elf_greg_t sar;
        elf_greg_t windowstart;
        elf_greg_t windowbase;
-       elf_greg_t reserved[8+48];
+       elf_greg_t threadptr;
+       elf_greg_t reserved[7+48];
        elf_greg_t a[64];
 } xtensa_gregset_t;
 
 
        unsigned long syscall;          /*  56 */
        unsigned long icountlevel;      /*  60 */
        unsigned long scompare1;        /*  64 */
+       unsigned long threadptr;        /*  68 */
 
        /* Additional configurable registers that are used by the compiler. */
        xtregs_opt_t xtregs_opt;
        /* current register frame.
         * Note: The ESF for kernel exceptions ends after 16 registers!
         */
-       unsigned long areg[16];         /* 128 (64) */
+       unsigned long areg[16];
 };
 
 #include <variant/core.h>
 
        DEFINE(PT_ICOUNTLEVEL, offsetof (struct pt_regs, icountlevel));
        DEFINE(PT_SYSCALL, offsetof (struct pt_regs, syscall));
        DEFINE(PT_SCOMPARE1, offsetof(struct pt_regs, scompare1));
+       DEFINE(PT_THREADPTR, offsetof(struct pt_regs, threadptr));
        DEFINE(PT_AREG, offsetof (struct pt_regs, areg[0]));
        DEFINE(PT_AREG0, offsetof (struct pt_regs, areg[0]));
        DEFINE(PT_AREG1, offsetof (struct pt_regs, areg[1]));
 
        s32i    a3, a1, PT_SAR
        s32i    a2, a1, PT_ICOUNTLEVEL
 
+#if XCHAL_HAVE_THREADPTR
+       rur     a2, threadptr
+       s32i    a2, a1, PT_THREADPTR
+#endif
+
        /* Rotate ws so that the current windowbase is at bit0. */
        /* Assume ws = xxwww1yyyy. Rotate ws right, so that a2 = yyyyxxwww1 */
 
         *       (if we have restored WSBITS-1 frames).
         */
 
+#if XCHAL_HAVE_THREADPTR
+       l32i    a3, a1, PT_THREADPTR
+       wur     a3, threadptr
+#endif
+
 2:     j       common_exception_exit
 
        /* This is the kernel exception exit.
        s32i    a6, a3, EXC_TABLE_FIXUP
        s32i    a7, a3, EXC_TABLE_KSTK
 
-       /* restore context of the task that 'next' addresses */
+       /* restore context of the task 'next' */
 
        l32i    a0, a13, THREAD_RA      # restore return address
        l32i    a1, a13, THREAD_SP      # restore stack pointer
 
                        memcpy(&childregs->areg[XCHAL_NUM_AREGS - len/4],
                               ®s->areg[XCHAL_NUM_AREGS - len/4], len);
                }
-// FIXME: we need to set THREADPTR in thread_info...
+
+               /* The thread pointer is passed in the '4th argument' (= a5) */
                if (clone_flags & CLONE_SETTLS)
-                       childregs->areg[2] = childregs->areg[6];
+                       childregs->threadptr = childregs->areg[5];
        } else {
                p->thread.ra = MAKE_RA_FOR_CALL(
                                (unsigned long)ret_from_kernel_thread, 1);
 
        __put_user(regs->lcount, &gregset->lcount);
        __put_user(regs->windowstart, &gregset->windowstart);
        __put_user(regs->windowbase, &gregset->windowbase);
+       __put_user(regs->threadptr, &gregset->threadptr);
 
        for (i = 0; i < XCHAL_NUM_AREGS; i++)
                __put_user(regs->areg[i],
        __get_user(regs->lcount, &gregset->lcount);
        __get_user(ws, &gregset->windowstart);
        __get_user(wb, &gregset->windowbase);
+       __get_user(regs->threadptr, &gregset->threadptr);
 
        regs->ps = (regs->ps & ~ps_mask) | (ps & ps_mask) | (1 << PS_EXCM_BIT);
 
 
        struct rt_sigframe *frame;
        int err = 0;
        int signal;
-       unsigned long sp, ra;
+       unsigned long sp, ra, tp;
 
        sp = regs->areg[1];
 
         * Return context not modified until this point.
         */
 
-       /* Set up registers for signal handler */
+       /* Set up registers for signal handler; preserve the threadptr */
+       tp = regs->threadptr;
        start_thread(regs, (unsigned long) ka->sa.sa_handler,
                     (unsigned long) frame);
 
        regs->areg[6] = (unsigned long) signal;
        regs->areg[7] = (unsigned long) &frame->info;
        regs->areg[8] = (unsigned long) &frame->uc;
+       regs->threadptr = tp;
 
        /* Set access mode to USER_DS.  Nomenclature is outdated, but
         * functionality is used in uaccess.h