陷阱指令：为何程序计数器与处理器状态寄存器需原子性修改？

Great question—this cuts to the core of how trap instructions enforce the privilege isolation that keeps systems secure. Let’s break down the problem step by step:

The Core Purpose of a TRAP Instruction #

First, remember what a TRAP is supposed to do: it’s a controlled way for user-mode code to request kernel services (like system calls). To do this safely, it needs two key things:

• Switch the processor from user mode (limited privileges) to kernel mode (full system access) by updating the PCR.
• Transfer execution to a trusted kernel trap handler by updating the PC to the handler’s predefined address.

The Security Hole of Separating PCR and PC Updates #

If the TRAP instruction only updates the PCR (switches to kernel mode) without immediately and atomically updating the PC, you create a dangerous window of opportunity for malicious user code:

• After the PCR is updated to kernel mode, the processor’s next instruction will still be the next line of user code (since PC hasn’t changed).
• But now that processor is running in kernel mode, that user code has full, unrestricted access to system resources—things like kernel memory, privileged hardware registers, and system configuration settings that user mode is never supposed to touch.

A Concrete Example #

Imagine a malicious user program has this sequence of instructions:

TRAP  ; Hypothetical version that only sets PCR to kernel mode
MOV CR3, 0xDEADBEEF  ; User-space instruction to overwrite the kernel's page table register

If the TRAP doesn’t update PC synchronously:

1. The TRAP executes, switching the processor to kernel mode.
2. The processor moves to the next instruction (the MOV), which runs with kernel privileges.
3. The attacker successfully overwrites the kernel’s page table, gaining full control over which memory the system can access—effectively taking over the entire machine.

Why Atomicity Fixes This #

By updating both the PCR (privilege mode) and PC (execution address) in the same instruction cycle, you eliminate this window. The switch to kernel mode and transfer to the trusted kernel handler happen atomically—there’s no chance for user code to run in kernel mode. The first instruction executed after the TRAP is always the kernel’s trap handler, which validates the user’s request and maintains system security.

内容的提问来源于stack exchange，提问作者Tyler Small