fix(model_specific): make {Fs,Gs,KernelGs}Base::write() unsafe

[mkroening]

This makes FsBase::write(), GsBase::write(), and KernelGsBase::write() unsafe and applies the safety doc comment from Segment64::write_base().

Closes #526.

[mkroening]

I am not familiar with KernelGsBase, but I think the same reasoning applies.

Ah, this should target next, right?

[Freax13]

I am not familiar with KernelGsBase, but I think the same reasoning applies.

I'm not completely sure about this one. Writing to KernelGsBase does not directly affect the base of the GS segment register even when in kernel mode. There's an instruction, swapgs, that can be used to exchange the GS segment register base with the value of the KernelGsBase MSR, and our wrapper for this instruction, GS::swap, is unsafe. While it could be argued that it's only the swapgs instruction that has the potential to cause UB, any code that uses swapgs likely relies on KernelGsBase containing valid values, so making writes KernelGsBase unsafe seems okay to me.

Ah, this should target next, right?

Yes

[Freax13]

Suggested change

	/// The caller must ensure that this write operation has no unsafe side
	/// effects, as the segment base address might be in use.
	/// The caller must ensure that this write operation has no unsafe side
	/// effects, as the segment base address might be in use.

As mentioned in my previous comment, the KernelGsBase register is not the same as the base of the GS registers, so it cannot be "in use".

[mkroening]

Ah, that's what you meant. I changed it to “The caller must ensure that a future call to GS::swap has no unsafe side effects.”

Are you fine with that wording, or would you prefer a different wording?

[Freax13]

I can't come up with anything better of the top of my head. My impression is that the safety implications are closely tied to how a user actually uses KernelGsBase, so it's hard to provide generic guidelines and this is probably the best we can do.

[mkroening]

I'm not completely sure about this one. Writing to KernelGsBase does not directly affect the base of the GS segment register even when in kernel mode. There's an instruction, swapgs, that can be used to exchange the GS segment register base with the value of the KernelGsBase MSR, and our wrapper for this instruction, GS::swap, is unsafe. While it could be argued that it's only the swapgs instruction that has the potential to cause UB, any code that uses swapgs likely relies on KernelGsBase containing valid values, so making writes KernelGsBase unsafe seems okay to me.

Ah, yes, I remember. Sounds good to me. 👍

[Freax13]

Looks good to me, thanks! 🎄