arrrg... i found the problem... of course! Plan9 *does* restore/reload the segment registers! It does it still in kernel mode. So if a segment register is set (from usermode) with a selector pointing to my TLS descriptor, and that descriptor gets changed to {0, 0} again, forkret() restores/reloads the segment register and *kernel* gets a GP fault.
Now the selector checking in trap() makes sense... arrg >_< sorry for the noise...
--- Begin Message ---it seems reasonable on first glance. What's the stack barf look like? ron
--- End Message ---