When running with TPM, you will notice some processes which may be cloned().
These may show up under UML and 2.4 as seperate processes. 
(I think that they do not under NPTL which 2.6 has)

  863 ?        S      0:00 /usr/lib/ipsec/pluto --nofork --secretsfile /tmp/tpm-accept-01/ipse
  864 ?        S      0:00 lwdnsq
  865 ?        S      0:00 /usr/lib/ipsec/pluto --nofork --secretsfile /tmp/tpm-accept-01/ipse
  866 ?        S      0:00 /usr/lib/ipsec/pluto --nofork --secretsfile /tmp/tpm-accept-01/ipse

This is because the Tcl library calls clone(2).