diff --git a/src/conf/capabilities.c b/src/conf/capabilities.c
index 02298e40a310aa0754e65800cdfa9c25a421a76b..aca9be7c835703e2c63fc4345932172252d872e6 100644
--- a/src/conf/capabilities.c
+++ b/src/conf/capabilities.c
@@ -688,10 +688,8 @@ virCapabilitiesDomainDataLookupInternal(virCaps *caps,
         if (domaintype > VIR_DOMAIN_VIRT_NONE)
             virBufferAsprintf(&buf, "domaintype=%s ",
                               virDomainVirtTypeToString(domaintype));
-        if (emulator)
-            virBufferEscapeString(&buf, "emulator=%s ", emulator);
-        if (machinetype)
-            virBufferEscapeString(&buf, "machine=%s ", machinetype);
+        virBufferEscapeString(&buf, "emulator=%s ", emulator);
+        virBufferEscapeString(&buf, "machine=%s ", machinetype);
         if (virBufferCurrentContent(&buf) &&
             !virBufferCurrentContent(&buf)[0])
             virBufferAsprintf(&buf, "%s", _("any configuration"));
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 04f264210966880c53f0a6124a39e3ea1519c65e..6f7c054fea82b693e4ce2742e11e33b306fea892 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -3824,7 +3824,7 @@ virDomainSecDefFree(virDomainSecDef *def)
     if (!def)
         return;
 
-    switch ((virDomainLaunchSecurity) def->sectype) {
+    switch (def->sectype) {
     case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
         g_free(def->data.sev.dh_cert);
         g_free(def->data.sev.session);
@@ -5377,8 +5377,7 @@ virDomainDeviceInfoFormat(virBuffer *buf,
             if (rombar)
                 virBufferAsprintf(buf, " bar='%s'", rombar);
         }
-        if (info->romfile)
-            virBufferEscapeString(buf, " file='%s'", info->romfile);
+        virBufferEscapeString(buf, " file='%s'", info->romfile);
         virBufferAddLit(buf, "/>\n");
     }
 
@@ -13518,8 +13517,8 @@ virDomainMemoryTargetDefParseXML(xmlNodePtr node,
 
 
 static int
-virDomainSEVDefParseXML(virDomainSEVDef *def,
-                        xmlXPathContextPtr ctxt)
+virDomainSEVCommonDefParseXML(virDomainSEVCommonDef *def,
+                              xmlXPathContextPtr ctxt)
 {
     int rc;
 
@@ -13527,12 +13526,6 @@ virDomainSEVDefParseXML(virDomainSEVDef *def,
                                &def->kernel_hashes) < 0)
         return -1;
 
-    if (virXPathUIntBase("string(./policy)", ctxt, 16, &def->policy) < 0) {
-        virReportError(VIR_ERR_XML_ERROR, "%s",
-                       _("failed to get launch security policy"));
-        return -1;
-    }
-
     /* the following attributes are platform dependent and if missing, we can
      * autofill them from domain capabilities later
      */
@@ -13555,6 +13548,23 @@ virDomainSEVDefParseXML(virDomainSEVDef *def,
         return -1;
     }
 
+    return 0;
+}
+
+
+static int
+virDomainSEVDefParseXML(virDomainSEVDef *def,
+                        xmlXPathContextPtr ctxt)
+{
+    if (virDomainSEVCommonDefParseXML(&def->common, ctxt) < 0)
+        return -1;
+
+    if (virXPathUIntBase("string(./policy)", ctxt, 16, &def->policy) < 0) {
+        virReportError(VIR_ERR_XML_ERROR, "%s",
+                       _("failed to get launch security policy"));
+        return -1;
+    }
+
     def->dh_cert = virXPathString("string(./dhCert)", ctxt);
     def->session = virXPathString("string(./session)", ctxt);
     def->user_id = virXPathString("string(./userid)", ctxt);
@@ -13579,7 +13589,7 @@ virDomainSecDefParseXML(xmlNodePtr lsecNode,
                        &sec->sectype) < 0)
         return NULL;
 
-    switch ((virDomainLaunchSecurity) sec->sectype) {
+    switch (sec->sectype) {
     case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
         if (virDomainSEVDefParseXML(&sec->data.sev, ctxt) < 0)
             return NULL;
@@ -22209,8 +22219,7 @@ virSecurityDeviceLabelDefFormat(virBuffer *buf,
 
     virBufferAddLit(buf, "<seclabel");
 
-    if (def->model)
-        virBufferEscapeString(buf, " model='%s'", def->model);
+    virBufferEscapeString(buf, " model='%s'", def->model);
 
     if (def->labelskip)
         virBufferAddLit(buf, " labelskip='yes'");
@@ -22405,8 +22414,7 @@ virDomainDiskSourceFormatNetwork(virBuffer *attrBuf,
         virBufferAsprintf(childBuf, "<timeout seconds='%llu'/>\n", src->timeout);
 
     if (src->protocol == VIR_STORAGE_NET_PROTOCOL_SSH) {
-        if (src->ssh_known_hosts_file)
-            virBufferEscapeString(childBuf, "<knownHosts path='%s'/>\n", src->ssh_known_hosts_file);
+        virBufferEscapeString(childBuf, "<knownHosts path='%s'/>\n", src->ssh_known_hosts_file);
         if (src->ssh_keyfile || src->ssh_agent) {
             virBufferAddLit(childBuf, "<identity");
 
@@ -23174,8 +23182,7 @@ virDomainControllerDefFormat(virBuffer *buf,
                       " type='%s' index='%d'",
                       type, def->idx);
 
-    if (model)
-        virBufferEscapeString(&attrBuf, " model='%s'", model);
+    virBufferEscapeString(&attrBuf, " model='%s'", model);
 
     switch (def->type) {
     case VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL:
@@ -24594,8 +24601,7 @@ virDomainChrTargetDefFormat(virBuffer *buf,
 
         case VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_XEN:
         case VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO:
-            if (def->target.name)
-                virBufferEscapeString(buf, " name='%s'", def->target.name);
+            virBufferEscapeString(buf, " name='%s'", def->target.name);
 
             if (def->targetType == VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO &&
                 def->state != VIR_DOMAIN_CHR_DEVICE_STATE_DEFAULT &&
@@ -26002,9 +26008,8 @@ virDomainGraphicsDefFormat(virBuffer *buf,
             break;
         }
 
-        if (def->data.vnc.keymap)
-            virBufferEscapeString(buf, " keymap='%s'",
-                                  def->data.vnc.keymap);
+        virBufferEscapeString(buf, " keymap='%s'",
+                              def->data.vnc.keymap);
 
         if (def->data.vnc.sharePolicy)
             virBufferAsprintf(buf, " sharePolicy='%s'",
@@ -26019,13 +26024,11 @@ virDomainGraphicsDefFormat(virBuffer *buf,
         break;
 
     case VIR_DOMAIN_GRAPHICS_TYPE_SDL:
-        if (def->data.sdl.display)
-            virBufferEscapeString(buf, " display='%s'",
-                                  def->data.sdl.display);
+        virBufferEscapeString(buf, " display='%s'",
+                              def->data.sdl.display);
 
-        if (def->data.sdl.xauth)
-            virBufferEscapeString(buf, " xauth='%s'",
-                                  def->data.sdl.xauth);
+        virBufferEscapeString(buf, " xauth='%s'",
+                              def->data.sdl.xauth);
         if (def->data.sdl.fullscreen)
             virBufferAddLit(buf, " fullscreen='yes'");
 
@@ -26064,9 +26067,8 @@ virDomainGraphicsDefFormat(virBuffer *buf,
         break;
 
     case VIR_DOMAIN_GRAPHICS_TYPE_DESKTOP:
-        if (def->data.desktop.display)
-            virBufferEscapeString(buf, " display='%s'",
-                                  def->data.desktop.display);
+        virBufferEscapeString(buf, " display='%s'",
+                              def->data.desktop.display);
 
         if (def->data.desktop.fullscreen)
             virBufferAddLit(buf, " fullscreen='yes'");
@@ -26119,9 +26121,8 @@ virDomainGraphicsDefFormat(virBuffer *buf,
             break;
         }
 
-        if (def->data.spice.keymap)
-            virBufferEscapeString(buf, " keymap='%s'",
-                                  def->data.spice.keymap);
+        virBufferEscapeString(buf, " keymap='%s'",
+                              def->data.spice.keymap);
 
         if (def->data.spice.defaultMode != VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY)
             virBufferAsprintf(buf, " defaultMode='%s'",
@@ -26498,11 +26499,9 @@ virDomainResourceDefFormat(virBuffer *buf,
     if (!def)
         return;
 
-    if (def->partition)
-        virBufferEscapeString(&childBuf, "<partition>%s</partition>\n", def->partition);
+    virBufferEscapeString(&childBuf, "<partition>%s</partition>\n", def->partition);
 
-    if (def->appid)
-        virBufferEscapeString(&childBuf, "<fibrechannel appid='%s'/>\n", def->appid);
+    virBufferEscapeString(&childBuf, "<fibrechannel appid='%s'/>\n", def->appid);
 
     virXMLFormatElement(buf, "resource", NULL, &childBuf);
 }
@@ -26648,6 +26647,24 @@ virDomainKeyWrapDefFormat(virBuffer *buf, virDomainKeyWrapDef *keywrap)
 }
 
 
+static void
+virDomainSEVCommonDefFormat(virBuffer *attrBuf,
+                            virBuffer *childBuf,
+                            virDomainSEVCommonDef *def)
+{
+    if (def->kernel_hashes != VIR_TRISTATE_BOOL_ABSENT)
+        virBufferAsprintf(attrBuf, " kernelHashes='%s'",
+                          virTristateBoolTypeToString(def->kernel_hashes));
+
+    if (def->haveCbitpos)
+        virBufferAsprintf(childBuf, "<cbitpos>%d</cbitpos>\n", def->cbitpos);
+
+    if (def->haveReducedPhysBits)
+        virBufferAsprintf(childBuf, "<reducedPhysBits>%d</reducedPhysBits>\n",
+                          def->reduced_phys_bits);
+}
+
+
 static void
 virDomainSecDefFormat(virBuffer *buf, virDomainSecDef *sec)
 {
@@ -26660,26 +26677,16 @@ virDomainSecDefFormat(virBuffer *buf, virDomainSecDef *sec)
     virBufferAsprintf(&attrBuf, " type='%s'",
                       virDomainLaunchSecurityTypeToString(sec->sectype));
 
-    switch ((virDomainLaunchSecurity) sec->sectype) {
+    switch (sec->sectype) {
     case VIR_DOMAIN_LAUNCH_SECURITY_SEV: {
         virDomainSEVDef *sev = &sec->data.sev;
 
-        if (sev->kernel_hashes != VIR_TRISTATE_BOOL_ABSENT)
-            virBufferAsprintf(&attrBuf, " kernelHashes='%s'",
-                              virTristateBoolTypeToString(sev->kernel_hashes));
-
-        if (sev->haveCbitpos)
-            virBufferAsprintf(&childBuf, "<cbitpos>%d</cbitpos>\n", sev->cbitpos);
+        virDomainSEVCommonDefFormat(&attrBuf, &childBuf, &sev->common);
 
-        if (sev->haveReducedPhysBits)
-            virBufferAsprintf(&childBuf, "<reducedPhysBits>%d</reducedPhysBits>\n",
-                              sev->reduced_phys_bits);
         virBufferAsprintf(&childBuf, "<policy>0x%04x</policy>\n", sev->policy);
-        if (sev->dh_cert)
-            virBufferEscapeString(&childBuf, "<dhCert>%s</dhCert>\n", sev->dh_cert);
+        virBufferEscapeString(&childBuf, "<dhCert>%s</dhCert>\n", sev->dh_cert);
 
-        if (sev->session)
-            virBufferEscapeString(&childBuf, "<session>%s</session>\n", sev->session);
+        virBufferEscapeString(&childBuf, "<session>%s</session>\n", sev->session);
 
         if (sev->user_id)
             virBufferEscapeString(&childBuf, "<userid>%s</userid>\n", sev->user_id);
@@ -27935,9 +27942,8 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def,
     for (i = 0; def->os.initenv && def->os.initenv[i]; i++)
         virBufferAsprintf(buf, "<initenv name='%s'>%s</initenv>\n",
                           def->os.initenv[i]->name, def->os.initenv[i]->value);
-    if (def->os.initdir)
-        virBufferEscapeString(buf, "<initdir>%s</initdir>\n",
-                              def->os.initdir);
+    virBufferEscapeString(buf, "<initdir>%s</initdir>\n",
+                          def->os.initdir);
     if (def->os.inituser)
         virBufferAsprintf(buf, "<inituser>%s</inituser>\n", def->os.inituser);
     if (def->os.initgroup)
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 180f092c067e014893f0c006e2818c0f54e7b971..c2588a8352ccdfa01f9a542432f9d7401afc6eeb 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -2865,15 +2865,19 @@ typedef enum {
 } virDomainLaunchSecurity;
 
 
-struct _virDomainSEVDef {
-    char *dh_cert;
-    char *session;
-    unsigned int policy;
+struct _virDomainSEVCommonDef {
     bool haveCbitpos;
     unsigned int cbitpos;
     bool haveReducedPhysBits;
     unsigned int reduced_phys_bits;
     virTristateBool kernel_hashes;
+};
+
+struct _virDomainSEVDef {
+    virDomainSEVCommonDef common;
+    char *dh_cert;
+    char *session;
+    unsigned int policy;
     char *user_id;
     char *secret_header;
     char *secret;
diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 0449b6f07c7325650d336df63e5c0add0928530a..cc8956af538c44e37f23c8ea34e517c9a12a8b85 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -2043,10 +2043,8 @@ virNetworkDNSDefFormat(virBuffer *buf,
                                   def->srvs[i].service);
             virBufferEscapeString(buf, "protocol='%s'", def->srvs[i].protocol);
 
-            if (def->srvs[i].domain)
-                virBufferEscapeString(buf, " domain='%s'", def->srvs[i].domain);
-            if (def->srvs[i].target)
-                virBufferEscapeString(buf, " target='%s'", def->srvs[i].target);
+            virBufferEscapeString(buf, " domain='%s'", def->srvs[i].domain);
+            virBufferEscapeString(buf, " target='%s'", def->srvs[i].target);
             if (def->srvs[i].port)
                 virBufferAsprintf(buf, " port='%d'", def->srvs[i].port);
             if (def->srvs[i].priority)
diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
index f722ab37c60a60998f62fa5fa0a7f67cbac1e395..6c78c9a263381c27bcae540bf9f84cd2949a8b56 100644
--- a/src/conf/node_device_conf.c
+++ b/src/conf/node_device_conf.c
@@ -176,20 +176,16 @@ virNodeDeviceCapSystemDefFormat(virBuffer *buf,
 {
     char uuidstr[VIR_UUID_STRING_BUFLEN];
 
-    if (data->system.product_name)
-        virBufferEscapeString(buf, "<product>%s</product>\n",
-                              data->system.product_name);
+    virBufferEscapeString(buf, "<product>%s</product>\n",
+                          data->system.product_name);
     virBufferAddLit(buf, "<hardware>\n");
     virBufferAdjustIndent(buf, 2);
-    if (data->system.hardware.vendor_name)
-        virBufferEscapeString(buf, "<vendor>%s</vendor>\n",
-                              data->system.hardware.vendor_name);
-    if (data->system.hardware.version)
-        virBufferEscapeString(buf, "<version>%s</version>\n",
-                              data->system.hardware.version);
-    if (data->system.hardware.serial)
-        virBufferEscapeString(buf, "<serial>%s</serial>\n",
-                              data->system.hardware.serial);
+    virBufferEscapeString(buf, "<vendor>%s</vendor>\n",
+                          data->system.hardware.vendor_name);
+    virBufferEscapeString(buf, "<version>%s</version>\n",
+                          data->system.hardware.version);
+    virBufferEscapeString(buf, "<serial>%s</serial>\n",
+                          data->system.hardware.serial);
     virUUIDFormat(data->system.hardware.uuid, uuidstr);
     virBufferAsprintf(buf, "<uuid>%s</uuid>\n", uuidstr);
     virBufferAdjustIndent(buf, -2);
@@ -197,15 +193,12 @@ virNodeDeviceCapSystemDefFormat(virBuffer *buf,
 
     virBufferAddLit(buf, "<firmware>\n");
     virBufferAdjustIndent(buf, 2);
-    if (data->system.firmware.vendor_name)
-        virBufferEscapeString(buf, "<vendor>%s</vendor>\n",
-                              data->system.firmware.vendor_name);
-    if (data->system.firmware.version)
-        virBufferEscapeString(buf, "<version>%s</version>\n",
-                              data->system.firmware.version);
-    if (data->system.firmware.release_date)
-        virBufferEscapeString(buf, "<release_date>%s</release_date>\n",
-                              data->system.firmware.release_date);
+    virBufferEscapeString(buf, "<vendor>%s</vendor>\n",
+                          data->system.firmware.vendor_name);
+    virBufferEscapeString(buf, "<version>%s</version>\n",
+                          data->system.firmware.version);
+    virBufferEscapeString(buf, "<release_date>%s</release_date>\n",
+                          data->system.firmware.release_date);
     virBufferAdjustIndent(buf, -2);
     virBufferAddLit(buf, "</firmware>\n");
 }
@@ -225,9 +218,8 @@ virNodeDeviceCapMdevTypesFormat(virBuffer *buf,
             virMediatedDeviceType *type = mdev_types[i];
             virBufferEscapeString(buf, "<type id='%s'>\n", type->id);
             virBufferAdjustIndent(buf, 2);
-            if (type->name)
-                virBufferEscapeString(buf, "<name>%s</name>\n",
-                                      type->name);
+            virBufferEscapeString(buf, "<name>%s</name>\n",
+                                  type->name);
             virBufferEscapeString(buf, "<deviceAPI>%s</deviceAPI>\n",
                                   type->device_api);
             virBufferAsprintf(buf,
@@ -451,10 +443,9 @@ virNodeDeviceCapUSBInterfaceDefFormat(virBuffer *buf,
                       data->usb_if.subclass);
     virBufferAsprintf(buf, "<protocol>%d</protocol>\n",
                       data->usb_if.protocol);
-    if (data->usb_if.description)
-        virBufferEscapeString(buf,
-                              "<description>%s</description>\n",
-                              data->usb_if.description);
+    virBufferEscapeString(buf,
+                          "<description>%s</description>\n",
+                          data->usb_if.description);
 }
 
 
@@ -466,9 +457,8 @@ virNodeDeviceCapNetDefFormat(virBuffer *buf,
 
     virBufferEscapeString(buf, "<interface>%s</interface>\n",
                           data->net.ifname);
-    if (data->net.address)
-        virBufferEscapeString(buf, "<address>%s</address>\n",
-                              data->net.address);
+    virBufferEscapeString(buf, "<address>%s</address>\n",
+                          data->net.address);
     virInterfaceLinkFormat(buf, &data->net.lnk);
     if (data->net.features) {
         for (i = 0; i < VIR_NET_DEV_FEAT_LAST; i++) {
@@ -530,9 +520,8 @@ virNodeDeviceCapSCSIDefFormat(virBuffer *buf,
     virBufferAsprintf(buf, "<target>%d</target>\n",
                       data->scsi.target);
     virBufferAsprintf(buf, "<lun>%d</lun>\n", data->scsi.lun);
-    if (data->scsi.type)
-        virBufferEscapeString(buf, "<type>%s</type>\n",
-                              data->scsi.type);
+    virBufferEscapeString(buf, "<type>%s</type>\n",
+                          data->scsi.type);
 }
 
 
diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
index a2e011988819be2549f47ef2bad3a51fc1083c3d..160d28344cceed4aec733f9e02578885efaad498 100644
--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
@@ -527,6 +527,19 @@
     </element>
   </define>
 
+  <define name="launchSecuritySEVCommon">
+    <optional>
+      <element name="cbitpos">
+        <data type="unsignedInt"/>
+      </element>
+    </optional>
+    <optional>
+      <element name="reducedPhysBits">
+        <data type="unsignedInt"/>
+      </element>
+    </optional>
+  </define>
+
   <define name="launchSecuritySEV">
     <attribute name="type">
       <value>sev</value>
@@ -537,16 +550,7 @@
       </attribute>
     </optional>
     <interleave>
-      <optional>
-        <element name="cbitpos">
-          <data type="unsignedInt"/>
-        </element>
-      </optional>
-      <optional>
-        <element name="reducedPhysBits">
-          <data type="unsignedInt"/>
-        </element>
-      </optional>
+      <ref name="launchSecuritySEVCommon"/>
       <element name="policy">
         <ref name="hexuint"/>
       </element>
diff --git a/src/conf/snapshot_conf.c b/src/conf/snapshot_conf.c
index d7fcded302a44a635b6f933ecd5cb2cc67f992be..039ed77b846c23f474fde1fd9af2e6e33bbb0e2e 100644
--- a/src/conf/snapshot_conf.c
+++ b/src/conf/snapshot_conf.c
@@ -819,9 +819,8 @@ virDomainSnapshotDefFormatInternal(virBuffer *buf,
     virBufferAdjustIndent(buf, 2);
 
     virBufferEscapeString(buf, "<name>%s</name>\n", def->parent.name);
-    if (def->parent.description)
-        virBufferEscapeString(buf, "<description>%s</description>\n",
-                              def->parent.description);
+    virBufferEscapeString(buf, "<description>%s</description>\n",
+                          def->parent.description);
     if (def->state)
         virBufferAsprintf(buf, "<state>%s</state>\n",
                           virDomainSnapshotStateTypeToString(def->state));
diff --git a/src/conf/storage_encryption_conf.c b/src/conf/storage_encryption_conf.c
index 1849df5c6c9bd36259d2e72dfc40de68e4798d76..b86001ec5092cd797b8f72539072e0b2a254e502 100644
--- a/src/conf/storage_encryption_conf.c
+++ b/src/conf/storage_encryption_conf.c
@@ -317,16 +317,13 @@ virStorageEncryptionInfoDefFormat(virBuffer *buf,
 {
     virBufferEscapeString(buf, "<cipher name='%s'", enc->cipher_name);
     virBufferAsprintf(buf, " size='%u'", enc->cipher_size);
-    if (enc->cipher_mode)
-        virBufferEscapeString(buf, " mode='%s'", enc->cipher_mode);
-    if (enc->cipher_hash)
-        virBufferEscapeString(buf, " hash='%s'", enc->cipher_hash);
+    virBufferEscapeString(buf, " mode='%s'", enc->cipher_mode);
+    virBufferEscapeString(buf, " hash='%s'", enc->cipher_hash);
     virBufferAddLit(buf, "/>\n");
 
     if (enc->ivgen_name) {
         virBufferEscapeString(buf, "<ivgen name='%s'", enc->ivgen_name);
-        if (enc->ivgen_hash)
-            virBufferEscapeString(buf, " hash='%s'", enc->ivgen_hash);
+        virBufferEscapeString(buf, " hash='%s'", enc->ivgen_hash);
         virBufferAddLit(buf, "/>\n");
     }
 }
diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c
index f974a521b1f6b2bfc8adccf6cbc9982e664005ef..003fbf031e2910d9d697827b5f8887b0dd7b7735 100644
--- a/src/conf/storage_source_conf.c
+++ b/src/conf/storage_source_conf.c
@@ -1347,8 +1347,7 @@ int
 virStorageSourcePrivateDataFormatRelPath(virStorageSource *src,
                                          virBuffer *buf)
 {
-    if (src->relPath)
-        virBufferEscapeString(buf, "<relPath>%s</relPath>\n", src->relPath);
+    virBufferEscapeString(buf, "<relPath>%s</relPath>\n", src->relPath);
 
     return 0;
 }
diff --git a/src/conf/virconftypes.h b/src/conf/virconftypes.h
index bcdcb8b825b97c81c28c865bb4a7454eed9d87a5..d175e548983ecb6371cf518d79796623c430bffa 100644
--- a/src/conf/virconftypes.h
+++ b/src/conf/virconftypes.h
@@ -210,6 +210,8 @@ typedef struct _virDomainResctrlMonDef virDomainResctrlMonDef;
 
 typedef struct _virDomainResourceDef virDomainResourceDef;
 
+typedef struct _virDomainSEVCommonDef virDomainSEVCommonDef;
+
 typedef struct _virDomainSEVDef virDomainSEVDef;
 
 typedef struct _virDomainSecDef virDomainSecDef;
diff --git a/src/conf/virnwfilterbindingdef.c b/src/conf/virnwfilterbindingdef.c
index 423ed7a392b3cd692ce786c4bd0db2bf9faa98a3..fe45c843472136f3e45ceb0a1d47217c84453ef3 100644
--- a/src/conf/virnwfilterbindingdef.c
+++ b/src/conf/virnwfilterbindingdef.c
@@ -203,8 +203,7 @@ virNWFilterBindingDefFormatBuf(virBuffer *buf,
     virBufferAddLit(buf, "</owner>\n");
 
     virBufferEscapeString(buf, "<portdev name='%s'/>\n", def->portdevname);
-    if (def->linkdevname)
-        virBufferEscapeString(buf, "<linkdev name='%s'/>\n", def->linkdevname);
+    virBufferEscapeString(buf, "<linkdev name='%s'/>\n", def->linkdevname);
 
     virMacAddrFormat(&def->mac, mac);
     virBufferAsprintf(buf, "<mac address='%s'/>\n", mac);
diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
index 47402b37507b6728501391c784b6b5a360f0a55b..1280989a0170c75f94b13e7b824ce6cf1b3b9322 100644
--- a/src/qemu/qemu_cgroup.c
+++ b/src/qemu/qemu_cgroup.c
@@ -844,10 +844,21 @@ qemuSetupDevicesCgroup(virDomainObj *vm)
             return -1;
     }
 
-    if (vm->def->sec &&
-        vm->def->sec->sectype == VIR_DOMAIN_LAUNCH_SECURITY_SEV &&
-        qemuSetupSEVCgroup(vm) < 0)
-        return -1;
+    if (vm->def->sec) {
+        switch (vm->def->sec->sectype) {
+        case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
+            if (qemuSetupSEVCgroup(vm) < 0)
+                return -1;
+            break;
+        case VIR_DOMAIN_LAUNCH_SECURITY_PV:
+            break;
+	case VIR_DOMAIN_LAUNCH_SECURITY_CVM:
+        case VIR_DOMAIN_LAUNCH_SECURITY_NONE:
+        case VIR_DOMAIN_LAUNCH_SECURITY_LAST:
+            virReportEnumRangeError(virDomainLaunchSecurity, vm->def->sec->sectype);
+            return -1;
+        }
+    }
 
     return 0;
 }
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index c6ce598e4a74e3fe61f53bc6aa5d46c224e9bddb..97cf5f7eaad5c1b2e5b47e7d6bbed67beacaa13c 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -7055,7 +7055,7 @@ qemuBuildMachineCommandLine(virCommand *cmd,
     qemuAppendLoadparmMachineParm(&buf, def);
 
     if (def->sec) {
-        switch ((virDomainLaunchSecurity) def->sec->sectype) {
+        switch (def->sec->sectype) {
         case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
             if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SUPPORT)) {
                 virBufferAddLit(&buf, ",confidential-guest-support=lsec0");
@@ -9811,7 +9811,7 @@ qemuBuildSEVCommandLine(virDomainObj *vm, virCommand *cmd,
     g_autofree char *secretpath = NULL;
 
     VIR_DEBUG("policy=0x%x cbitpos=%d reduced_phys_bits=%d",
-              sev->policy, sev->cbitpos, sev->reduced_phys_bits);
+              sev->policy, sev->common.cbitpos, sev->common.reduced_phys_bits);
 
     if (sev->user_id)
         VIR_DEBUG("user_id=%s", sev->user_id);
@@ -9829,13 +9829,13 @@ qemuBuildSEVCommandLine(virDomainObj *vm, virCommand *cmd,
         secretpath = g_strdup_printf("%s/secret.base64", priv->libDir);
 
     if (qemuMonitorCreateObjectProps(&props, "sev-guest", "lsec0",
-                                     "u:cbitpos", sev->cbitpos,
-                                     "u:reduced-phys-bits", sev->reduced_phys_bits,
+                                     "u:cbitpos", sev->common.cbitpos,
+                                     "u:reduced-phys-bits", sev->common.reduced_phys_bits,
                                      "u:policy", sev->policy,
                                      "S:user-id", sev->user_id,
                                      "S:dh-cert-file", dhpath,
                                      "S:session-file", sessionpath,
-                                     "T:kernel-hashes", sev->kernel_hashes,
+                                     "T:kernel-hashes", sev->common.kernel_hashes,
                                      "S:secret-header-file", secretheaderpath,
                                      "S:secret-file", secretpath,
                                      NULL) < 0)
@@ -9872,7 +9872,7 @@ qemuBuildSecCommandLine(virDomainObj *vm, virCommand *cmd,
     if (!sec)
         return 0;
 
-    switch ((virDomainLaunchSecurity) sec->sectype) {
+    switch (sec->sectype) {
     case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
         return qemuBuildSEVCommandLine(vm, cmd, &sec->data.sev);
         break;
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index df275c403c78fa586c59f52eb9b824627764dc2a..1aab51dea82ddfeea648df5ee570e04118d87478 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -19105,10 +19105,23 @@ qemuDomainGetLaunchSecurityInfo(virDomainPtr domain,
     if (virDomainGetLaunchSecurityInfoEnsureACL(domain->conn, vm->def) < 0)
         goto cleanup;
 
-    if (vm->def->sec &&
-        vm->def->sec->sectype == VIR_DOMAIN_LAUNCH_SECURITY_SEV) {
+    if (!vm->def->sec) {
+        ret = 0;
+        goto cleanup;
+    }
+
+    switch (vm->def->sec->sectype) {
+    case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
         if (qemuDomainGetSEVInfo(vm, params, nparams, flags) < 0)
             goto cleanup;
+        break;
+    case VIR_DOMAIN_LAUNCH_SECURITY_PV:
+        break;
+    case VIR_DOMAIN_LAUNCH_SECURITY_CVM:
+    case VIR_DOMAIN_LAUNCH_SECURITY_NONE:
+    case VIR_DOMAIN_LAUNCH_SECURITY_LAST:
+        virReportEnumRangeError(virDomainLaunchSecurity, vm->def->sec->sectype);
+        return -1;
     }
 
     ret = 0;
diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
index 31ed6e881bb9a543865303865386321f898d24cb..8ee16daf8d4994956b7129d7968de14d060ddbdd 100644
--- a/src/qemu/qemu_firmware.c
+++ b/src/qemu/qemu_firmware.c
@@ -1358,7 +1358,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
     }
 
     if (def->sec) {
-        switch ((virDomainLaunchSecurity) def->sec->sectype) {
+        switch (def->sec->sectype) {
         case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
             if (!supportsSEV) {
                 VIR_DEBUG("Domain requires SEV, firmware '%s' doesn't support it",
diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
index 7f23d034b807f61a3f65952552c6594ca76f545d..95cfc881b99a2b635548afe96d4cb4bbf2dd19a8 100644
--- a/src/qemu/qemu_monitor_json.c
+++ b/src/qemu/qemu_monitor_json.c
@@ -8023,8 +8023,11 @@ qemuMonitorJSONGetSEVMeasurement(qemuMonitor *mon)
     if (!(data = qemuMonitorJSONGetReply(cmd, reply, VIR_JSON_TYPE_OBJECT)))
         return NULL;
 
-    if (!(tmp = virJSONValueObjectGetString(data, "data")))
+    if (!(tmp = virJSONValueObjectGetString(data, "data"))) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       _("query-sev-launch-measure reply was missing 'data'"));
         return NULL;
+    }
 
     return g_strdup(tmp);
 }
@@ -8067,8 +8070,11 @@ qemuMonitorJSONGetSEVInfo(qemuMonitor *mon,
     if (virJSONValueObjectGetNumberUint(data, "api-major", apiMajor) < 0 ||
         virJSONValueObjectGetNumberUint(data, "api-minor", apiMinor) < 0 ||
         virJSONValueObjectGetNumberUint(data, "build-id", buildID) < 0 ||
-        virJSONValueObjectGetNumberUint(data, "policy", policy) < 0)
+        virJSONValueObjectGetNumberUint(data, "policy", policy) < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       _("query-sev reply was missing some data"));
         return -1;
+    }
 
     return 0;
 }
diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
index ff314ce243c0d33c067876a431989f0596ed38f2..821e0594802d13ebae0671568123d6281c5ebb96 100644
--- a/src/qemu/qemu_namespace.c
+++ b/src/qemu/qemu_namespace.c
@@ -651,7 +651,7 @@ qemuDomainSetupLaunchSecurity(virDomainObj *vm,
     if (!sec)
         return 0;
 
-    switch ((virDomainLaunchSecurity) sec->sectype) {
+    switch (sec->sectype) {
     case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
         VIR_DEBUG("Setting up launch security for SEV");
 
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 5240fbce0931c6a0b469ee906f4aa00b7b8472e3..08c1bca53c6b89ba67641a8c91351037040d4b1e 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -6811,14 +6811,14 @@ qemuProcessUpdateSEVInfo(virDomainObj *vm)
      * mandatory on QEMU cmdline
      */
     sevCaps = virQEMUCapsGetSEVCapabilities(qemuCaps);
-    if (!sev->haveCbitpos) {
-        sev->cbitpos = sevCaps->cbitpos;
-        sev->haveCbitpos = true;
+    if (!sev->common.haveCbitpos) {
+        sev->common.cbitpos = sevCaps->cbitpos;
+        sev->common.haveCbitpos = true;
     }
 
-    if (!sev->haveReducedPhysBits) {
-        sev->reduced_phys_bits = sevCaps->reduced_phys_bits;
-        sev->haveReducedPhysBits = true;
+    if (!sev->common.haveReducedPhysBits) {
+        sev->common.reduced_phys_bits = sevCaps->reduced_phys_bits;
+        sev->common.haveReducedPhysBits = true;
     }
 
     return 0;
@@ -6979,11 +6979,21 @@ qemuProcessPrepareDomain(virQEMUDriver *driver,
     for (i = 0; i < vm->def->nshmems; i++)
         qemuDomainPrepareShmemChardev(vm->def->shmems[i]);
 
-    if (vm->def->sec &&
-        vm->def->sec->sectype == VIR_DOMAIN_LAUNCH_SECURITY_SEV) {
-        VIR_DEBUG("Updating SEV platform info");
-        if (qemuProcessUpdateSEVInfo(vm) < 0)
+    if (vm->def->sec) {
+        switch (vm->def->sec->sectype) {
+        case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
+            VIR_DEBUG("Updating SEV platform info");
+            if (qemuProcessUpdateSEVInfo(vm) < 0)
+                return -1;
+            break;
+        case VIR_DOMAIN_LAUNCH_SECURITY_PV:
+            break;
+        case VIR_DOMAIN_LAUNCH_SECURITY_CVM:
+        case VIR_DOMAIN_LAUNCH_SECURITY_NONE:
+        case VIR_DOMAIN_LAUNCH_SECURITY_LAST:
+            virReportEnumRangeError(virDomainLaunchSecurity, vm->def->sec->sectype);
             return -1;
+        }
     }
 
     return 0;
@@ -7054,7 +7064,7 @@ qemuProcessPrepareLaunchSecurityGuestInput(virDomainObj *vm)
     if (!sec)
         return 0;
 
-    switch ((virDomainLaunchSecurity) sec->sectype) {
+    switch (sec->sectype) {
     case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
         return qemuProcessPrepareSEVGuestInput(vm);
     case VIR_DOMAIN_LAUNCH_SECURITY_PV:
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 5894e2bd26a17e4c1502c1dfbe76fd4c101d220c..33f0994d141e884e384f141cd468e0641d2f8624 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -1297,7 +1297,7 @@ qemuValidateDomainDef(const virDomainDef *def,
         return -1;
 
     if (def->sec) {
-        switch ((virDomainLaunchSecurity) def->sec->sectype) {
+        switch (def->sec->sectype) {
         case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
             if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST)) {
                 virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@@ -1305,7 +1305,7 @@ qemuValidateDomainDef(const virDomainDef *def,
                 return -1;
             }
 
-            if (def->sec->data.sev.kernel_hashes != VIR_TRISTATE_BOOL_ABSENT &&
+            if (def->sec->data.sev.common.kernel_hashes != VIR_TRISTATE_BOOL_ABSENT &&
                 !virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST_KERNEL_HASHES)) {
                 virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
                                _("SEV measured direct kernel boot is not supported with this QEMU binary"));
diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index 96aebfce5b0c69cf23d086d8cc2ded49ea6e9453..4be9174704ea34660e82bf045b9b30d2c6e2cad9 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -1977,10 +1977,20 @@ virSecurityDACRestoreAllLabel(virSecurityManager *mgr,
             rc = -1;
     }
 
-    if (def->sec &&
-        def->sec->sectype == VIR_DOMAIN_LAUNCH_SECURITY_SEV) {
-        if (virSecurityDACRestoreSEVLabel(mgr, def) < 0)
-            rc = -1;
+    if (def->sec) {
+        switch (def->sec->sectype) {
+        case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
+            if (virSecurityDACRestoreSEVLabel(mgr, def) < 0)
+                rc = -1;
+            break;
+        case VIR_DOMAIN_LAUNCH_SECURITY_PV:
+            break;
+	case VIR_DOMAIN_LAUNCH_SECURITY_CVM:
+        case VIR_DOMAIN_LAUNCH_SECURITY_NONE:
+        case VIR_DOMAIN_LAUNCH_SECURITY_LAST:
+            virReportEnumRangeError(virDomainLaunchSecurity, def->sec->sectype);
+            return -1;
+        }
     }
 
     for (i = 0; i < def->nsysinfo; i++) {
@@ -2201,10 +2211,20 @@ virSecurityDACSetAllLabel(virSecurityManager *mgr,
             return -1;
     }
 
-    if (def->sec &&
-        def->sec->sectype == VIR_DOMAIN_LAUNCH_SECURITY_SEV) {
-        if (virSecurityDACSetSEVLabel(mgr, def) < 0)
+    if (def->sec) {
+        switch (def->sec->sectype) {
+        case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
+            if (virSecurityDACSetSEVLabel(mgr, def) < 0)
+                return -1;
+            break;
+        case VIR_DOMAIN_LAUNCH_SECURITY_PV:
+            break;
+        case VIR_DOMAIN_LAUNCH_SECURITY_CVM:
+        case VIR_DOMAIN_LAUNCH_SECURITY_NONE:
+        case VIR_DOMAIN_LAUNCH_SECURITY_LAST:
+            virReportEnumRangeError(virDomainLaunchSecurity, def->sec->sectype);
             return -1;
+        }
     }
 
     if (virSecurityDACGetImageIds(secdef, priv, &user, &group))