146         // Open calls are safe because we give a nul-terminated string and verify the result.  in new_with_path()
152         // Safe because we verify that ret is valid and we own the fd.  in new_with_path()
155         // Safe because we know that the descriptor is valid and we verify the return result.  in new_with_path()
181         // Safe because we know that our file is a KVM fd and we verify the return result.  in get_vcpu_mmap_size()
206             // this ioctl is safe because we know this kvm descriptor is valid,  in check_capability()
229         // Safe because we know kvm is a real kvm fd as this module is the only one that can make  in new()
241         // Safe because we verify that ret is valid and we own the fd.  in new()
252                     // Safe because the guest regions are guaranteed not to overlap.  in new()
280         // Safe because we know that our file is a VM fd and we verify the return result.  in create_kvm_vcpu()
286         // Wrap the vcpu now in case the following ? returns early. This is safe because we verified  in create_kvm_vcpu()
309         // Safe because we know that our file is a VM fd and we verify the return result.  in create_irq_chip()
324         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in set_irq_line()
353         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in register_irqfd()
375         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in unregister_irqfd()
392         // Safe because we ensured there is enough space in irq_routing to hold the number of  in set_gsi_routing()
454         // Safe because we know that our file is a VM fd, we know the kernel will only read the  in ioeventfd()
466         // Safe because we know that our file is a KVM fd, and if the cap is invalid KVM assumes  in check_raw_capability()
487     /// This function is marked as unsafe because `args` may be interpreted as pointers for some
502         // Safe because we allocated the struct and we know the kernel will read exactly the size of
503         // the struct, and because we assume the caller has allocated the args appropriately.
569         // the mem.size() to be page size aligned because the mmap will round up the size to be  in add_memory_region()
585         // Safe because we check that the given guest address is valid and has no overlaps. We also  in add_memory_region()
586         // know that the pointer and size are correct because the MemoryMapping interface ensures  in add_memory_region()
626         // Safe because the slot is checked against the list of memory slots.  in remove_memory_region()
631         // This remove will always succeed because of the contains_key check above.  in remove_memory_region()
652         // Safe because we know that our file is a VM fd, we know the kernel will only write correct  in create_device()
656             // Safe because we verify that ret is valid and we own the fd.  in create_device()
676         // Safe because the `dirty_bitmap` pointer assigned above is guaranteed to be valid (because  in get_dirty_log()
870         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in set_immediate_exit()
919             // The ioctl is safe because the kernel will only read from the  in set_signal_mask()
936         // Safe because we allocated the struct and we know the kernel will read exactly the size of
937         // the struct, and because we assume the caller has allocated the args appropriately.
959         // Safe because we know that our file is a VCPU fd and we verify the return result.  in run()
965         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in run()
972                 // Safe because the exit_reason (which comes from the kernel) told us which  in run()
986                 // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1012                 // Safe because we know the exit reason told us this union  in run()
1032                 // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1041                 // Safe because the exit_reason (which comes from the kernel) told us which  in run()
1056         // Safe because we know we mapped enough memory to hold the kvm_run struct because the
1062         // Safe because the exit_reason (which comes from the kernel) told us which
1087         // Safe because we know we mapped enough memory to hold the kvm_run struct because the
1094         // Safe because the exit_reason (which comes from the kernel) told us which
1139         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in handle_hyperv_hypercall()
1144         // Safe because the exit_reason (which comes from the kernel) told us which  in handle_hyperv_hypercall()
1171         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in handle_rdmsr()
1176         // Safe because the exit_reason (which comes from the kernel) told us which  in handle_rdmsr()
1185         // Safe because we know we mapped enough memory to hold the kvm_run struct because the  in handle_wrmsr()
1190         // Safe because the exit_reason (which comes from the kernel) told us which  in handle_wrmsr()
1206         // Safe because we know that our file is a VCPU fd, we know the kernel will only write the  in get_mp_state()
1225             // The ioctl is safe because the kernel will only read from the kvm_mp_state struct.  in set_mp_state()