152         // Open calls are safe because we give a nul-terminated string and verify the result.  in new_with_path()
160                 // Safe because we verify that ret is valid and we own the fd.  in new_with_path()
168         // Safe because we know that our file is a KVM fd and that the extension is one of the ones  in check_extension_int()
181         // Safe because we know that our file is a KVM fd and we verify the return result.  in get_vcpu_mmap_size()
241         // Mapping the unsized array to a slice is unsafe because the length isn't known.  Using  in get_msr_index_list()
267         // Safe because we know self is a real kvm fd  in get_vm_type()
350         // Safe because we know kvm is a real kvm fd as this module is the only one that can make  in new()
355             // Safe because we verify the value of ret and we are the owners of the fd.  in new()
359                 // Safe because the guest regions are guaranteed not to overlap.  in new()
386     /// This is distinct from the `Kvm` version of this method because the some extensions depend on
387     /// the particular `Vm` existence. This method is encouraged by the kernel because it more
391         // Safe because we know that our file is a KVM fd and that the extension is one of the ones  in check_extension()
432         // Safe because we check that the given guest address is valid and has no overlaps. We also  in add_memory_region()
433         // know that the pointer and size are correct because the MemoryMapping interface ensures  in add_memory_region()
465         // Safe because the slot is checked against the list of memory slots.  in remove_memory_region()
470         // This remove will always succeed because of the contains_key check above.  in remove_memory_region()
493                 // Safe because the `dirty_bitmap` pointer assigned above is guaranteed to be valid  in get_dirty_log()
494                 // (because it's from a slice) and we checked that it will be large enough to hold  in get_dirty_log()
521         // Safe because we know that our file is a VM fd and we verify the return result.  in set_identity_map_addr()
538         // Safe because we know that our file is a VM fd, we know the kernel will only write  in get_clock()
554         // Safe because we know that our file is a VM fd, we know the kernel will only read  in set_clock()
570         // Safe because we know that our file is a VM fd and we verify the return result.  in create_irq_chip()
589         // Safe because we know our file is a VM fd, we know the kernel will only write  in get_pic_state()
615         // Safe because we know that our file is a VM fd, we know the kernel will only read  in set_pic_state()
636             // Safe because we know our file is a VM fd, we know the kernel will only write  in get_ioapic_state()
664         // Safe because we know that our file is a VM fd, we know the kernel will only read  in set_ioapic_state()
682         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in set_irq_line()
699         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in create_pit()
717         // Safe because we know that our file is a VM fd, we know the kernel will only write  in get_pit_state()
733         // Safe because we know that our file is a VM fd, we know the kernel will only read  in set_pit_state()
821         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in ioeventfd()
848         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in register_irqfd_resample()
872         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in unregister_irqfd()
891         // Safe because we ensured there is enough space in irq_routing to hold the number of  in set_gsi_routing()
926     /// This function is marked as unsafe because `cap` may contain values which are interpreted as
929         // Safe because we allocated the struct and we know the kernel will read exactly the size of  in kvm_enable_cap()
1044         // Safe because we know that vm a VM fd and we verify the return result.  in new()
1051         // Wrap the vcpu now in case the following ? returns early. This is safe because we verified  in new()
1105         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in set_data()
1113                 // Safe because the exit_reason (which comes from the kernel) told us which  in set_data()
1134                 // Safe because the exit_reason (which comes from the kernel) told us which  in set_data()
1149                 // Safe because the exit_reason (which comes from the kernel) told us which  in set_data()
1174         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in set_immediate_exit()
1200         // Safe because we know that our file is a VCPU fd, we know the kernel will only read the  in get_regs()
1213         // Safe because we know that our file is a VCPU fd, we know the kernel will only read the  in set_regs()
1228         // Safe because we know that our file is a VCPU fd, we know the kernel will only write the  in get_sregs()
1241         // Safe because we know that our file is a VCPU fd, we know the kernel will only read the  in set_sregs()
1257         // Safe because we know that our file is a VCPU fd, we know the kernel will only write the  in get_fpu()
1287         // Safe because we know that our file is a VCPU fd, we know the kernel will only write the  in get_debugregs()
1316         // Safe because we know that our file is a VCPU fd, we know the kernel will only write the  in get_xcrs()
1347             // Mapping the unsized array to a slice is unsafe because the length isn't known.  in get_msrs()
1456             // The ioctl is safe because the kernel will only read from the klapic struct.  in set_lapic()
1477         // Safe because we know that our file is a VCPU fd, we know the kernel will only  in get_mp_state()
1497             // The ioctl is safe because the kernel will only read from the kvm_mp_state struct.  in set_mp_state()
1514         // Safe because we know that our file is a VCPU fd, we know the kernel  in get_vcpu_events()
1531             // The ioctl is safe because the kernel will only read from the  in set_vcpu_events()
1544     /// This function is marked as unsafe because `cap` may contain values which are interpreted as
1548         // Safe because we allocated the struct and we know the kernel will read exactly the size of  in kvm_enable_cap()
1584             // The ioctl is safe because the kernel will only read from the  in set_signal_mask()
1604         // safe because we allocated the struct and we know the kernel will read  in set_one_reg()
1640         // Safe because we know that our file is a VCPU fd and we verify the return result.  in run()
1644             // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in run()
1650                     // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1678                     // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1695                     // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1702                     // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1738                     // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1766                         // Safe because we know the exit reason told us this union  in run()