _name(name) { }
 
 		/**
diff --git a/repos/base-linux/src/core/platform.cc b/repos/base-linux/src/core/platform.cc
index 12c7849a1b..8f47817235 100644
--- a/repos/base-linux/src/core/platform.cc
+++ b/repos/base-linux/src/core/platform.cc
@@ -160,25 +160,48 @@ void Core::Platform::wait_for_exit()
 }
 
 
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
+
+
 /*********************************
  ** Support for Region_map_mmap **
  *********************************/
 
+static Rpc_entrypoint *_core_ep_ptr;
+
+
+void Core_region_map::init(Rpc_entrypoint &ep) { _core_ep_ptr = &ep; }
+
+
+static auto with_linux_dataspace(Capability<Dataspace> ds,
+                                 auto const &fn, auto const &missing_fn) -> decltype(missing_fn())
+{
+	if (!_core_ep_ptr)
+		error("missing call of Core_region_map::init");
+
+	Capability<Linux_dataspace> lx_ds = static_cap_cast<Linux_dataspace>(ds);
+
+	if (_core_ep_ptr)
+		return _core_ep_ptr->apply(lx_ds, [&] (Linux_dataspace *ds_ptr) {
+			return ds_ptr ? fn(*ds_ptr) : missing_fn(); });
+
+	return missing_fn();
+}
+
+
 size_t Region_map_mmap::_dataspace_size(Capability<Dataspace> ds_cap)
 {
 	if (!ds_cap.valid())
 		return Local_capability<Dataspace>::deref(ds_cap)->size();
 
-	/* use local function call if called from the entrypoint */
-	return core_env().entrypoint().apply(ds_cap, [] (Dataspace *ds) {
-		return ds ? ds->size() : 0; });
+	return with_linux_dataspace(ds_cap,
+		[&] (Linux_dataspace &ds) -> size_t { return ds.size(); },
+		[&] () /* missing */      -> size_t { return 0; });
 }
 
 
 int Region_map_mmap::_dataspace_fd(Capability<Dataspace> ds_cap)
 {
-	Capability<Linux_dataspace> lx_ds_cap = static_cap_cast<Linux_dataspace>(ds_cap);
-
 	/*
 	 * Return a duplicate of the dataspace file descriptor, which will be freed
 	 * immediately after mmap'ing the file (see 'Region_map_mmap').
@@ -188,13 +211,19 @@ int Region_map_mmap::_dataspace_fd(Capability<Dataspace> ds_cap)
 	 * socket descriptor during the RPC handling). When later destroying the
 	 * dataspace, the descriptor would unexpectedly be closed again.
 	 */
-	return core_env().entrypoint().apply(lx_ds_cap, [] (Linux_dataspace *ds) {
-		return ds ? lx_dup(Capability_space::ipc_cap_data(ds->fd()).dst.socket.value) : -1; });
+
+	return with_linux_dataspace(ds_cap,
+		[&] (Linux_dataspace &ds)
+		{
+			return lx_dup(Capability_space::ipc_cap_data(ds.fd()).dst.socket.value);
+		},
+		[&] /* missing */ { return -1; });
 }
 
 
 bool Region_map_mmap::_dataspace_writeable(Dataspace_capability ds_cap)
 {
-	return core_env().entrypoint().apply(ds_cap, [] (Dataspace *ds) {
-		return ds ? ds->writeable() : false; });
+	return with_linux_dataspace(ds_cap,
+		[&] (Linux_dataspace &ds) { return ds.writeable(); },
+		[&] /* missing */         { return false; });
 }
diff --git a/repos/base-nova/src/core/include/pager.h b/repos/base-nova/src/core/include/pager.h
index 19cc38baec..5a07f48b1d 100644
--- a/repos/base-nova/src/core/include/pager.h
+++ b/repos/base-nova/src/core/include/pager.h
@@ -36,6 +36,8 @@ namespace Core {
 	class Exception_handlers;
 
 	using Pager_capability = Capability<Pager_object>;
+
+	extern void init_page_fault_handling(Rpc_entrypoint &);
 }
 
 
diff --git a/repos/base-nova/src/core/include/platform_thread.h b/repos/base-nova/src/core/include/platform_thread.h
index 2d0bb4ae41..49428a89b8 100644
--- a/repos/base-nova/src/core/include/platform_thread.h
+++ b/repos/base-nova/src/core/include/platform_thread.h
@@ -93,10 +93,9 @@ class Core::Platform_thread
 		/**
 		 * Constructor
 		 */
-		Platform_thread(Platform_pd &, size_t quota, char const *name,
-		                unsigned priority,
-		                Affinity::Location affinity,
-		                addr_t utcb);
+		Platform_thread(Platform_pd &, Rpc_entrypoint &, Ram_allocator &, Region_map &,
+		                size_t quota, char const *name, unsigned priority,
+		                Affinity::Location affinity, addr_t utcb);
 
 		/**
 		 * Destructor
diff --git a/repos/base-nova/src/core/pager.cc b/repos/base-nova/src/core/pager.cc
index aa2039173f..5024229a9d 100644
--- a/repos/base-nova/src/core/pager.cc
+++ b/repos/base-nova/src/core/pager.cc
@@ -38,6 +38,11 @@ using namespace Core;
 using namespace Nova;
 
 
+static Rpc_entrypoint *_core_ep_ptr;
+
+void Core::init_page_fault_handling(Rpc_entrypoint &ep) { _core_ep_ptr = &ep; }
+
+
 /**
  * Pager threads - one thread per CPU
  */
@@ -397,9 +402,8 @@ void Pager_object::_invoke_handler(Pager_object &obj)
 		Nova::Crd const cap(item.crd);
 
 		/* valid item which got translated ? */
-		if (!cap.is_null() && !item.is_del()) {
-			Rpc_entrypoint &e = core_env().entrypoint();
-			e.apply(cap.base(),
+		if (!cap.is_null() && !item.is_del() && _core_ep_ptr) {
+			_core_ep_ptr->apply(cap.base(),
 				[&] (Cpu_thread_component *source) {
 					if (!source)
 						return;
diff --git a/repos/base-nova/src/core/platform_thread.cc b/repos/base-nova/src/core/platform_thread.cc
index 5175812aae..e367f7741c 100644
--- a/repos/base-nova/src/core/platform_thread.cc
+++ b/repos/base-nova/src/core/platform_thread.cc
@@ -343,7 +343,8 @@ void Platform_thread::thread_type(Cpu_session::Native_cpu::Thread_type thread_ty
 }
 
 
-Platform_thread::Platform_thread(Platform_pd &pd, size_t, const char *name,
+Platform_thread::Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+                                 Region_map &, size_t, const char *name,
                                  unsigned prio, Affinity::Location affinity, addr_t)
 :
 	_pd(pd), _pager(0), _id_base(cap_map().insert(2)),
diff --git a/repos/base-okl4/src/core/include/platform_thread.h b/repos/base-okl4/src/core/include/platform_thread.h
index b0a47f8982..e515e24ab8 100644
--- a/repos/base-okl4/src/core/include/platform_thread.h
+++ b/repos/base-okl4/src/core/include/platform_thread.h
@@ -42,14 +42,14 @@ class Core::Platform_thread
 
 		int _thread_id = THREAD_INVALID;    /* plain thread number */
 
-		Okl4::L4_ThreadId_t _l4_thread_id;  /* L4 thread ID */
+		Okl4::L4_ThreadId_t _l4_thread_id = Okl4::L4_nilthread;
 
 		char          _name[32];            /* thread name that will be
 		                                       registered at the kernel
 		                                       debugger */
 		Platform_pd  &_pd;
-		unsigned      _priority;            /* thread priority */
-		Pager_object *_pager;
+		unsigned      _priority = 0;        /* thread priority */
+		Pager_object *_pager = nullptr;
 
 		bool _bound_to_pd = false;
 
@@ -61,16 +61,24 @@ class Core::Platform_thread
 		/**
 		 * Constructor
 		 */
-		Platform_thread(Platform_pd &pd, size_t, const char *name,
-		                unsigned priority,
-		                Affinity::Location,
-		                addr_t utcb);
+		Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+		                Region_map &, size_t, const char *name,
+		                unsigned prio, Affinity::Location, addr_t)
+		:
+			_pd(pd), _priority(prio)
+		{
+			copy_cstring(_name, name, sizeof(_name));
+			_bound_to_pd = pd.bind_thread(*this);
+		}
 
 		/**
 		 * Constructor used for core-internal threads
 		 */
-		Platform_thread(Platform_pd &pd, char const *name)
-		: Platform_thread(pd, 0, name, 0, Affinity::Location(), 0) { }
+		Platform_thread(Platform_pd &pd, char const *name) : _pd(pd)
+		{
+			copy_cstring(_name, name, sizeof(_name));
+			_bound_to_pd = pd.bind_thread(*this);
+		}
 
 		/**
 		 * Destructor
diff --git a/repos/base-okl4/src/core/pager.cc b/repos/base-okl4/src/core/pager.cc
index f2549d8b68..148bb1003c 100644
--- a/repos/base-okl4/src/core/pager.cc
+++ b/repos/base-okl4/src/core/pager.cc
@@ -146,3 +146,6 @@ Untyped_capability Pager_entrypoint::_pager_object_cap(unsigned long badge)
 {
 	return Capability_space::import(native_thread().l4id, Rpc_obj_key(badge));
 }
+
+
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
diff --git a/repos/base-okl4/src/core/platform_thread.cc b/repos/base-okl4/src/core/platform_thread.cc
index c95ac8b6df..7ea322e69e 100644
--- a/repos/base-okl4/src/core/platform_thread.cc
+++ b/repos/base-okl4/src/core/platform_thread.cc
@@ -139,17 +139,6 @@ unsigned long Platform_thread::pager_object_badge() const
 }
 
 
-Platform_thread::Platform_thread(Platform_pd &pd, size_t, const char *name,
-                                 unsigned prio, Affinity::Location, addr_t)
-:
-	_l4_thread_id(L4_nilthread), _pd(pd), _priority(prio), _pager(0)
-{
-	copy_cstring(_name, name, sizeof(_name));
-
-	_bound_to_pd = pd.bind_thread(*this);
-}
-
-
 Platform_thread::~Platform_thread()
 {
 	/*
diff --git a/repos/base-okl4/src/core/thread_start.cc b/repos/base-okl4/src/core/thread_start.cc
index c37fc08f3b..ec27f499e1 100644
--- a/repos/base-okl4/src/core/thread_start.cc
+++ b/repos/base-okl4/src/core/thread_start.cc
@@ -20,7 +20,6 @@
 
 /* core includes */
 #include <platform.h>
-#include <core_env.h>
 
 using namespace Genode;
 
diff --git a/repos/base-pistachio/src/core/include/platform_thread.h b/repos/base-pistachio/src/core/include/platform_thread.h
index 98f241d177..0b3a27cfa6 100644
--- a/repos/base-pistachio/src/core/include/platform_thread.h
+++ b/repos/base-pistachio/src/core/include/platform_thread.h
@@ -86,7 +86,8 @@ class Core::Platform_thread : Interface
 		/**
 		 * Constructor
 		 */
-		Platform_thread(Platform_pd &pd, size_t, char const *name, unsigned priority,
+		Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+		                Region_map &, size_t, char const *name, unsigned priority,
 		                Affinity::Location location, addr_t)
 		:
 			_name(name), _pd(pd), _priority(priority), _location(location)
diff --git a/repos/base-pistachio/src/core/pager.cc b/repos/base-pistachio/src/core/pager.cc
index 636417bd1b..1fd1bb210b 100644
--- a/repos/base-pistachio/src/core/pager.cc
+++ b/repos/base-pistachio/src/core/pager.cc
@@ -132,3 +132,6 @@ Untyped_capability Pager_entrypoint::_pager_object_cap(unsigned long badge)
 {
 	return Capability_space::import(native_thread().l4id, Rpc_obj_key(badge));
 }
+
+
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
diff --git a/repos/base-pistachio/src/core/thread_start.cc b/repos/base-pistachio/src/core/thread_start.cc
index d31662b446..6232548265 100644
--- a/repos/base-pistachio/src/core/thread_start.cc
+++ b/repos/base-pistachio/src/core/thread_start.cc
@@ -18,7 +18,6 @@
 /* core includes */
 #include <platform.h>
 #include <platform_thread.h>
-#include <core_env.h>
 
 /* base-internal includes */
 #include <base/internal/stack.h>
diff --git a/repos/base-sel4/src/core/include/pager.h b/repos/base-sel4/src/core/include/pager.h
index 3c90bc8f19..5dd2dff1a6 100644
--- a/repos/base-sel4/src/core/include/pager.h
+++ b/repos/base-sel4/src/core/include/pager.h
@@ -46,6 +46,8 @@ namespace Core {
 	using Pager_capability = Capability<Pager_object>;
 
 	enum { PAGER_EP_STACK_SIZE = sizeof(addr_t) * 2048 };
+
+	extern void init_page_fault_handling(Rpc_entrypoint &);
 }
 
 
diff --git a/repos/base-sel4/src/core/include/platform_thread.h b/repos/base-sel4/src/core/include/platform_thread.h
index 447ac953a2..d6416451d3 100644
--- a/repos/base-sel4/src/core/include/platform_thread.h
+++ b/repos/base-sel4/src/core/include/platform_thread.h
@@ -88,7 +88,8 @@ class Core::Platform_thread : public List<Platform_thread>::Element
 		/**
 		 * Constructor
 		 */
-		Platform_thread(Platform_pd &pd, size_t, const char *name, unsigned priority,
+		Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+		                Region_map &, size_t, const char *name, unsigned priority,
 		                Affinity::Location, addr_t utcb);
 
 		/**
diff --git a/repos/base-sel4/src/core/include/vm_session_component.h b/repos/base-sel4/src/core/include/vm_session_component.h
index 66828e6ea6..c1046fdd60 100644
--- a/repos/base-sel4/src/core/include/vm_session_component.h
+++ b/repos/base-sel4/src/core/include/vm_session_component.h
@@ -16,9 +16,11 @@
 
 /* Genode includes */
 #include <base/rpc_server.h>
+#include <base/registry.h>
 #include <vm_session/vm_session.h>
 
 /* core includes */
+#include <region_map_component.h>
 #include <trace/source_registry.h>
 #include <sel4_native_vcpu/sel4_native_vcpu.h>
 
diff --git a/repos/base-sel4/src/core/pager.cc b/repos/base-sel4/src/core/pager.cc
index 36f3313c8c..f2eded3b7c 100644
--- a/repos/base-sel4/src/core/pager.cc
+++ b/repos/base-sel4/src/core/pager.cc
@@ -31,6 +31,9 @@ using namespace Core;
 void Mapping::prepare_map_operation() const { }
 
 
+void Core::init_page_fault_handling(Rpc_entrypoint &) { }
+
+
 /***************
  ** IPC pager **
  ***************/
diff --git a/repos/base-sel4/src/core/platform_thread.cc b/repos/base-sel4/src/core/platform_thread.cc
index 6b97b81bd4..ecb302ba1d 100644
--- a/repos/base-sel4/src/core/platform_thread.cc
+++ b/repos/base-sel4/src/core/platform_thread.cc
@@ -209,7 +209,8 @@ bool Platform_thread::install_mapping(Mapping const &mapping)
 }
 
 
-Platform_thread::Platform_thread(Platform_pd &pd, size_t, const char *name,
+Platform_thread::Platform_thread(Platform_pd &pd, Rpc_entrypoint &, Ram_allocator &,
+                                 Region_map &, size_t, const char *name,
                                  unsigned priority, Affinity::Location location,
                                  addr_t utcb)
 :
diff --git a/repos/base-sel4/src/core/spec/x86/vm_session_component.cc b/repos/base-sel4/src/core/spec/x86/vm_session_component.cc
index 510f59cd1f..f703de8aff 100644
--- a/repos/base-sel4/src/core/spec/x86/vm_session_component.cc
+++ b/repos/base-sel4/src/core/spec/x86/vm_session_component.cc
@@ -16,7 +16,6 @@
 #include <cpu/vcpu_state.h>
 
 /* core includes */
-#include <core_env.h>
 #include <vm_session_component.h>
 #include <pd_session_component.h>
 #include <cpu_thread_component.h>
diff --git a/repos/base/src/core/cpu_session_component.cc b/repos/base/src/core/cpu_session_component.cc
index e00093ea92..edcb431d79 100644
--- a/repos/base/src/core/cpu_session_component.cc
+++ b/repos/base/src/core/cpu_session_component.cc
@@ -62,9 +62,9 @@ Cpu_session_component::create_thread(Capability<Pd_session> pd_cap,
 				try {
 					Cpu_thread_component &thread = *new (&_thread_alloc)
 						Cpu_thread_component(
-							cap(), *this, _thread_ep, _pager_ep, *pd, platform_pd,
-							pd_threads, _trace_control_area, _trace_sources,
-							weight, _weight_to_quota(weight.value),
+							cap(), *this, _thread_ep, _local_rm, _pager_ep,
+							*pd, _ram_alloc, platform_pd, pd_threads, _trace_control_area,
+							_trace_sources, weight, _weight_to_quota(weight.value),
 							_thread_affinity(affinity), _label, name,
 							_priority, utcb);
 
@@ -261,6 +261,7 @@ Cpu_session_component::Cpu_session_component(Rpc_entrypoint         &session_ep,
 :
 	Session_object(session_ep, resources, label, diag),
 	_session_ep(session_ep), _thread_ep(thread_ep), _pager_ep(pager_ep),
+	_local_rm(local_rm),
 	_ram_alloc(ram_alloc, _ram_quota_guard(), _cap_quota_guard()),
 	_md_alloc(_ram_alloc, local_rm),
 	_thread_alloc(_md_alloc), _priority(0),
diff --git a/repos/base/src/core/include/cpu_session_component.h b/repos/base/src/core/include/cpu_session_component.h
index 78559171e2..0b0cf54daf 100644
--- a/repos/base/src/core/include/cpu_session_component.h
+++ b/repos/base/src/core/include/cpu_session_component.h
@@ -43,6 +43,7 @@ class Core::Cpu_session_component : public  Session_object<Cpu_session>,
 		Rpc_entrypoint            &_session_ep;
 		Rpc_entrypoint            &_thread_ep;
 		Pager_entrypoint          &_pager_ep;
+		Region_map                &_local_rm;
 		Constrained_ram_allocator  _ram_alloc;
 		Sliced_heap                _md_alloc;               /* guarded meta-data allocator */
 		Cpu_thread_allocator       _thread_alloc;           /* meta-data allocator */
diff --git a/repos/base/src/core/include/cpu_thread_component.h b/repos/base/src/core/include/cpu_thread_component.h
index 626f222464..1850e32175 100644
--- a/repos/base/src/core/include/cpu_thread_component.h
+++ b/repos/base/src/core/include/cpu_thread_component.h
@@ -141,8 +141,10 @@ class Core::Cpu_thread_component : public  Rpc_object<Cpu_thread>,
 		Cpu_thread_component(Cpu_session_capability     cpu_session_cap,
 		                     Cpu_session_component     &cpu,
 		                     Rpc_entrypoint            &ep,
+		                     Region_map                &core_rm,
 		                     Pager_entrypoint          &pager_ep,
 		                     Pd_session_component      &pd,
+		                     Ram_allocator             &cpu_ram,
 		                     Platform_pd               &platform_pd,
 		                     Pd_threads                &pd_threads,
 		                     Trace::Control_area       &trace_control_area,
@@ -160,7 +162,8 @@ class Core::Cpu_thread_component : public  Rpc_object<Cpu_thread>,
 			_weight(weight),
 			_session_label(label), _name(name),
 			_pd_element(pd_threads, *this),
-			_platform_thread(platform_pd, quota, name.string(), priority, location, utcb),
+			_platform_thread(platform_pd, ep, cpu_ram, core_rm, quota, name.string(),
+			                 priority, location, utcb),
 			_trace_control_slot(trace_control_area),
 			_trace_sources(trace_sources),
 			_managed_thread_cap(_ep, *this),
diff --git a/repos/base/src/core/include/pager.h b/repos/base/src/core/include/pager.h
index 925c099d38..2322a0ce0a 100644
--- a/repos/base/src/core/include/pager.h
+++ b/repos/base/src/core/include/pager.h
@@ -47,6 +47,8 @@ namespace Core {
 	using Pager_capability = Capability<Pager_object>;
 
 	enum { PAGER_EP_STACK_SIZE = sizeof(addr_t) * 2048 };
+
+	extern void init_page_fault_handling(Rpc_entrypoint &);
 }
 
 
diff --git a/repos/base/src/core/main.cc b/repos/base/src/core/main.cc
index 66064508dd..0a44468599 100644
--- a/repos/base/src/core/main.cc
+++ b/repos/base/src/core/main.cc
@@ -39,6 +39,7 @@
 #include <irq_root.h>
 #include <trace/root.h>
 #include <platform_services.h>
+#include <pager.h>
 
 using namespace Core;
 
@@ -228,6 +229,7 @@ namespace Genode {
 void Genode::bootstrap_component(Genode::Platform &)
 {
 	init_exception_handling(*core_env().pd_session(), core_env().local_rm());
+	init_page_fault_handling(core_env().entrypoint());
 
 	/* disable tracing within core because it is not fully implemented */
 	inhibit_tracing = true;
diff --git a/repos/base/src/core/signal_transmitter_noinit.cc b/repos/base/src/core/signal_transmitter_noinit.cc
index 62ba8f6342..44b16eb921 100644
--- a/repos/base/src/core/signal_transmitter_noinit.cc
+++ b/repos/base/src/core/signal_transmitter_noinit.cc
@@ -23,4 +23,5 @@ using namespace Core;
 
 void Core::init_core_signal_transmitter(Rpc_entrypoint &) { }
 
+
 Rpc_entrypoint &Core_env::signal_ep() { return _entrypoint; }
diff --git a/repos/libports/recipes/pkg/test-pthread/runtime b/repos/libports/recipes/pkg/test-pthread/runtime
index 1c2a9a8283..1e3ba85f3c 100644
--- a/repos/libports/recipes/pkg/test-pthread/runtime
+++ b/repos/libports/recipes/pkg/test-pthread/runtime
@@ -27,7 +27,7 @@
 		<default-route>
 			<any-service> <parent/> <any-child/> </any-service>
 		</default-route>
-		<start name="test-pthread" caps="200">
+		<start name="test-pthread" caps="600">
 			<resource name="RAM" quantum="64M"/>
 			<config>
 				<vfs> <dir name="dev"> <log/> </dir> </vfs>