diff --git a/thermosphere/src/asm_macros.s b/thermosphere/src/asm_macros.s
index bd605d5bd..356b69170 100644
--- a/thermosphere/src/asm_macros.s
+++ b/thermosphere/src/asm_macros.s
@@ -16,11 +16,6 @@
 
 #define EXCEP_STACK_FRAME_SIZE      0x140
 
-#define CORECTX_CRASH_STACK_OFFSET  0x000
-#define CORECTX_GUEST_FRAME_OFFSET  0x040
-#define CORECTX_SCRATCH_OFFSET      0x048
-
-
 .macro FUNCTION name
     .section        .text.\name, "ax", %progbits
     .global         \name
diff --git a/thermosphere/src/core_ctx.h b/thermosphere/src/core_ctx.h
index 09e8e4cd6..54a3120ff 100644
--- a/thermosphere/src/core_ctx.h
+++ b/thermosphere/src/core_ctx.h
@@ -23,11 +23,9 @@ struct ExceptionStackFrame;
 typedef struct ALIGN(64) CoreCtx {
     // Most likely only just read (assume cache line size of at most 64 bytes):
 
-    u8 *crashStack;                                         // @0x00
     u64 kernelArgument;                                     // @0x08
     uintptr_t kernelEntrypoint;                             // @0x10
     u32 coreId;                                             // @0x18
-    u8 gicInterfaceMask;                                    // @0x1C. Equal to BIT(coreId) anyway
     bool isBootCore;                                        // @0x1D
     bool warmboot;                                          // @0x1E
 
@@ -39,14 +37,10 @@ typedef struct ALIGN(64) CoreCtx {
     // Most likely written to:
 
     ALIGN(64) struct ExceptionStackFrame *guestFrame;       // @0x40
-    u64 scratch;                                            // @0x48
 
     // Timer stuff
     u64 totalTimeInHypervisor;                              // @0x50. cntvoff_el2 is updated to that value.
     u64 emulPtimerCval;                                     // @0x58. When setting cntp_cval_el0 and on interrupt
-
-    // Cache stuff
-    u32 setWayCounter;                                      // @0x7C
 } CoreCtx;
 
 /*static_assert(offsetof(CoreCtx, warmboot) == 0x1E, "Wrong definition for CoreCtx");
diff --git a/thermosphere/src/exception_vectors.s b/thermosphere/src/exception_vectors.s
index 5572a2393..19e1618d0 100644
--- a/thermosphere/src/exception_vectors.s
+++ b/thermosphere/src/exception_vectors.s
@@ -78,14 +78,16 @@
 .endm
 
 .macro PIVOT_STACK_FOR_CRASH
-    // Note: x18 assumed uncorrupted
-    // Note: replace sp_el0 with crashing sp
-    str     x16, [x18, #CORECTX_SCRATCH_OFFSET]
-    mov     x16, sp
-    msr     sp_el0, x16
-    ldr     x16, [x18, #CORECTX_CRASH_STACK_OFFSET]
-    mov     sp, x16
-    ldr     x16, [x18, #CORECTX_SCRATCH_OFFSET]
+    // Note: replace sp_el1 with crashing sp (for convenience)
+    // The way we do things means that exception stack ptr won't be reset on double fault
+    // (sp_el2 is not accessible at el2)
+    msr     spsel, #0
+    str     x0, [sp, #-0x10]
+    msr     spsel, #1
+    mov     x0, sp
+    msr     sp_el1, x0
+    msr     spsel, #0
+    ldr     x0, [sp, #-0x10]
 .endm
 
 #define     EXCEPTION_TYPE_HOST            0
@@ -103,10 +105,10 @@ vector_entry \name
     mov         x0, sp
 
     .if \type == EXCEPTION_TYPE_GUEST
-        ldp     x18, xzr, [sp, #EXCEP_STACK_FRAME_SIZE]
-        prfm    pldl1keep, [x18]
-        prfm    pstl1keep, [x18, #0x40]
-        str     x0, [x18, #CORECTX_GUEST_FRAME_OFFSET]
+        ldp     x18, x19, [sp, #EXCEP_STACK_FRAME_SIZE]
+        msr     sp_el0, x19
+        prfm    pstl1keep, [x18]
+        //todo str     x0, [x18, #CORECTX_GUEST_FRAME_OFFSET]
         mov     w1, #1
     .else
         mov     w1, #0
@@ -148,7 +150,7 @@ vector_entry        _synchSp0
 check_vector_size   _synchSp0
 
 _unknownException:
-    pivot_stack_for_crash
+    PIVOT_STACK_FOR_CRASH
     mov     x0, x30
     adr     x1, g_thermosphereVectors + 4
     sub     x0, x0, x1
diff --git a/thermosphere/src/start.s b/thermosphere/src/start.s
index da2184096..b276b23ae 100644
--- a/thermosphere/src/start.s
+++ b/thermosphere/src/start.s
@@ -94,16 +94,16 @@ _postMmuEnableReturnAddr:
     bl      initSystem
 
     // Save x18, reserve space for exception frame
+    // TODO: save exception stack too
     stp     x18, xzr, [sp, #-0x10]!
     sub     sp, sp, #EXCEP_STACK_FRAME_SIZE
 
     mov     x0, sp
     mov     x1, x20
-    str     x0, [x18, #CORECTX_GUEST_FRAME_OFFSET]
+    //str     x0, [x18, #CORECTX_GUEST_FRAME_OFFSET]
     bl      thermosphereMain
 
-    prfm    pldl1keep, [x18]
-    prfm    pstl1keep, [x18, #0x40]
+    prfm    pstl1keep, [x18]
 
     dsb     sy
     isb