Index: qemu/linux-user/main.c
===================================================================
--- qemu.orig/linux-user/main.c	2007-06-29 10:47:58.000000000 +0000
+++ qemu/linux-user/main.c	2007-06-29 10:47:58.000000000 +0000
@@ -156,7 +156,7 @@
     p[1] = tswapl(e2);
 }
 
-uint64_t gdt_table[6];
+uint64_t gdt_table[9];
 uint64_t idt_table[256];
 
 /* only dpl matters as we do only user space emulation */
@@ -1768,7 +1768,11 @@
     int optind;
     const char *r;
     int gdbstub_port = 0;
-    
+    char *assume_kernel = getenv("QEMU_ASSUME_KERNEL");
+
+    if (assume_kernel)
+       setenv("LD_ASSUME_KERNEL", assume_kernel, 1);
+
     if (argc <= 1)
         usage();
 
Index: qemu/linux-user/syscall.c
===================================================================
--- qemu.orig/linux-user/syscall.c	2007-06-29 10:47:58.000000000 +0000
+++ qemu/linux-user/syscall.c	2007-06-29 10:53:44.000000000 +0000
@@ -60,6 +60,7 @@
 #define tchars host_tchars /* same as target */
 #define ltchars host_ltchars /* same as target */
 
+#include <linux/futex.h>
 #include <linux/termios.h>
 #include <linux/unistd.h>
 #include <linux/utsname.h>
@@ -2122,6 +2123,80 @@
     return ret;
 }
 
+int do_set_thread_area(CPUX86State *env, target_ulong ptr)
+{
+    uint64_t *gdt_table = g2h(env->gdt.base);
+    struct target_modify_ldt_ldt_s ldt_info;
+    struct target_modify_ldt_ldt_s *target_ldt_info;
+    int seg_32bit, contents, read_exec_only, limit_in_pages;
+    int seg_not_present, useable;
+    uint32_t *lp, entry_1, entry_2;
+    int i;
+
+    lock_user_struct(target_ldt_info, ptr, 1);
+    ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
+    ldt_info.base_addr = tswapl(target_ldt_info->base_addr);
+    ldt_info.limit = tswap32(target_ldt_info->limit);
+    ldt_info.flags = tswap32(target_ldt_info->flags);
+    if (ldt_info.entry_number == -1) {
+           for (i=6; i<8; i++)
+                   if (gdt_table[i] == 0) {
+                           ldt_info.entry_number = i;
+                           target_ldt_info->entry_number = tswap32(i);
+                           break;
+                   }
+    }
+    unlock_user_struct(target_ldt_info, ptr, 0);
+    
+    if (ldt_info.entry_number < 6 || ldt_info.entry_number > 8)
+           return -EINVAL;
+    seg_32bit = ldt_info.flags & 1;
+    contents = (ldt_info.flags >> 1) & 3;
+    read_exec_only = (ldt_info.flags >> 3) & 1;
+    limit_in_pages = (ldt_info.flags >> 4) & 1;
+    seg_not_present = (ldt_info.flags >> 5) & 1;
+    useable = (ldt_info.flags >> 6) & 1;
+
+    if (contents == 3) {
+        if (seg_not_present == 0)
+            return -EINVAL;
+    }
+
+    /* NOTE: same code as Linux kernel */
+    /* Allow LDTs to be cleared by the user. */
+    if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
+        if ((contents == 0             &&
+             read_exec_only == 1       &&
+             seg_32bit == 0            &&
+             limit_in_pages == 0       &&
+             seg_not_present == 1      &&
+             useable == 0 )) {
+            entry_1 = 0;
+            entry_2 = 0;
+            goto install;
+        }
+    }
+    
+    entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
+        (ldt_info.limit & 0x0ffff);
+    entry_2 = (ldt_info.base_addr & 0xff000000) |
+        ((ldt_info.base_addr & 0x00ff0000) >> 16) |
+        (ldt_info.limit & 0xf0000) |
+        ((read_exec_only ^ 1) << 9) |
+        (contents << 10) |
+        ((seg_not_present ^ 1) << 15) |
+        (seg_32bit << 22) |
+        (limit_in_pages << 23) |
+       (useable << 20) |
+       0x7000;
+
+    /* Install the new entry ...  */
+install:
+    lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
+    lp[0] = tswap32(entry_1);
+    lp[1] = tswap32(entry_2);
+    return 0;
+}
 #endif /* defined(TARGET_I386) */
 
 /* this stack is the equivalent of the kernel stack associated with a
@@ -2154,15 +2229,20 @@
     TaskState *ts;
     uint8_t *new_stack;
     CPUState *new_env;
+#if defined(TARGET_I386)
+       uint64_t *new_gdt_table;
+#endif
 #ifdef USE_NPTL
     unsigned int nptl_flags;
 
     if (flags & CLONE_PARENT_SETTID)
         *parent_tidptr = gettid();
 #endif
-    
+
     if (flags & CLONE_VM) {
         ts = malloc(sizeof(TaskState) + NEW_STACK_SIZE);
+               if (!ts)
+                       return -ENOMEM;
         memset(ts, 0, sizeof(TaskState));
         new_stack = ts->stack;
         ts->used = 1;
@@ -2174,6 +2254,29 @@
 #if defined(TARGET_I386)
         if (!newsp)
             newsp = env->regs[R_ESP];
+       new_gdt_table = malloc(9 * 8);
+       if (!new_gdt_table) {
+               free(new_env);
+               return -ENOMEM;
+       }
+       /* Copy main GDT table from parent, but clear TLS entries */
+       memcpy(new_gdt_table, g2h(env->gdt.base), 6 * 8);
+       memset(&new_gdt_table[6], 0, 3 * 8); 
+       new_env->gdt.base = h2g(new_gdt_table);
+       if (flags & 0x00080000 /* CLONE_SETTLS */) {
+               ret = do_set_thread_area(new_env, new_env->regs[R_ESI]);
+               if (ret) {
+                       free(new_gdt_table);
+                       free(new_env);
+                       return ret;
+               }
+       }
+       cpu_x86_load_seg(env, R_CS, new_env->regs[R_CS]);
+       cpu_x86_load_seg(env, R_DS, new_env->regs[R_DS]);
+       cpu_x86_load_seg(env, R_ES, new_env->regs[R_ES]);
+       cpu_x86_load_seg(env, R_SS, new_env->regs[R_SS]);
+       cpu_x86_load_seg(env, R_FS, new_env->regs[R_FS]);
+       cpu_x86_load_seg(env, R_GS, new_env->regs[R_GS]);
         new_env->regs[R_ESP] = newsp;
         new_env->regs[R_EAX] = 0;
 #elif defined(TARGET_ARM)
@@ -2517,6 +2620,68 @@
     unlock_user_struct(target_ts, target_addr, 1);
 }
 
+static long do_futex(target_ulong uaddr, int op, uint32_t val,
+                    target_ulong utime, target_ulong uaddr2,
+                    uint32_t val3)
+{
+       struct timespec host_utime;
+       unsigned long val2 = utime;
+
+       if (utime && (op == FUTEX_WAIT || op == FUTEX_LOCK_PI)) {
+               target_to_host_timespec(&host_utime, utime);
+               val2 = (unsigned long)&host_utime;
+       }
+ 
+#ifdef BSWAP_NEEDED
+       switch(op) {
+       case FUTEX_CMP_REQUEUE:
+               val3 = tswap32(val3);
+       case FUTEX_REQUEUE:
+               val2 = tswap32(val2);
+       case FUTEX_WAIT:
+       case FUTEX_WAKE:
+               val = tswap32(val);
+       case FUTEX_LOCK_PI: /* This one's icky, but comes out OK */
+       case FUTEX_UNLOCK_PI:
+               break;
+       default: 
+               gemu_log("qemu: Unsupported futex op %d\n", op);
+               return -ENOSYS;
+       } 
+#if 0 /* No, it's worse than this */
+       if (op == FUTEX_WAKE_OP) {
+               /* Need to munge the secondary operation (val3) */
+               val3 = tswap32(val3);
+               int op2 = (val3 >> 28) & 7;
+               int cmp = (val3 >> 24) & 15;
+               int oparg = (val3 << 8) >> 20;
+               int cmparg = (val3 << 20) >> 20;
+               int shift = val3 & (FUTEX_OP_OPARG_SHIFT << 28);
+
+               if (shift)
+                   oparg = (oparg & 7) + 24 - (oparg & 24);
+               else oparg = 
+               if (op2 == FUTEX_OP_ADD) {
+                       gemu_log("qemu: Unsupported wrong-endian FUTEX_OP_ADD\n");
+                       return -ENOSYS;
+               }
+               if (cmparg == FUTEX_OP_CMP_LT || cmparg == FUTEX_OP_CMP_GE ||
+                   cmparg == FUTEX_OP_CMP_LE || cmparg == FUTEX_OP_CMP_GT) {
+                       gemu_log("qemu: Unsupported wrong-endian futex cmparg %d\n", cmparg);
+                       return -ENOSYS;
+               }
+               val3 = shift | (op2<<28) | (cmp<<24) | (oparg<<12) | cmparg;
+       }
+#endif
+#endif
+       return syscall(__NR_futex, g2h(uaddr), op, val, val2, g2h(uaddr2), val3);
+}
+
+int do_set_tid_address(target_ulong tidptr)
+{
+       return syscall(__NR_set_tid_address, g2h(tidptr));
+}
+
 long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, 
                 long arg4, long arg5, long arg6)
 {
@@ -2534,7 +2699,7 @@
         _mcleanup();
 #endif
         gdb_exit(cpu_env, arg1);
-        /* XXX: should free thread stack and CPU env */
+        /* XXX: should free thread stack, GDT and CPU env */
         _exit(arg1);
         ret = 0; /* avoid warning */
         break;
@@ -4642,6 +4807,9 @@
       ((CPUMIPSState *) cpu_env)->tls_value = arg1;
       ret = 0;
       break;
+#elif TARGET_i386
+	  ret = get_errno(do_set_thread_area(cpu_env, arg1));
+	  break;
 #else
       goto unimplemented_nowarn;
 #endif
@@ -4655,6 +4823,21 @@
         goto unimplemented_nowarn;
 #endif
 
+#ifdef TARGET_NR_futex
+    case TARGET_NR_futex:
+       ret = get_errno(do_futex(arg1, arg2, arg3, arg4, arg5, arg6));
+       break;
+#endif
+#ifdef TARGET_NR_set_tid_address
+    case TARGET_NR_set_tid_address:
+        ret = get_errno(do_set_tid_address(arg1));
+       break;
+#endif
+#ifdef TARGET_NR_set_robust_list
+    case TARGET_NR_set_robust_list:
+           goto unimplemented_nowarn;
+#endif
+
 #ifdef TARGET_NR_clock_gettime
     case TARGET_NR_clock_gettime:
     {
@@ -4678,12 +4861,6 @@
     }
 #endif
 
-#if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
-    case TARGET_NR_set_tid_address:
-      ret = get_errno(set_tid_address((int *) arg1));
-      break;
-#endif
-
     default:
     unimplemented:
         gemu_log("qemu: Unsupported syscall: %d\n", num);
