merge of '0d9bd56d97ada159199c80422a743fbaa437a818'

     and '7c47cd537d8cebaa3111aa836db24534a39b5ed9'

27 files changed, 1900 insertions, 0 deletions

diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/.mtn2git_empty b/packages/qemu/qemu-0.9.0+cvs20071121/.mtn2git_empty
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/.mtn2git_empty
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/02_snapshot_use_tmpdir.patch b/packages/qemu/qemu-0.9.0+cvs20071121/02_snapshot_use_tmpdir.patch
new file mode 100644
index 0000000000..40264ed443
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/02_snapshot_use_tmpdir.patch
@@ -0,0 +1,23 @@
+#DPATCHLEVEL=0
+---
+# block.c |    6 +++++-
+# 1 file changed, 5 insertions(+), 1 deletion(-)
+#
+Index: block.c
+===================================================================
+--- block.c.orig	2007-12-03 23:47:25.000000000 +0000
++++ block.c	2007-12-03 23:47:31.000000000 +0000
+@@ -191,8 +191,12 @@ void get_tmp_filename(char *filename, in
+ void get_tmp_filename(char *filename, int size)
+ {
+     int fd;
++    char *tmpdir;
+     /* XXX: race condition possible */
+-    pstrcpy(filename, size, "/tmp/vl.XXXXXX");
++    tmpdir = getenv("TMPDIR");
++    if (!tmpdir)
++        tmpdir = "/tmp";
++    snprintf(filename, size, "%s/vl.XXXXXX", tmpdir);
+     fd = mkstemp(filename);
+     close(fd);
+ }
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/04_do_not_print_rtc_freq_if_ok.patch b/packages/qemu/qemu-0.9.0+cvs20071121/04_do_not_print_rtc_freq_if_ok.patch
new file mode 100644
index 0000000000..31c9da491d
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/04_do_not_print_rtc_freq_if_ok.patch
@@ -0,0 +1,26 @@
+#DPATCHLEVEL=1
+---
+# vl.c |    5 ++++-
+# 1 file changed, 4 insertions(+), 1 deletion(-)
+#
+Index: qemu/vl.c
+===================================================================
+--- qemu.orig/vl.c	2007-12-03 15:44:35.000000000 +0000
++++ qemu/vl.c	2007-12-03 15:51:03.000000000 +0000
+@@ -1289,12 +1289,15 @@ static void hpet_stop_timer(struct qemu_
+ 
+ static int rtc_start_timer(struct qemu_alarm_timer *t)
+ {
++    unsigned long current_rtc_freq = 0;
+     int rtc_fd;
+ 
+     TFR(rtc_fd = open("/dev/rtc", O_RDONLY));
+     if (rtc_fd < 0)
+         return -1;
+-    if (ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
++    ioctl(rtc_fd, RTC_IRQP_READ, &current_rtc_freq);
++    if (current_rtc_freq != RTC_FREQ &&
++        ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
+         fprintf(stderr, "Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\n"
+                 "error, but for better emulation accuracy either use a 2.6 host Linux kernel or\n"
+                 "type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\n");
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/05_non-fatal_if_linux_hd_missing.patch b/packages/qemu/qemu-0.9.0+cvs20071121/05_non-fatal_if_linux_hd_missing.patch
new file mode 100644
index 0000000000..fdd922605e
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/05_non-fatal_if_linux_hd_missing.patch
@@ -0,0 +1,17 @@
+#DPATCHLEVEL=1
+---
+# hw/pc.c |    1 -
+# 1 file changed, 1 deletion(-)
+#
+Index: qemu/hw/pc.c
+===================================================================
+--- qemu.orig/hw/pc.c	2007-12-03 23:47:25.000000000 +0000
++++ qemu/hw/pc.c	2007-12-03 23:47:38.000000000 +0000
+@@ -385,7 +385,6 @@ static void generate_bootsect(uint32_t g
+     if (bs_table[0] == NULL) {
+ 	fprintf(stderr, "A disk image must be given for 'hda' when booting "
+ 		"a Linux kernel\n");
+-	exit(1);
+     }
+ 
+     memset(bootsect, 0, sizeof(bootsect));
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/06_exit_segfault.patch b/packages/qemu/qemu-0.9.0+cvs20071121/06_exit_segfault.patch
new file mode 100644
index 0000000000..06123d0626
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/06_exit_segfault.patch
@@ -0,0 +1,45 @@
+#DPATCHLEVEL=0
+---
+# linux-user/main.c |    8 ++++----
+# 1 file changed, 4 insertions(+), 4 deletions(-)
+#
+Index: linux-user/main.c
+===================================================================
+--- linux-user/main.c.orig	2007-12-03 23:47:25.000000000 +0000
++++ linux-user/main.c	2007-12-03 23:47:41.000000000 +0000
+@@ -714,7 +714,7 @@ void cpu_loop (CPUSPARCState *env)
+         default:
+             printf ("Unhandled trap: 0x%x\n", trapnr);
+             cpu_dump_state(env, stderr, fprintf, 0);
+-            exit (1);
++            _exit (1);
+         }
+         process_pending_signals (env);
+     }
+@@ -1634,7 +1634,7 @@ void cpu_loop (CPUState *env)
+         default:
+             printf ("Unhandled trap: 0x%x\n", trapnr);
+             cpu_dump_state(env, stderr, fprintf, 0);
+-            exit (1);
++            _exit (1);
+         }
+         process_pending_signals (env);
+     }
+@@ -1954,7 +1954,7 @@ int main(int argc, char **argv)
+                 for(item = cpu_log_items; item->mask != 0; item++) {
+                     printf("%-10s %s\n", item->name, item->help);
+                 }
+-                exit(1);
++                _exit(1);
+             }
+             cpu_set_log(mask);
+         } else if (!strcmp(r, "s")) {
+@@ -1973,7 +1973,7 @@ int main(int argc, char **argv)
+             if (qemu_host_page_size == 0 ||
+                 (qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
+                 fprintf(stderr, "page size must be a power of two\n");
+-                exit(1);
++                _exit(1);
+             }
+         } else if (!strcmp(r, "g")) {
+             gdbstub_port = atoi(argv[optind++]);
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/10_signal_jobs.patch b/packages/qemu/qemu-0.9.0+cvs20071121/10_signal_jobs.patch
new file mode 100644
index 0000000000..34282adc9d
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/10_signal_jobs.patch
@@ -0,0 +1,26 @@
+#DPATCHLEVEL=0
+---
+# linux-user/signal.c |    7 ++++++-
+# 1 file changed, 6 insertions(+), 1 deletion(-)
+#
+Index: linux-user/signal.c
+===================================================================
+--- linux-user/signal.c.orig	2007-12-03 15:40:26.000000000 +0000
++++ linux-user/signal.c	2007-12-03 15:55:49.000000000 +0000
+@@ -364,10 +364,15 @@ int queue_signal(int sig, target_siginfo
+     k = &sigact_table[sig - 1];
+     handler = k->sa._sa_handler;
+     if (handler == TARGET_SIG_DFL) {
++        if (sig == TARGET_SIGTSTP || sig == TARGET_SIGTTIN || sig == TARGET_SIGTTOU) {
++            kill(getpid(),SIGSTOP);
++            return 0;
++        } else
+         /* default handler : ignore some signal. The other are fatal */
+         if (sig != TARGET_SIGCHLD &&
+             sig != TARGET_SIGURG &&
+-            sig != TARGET_SIGWINCH) {
++            sig != TARGET_SIGWINCH &&
++            sig != TARGET_SIGCONT) {
+             force_sig(sig);
+         } else {
+             return 0; /* indicate ignored */
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/11_signal_sigaction.patch b/packages/qemu/qemu-0.9.0+cvs20071121/11_signal_sigaction.patch
new file mode 100644
index 0000000000..33c5e8b12d
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/11_signal_sigaction.patch
@@ -0,0 +1,21 @@
+#DPATCHLEVEL=0
+---
+# linux-user/signal.c |    5 +++++
+# 1 file changed, 5 insertions(+)
+#
+Index: linux-user/signal.c
+===================================================================
+--- linux-user/signal.c.orig	2007-12-03 23:47:44.000000000 +0000
++++ linux-user/signal.c	2007-12-03 23:47:46.000000000 +0000
+@@ -512,6 +512,11 @@ int do_sigaction(int sig, const struct t
+ 
+     if (sig < 1 || sig > TARGET_NSIG || sig == SIGKILL || sig == SIGSTOP)
+         return -EINVAL;
++
++    /* no point doing the stuff as those are not allowed for sigaction */
++    if ((sig == TARGET_SIGKILL) || (sig == TARGET_SIGSTOP))
++        return -EINVAL;
++
+     k = &sigact_table[sig - 1];
+ #if defined(DEBUG_SIGNAL)
+     fprintf(stderr, "sigaction sig=%d act=0x%08x, oact=0x%08x\n",
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/22_net_tuntap_stall.patch b/packages/qemu/qemu-0.9.0+cvs20071121/22_net_tuntap_stall.patch
new file mode 100644
index 0000000000..6017df0f6d
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/22_net_tuntap_stall.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=0
+---
+# vl.c |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: vl.c
+===================================================================
+--- vl.c.orig	2007-12-03 23:47:36.000000000 +0000
++++ vl.c	2007-12-03 23:47:48.000000000 +0000
+@@ -4023,7 +4023,7 @@ static int tap_open(char *ifname, int if
+         return -1;
+     }
+     memset(&ifr, 0, sizeof(ifr));
+-    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
++    ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE;
+     if (ifname[0] != '\0')
+         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
+     else
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/31_syscalls.patch b/packages/qemu/qemu-0.9.0+cvs20071121/31_syscalls.patch
new file mode 100644
index 0000000000..95a7332ee8
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/31_syscalls.patch
@@ -0,0 +1,48 @@
+#DPATCHLEVEL=0
+---
+# linux-user/syscall.c |   11 ++++++++---
+# 1 file changed, 8 insertions(+), 3 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-12-03 19:32:56.000000000 +0000
++++ linux-user/syscall.c	2007-12-03 19:33:41.000000000 +0000
+@@ -250,6 +250,7 @@ extern int getresuid(uid_t *, uid_t *, u
+ extern int setresgid(gid_t, gid_t, gid_t);
+ extern int getresgid(gid_t *, gid_t *, gid_t *);
+ extern int setgroups(int, gid_t *);
++extern int uselib(const char*);
+ 
+ #define ERRNO_TABLE_SIZE 1200
+ 
+@@ -4024,7 +4025,8 @@ abi_long do_syscall(void *cpu_env, int n
+ #endif
+ #ifdef TARGET_NR_uselib
+     case TARGET_NR_uselib:
+-        goto unimplemented;
++        ret = get_errno(uselib(path((const char*)arg1)));
++        break;
+ #endif
+ #ifdef TARGET_NR_swapon
+     case TARGET_NR_swapon:
+@@ -5289,7 +5291,9 @@ abi_long do_syscall(void *cpu_env, int n
+         goto unimplemented;
+ #ifdef TARGET_NR_mincore
+     case TARGET_NR_mincore:
+-        goto unimplemented;
++        /*page_unprotect_range((void*)arg3, ((size_t)arg2 + TARGET_PAGE_SIZE - 1) / TARGET_PAGE_SIZE);*/
++        ret = get_errno(mincore((void*)arg1, (size_t)arg2, (unsigned char*)arg3));
++        break;
+ #endif
+ #ifdef TARGET_NR_madvise
+     case TARGET_NR_madvise:
+@@ -5429,7 +5433,8 @@ abi_long do_syscall(void *cpu_env, int n
+         break;
+ #ifdef TARGET_NR_readahead
+     case TARGET_NR_readahead:
+-        goto unimplemented;
++        ret = get_errno(readahead((int)arg1, (off64_t)arg2, (size_t)arg3));
++        break;
+ #endif
+ #ifdef TARGET_NR_setxattr
+     case TARGET_NR_setxattr:
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/32_syscall_sysctl.patch b/packages/qemu/qemu-0.9.0+cvs20071121/32_syscall_sysctl.patch
new file mode 100644
index 0000000000..5e8dd75b0e
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/32_syscall_sysctl.patch
@@ -0,0 +1,55 @@
+#DPATCHLEVEL=0
+---
+# linux-user/syscall.c |   32 +++++++++++++++++++++++++++++---
+# 1 file changed, 29 insertions(+), 3 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-12-03 15:56:24.000000000 +0000
++++ linux-user/syscall.c	2007-12-03 15:57:36.000000000 +0000
+@@ -52,6 +52,7 @@
+ //#include <sys/user.h>
+ #include <netinet/ip.h>
+ #include <netinet/tcp.h>
++#include <sys/sysctl.h>
+ 
+ #define termios host_termios
+ #define winsize host_winsize
+@@ -4739,9 +4740,34 @@ abi_long do_syscall(void *cpu_env, int n
+         break;
+ #endif
+     case TARGET_NR__sysctl:
+-        /* We don't implement this, but ENOTDIR is always a safe
+-           return value. */
+-        ret = -TARGET_ENOTDIR;
++        {
++            struct __sysctl_args *args = (struct __sysctl_args *) arg1;
++            int *name_target, *name, nlen, *oldlenp, oldlen, newlen, i;
++            void *oldval, *newval;
++
++            name_target = (int *) tswapl((long) args->name);
++            nlen = tswapl(args->nlen);
++            oldval = (void *) tswapl((long) args->oldval);
++            oldlenp = (int *) tswapl((long) args->oldlenp);
++            oldlen = tswapl(*oldlenp);
++            newval = (void *) tswapl((long) args->newval);
++            newlen = tswapl(args->newlen);
++
++            name = alloca(nlen * sizeof (int));
++            for (i = 0; i < nlen; i++)
++                name[i] = tswapl(name_target[i]);
++
++            if (nlen == 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION) {
++                ret = get_errno(
++                        sysctl(name, nlen, oldval, &oldlen, newval, newlen));
++                if (!is_error(ret)) {
++                    *oldlenp = tswapl(oldlen);
++                }
++            } else {
++                gemu_log("qemu: Unsupported sysctl name\n");
++                ret = -ENOSYS;
++            }
++        }
+         break;
+     case TARGET_NR_sched_setparam:
+         {
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/33_syscall_ppc_clone.patch b/packages/qemu/qemu-0.9.0+cvs20071121/33_syscall_ppc_clone.patch
new file mode 100644
index 0000000000..3f733b6ab8
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/33_syscall_ppc_clone.patch
@@ -0,0 +1,22 @@
+#DPATCHLEVEL=0
+---
+# linux-user/syscall.c |    6 +-----
+# 1 file changed, 1 insertion(+), 5 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-12-03 15:58:11.000000000 +0000
++++ linux-user/syscall.c	2007-12-03 15:58:46.000000000 +0000
+@@ -2750,11 +2750,7 @@ int do_fork(CPUState *env, unsigned int 
+         if (!newsp)
+             newsp = env->gpr[1];
+         new_env->gpr[1] = newsp;
+-        {
+-            int i;
+-            for (i = 7; i < 32; i++)
+-                new_env->gpr[i] = 0;
+-        }
++        new_env->gpr[3] = 0;
+ #elif defined(TARGET_SH4)
+ 	if (!newsp)
+ 	  newsp = env->gregs[15];
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/39_syscall_fadvise64.patch b/packages/qemu/qemu-0.9.0+cvs20071121/39_syscall_fadvise64.patch
new file mode 100644
index 0000000000..54ee3e0948
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/39_syscall_fadvise64.patch
@@ -0,0 +1,21 @@
+---
+ linux-user/syscall.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-12-03 19:33:47.000000000 +0000
++++ linux-user/syscall.c	2007-12-03 19:33:48.000000000 +0000
+@@ -5317,6 +5317,12 @@ abi_long do_syscall(void *cpu_env, int n
+         ret = get_errno(mincore((void*)arg1, (size_t)arg2, (unsigned char*)arg3));
+         break;
+ #endif
++#ifdef TARGET_NR_fadvise64_64
++     case TARGET_NR_fadvise64_64:
++        /* Just return success */
++        ret = get_errno(0);
++        break;
++#endif
+ #ifdef TARGET_NR_madvise
+     case TARGET_NR_madvise:
+         /* A straight passthrough may not be safe because qemu sometimes
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/41_arm_fpa_sigfpe.patch b/packages/qemu/qemu-0.9.0+cvs20071121/41_arm_fpa_sigfpe.patch
new file mode 100644
index 0000000000..cea3afc7ff
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/41_arm_fpa_sigfpe.patch
@@ -0,0 +1,104 @@
+#DPATCHLEVEL=0
+---
+# linux-user/main.c        |   51 ++++++++++++++++++++++++++++++++++++++++++++++-
+# target-arm/nwfpe/fpa11.c |    7 ++++++
+# 2 files changed, 57 insertions(+), 1 deletion(-)
+#
+Index: linux-user/main.c
+===================================================================
+--- linux-user/main.c.orig	2007-12-03 15:59:10.000000000 +0000
++++ linux-user/main.c	2007-12-03 16:01:27.000000000 +0000
+@@ -377,18 +377,67 @@ void cpu_loop(CPUARMState *env)
+             {
+                 TaskState *ts = env->opaque;
+                 uint32_t opcode;
++                int rc;
+ 
+                 /* we handle the FPU emulation here, as Linux */
+                 /* we get the opcode */
+                 /* FIXME - what to do if get_user() fails? */
+                 get_user_u32(opcode, env->regs[15]);
+ 
+-                if (EmulateAll(opcode, &ts->fpa, env) == 0) {
++                rc = EmulateAll(opcode, &ts->fpa, env);
++                if (rc == 0) { /* illegal instruction */
+                     info.si_signo = SIGILL;
+                     info.si_errno = 0;
+                     info.si_code = TARGET_ILL_ILLOPN;
+                     info._sifields._sigfault._addr = env->regs[15];
+                     queue_signal(info.si_signo, &info);
++                } else if (rc < 0) { /* FP exception */
++                    int arm_fpe=0;
++
++                     /* translate softfloat flags to FPSR flags */
++                    if (-rc & float_flag_invalid)
++                      arm_fpe |= BIT_IOC;
++                    if (-rc & float_flag_divbyzero)
++                      arm_fpe |= BIT_DZC;
++                    if (-rc & float_flag_overflow)
++                      arm_fpe |= BIT_OFC;
++                    if (-rc & float_flag_underflow)
++                      arm_fpe |= BIT_UFC;
++                    if (-rc & float_flag_inexact)
++                      arm_fpe |= BIT_IXC;
++
++                    FPSR fpsr = ts->fpa.fpsr;
++                    //printf("fpsr 0x%x, arm_fpe 0x%x\n",fpsr,arm_fpe);
++
++                    if (fpsr & (arm_fpe << 16)) { /* exception enabled? */
++                      info.si_signo = SIGFPE;
++                      info.si_errno = 0;
++
++                      /* ordered by priority, least first */
++                      if (arm_fpe & BIT_IXC) info.si_code = TARGET_FPE_FLTRES;
++                      if (arm_fpe & BIT_UFC) info.si_code = TARGET_FPE_FLTUND;
++                      if (arm_fpe & BIT_OFC) info.si_code = TARGET_FPE_FLTOVF;
++                      if (arm_fpe & BIT_DZC) info.si_code = TARGET_FPE_FLTDIV;
++                      if (arm_fpe & BIT_IOC) info.si_code = TARGET_FPE_FLTINV;
++
++                      info._sifields._sigfault._addr = env->regs[15];
++                      queue_signal(info.si_signo, &info);
++                    } else {
++                      env->regs[15] += 4;
++                    }
++
++                    /* accumulate unenabled exceptions */
++                    if ((!(fpsr & BIT_IXE)) && (arm_fpe & BIT_IXC))
++                      fpsr |= BIT_IXC;
++                    if ((!(fpsr & BIT_UFE)) && (arm_fpe & BIT_UFC))
++                      fpsr |= BIT_UFC;
++                    if ((!(fpsr & BIT_OFE)) && (arm_fpe & BIT_OFC))
++                      fpsr |= BIT_OFC;
++                    if ((!(fpsr & BIT_DZE)) && (arm_fpe & BIT_DZC))
++                      fpsr |= BIT_DZC;
++                    if ((!(fpsr & BIT_IOE)) && (arm_fpe & BIT_IOC))
++                      fpsr |= BIT_IOC;
++                    ts->fpa.fpsr=fpsr;
+                 } else {
+                     /* increment PC */
+                     env->regs[15] += 4;
+Index: target-arm/nwfpe/fpa11.c
+===================================================================
+--- target-arm/nwfpe/fpa11.c.orig	2007-12-03 15:40:26.000000000 +0000
++++ target-arm/nwfpe/fpa11.c	2007-12-03 15:59:11.000000000 +0000
+@@ -162,6 +162,8 @@ unsigned int EmulateAll(unsigned int opc
+     fpa11->initflag = 1;
+   }
+ 
++  set_float_exception_flags(0, &fpa11->fp_status);  
++
+   if (TEST_OPCODE(opcode,MASK_CPRT))
+   {
+     //fprintf(stderr,"emulating CPRT\n");
+@@ -191,6 +193,11 @@ unsigned int EmulateAll(unsigned int opc
+   }
+ 
+ //  restore_flags(flags);
++  if(nRc == 1 && get_float_exception_flags(&fpa11->fp_status))
++  {
++    //printf("fef 0x%x\n",float_exception_flags);
++    nRc=-get_float_exception_flags(&fpa11->fp_status);
++  }
+ 
+   //printf("returning %d\n",nRc);
+   return(nRc);
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/52_ne2000_return.patch b/packages/qemu/qemu-0.9.0+cvs20071121/52_ne2000_return.patch
new file mode 100644
index 0000000000..e4ea33f2c6
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/52_ne2000_return.patch
@@ -0,0 +1,17 @@
+---
+ hw/ne2000.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: qemu/hw/ne2000.c
+===================================================================
+--- qemu.orig/hw/ne2000.c	2007-12-03 19:32:52.000000000 +0000
++++ qemu/hw/ne2000.c	2007-12-03 19:33:55.000000000 +0000
+@@ -217,7 +217,7 @@ static int ne2000_can_receive(void *opaq
+     NE2000State *s = opaque;
+ 
+     if (s->cmd & E8390_STOP)
+-        return 1;
++        return 0;
+     return !ne2000_buffer_full(s);
+ }
+ 
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/61_safe_64bit_int.patch b/packages/qemu/qemu-0.9.0+cvs20071121/61_safe_64bit_int.patch
new file mode 100644
index 0000000000..bdb0d2e232
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/61_safe_64bit_int.patch
@@ -0,0 +1,27 @@
+#DPATCHLEVEL=0
+---
+# dyngen-exec.h |    4 ++--
+# 1 file changed, 2 insertions(+), 2 deletions(-)
+#
+Index: dyngen-exec.h
+===================================================================
+--- dyngen-exec.h.orig	2007-12-03 15:40:26.000000000 +0000
++++ dyngen-exec.h	2007-12-03 16:03:29.000000000 +0000
+@@ -38,7 +38,7 @@ typedef unsigned int uint32_t;
+ // Linux/Sparc64 defines uint64_t
+ #if !(defined (__sparc_v9__) && defined(__linux__))
+ /* XXX may be done for all 64 bits targets ? */
+-#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__)
++#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) || defined(__sparc__)
+ typedef unsigned long uint64_t;
+ #else
+ typedef unsigned long long uint64_t;
+@@ -55,7 +55,7 @@ typedef signed short int16_t;
+ typedef signed int int32_t;
+ // Linux/Sparc64 defines int64_t
+ #if !(defined (__sparc_v9__) && defined(__linux__))
+-#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__)
++#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) || defined(__sparc__)
+ typedef signed long int64_t;
+ #else
+ typedef signed long long int64_t;
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/63_sparc_build.patch b/packages/qemu/qemu-0.9.0+cvs20071121/63_sparc_build.patch
new file mode 100644
index 0000000000..37b38f641b
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/63_sparc_build.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=0
+---
+# sparc.ld |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: sparc.ld
+===================================================================
+--- sparc.ld.orig	2007-12-03 15:40:26.000000000 +0000
++++ sparc.ld	2007-12-03 16:05:06.000000000 +0000
+@@ -6,7 +6,7 @@ ENTRY(_start)
+ SECTIONS
+ {
+   /* Read-only sections, merged into text segment: */
+-  . = 0x60000000 + SIZEOF_HEADERS;
++  . = 0x60000000 + 0x400;
+   .interp     : { *(.interp)    }
+   .hash          : { *(.hash)           }
+   .dynsym        : { *(.dynsym)         }
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/64_ppc_asm_constraints.patch b/packages/qemu/qemu-0.9.0+cvs20071121/64_ppc_asm_constraints.patch
new file mode 100644
index 0000000000..e4858b79d7
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/64_ppc_asm_constraints.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=1
+---
+# cpu-all.h |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: qemu/cpu-all.h
+===================================================================
+--- qemu.orig/cpu-all.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/cpu-all.h	2007-06-13 11:51:56.000000000 +0100
+@@ -250,7 +250,7 @@ static inline void stw_le_p(void *ptr, i
+ static inline void stl_le_p(void *ptr, int v)
+ {
+ #ifdef __powerpc__
+-    __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*(uint32_t *)ptr) : "r" (v), "r" (ptr));
++    __asm__ __volatile__ ("stwbrx %0,0,%1" : : "r" (v), "r" (ptr) : "memory");
+ #else
+     uint8_t *p = ptr;
+     p[0] = v;
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/65_kfreebsd.patch b/packages/qemu/qemu-0.9.0+cvs20071121/65_kfreebsd.patch
new file mode 100644
index 0000000000..dfece800ac
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/65_kfreebsd.patch
@@ -0,0 +1,35 @@
+---
+ configure |    6 ++++++
+ vl.c      |    2 ++
+ 2 files changed, 8 insertions(+)
+
+Index: configure
+===================================================================
+--- configure.orig	2007-12-03 15:40:26.000000000 +0000
++++ configure	2007-12-03 16:05:34.000000000 +0000
+@@ -129,6 +129,12 @@ if [ "$cpu" = "i386" -o "$cpu" = "x86_64
+     kqemu="yes"
+ fi
+ ;;
++GNU/kFreeBSD)
++oss="yes"
++if [ "$cpu" = "i386" -o "$cpu" = "x86_64" ] ; then
++    kqemu="yes"
++fi
++;;
+ FreeBSD)
+ bsd="yes"
+ oss="yes"
+Index: vl.c
+===================================================================
+--- vl.c.orig	2007-12-03 16:05:32.000000000 +0000
++++ vl.c	2007-12-03 16:05:34.000000000 +0000
+@@ -97,6 +97,8 @@
+ #include <stropts.h>
+ #endif
+ #endif
++#elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
++#include <freebsd/stdlib.h>
+ #else
+ #include <winsock2.h>
+ int inet_aton(const char *cp, struct in_addr *ia);
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/66_tls_ld.patch b/packages/qemu/qemu-0.9.0+cvs20071121/66_tls_ld.patch
new file mode 100644
index 0000000000..54e02eff8b
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/66_tls_ld.patch
@@ -0,0 +1,55 @@
+---
+ arm.ld  |    7 +++++++
+ i386.ld |    7 +++++++
+ 2 files changed, 14 insertions(+)
+
+Index: arm.ld
+===================================================================
+--- arm.ld.orig	2007-06-13 11:48:22.000000000 +0100
++++ arm.ld	2007-06-13 11:51:56.000000000 +0100
+@@ -26,6 +26,10 @@ SECTIONS
+     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
+   .rela.rodata   :
+     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
++  .rel.tdata     : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
++  .rela.tdata    : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
++  .rel.tbss      : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
++  .rela.tbss     : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
+   .rel.got       : { *(.rel.got)		}
+   .rela.got      : { *(.rela.got)		}
+   .rel.ctors     : { *(.rel.ctors)	}
+@@ -58,6 +62,9 @@ SECTIONS
+   .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) }
+    __exidx_end = .;
+   .reginfo : { *(.reginfo) }
++  /* Thread Local Storage sections  */
++  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
++  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+   /* Adjust the address for the data segment.  We want to adjust up to
+      the same address within the page on the next page up.  */
+   . = ALIGN(0x100000) + (. & (0x100000 - 1));
+Index: i386.ld
+===================================================================
+--- i386.ld.orig	2007-06-13 11:48:22.000000000 +0100
++++ i386.ld	2007-06-13 11:51:56.000000000 +0100
+@@ -28,6 +28,10 @@ SECTIONS
+     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
+   .rela.rodata   :
+     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
++  .rel.tdata     : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
++  .rela.tdata    : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
++  .rel.tbss      : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
++  .rela.tbss     : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
+   .rel.got       : { *(.rel.got)		}
+   .rela.got      : { *(.rela.got)		}
+   .rel.ctors     : { *(.rel.ctors)	}
+@@ -53,6 +57,9 @@ SECTIONS
+   _etext = .;
+   PROVIDE (etext = .);
+   .fini      : { *(.fini)    } =0x47ff041f
++  /* Thread Local Storage sections  */
++  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
++  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+   . = ALIGN(32 / 8);
+   PROVIDE (__preinit_array_start = .);
+   .preinit_array     : { *(.preinit_array) }
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/91-oh-sdl-cursor.patch b/packages/qemu/qemu-0.9.0+cvs20071121/91-oh-sdl-cursor.patch
new file mode 100644
index 0000000000..0d60c1c306
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/91-oh-sdl-cursor.patch
@@ -0,0 +1,18 @@
+=== modified file 'sdl.c'
+---
+ sdl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: sdl.c
+===================================================================
+--- sdl.c.orig	2007-12-03 19:32:15.000000000 +0000
++++ sdl.c	2007-12-03 19:34:04.000000000 +0000
+@@ -247,7 +247,7 @@ static void sdl_hide_cursor(void)
+ 
+     if (kbd_mouse_is_absolute()) {
+         SDL_ShowCursor(1);
+-        SDL_SetCursor(sdl_cursor_hidden);
++        /* SDL_SetCursor(sdl_cursor_hidden); */
+     } else {
+         SDL_ShowCursor(0);
+     }
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/disable-error-in-configure.patch b/packages/qemu/qemu-0.9.0+cvs20071121/disable-error-in-configure.patch
new file mode 100644
index 0000000000..017f9f6355
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/disable-error-in-configure.patch
@@ -0,0 +1,17 @@
+---
+ configure |    2 --
+ 1 file changed, 2 deletions(-)
+
+Index: qemu/configure
+===================================================================
+--- qemu.orig/configure	2007-12-03 16:38:38.000000000 +0000
++++ qemu/configure	2007-12-03 16:38:39.000000000 +0000
+@@ -323,8 +323,6 @@ for opt do
+   ;;
+   --disable-werror) werror="no"
+   ;;
+-  *) echo "ERROR: unknown option $opt"; show_help="yes"
+-  ;;
+   --disable-nptl) nptl="no"
+   ;;
+   esac
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/fix_segfault.patch b/packages/qemu/qemu-0.9.0+cvs20071121/fix_segfault.patch
new file mode 100644
index 0000000000..443c330650
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/fix_segfault.patch
@@ -0,0 +1,37 @@
+---
+ linux-user/syscall.c |   22 ----------------------
+ 1 file changed, 22 deletions(-)
+
+Index: qemu/linux-user/syscall.c
+===================================================================
+--- qemu.orig/linux-user/syscall.c	2007-12-03 23:40:11.000000000 +0000
++++ qemu/linux-user/syscall.c	2007-12-03 23:40:21.000000000 +0000
+@@ -5695,28 +5695,6 @@ abi_long do_syscall(void *cpu_env, int n
+            goto unimplemented_nowarn;
+ #endif
+ 
+-#ifdef TARGET_NR_clock_gettime
+-    case TARGET_NR_clock_gettime:
+-    {
+-        struct timespec ts;
+-        ret = get_errno(clock_gettime(arg1, &ts));
+-        if (!is_error(ret)) {
+-            host_to_target_timespec(arg2, &ts);
+-        }
+-        break;
+-    }
+-#endif
+-#ifdef TARGET_NR_clock_getres
+-    case TARGET_NR_clock_getres:
+-    {
+-        struct timespec ts;
+-        ret = get_errno(clock_getres(arg1, &ts));
+-        if (!is_error(ret)) {
+-            host_to_target_timespec(arg2, &ts);
+-        }
+-        break;
+-    }
+-#endif
+ 
+ #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
+     case TARGET_NR_set_tid_address:
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/no-strip.patch b/packages/qemu/qemu-0.9.0+cvs20071121/no-strip.patch
new file mode 100644
index 0000000000..fe90f36182
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/no-strip.patch
@@ -0,0 +1,22 @@
+--- a/Makefile.org	2007-11-18 23:33:07.000000000 +0200
++++ a/Makefile	2008-01-01 19:09:25.000000000 +0200
+@@ -165,7 +165,7 @@
+ install: all $(if $(BUILD_DOCS),install-doc)
+ 	mkdir -p "$(DESTDIR)$(bindir)"
+ ifneq ($(TOOLS),)
+-	$(INSTALL) -m 755 -s $(TOOLS) "$(DESTDIR)$(bindir)"
++	$(INSTALL) -m 755 $(TOOLS) "$(DESTDIR)$(bindir)"
+ endif
+ 	mkdir -p "$(DESTDIR)$(datadir)"
+ 	for x in bios.bin vgabios.bin vgabios-cirrus.bin ppc_rom.bin \
+--- a/Makefile.target.org	2007-11-19 00:34:46.000000000 +0200
++++ a/Makefile.target	2008-01-01 19:10:02.000000000 +0200
+@@ -629,7 +629,7 @@
+ 
+ install: all
+ ifneq ($(PROGS),)
+-	$(INSTALL) -m 755 -s $(PROGS) "$(DESTDIR)$(bindir)"
++	$(INSTALL) -m 755 $(PROGS) "$(DESTDIR)$(bindir)"
+ endif
+ 
+ ifneq ($(wildcard .depend),)
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl-update.patch b/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl-update.patch
new file mode 100644
index 0000000000..ebc996e873
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl-update.patch
@@ -0,0 +1,219 @@
+---
+ linux-user/main.c    |    7 ++-
+ linux-user/syscall.c |  114 ++++++++++++++++++++++++++++++++++++++++++++++-----
+ 2 files changed, 111 insertions(+), 10 deletions(-)
+
+Index: qemu/linux-user/main.c
+===================================================================
+--- qemu.orig/linux-user/main.c	2007-12-03 19:34:09.000000000 +0000
++++ qemu/linux-user/main.c	2007-12-03 23:44:45.000000000 +0000
+@@ -391,7 +391,7 @@ do_kernel_trap(CPUARMState *env)
+         cpu_unlock();
+         break;
+     case 0xffff0fe0: /* __kernel_get_tls */
+-        env->regs[0] = env->cp15.c13_tls;
++        env->regs[0] = env->cp15.c13_tls2;
+         break;
+     default:
+         return 1;
+@@ -2037,6 +2037,11 @@ int main(int argc, char **argv)
+     int drop_ld_preload = 0, environ_count = 0;
+     char **target_environ, **wrk, **dst;
+ 
++    char *assume_kernel = getenv("QEMU_ASSUME_KERNEL");
++
++    if (assume_kernel)
++       setenv("LD_ASSUME_KERNEL", assume_kernel, 1);
++
+     if (argc <= 1)
+         usage();
+ 
+Index: qemu/linux-user/syscall.c
+===================================================================
+--- qemu.orig/linux-user/syscall.c	2007-12-03 19:34:09.000000000 +0000
++++ qemu/linux-user/syscall.c	2007-12-03 23:46:54.000000000 +0000
+@@ -61,6 +61,7 @@
+ #define tchars host_tchars /* same as target */
+ #define ltchars host_ltchars /* same as target */
+ 
++#include <linux/futex.h>
+ #include <linux/termios.h>
+ #include <linux/unistd.h>
+ #include <linux/utsname.h>
+@@ -2694,7 +2695,6 @@ abi_long do_arch_prctl(CPUX86State *env,
+     return 0;
+ }
+ #endif
+-
+ #endif /* defined(TARGET_I386) */
+ 
+ /* this stack is the equivalent of the kernel stack associated with a
+@@ -2729,16 +2729,19 @@ int do_fork(CPUState *env, unsigned int 
+     TaskState *ts;
+     uint8_t *new_stack;
+     CPUState *new_env;
+-
++#if defined(TARGET_I386)
++     uint64_t *new_gdt_table;
++#endif
+ #ifdef USE_NPTL
+     unsigned int nptl_flags;
+ 
+     if (flags & CLONE_PARENT_SETTID)
+         *parent_tidptr = gettid();
+ #endif
+-
+     if (flags & CLONE_VM) {
+         ts = malloc(sizeof(TaskState) + NEW_STACK_SIZE);
++        if (!ts)
++          return -ENOMEM;
+         memset(ts, 0, sizeof(TaskState));
+         new_stack = ts->stack;
+         ts->used = 1;
+@@ -2750,6 +2753,29 @@ int do_fork(CPUState *env, unsigned int 
+ #if defined(TARGET_I386)
+         if (!newsp)
+             newsp = env->regs[R_ESP];
++       new_gdt_table = malloc(9 * 8);
++       if (!new_gdt_table) {
++               free(new_env);
++               return -ENOMEM;
++       }
++       /* Copy main GDT table from parent, but clear TLS entries */
++       memcpy(new_gdt_table, g2h(env->gdt.base), 6 * 8);
++       memset(&new_gdt_table[6], 0, 3 * 8); 
++       new_env->gdt.base = h2g(new_gdt_table);
++       if (flags & 0x00080000 /* CLONE_SETTLS */) {
++               ret = do_set_thread_area(new_env, new_env->regs[R_ESI]);
++               if (ret) {
++                       free(new_gdt_table);
++                       free(new_env);
++                       return ret;
++               }
++       }
++       cpu_x86_load_seg(env, R_CS, new_env->regs[R_CS]);
++       cpu_x86_load_seg(env, R_DS, new_env->regs[R_DS]);
++       cpu_x86_load_seg(env, R_ES, new_env->regs[R_ES]);
++       cpu_x86_load_seg(env, R_SS, new_env->regs[R_SS]);
++       cpu_x86_load_seg(env, R_FS, new_env->regs[R_FS]);
++       cpu_x86_load_seg(env, R_GS, new_env->regs[R_GS]);
+         new_env->regs[R_ESP] = newsp;
+         new_env->regs[R_EAX] = 0;
+ #elif defined(TARGET_ARM)
+@@ -3121,6 +3147,68 @@ static inline abi_long host_to_target_ti
+     unlock_user_struct(target_ts, target_addr, 1);
+ }
+ 
++static long do_futex(target_ulong uaddr, int op, uint32_t val,
++                    target_ulong utime, target_ulong uaddr2,
++                    uint32_t val3)
++{
++       struct timespec host_utime;
++       unsigned long val2 = utime;
++
++       if (utime && (op == FUTEX_WAIT || op == FUTEX_LOCK_PI)) {
++               target_to_host_timespec(&host_utime, utime);
++               val2 = (unsigned long)&host_utime;
++       }
++ 
++#ifdef BSWAP_NEEDED
++       switch(op) {
++       case FUTEX_CMP_REQUEUE:
++               val3 = tswap32(val3);
++       case FUTEX_REQUEUE:
++               val2 = tswap32(val2);
++       case FUTEX_WAIT:
++       case FUTEX_WAKE:
++               val = tswap32(val);
++       case FUTEX_LOCK_PI: /* This one's icky, but comes out OK */
++       case FUTEX_UNLOCK_PI:
++               break;
++       default: 
++               gemu_log("qemu: Unsupported futex op %d\n", op);
++               return -ENOSYS;
++       } 
++#if 0 /* No, it's worse than this */
++       if (op == FUTEX_WAKE_OP) {
++               /* Need to munge the secondary operation (val3) */
++               val3 = tswap32(val3);
++               int op2 = (val3 >> 28) & 7;
++               int cmp = (val3 >> 24) & 15;
++               int oparg = (val3 << 8) >> 20;
++               int cmparg = (val3 << 20) >> 20;
++               int shift = val3 & (FUTEX_OP_OPARG_SHIFT << 28);
++
++               if (shift)
++                   oparg = (oparg & 7) + 24 - (oparg & 24);
++               else oparg = 
++               if (op2 == FUTEX_OP_ADD) {
++                       gemu_log("qemu: Unsupported wrong-endian FUTEX_OP_ADD\n");
++                       return -ENOSYS;
++               }
++               if (cmparg == FUTEX_OP_CMP_LT || cmparg == FUTEX_OP_CMP_GE ||
++                   cmparg == FUTEX_OP_CMP_LE || cmparg == FUTEX_OP_CMP_GT) {
++                       gemu_log("qemu: Unsupported wrong-endian futex cmparg %d\n", cmparg);
++                       return -ENOSYS;
++               }
++               val3 = shift | (op2<<28) | (cmp<<24) | (oparg<<12) | cmparg;
++       }
++#endif
++#endif
++       return syscall(__NR_futex, g2h(uaddr), op, val, val2, g2h(uaddr2), val3);
++}
++
++int do_set_tid_address(target_ulong tidptr)
++{
++       return syscall(__NR_set_tid_address, g2h(tidptr));
++}
++
+ /* do_syscall() should always have a single exit point at the end so
+    that actions, such as logging of syscall results, can be performed.
+    All errnos that do_syscall() returns must be -TARGET_<errcode>. */
+@@ -3145,7 +3233,7 @@ abi_long do_syscall(void *cpu_env, int n
+         _mcleanup();
+ #endif
+         gdb_exit(cpu_env, arg1);
+-        /* XXX: should free thread stack and CPU env */
++        /* XXX: should free thread stack, GDT and CPU env */
+         _exit(arg1);
+         ret = 0; /* avoid warning */
+         break;
+@@ -5569,6 +5657,9 @@ abi_long do_syscall(void *cpu_env, int n
+ #elif defined(TARGET_I386) && defined(TARGET_ABI32)
+       ret = do_set_thread_area(cpu_env, arg1);
+       break;
++#elif TARGET_i386
++	  ret = get_errno(do_set_thread_area(cpu_env, arg1));
++	  break;
+ #else
+       goto unimplemented_nowarn;
+ #endif
+@@ -5586,6 +5677,16 @@ abi_long do_syscall(void *cpu_env, int n
+         goto unimplemented_nowarn;
+ #endif
+ 
++#ifdef TARGET_NR_futex
++    case TARGET_NR_futex:
++       ret = get_errno(do_futex(arg1, arg2, arg3, arg4, arg5, arg6));
++       break;
++#endif
++#ifdef TARGET_NR_set_robust_list
++    case TARGET_NR_set_robust_list:
++           goto unimplemented_nowarn;
++#endif
++
+ #ifdef TARGET_NR_clock_gettime
+     case TARGET_NR_clock_gettime:
+     {
+@@ -5627,11 +5728,6 @@ abi_long do_syscall(void *cpu_env, int n
+ 	break;
+ #endif
+ 
+-#ifdef TARGET_NR_set_robust_list
+-    case TARGET_NR_set_robust_list:
+-	goto unimplemented_nowarn;
+-#endif
+-
+ #if defined(TARGET_NR_utimensat) && defined(__NR_utimensat)
+     case TARGET_NR_utimensat:
+         {
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl.patch b/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl.patch
new file mode 100644
index 0000000000..10e3cc04a5
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl.patch
@@ -0,0 +1,929 @@
+These are Paul Brook's patches to QEMU-0.8.2 to enable the running of single
+ARM binaries under QEMU's user-emulation mode. Without them, QEMU-0.8.1
+immediately dies saying:
+	Error: f0005
+	qemu: uncaught target signal 6 (Aborted) - exiting
+while qemu-0.8.2 dies saying:
+	qemu: Unsupported syscall: 983045
+	cannot set up thread-local storage: unknown error
+
+This file is a rediffing of the patches visible at
+https://nowt.dyndns.org/patch.qemu_nptl on 27 Sept 2006
+which "patch" fails to apply automatically.
+See also http://lists.gnu.org/archive/html/qemu-devel/2006-09/msg00194.html
+
+	Martin Guy, 27 Sept 2006
+
+---
+ configure                |   25 ++++++
+ exec-all.h               |  165 ------------------------------------------
+ linux-user/arm/syscall.h |    4 -
+ linux-user/main.c        |   94 +++++++++++++++++++++---
+ linux-user/qemu.h        |    3 
+ linux-user/syscall.c     |   91 ++++++++++++++++++++++-
+ qemu_spinlock.h          |  181 +++++++++++++++++++++++++++++++++++++++++++++++
+ target-arm/cpu.h         |   10 ++
+ target-arm/op.c          |    6 +
+ target-arm/translate.c   |    9 ++
+ 10 files changed, 405 insertions(+), 183 deletions(-)
+
+--- qemu.orig/configure
++++ qemu/configure
+@@ -103,10 +103,11 @@ check_gcc="yes"
+ softmmu="yes"
+ linux_user="no"
+ darwin_user="no"
+ build_docs="no"
+ uname_release=""
++nptl="yes"
+ 
+ # OS specific
+ targetos=`uname -s`
+ case $targetos in
+ CYGWIN*)
+@@ -322,10 +323,12 @@ for opt do
+   ;;
+   --disable-werror) werror="no"
+   ;;
+   *) echo "ERROR: unknown option $opt"; show_help="yes"
+   ;;
++  --disable-nptl) nptl="no"
++  ;;
+   esac
+ done
+ 
+ if [ "$bsd" = "yes" -o "$darwin" = "yes" -o "$mingw32" = "yes" ] ; then
+     AIOLIBS=
+@@ -417,10 +420,11 @@ echo "  --enable-system          enable 
+ echo "  --disable-system         disable all system emulation targets"
+ echo "  --enable-linux-user      enable all linux usermode emulation targets"
+ echo "  --disable-linux-user     disable all linux usermode emulation targets"
+ echo "  --enable-darwin-user     enable all darwin usermode emulation targets"
+ echo "  --disable-darwin-user    disable all darwin usermode emulation targets"
++echo "  --disable-nptl           disable usermode NPTL guest support"
+ echo "  --fmod-lib               path to FMOD library"
+ echo "  --fmod-inc               path to FMOD includes"
+ echo "  --enable-uname-release=R Return R for uname -r in usermode emulation"
+ echo "  --sparc_cpu=V            Build qemu for Sparc architecture v7, v8, v8plus, v8plusa, v9"
+ echo ""
+@@ -583,10 +587,27 @@ fi
+ cat > $TMPC <<EOF
+ int main(void) {
+ }
+ EOF
+ 
++# check NPTL support
++cat > $TMPC <<EOF
++#include <sched.h>
++void foo()
++{
++#ifndef CLONE_SETTLS
++#error bork
++#endif
++}
++EOF
++
++if $cc -c -o $TMPO $TMPC 2> /dev/null ; then
++  :
++else
++   nptl="no"
++fi
++
+ ##########################################
+ # SDL probe
+ 
+ sdl_too_old=no
+ 
+@@ -747,10 +768,11 @@ if test -n "$sparc_cpu"; then
+ fi
+ echo "kqemu support     $kqemu"
+ echo "Documentation     $build_docs"
+ [ ! -z "$uname_release" ] && \
+ echo "uname -r          $uname_release"
++echo "NPTL support      $nptl"
+ 
+ if test $sdl_too_old = "yes"; then
+ echo "-> Your SDL version is too old - please upgrade to have SDL support"
+ fi
+ if [ -s /tmp/qemu-$$-sdl-config.log ]; then
+@@ -1063,10 +1085,13 @@ if test "$target_cpu" = "i386" ; then
+   fi
+ elif test "$target_cpu" = "arm" -o "$target_cpu" = "armeb" ; then
+   echo "TARGET_ARCH=arm" >> $config_mak
+   echo "#define TARGET_ARCH \"arm\"" >> $config_h
+   echo "#define TARGET_ARM 1" >> $config_h
++  if test "$nptl" = "yes" ; then
++	  echo "#define USE_NPTL 1" >> $config_h
++  fi
+   bflt="yes"
+ elif test "$target_cpu" = "sparc" ; then
+   echo "TARGET_ARCH=sparc" >> $config_mak
+   echo "#define TARGET_ARCH \"sparc\"" >> $config_h
+   echo "#define TARGET_SPARC 1" >> $config_h
+--- qemu.orig/exec-all.h
++++ qemu/exec-all.h
+@@ -338,174 +338,11 @@ dummy_label ## n: ;\
+ 
+ extern CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
+ extern CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
+ extern void *io_mem_opaque[IO_MEM_NB_ENTRIES];
+ 
+-#if defined(__powerpc__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-    __asm__ __volatile__ (
+-                          "0:    lwarx %0,0,%1\n"
+-                          "      xor. %0,%3,%0\n"
+-                          "      bne 1f\n"
+-                          "      stwcx. %2,0,%1\n"
+-                          "      bne- 0b\n"
+-                          "1:    "
+-                          : "=&r" (ret)
+-                          : "r" (p), "r" (1), "r" (0)
+-                          : "cr0", "memory");
+-    return ret;
+-}
+-#elif defined(__i386__)
+-static inline int testandset (int *p)
+-{
+-    long int readval = 0;
+-
+-    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
+-                          : "+m" (*p), "+a" (readval)
+-                          : "r" (1)
+-                          : "cc");
+-    return readval;
+-}
+-#elif defined(__x86_64__)
+-static inline int testandset (int *p)
+-{
+-    long int readval = 0;
+-
+-    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
+-                          : "+m" (*p), "+a" (readval)
+-                          : "r" (1)
+-                          : "cc");
+-    return readval;
+-}
+-#elif defined(__s390__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-
+-    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
+-			  "   jl    0b"
+-			  : "=&d" (ret)
+-			  : "r" (1), "a" (p), "0" (*p)
+-			  : "cc", "memory" );
+-    return ret;
+-}
+-#elif defined(__alpha__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-    unsigned long one;
+-
+-    __asm__ __volatile__ ("0:	mov 1,%2\n"
+-			  "	ldl_l %0,%1\n"
+-			  "	stl_c %2,%1\n"
+-			  "	beq %2,1f\n"
+-			  ".subsection 2\n"
+-			  "1:	br 0b\n"
+-			  ".previous"
+-			  : "=r" (ret), "=m" (*p), "=r" (one)
+-			  : "m" (*p));
+-    return ret;
+-}
+-#elif defined(__sparc__)
+-static inline int testandset (int *p)
+-{
+-	int ret;
+-
+-	__asm__ __volatile__("ldstub	[%1], %0"
+-			     : "=r" (ret)
+-			     : "r" (p)
+-			     : "memory");
+-
+-	return (ret ? 1 : 0);
+-}
+-#elif defined(__arm__)
+-static inline int testandset (int *spinlock)
+-{
+-    register unsigned int ret;
+-    __asm__ __volatile__("swp %0, %1, [%2]"
+-                         : "=r"(ret)
+-                         : "0"(1), "r"(spinlock));
+-
+-    return ret;
+-}
+-#elif defined(__mc68000)
+-static inline int testandset (int *p)
+-{
+-    char ret;
+-    __asm__ __volatile__("tas %1; sne %0"
+-                         : "=r" (ret)
+-                         : "m" (p)
+-                         : "cc","memory");
+-    return ret;
+-}
+-#elif defined(__ia64)
+-
+-#include <ia64intrin.h>
+-
+-static inline int testandset (int *p)
+-{
+-    return __sync_lock_test_and_set (p, 1);
+-}
+-#elif defined(__mips__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-
+-    __asm__ __volatile__ (
+-	"	.set push		\n"
+-	"	.set noat		\n"
+-	"	.set mips2		\n"
+-	"1:	li	$1, 1		\n"
+-	"	ll	%0, %1		\n"
+-	"	sc	$1, %1		\n"
+-	"	beqz	$1, 1b		\n"
+-	"	.set pop		"
+-	: "=r" (ret), "+R" (*p)
+-	:
+-	: "memory");
+-
+-    return ret;
+-}
+-#else
+-#error unimplemented CPU support
+-#endif
+-
+-typedef int spinlock_t;
+-
+-#define SPIN_LOCK_UNLOCKED 0
+-
+-#if defined(CONFIG_USER_ONLY)
+-static inline void spin_lock(spinlock_t *lock)
+-{
+-    while (testandset(lock));
+-}
+-
+-static inline void spin_unlock(spinlock_t *lock)
+-{
+-    *lock = 0;
+-}
+-
+-static inline int spin_trylock(spinlock_t *lock)
+-{
+-    return !testandset(lock);
+-}
+-#else
+-static inline void spin_lock(spinlock_t *lock)
+-{
+-}
+-
+-static inline void spin_unlock(spinlock_t *lock)
+-{
+-}
+-
+-static inline int spin_trylock(spinlock_t *lock)
+-{
+-    return 1;
+-}
+-#endif
++#include "qemu_spinlock.h"
+ 
+ extern spinlock_t tb_lock;
+ 
+ extern int tb_invalidated_flag;
+ 
+--- qemu.orig/linux-user/arm/syscall.h
++++ qemu/linux-user/arm/syscall.h
+@@ -26,11 +26,13 @@ struct target_pt_regs {
+ #define ARM_ORIG_r0	uregs[17]
+ 
+ #define ARM_SYSCALL_BASE	0x900000
+ #define ARM_THUMB_SYSCALL	0
+ 
+-#define ARM_NR_cacheflush (ARM_SYSCALL_BASE + 0xf0000 + 2)
++#define ARM_NR_BASE	  0xf0000
++#define ARM_NR_cacheflush (ARM_NR_BASE + 2)
++#define ARM_NR_set_tls	  (ARM_NR_BASE + 5)
+ 
+ #define ARM_NR_semihosting	  0x123456
+ #define ARM_NR_thumb_semihosting  0xAB
+ 
+ #if defined(TARGET_WORDS_BIGENDIAN)
+--- qemu.orig/linux-user/main.c
++++ qemu/linux-user/main.c
+@@ -361,10 +361,54 @@ static void arm_cache_flush(abi_ulong st
+             break;
+         addr = last1 + 1;
+     }
+ }
+ 
++/* Handle a jump to the kernel code page.  */
++static int
++do_kernel_trap(CPUARMState *env)
++{
++    uint32_t addr;
++    uint32_t *ptr;
++    uint32_t cpsr;
++
++    switch (env->regs[15]) {
++    case 0xffff0fc0: /* __kernel_cmpxchg */
++        /* XXX: This only works between threads, not between processes.
++           Use native atomic operations.  */
++        /* ??? This probably breaks horribly if the access segfaults.  */
++        cpu_lock();
++        ptr = (uint32_t *)env->regs[2];
++        cpsr = cpsr_read(env);
++        if (*ptr == env->regs[0]) {
++            *ptr = env->regs[1];
++            env->regs[0] = 0;
++            cpsr |= CPSR_C;
++        } else {
++            env->regs[0] = -1;
++            cpsr &= ~CPSR_C;
++        }
++        cpsr_write(env, cpsr, CPSR_C);
++        cpu_unlock();
++        break;
++    case 0xffff0fe0: /* __kernel_get_tls */
++        env->regs[0] = env->cp15.c13_tls;
++        break;
++    default:
++        return 1;
++    }
++    /* Jump back to the caller.  */
++    addr = env->regs[14];
++    if (addr & 1) {
++        env->thumb = 1;
++        addr &= ~1;
++    }
++    env->regs[15] = addr;
++
++    return 0;
++}
++
+ void cpu_loop(CPUARMState *env)
+ {
+     int trapnr;
+     unsigned int n, insn;
+     target_siginfo_t info;
+@@ -471,32 +515,50 @@ void cpu_loop(CPUARMState *env)
+                         get_user_u32(insn, env->regs[15] - 4);
+                         n = insn & 0xffffff;
+                     }
+                 }
+ 
+-                if (n == ARM_NR_cacheflush) {
+-                    arm_cache_flush(env->regs[0], env->regs[1]);
+-                } else if (n == ARM_NR_semihosting
+-                           || n == ARM_NR_thumb_semihosting) {
++                if (n == ARM_NR_semihosting
++                    || n == ARM_NR_thumb_semihosting) {
+                     env->regs[0] = do_arm_semihosting (env);
+                 } else if (n == 0 || n >= ARM_SYSCALL_BASE
+                            || (env->thumb && n == ARM_THUMB_SYSCALL)) {
+                     /* linux syscall */
+                     if (env->thumb || n == 0) {
+                         n = env->regs[7];
+                     } else {
+                         n -= ARM_SYSCALL_BASE;
+                         env->eabi = 0;
+                     }
+-                    env->regs[0] = do_syscall(env,
+-                                              n,
+-                                              env->regs[0],
+-                                              env->regs[1],
+-                                              env->regs[2],
+-                                              env->regs[3],
+-                                              env->regs[4],
+-                                              env->regs[5]);
++                    if ( n > ARM_NR_BASE) {
++                        switch (n)
++                          {
++                          case ARM_NR_cacheflush:
++                              arm_cache_flush(env->regs[0], env->regs[1]);
++                              break;
++#ifdef USE_NPTL
++                          case ARM_NR_set_tls:
++                              cpu_set_tls(env, env->regs[0]);
++                              env->regs[0] = 0;
++                              break;
++#endif
++                          default:
++                              printf ("Error: Bad syscall: %x\n", n);
++                              goto error;
++                          }
++                      }
++                    else
++                      {
++                        env->regs[0] = do_syscall(env,
++                                                  n,
++                                                  env->regs[0],
++                                                  env->regs[1],
++                                                  env->regs[2],
++                                                  env->regs[3],
++                                                  env->regs[4],
++                                                  env->regs[5]);
++                      }
+                 } else {
+                     goto error;
+                 }
+             }
+             break;
+@@ -531,10 +593,14 @@ void cpu_loop(CPUARMState *env)
+                     info.si_code = TARGET_TRAP_BRKPT;
+                     queue_signal(info.si_signo, &info);
+                   }
+             }
+             break;
++        case EXCP_KERNEL_TRAP:
++            if (do_kernel_trap(env))
++              goto error;
++            break;
+         default:
+         error:
+             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",
+                     trapnr);
+             cpu_dump_state(env, stderr, fprintf, 0);
+@@ -2378,10 +2444,14 @@ int main(int argc, char **argv)
+ #if defined(TARGET_ARM) || defined(TARGET_M68K)
+     ts->stack_base = info->start_stack;
+     ts->heap_base = info->brk;
+     /* This will be filled in on the first SYS_HEAPINFO call.  */
+     ts->heap_limit = 0;
++    /* Register the magic kernel code page.  The cpu will generate a
++       special exception when it tries to execute code here.  We can't
++       put real code here because it may be in use by the host kernel.  */
++    page_set_flags(0xffff0000, 0xffff0fff, 0);
+ #endif
+ 
+     if (gdbstub_port) {
+         gdbserver_start (gdbstub_port);
+         gdb_handlesig(env, 0);
+--- qemu.orig/linux-user/qemu.h
++++ qemu/linux-user/qemu.h
+@@ -100,10 +100,13 @@ typedef struct TaskState {
+     /* Extra fields for semihosted binaries.  */
+     uint32_t stack_base;
+     uint32_t heap_base;
+     uint32_t heap_limit;
+ #endif
++#ifdef USE_NPTL
++    uint32_t *child_tidptr;
++#endif
+     int used; /* non zero if used */
+     struct image_info *info;
+     uint8_t stack[0];
+ } __attribute__((aligned(16))) TaskState;
+ 
+--- qemu.orig/linux-user/syscall.c
++++ qemu/linux-user/syscall.c
+@@ -69,13 +69,22 @@
+ #include <linux/soundcard.h>
+ #include <linux/dirent.h>
+ #include <linux/kd.h>
+ 
+ #include "qemu.h"
++#include "qemu_spinlock.h"
+ 
+ //#define DEBUG
+ 
++#ifdef USE_NPTL
++#define CLONE_NPTL_FLAGS2 (CLONE_SETTLS | \
++    CLONE_PARENT_SETTID | CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID)
++#else
++/* XXX: Hardcode the above values.  */
++#define CLONE_NPTL_FLAGS2 0
++#endif
++
+ #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) \
+     || defined(TARGET_M68K) || defined(TARGET_SH4) || defined(TARGET_CRIS)
+ /* 16 bit uid wrappers emulation */
+ #define USE_UID16
+ #endif
+@@ -2690,27 +2699,46 @@ abi_long do_arch_prctl(CPUX86State *env,
+ 
+ /* this stack is the equivalent of the kernel stack associated with a
+    thread/process */
+ #define NEW_STACK_SIZE 8192
+ 
++#ifdef USE_NPTL
++static spinlock_t nptl_lock = SPIN_LOCK_UNLOCKED;
++#endif
++
+ static int clone_func(void *arg)
+ {
+     CPUState *env = arg;
++#ifdef HAVE_NPTL
++    /* Wait until the parent has finshed initializing the tls state.  */
++    while (!spin_trylock(&nptl_lock))
++        usleep(1);
++    spin_unlock(&nptl_lock);
++#endif
+     cpu_loop(env);
+     /* never exits */
+     return 0;
+ }
+ 
+ /* do_fork() Must return host values and target errnos (unlike most
+    do_*() functions). */
+-int do_fork(CPUState *env, unsigned int flags, abi_ulong newsp)
++int do_fork(CPUState *env, unsigned int flags, unsigned long newsp,
++            uint32_t *parent_tidptr, void *newtls,
++            uint32_t *child_tidptr)
+ {
+     int ret;
+     TaskState *ts;
+     uint8_t *new_stack;
+     CPUState *new_env;
+ 
++#ifdef USE_NPTL
++    unsigned int nptl_flags;
++
++    if (flags & CLONE_PARENT_SETTID)
++        *parent_tidptr = gettid();
++#endif
++
+     if (flags & CLONE_VM) {
+         ts = malloc(sizeof(TaskState) + NEW_STACK_SIZE);
+         memset(ts, 0, sizeof(TaskState));
+         new_stack = ts->stack;
+         ts->used = 1;
+@@ -2772,20 +2800,71 @@ int do_fork(CPUState *env, unsigned int 
+ 	new_env->regs[14] = newsp;
+ #else
+ #error unsupported target CPU
+ #endif
+         new_env->opaque = ts;
++#ifdef USE_NPTL
++        nptl_flags = flags;
++        flags &= ~CLONE_NPTL_FLAGS2;
++
++        if (nptl_flags & CLONE_CHILD_CLEARTID) {
++            ts->child_tidptr = child_tidptr;
++        }
++
++        if (nptl_flags & CLONE_SETTLS)
++            cpu_set_tls (new_env, newtls);
++
++        /* Grab the global cpu lock so that the thread setup appears
++           atomic.  */
++        if (nptl_flags & CLONE_CHILD_SETTID)
++            spin_lock(&nptl_lock);
++
++#else
++        if (flags & CLONE_NPTL_FLAGS2)
++            return -EINVAL;
++#endif
++
++	 if (CLONE_VFORK & flags)
++		flags ^= CLONE_VM;
+ #ifdef __ia64__
+         ret = __clone2(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
+ #else
+ 	ret = clone(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
+ #endif
++#ifdef USE_NPTL
++        if (ret != -1) {
++            if (nptl_flags & CLONE_CHILD_SETTID)
++                *child_tidptr = ret;
++        }
++
++        /* Allow the child to continue.  */
++        if (nptl_flags & CLONE_CHILD_SETTID)
++            spin_unlock(&nptl_lock);
++#endif
+     } else {
+         /* if no CLONE_VM, we consider it is a fork */
+-        if ((flags & ~CSIGNAL) != 0)
++        if ((flags & ~(CSIGNAL | CLONE_NPTL_FLAGS2)) != 0)
+             return -EINVAL;
+         ret = fork();
++#ifdef USE_NPTL
++        /* There is a race condition here.  The parent process could
++           theoretically read the TID in the child process before the child
++           tid is set.  This would require using either ptrace
++           (not implemented) or having *_tidptr to point at a shared memory
++           mapping.  We can't repeat the spinlock hack used above because
++           the child process gets its own copy of the lock.  */
++        if (ret == 0) {
++            /* Child Process.  */
++            if (flags & CLONE_CHILD_SETTID)
++                *child_tidptr = gettid();
++            ts = (TaskState *)env->opaque;
++            if (flags & CLONE_CHILD_CLEARTID)
++                ts->child_tidptr = child_tidptr;
++            if (flags & CLONE_SETTLS)
++                cpu_set_tls (env, newtls);
++        }
++#endif
+     }
+     return ret;
+ }
+ 
+ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
+@@ -3106,11 +3185,11 @@ abi_long do_syscall(void *cpu_env, int n
+         break;
+     case TARGET_NR_brk:
+         ret = do_brk(arg1);
+         break;
+     case TARGET_NR_fork:
+-        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0));
++        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0, NULL, NULL, NULL));
+         break;
+ #ifdef TARGET_NR_waitpid
+     case TARGET_NR_waitpid:
+         {
+             int status;
+@@ -4463,11 +4542,12 @@ abi_long do_syscall(void *cpu_env, int n
+ #endif
+     case TARGET_NR_fsync:
+         ret = get_errno(fsync(arg1));
+         break;
+     case TARGET_NR_clone:
+-        ret = get_errno(do_fork(cpu_env, arg1, arg2));
++        ret = get_errno(do_fork(cpu_env, arg1, arg2, (uint32_t *)arg3,
++                        (void *)arg4, (uint32_t *)arg5));
+         break;
+ #ifdef __NR_exit_group
+         /* new thread calls */
+     case TARGET_NR_exit_group:
+         gdb_exit(cpu_env, arg1);
+@@ -4908,11 +4988,12 @@ abi_long do_syscall(void *cpu_env, int n
+     case TARGET_NR_putpmsg:
+         goto unimplemented;
+ #endif
+ #ifdef TARGET_NR_vfork
+     case TARGET_NR_vfork:
+-        ret = get_errno(do_fork(cpu_env, CLONE_VFORK | CLONE_VM | SIGCHLD, 0));
++        ret = get_errno(do_fork(cpu_env, CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
++                                NULL, NULL, NULL));
+         break;
+ #endif
+ #ifdef TARGET_NR_ugetrlimit
+     case TARGET_NR_ugetrlimit:
+     {
+--- /dev/null
++++ qemu/qemu_spinlock.h
+@@ -0,0 +1,181 @@
++/*
++ * Atomic operation helper include
++ *
++ *  Copyright (c) 2005 Fabrice Bellard
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
++ */
++#ifndef QEMU_SPINLOCK_H
++#define QEMU_SPINLOCK_H
++
++#ifdef __powerpc__
++static inline int testandset (int *p)
++{
++    int ret;
++    __asm__ __volatile__ (
++                          "0:    lwarx %0,0,%1\n"
++                          "      xor. %0,%3,%0\n"
++                          "      bne 1f\n"
++                          "      stwcx. %2,0,%1\n"
++                          "      bne- 0b\n"
++                          "1:    "
++                          : "=&r" (ret)
++                          : "r" (p), "r" (1), "r" (0)
++                          : "cr0", "memory");
++    return ret;
++}
++#endif
++
++#ifdef __i386__
++static inline int testandset (int *p)
++{
++    long int readval = 0;
++
++    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
++                          : "+m" (*p), "+a" (readval)
++                          : "r" (1)
++                          : "cc");
++    return readval;
++}
++#endif
++
++#ifdef __x86_64__
++static inline int testandset (int *p)
++{
++    long int readval = 0;
++
++    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
++                          : "+m" (*p), "+a" (readval)
++                          : "r" (1)
++                          : "cc");
++    return readval;
++}
++#endif
++
++#ifdef __s390__
++static inline int testandset (int *p)
++{
++    int ret;
++
++    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
++			  "   jl    0b"
++			  : "=&d" (ret)
++			  : "r" (1), "a" (p), "0" (*p)
++			  : "cc", "memory" );
++    return ret;
++}
++#endif
++
++#ifdef __alpha__
++static inline int testandset (int *p)
++{
++    int ret;
++    unsigned long one;
++
++    __asm__ __volatile__ ("0:	mov 1,%2\n"
++			  "	ldl_l %0,%1\n"
++			  "	stl_c %2,%1\n"
++			  "	beq %2,1f\n"
++			  ".subsection 2\n"
++			  "1:	br 0b\n"
++			  ".previous"
++			  : "=r" (ret), "=m" (*p), "=r" (one)
++			  : "m" (*p));
++    return ret;
++}
++#endif
++
++#ifdef __sparc__
++static inline int testandset (int *p)
++{
++	int ret;
++
++	__asm__ __volatile__("ldstub	[%1], %0"
++			     : "=r" (ret)
++			     : "r" (p)
++			     : "memory");
++
++	return (ret ? 1 : 0);
++}
++#endif
++
++#ifdef __arm__
++static inline int testandset (int *spinlock)
++{
++    register unsigned int ret;
++    __asm__ __volatile__("swp %0, %1, [%2]"
++                         : "=r"(ret)
++                         : "0"(1), "r"(spinlock));
++
++    return ret;
++}
++#endif
++
++#ifdef __mc68000
++static inline int testandset (int *p)
++{
++    char ret;
++    __asm__ __volatile__("tas %1; sne %0"
++                         : "=r" (ret)
++                         : "m" (p)
++                         : "cc","memory");
++    return ret;
++}
++#endif
++
++#ifdef __ia64
++#include <ia64intrin.h>
++
++static inline int testandset (int *p)
++{
++    return __sync_lock_test_and_set (p, 1);
++}
++#endif
++
++typedef int spinlock_t;
++
++#define SPIN_LOCK_UNLOCKED 0
++
++#if defined(CONFIG_USER_ONLY)
++static inline void spin_lock(spinlock_t *lock)
++{
++    while (testandset(lock));
++}
++
++static inline void spin_unlock(spinlock_t *lock)
++{
++    *lock = 0;
++}
++
++static inline int spin_trylock(spinlock_t *lock)
++{
++    return !testandset(lock);
++}
++#else
++static inline void spin_lock(spinlock_t *lock)
++{
++}
++
++static inline void spin_unlock(spinlock_t *lock)
++{
++}
++
++static inline int spin_trylock(spinlock_t *lock)
++{
++    return 1;
++}
++#endif
++
++#endif
+--- qemu.orig/target-arm/cpu.h
++++ qemu/target-arm/cpu.h
+@@ -36,10 +36,11 @@
+ #define EXCP_DATA_ABORT      4
+ #define EXCP_IRQ             5
+ #define EXCP_FIQ             6
+ #define EXCP_BKPT            7
+ #define EXCP_EXCEPTION_EXIT  8   /* Return from v7M exception.  */
++#define EXCP_KERNEL_TRAP     9   /* Jumped to kernel code page.  */
+ 
+ #define ARMV7M_EXCP_RESET   1
+ #define ARMV7M_EXCP_NMI     2
+ #define ARMV7M_EXCP_HARD    3
+ #define ARMV7M_EXCP_MEM     4
+@@ -220,10 +221,19 @@ int cpu_arm_signal_handler(int host_sign
+                            void *puc);
+ 
+ void cpu_lock(void);
+ void cpu_unlock(void);
+ 
++void cpu_lock(void);
++void cpu_unlock(void);
++#if defined(USE_NPTL)
++static inline void cpu_set_tls(CPUARMState *env, void *newtls)
++{
++  env->cp15.c13_tls2 = (uint32_t)(long)newtls;
++}
++#endif
++
+ #define CPSR_M (0x1f)
+ #define CPSR_T (1 << 5)
+ #define CPSR_F (1 << 6)
+ #define CPSR_I (1 << 7)
+ #define CPSR_A (1 << 8)
+--- qemu.orig/target-arm/op.c
++++ qemu/target-arm/op.c
+@@ -1007,10 +1007,16 @@ void OPPROTO op_exception_exit(void)
+ {
+     env->exception_index = EXCP_EXCEPTION_EXIT;
+     cpu_loop_exit();
+ }
+ 
++void OPPROTO op_kernel_trap(void)
++{
++    env->exception_index = EXCP_KERNEL_TRAP;
++    cpu_loop_exit();
++}
++
+ /* VFP support.  We follow the convention used for VFP instrunctions:
+    Single precition routines have a "s" suffix, double precision a
+    "d" suffix.  */
+ 
+ #define VFP_OP(name, p) void OPPROTO op_vfp_##name##p(void)
+--- qemu.orig/target-arm/translate.c
++++ qemu/target-arm/translate.c
+@@ -7518,11 +7518,18 @@ static inline int gen_intermediate_code_
+             /* We always get here via a jump, so know we are not in a
+                conditional execution block.  */
+             gen_op_exception_exit();
+         }
+ #endif
+-
++#ifdef CONFIG_USER_ONLY
++        /* Intercept jump to the magic kernel page.  */
++        if (dc->pc > 0xffff0000) {
++            gen_op_kernel_trap();
++            dc->is_jmp = DISAS_UPDATE;
++            break;
++        }
++#endif
+         if (env->nb_breakpoints > 0) {
+             for(j = 0; j < env->nb_breakpoints; j++) {
+                 if (env->breakpoints[j] == dc->pc) {
+                     gen_set_condexec(dc);
+                     gen_op_movl_T0_im((long)dc->pc);
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-amd64-32b-mapping-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20071121/qemu-amd64-32b-mapping-0.9.0.patch
new file mode 100644
index 0000000000..c7f36d8110
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/qemu-amd64-32b-mapping-0.9.0.patch
@@ -0,0 +1,37 @@
+---
+ linux-user/mmap.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+Index: qemu/linux-user/mmap.c
+===================================================================
+--- qemu.orig/linux-user/mmap.c	2007-12-03 15:40:25.000000000 +0000
++++ qemu/linux-user/mmap.c	2007-12-03 16:37:21.000000000 +0000
+@@ -29,6 +29,10 @@
+ 
+ //#define DEBUG_MMAP
+ 
++#ifndef MAP_32BIT
++#define MAP_32BIT 0
++#endif
++
+ /* NOTE: all the constants are the HOST ones, but addresses are target. */
+ int target_mprotect(abi_ulong start, abi_ulong len, int prot)
+ {
+@@ -251,7 +255,7 @@ abi_long target_mmap(abi_ulong start, ab
+            especially important if qemu_host_page_size >
+            qemu_real_host_page_size */
+         p = mmap(g2h(mmap_start),
+-                 host_len, prot, flags | MAP_FIXED, fd, host_offset);
++                 host_len, prot, flags | MAP_FIXED | MAP_32BIT, fd, host_offset);
+         if (p == MAP_FAILED)
+             return -1;
+         /* update start so that it points to the file position at 'offset' */
+@@ -406,7 +410,7 @@ abi_long target_mremap(abi_ulong old_add
+     unsigned long host_addr;
+ 
+     /* XXX: use 5 args syscall */
+-    host_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags);
++    host_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags | MAP_32BIT);
+     if (host_addr == -1)
+         return -1;
+     new_addr = h2g(host_addr);
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/workaround_bad_futex_headers.patch b/packages/qemu/qemu-0.9.0+cvs20071121/workaround_bad_futex_headers.patch
new file mode 100644
index 0000000000..cc122ebdba
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20071121/workaround_bad_futex_headers.patch
@@ -0,0 +1,25 @@
+---
+ linux-user/syscall.c |   10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+Index: qemu/linux-user/syscall.c
+===================================================================
+--- qemu.orig/linux-user/syscall.c	2007-08-09 20:28:06.000000000 +0100
++++ qemu/linux-user/syscall.c	2007-08-09 20:28:41.000000000 +0100
+@@ -61,7 +61,15 @@
+ #define tchars host_tchars /* same as target */
+ #define ltchars host_ltchars /* same as target */
+ 
+-#include <linux/futex.h>
++#define FUTEX_WAIT              0
++#define FUTEX_WAKE              1
++#define FUTEX_FD                2
++#define FUTEX_REQUEUE           3
++#define FUTEX_CMP_REQUEUE       4
++#define FUTEX_WAKE_OP           5
++#define FUTEX_LOCK_PI           6
++#define FUTEX_UNLOCK_PI         7
++
+ #include <linux/termios.h>
+ #include <linux/unistd.h>
+ #include <linux/utsname.h>