Move QOM typedefs and add missing includes

[qemu.git] / target / i386 / sev.c

diff --git a/target/i386/sev.c b/target/i386/sev.c
index 2395171acfdbb860d9e8a158c4610044bae20b57..d452e73c18e8d4612fe0664a0fcf005e83f8e18b 100644 (file)
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -11,25 +11,67 @@
  *
  */
 
  *
  */
 

+#include "qemu/osdep.h"
+

 #include <linux/kvm.h>
 #include <linux/psp-sev.h>
 
 #include <sys/ioctl.h>
 
 #include <linux/kvm.h>
 #include <linux/psp-sev.h>
 
 #include <sys/ioctl.h>
 

-#include "qemu/osdep.h"

 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
 #include "qemu/base64.h"
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
 #include "qemu/base64.h"

+#include "qemu/module.h"

 #include "sysemu/kvm.h"
 #include "sev_i386.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sev_i386.h"
 #include "sysemu/sysemu.h"

+#include "sysemu/runstate.h"

 #include "trace.h"
 #include "migration/blocker.h"
 #include "trace.h"
 #include "migration/blocker.h"

+#include "qom/object.h"
+
+#define TYPE_SEV_GUEST "sev-guest"
+typedef struct SevGuestState SevGuestState;
+#define SEV_GUEST(obj)                                          \
+    OBJECT_CHECK(SevGuestState, (obj), TYPE_SEV_GUEST)
+
+
+/**
+ * SevGuestState:
+ *
+ * The SevGuestState object is used for creating and managing a SEV
+ * guest.
+ *
+ * # $QEMU \
+ *         -object sev-guest,id=sev0 \
+ *         -machine ...,memory-encryption=sev0
+ */
+struct SevGuestState {
+    Object parent_obj;
+
+    /* configuration parameters */
+    char *sev_device;
+    uint32_t policy;
+    char *dh_cert_file;
+    char *session_file;
+    uint32_t cbitpos;
+    uint32_t reduced_phys_bits;
+
+    /* runtime state */
+    uint32_t handle;
+    uint8_t api_major;
+    uint8_t api_minor;
+    uint8_t build_id;
+    uint64_t me_mask;
+    int sev_fd;
+    SevState state;
+    gchar *measurement;
+};

 
 #define DEFAULT_GUEST_POLICY    0x1 /* disable debug */
 #define DEFAULT_SEV_DEVICE      "/dev/sev"
 
 
 #define DEFAULT_GUEST_POLICY    0x1 /* disable debug */
 #define DEFAULT_SEV_DEVICE      "/dev/sev"
 

-static SEVState *sev_state;
+static SevGuestState *sev_guest;

 static Error *sev_mig_blocker;
 
 static const char *const sev_fw_errlist[] = {
 static Error *sev_mig_blocker;
 
 static const char *const sev_fw_errlist[] = {


@@ -108,21 +150,21 @@ fw_error_to_str(int code)
 }
 
 static bool
 }
 
 static bool

-sev_check_state(SevState state)
+sev_check_state(const SevGuestState *sev, SevState state)

 {
 {

-    assert(sev_state);
-    return sev_state->state == state ? true : false;
+    assert(sev);
+    return sev->state == state ? true : false;

 }
 
 static void
 }
 
 static void

-sev_set_guest_state(SevState new_state)
+sev_set_guest_state(SevGuestState *sev, SevState new_state)

 {
     assert(new_state < SEV_STATE__MAX);
 {
     assert(new_state < SEV_STATE__MAX);

-    assert(sev_state);
+    assert(sev);

 
 

-    trace_kvm_sev_change_state(SevState_str(sev_state->state),
+    trace_kvm_sev_change_state(SevState_str(sev->state),

                                SevState_str(new_state));
                                SevState_str(new_state));

-    sev_state->state = new_state;
+    sev->state = new_state;

 }
 
 static void
 }
 
 static void


@@ -130,6 +172,17 @@ sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)
 {
     int r;
     struct kvm_enc_region range;
 {
     int r;
     struct kvm_enc_region range;

+    ram_addr_t offset;
+    MemoryRegion *mr;
+
+    /*
+     * The RAM device presents a memory region that should be treated
+     * as IO region and should not be pinned.
+     */
+    mr = memory_region_from_host(host, &offset);
+    if (mr && memory_region_is_ram_device(mr)) {
+        return;
+    }

 
     range.addr = (__u64)(unsigned long)host;
     range.size = size;
 
     range.addr = (__u64)(unsigned long)host;
     range.size = size;


@@ -148,6 +201,17 @@ sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size)
 {
     int r;
     struct kvm_enc_region range;
 {
     int r;
     struct kvm_enc_region range;

+    ram_addr_t offset;
+    MemoryRegion *mr;
+
+    /*
+     * The RAM device presents a memory region that should be treated
+     * as IO region and should not have been pinned.
+     */
+    mr = memory_region_from_host(host, &offset);
+    if (mr && memory_region_is_ram_device(mr)) {
+        return;
+    }

 
     range.addr = (__u64)(unsigned long)host;
     range.size = size;
 
     range.addr = (__u64)(unsigned long)host;
     range.size = size;


@@ -166,215 +230,123 @@ static struct RAMBlockNotifier sev_ram_notifier = {
 };
 
 static void
 };
 
 static void

-qsev_guest_finalize(Object *obj)
+sev_guest_finalize(Object *obj)

 {
 }
 
 static char *
 {
 }
 
 static char *

-qsev_guest_get_session_file(Object *obj, Error **errp)
+sev_guest_get_session_file(Object *obj, Error **errp)

 {
 {

-    QSevGuestInfo *s = QSEV_GUEST_INFO(obj);
+    SevGuestState *s = SEV_GUEST(obj);

 
     return s->session_file ? g_strdup(s->session_file) : NULL;
 }
 
 static void
 
     return s->session_file ? g_strdup(s->session_file) : NULL;
 }
 
 static void

-qsev_guest_set_session_file(Object *obj, const char *value, Error **errp)
+sev_guest_set_session_file(Object *obj, const char *value, Error **errp)

 {
 {

-    QSevGuestInfo *s = QSEV_GUEST_INFO(obj);
+    SevGuestState *s = SEV_GUEST(obj);

 
     s->session_file = g_strdup(value);
 }
 
 static char *
 
     s->session_file = g_strdup(value);
 }
 
 static char *

-qsev_guest_get_dh_cert_file(Object *obj, Error **errp)
+sev_guest_get_dh_cert_file(Object *obj, Error **errp)

 {
 {

-    QSevGuestInfo *s = QSEV_GUEST_INFO(obj);
+    SevGuestState *s = SEV_GUEST(obj);

 
     return g_strdup(s->dh_cert_file);
 }
 
 static void
 
     return g_strdup(s->dh_cert_file);
 }
 
 static void

-qsev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp)
+sev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp)

 {
 {

-    QSevGuestInfo *s = QSEV_GUEST_INFO(obj);
+    SevGuestState *s = SEV_GUEST(obj);

 
     s->dh_cert_file = g_strdup(value);
 }
 
 static char *
 
     s->dh_cert_file = g_strdup(value);
 }
 
 static char *

-qsev_guest_get_sev_device(Object *obj, Error **errp)
+sev_guest_get_sev_device(Object *obj, Error **errp)

 {
 {

-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
+    SevGuestState *sev = SEV_GUEST(obj);

 
     return g_strdup(sev->sev_device);
 }
 
 static void
 
     return g_strdup(sev->sev_device);
 }
 
 static void

-qsev_guest_set_sev_device(Object *obj, const char *value, Error **errp)
+sev_guest_set_sev_device(Object *obj, const char *value, Error **errp)

 {
 {

-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
+    SevGuestState *sev = SEV_GUEST(obj);

 
     sev->sev_device = g_strdup(value);
 }
 
 static void
 
     sev->sev_device = g_strdup(value);
 }
 
 static void

-qsev_guest_class_init(ObjectClass *oc, void *data)
+sev_guest_class_init(ObjectClass *oc, void *data)

 {
     object_class_property_add_str(oc, "sev-device",
 {
     object_class_property_add_str(oc, "sev-device",

-                                  qsev_guest_get_sev_device,
-                                  qsev_guest_set_sev_device,
-                                  NULL);
+                                  sev_guest_get_sev_device,
+                                  sev_guest_set_sev_device);

     object_class_property_set_description(oc, "sev-device",
     object_class_property_set_description(oc, "sev-device",

-            "SEV device to use", NULL);
+            "SEV device to use");

     object_class_property_add_str(oc, "dh-cert-file",
     object_class_property_add_str(oc, "dh-cert-file",

-                                  qsev_guest_get_dh_cert_file,
-                                  qsev_guest_set_dh_cert_file,
-                                  NULL);
+                                  sev_guest_get_dh_cert_file,
+                                  sev_guest_set_dh_cert_file);

     object_class_property_set_description(oc, "dh-cert-file",
     object_class_property_set_description(oc, "dh-cert-file",

-            "guest owners DH certificate (encoded with base64)", NULL);
+            "guest owners DH certificate (encoded with base64)");

     object_class_property_add_str(oc, "session-file",
     object_class_property_add_str(oc, "session-file",

-                                  qsev_guest_get_session_file,
-                                  qsev_guest_set_session_file,
-                                  NULL);
+                                  sev_guest_get_session_file,
+                                  sev_guest_set_session_file);

     object_class_property_set_description(oc, "session-file",
     object_class_property_set_description(oc, "session-file",

-            "guest owners session parameters (encoded with base64)", NULL);
-}
-
-static void
-qsev_guest_set_handle(Object *obj, Visitor *v, const char *name,
-                      void *opaque, Error **errp)
-{
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-    uint32_t value;
-
-    visit_type_uint32(v, name, &value, errp);
-    sev->handle = value;
-}
-
-static void
-qsev_guest_set_policy(Object *obj, Visitor *v, const char *name,
-                      void *opaque, Error **errp)
-{
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-    uint32_t value;
-
-    visit_type_uint32(v, name, &value, errp);
-    sev->policy = value;
+            "guest owners session parameters (encoded with base64)");

 }
 
 static void
 }
 
 static void

-qsev_guest_set_cbitpos(Object *obj, Visitor *v, const char *name,
-                       void *opaque, Error **errp)
+sev_guest_instance_init(Object *obj)

 {
 {

-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-    uint32_t value;
-
-    visit_type_uint32(v, name, &value, errp);
-    sev->cbitpos = value;
-}
-
-static void
-qsev_guest_set_reduced_phys_bits(Object *obj, Visitor *v, const char *name,
-                                   void *opaque, Error **errp)
-{
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-    uint32_t value;
-
-    visit_type_uint32(v, name, &value, errp);
-    sev->reduced_phys_bits = value;
-}
-
-static void
-qsev_guest_get_policy(Object *obj, Visitor *v, const char *name,
-                      void *opaque, Error **errp)
-{
-    uint32_t value;
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-
-    value = sev->policy;
-    visit_type_uint32(v, name, &value, errp);
-}
-
-static void
-qsev_guest_get_handle(Object *obj, Visitor *v, const char *name,
-                      void *opaque, Error **errp)
-{
-    uint32_t value;
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-
-    value = sev->handle;
-    visit_type_uint32(v, name, &value, errp);
-}
-
-static void
-qsev_guest_get_cbitpos(Object *obj, Visitor *v, const char *name,
-                       void *opaque, Error **errp)
-{
-    uint32_t value;
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-
-    value = sev->cbitpos;
-    visit_type_uint32(v, name, &value, errp);
-}
-
-static void
-qsev_guest_get_reduced_phys_bits(Object *obj, Visitor *v, const char *name,
-                                   void *opaque, Error **errp)
-{
-    uint32_t value;
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
-
-    value = sev->reduced_phys_bits;
-    visit_type_uint32(v, name, &value, errp);
-}
-
-static void
-qsev_guest_init(Object *obj)
-{
-    QSevGuestInfo *sev = QSEV_GUEST_INFO(obj);
+    SevGuestState *sev = SEV_GUEST(obj);

 
     sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
     sev->policy = DEFAULT_GUEST_POLICY;
 
     sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
     sev->policy = DEFAULT_GUEST_POLICY;

-    object_property_add(obj, "policy", "uint32", qsev_guest_get_policy,
-                        qsev_guest_set_policy, NULL, NULL, NULL);
-    object_property_add(obj, "handle", "uint32", qsev_guest_get_handle,
-                        qsev_guest_set_handle, NULL, NULL, NULL);
-    object_property_add(obj, "cbitpos", "uint32", qsev_guest_get_cbitpos,
-                        qsev_guest_set_cbitpos, NULL, NULL, NULL);
-    object_property_add(obj, "reduced-phys-bits", "uint32",
-                        qsev_guest_get_reduced_phys_bits,
-                        qsev_guest_set_reduced_phys_bits, NULL, NULL, NULL);
+    object_property_add_uint32_ptr(obj, "policy", &sev->policy,
+                                   OBJ_PROP_FLAG_READWRITE);
+    object_property_add_uint32_ptr(obj, "handle", &sev->handle,
+                                   OBJ_PROP_FLAG_READWRITE);
+    object_property_add_uint32_ptr(obj, "cbitpos", &sev->cbitpos,
+                                   OBJ_PROP_FLAG_READWRITE);
+    object_property_add_uint32_ptr(obj, "reduced-phys-bits",
+                                   &sev->reduced_phys_bits,
+                                   OBJ_PROP_FLAG_READWRITE);

 }
 
 /* sev guest info */
 }
 
 /* sev guest info */

-static const TypeInfo qsev_guest_info = {
+static const TypeInfo sev_guest_info = {

     .parent = TYPE_OBJECT,
     .parent = TYPE_OBJECT,

-    .name = TYPE_QSEV_GUEST_INFO,
-    .instance_size = sizeof(QSevGuestInfo),
-    .instance_finalize = qsev_guest_finalize,
-    .class_size = sizeof(QSevGuestInfoClass),
-    .class_init = qsev_guest_class_init,
-    .instance_init = qsev_guest_init,
+    .name = TYPE_SEV_GUEST,
+    .instance_size = sizeof(SevGuestState),
+    .instance_finalize = sev_guest_finalize,
+    .class_init = sev_guest_class_init,
+    .instance_init = sev_guest_instance_init,

     .interfaces = (InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
 };
 
     .interfaces = (InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
 };
 

-static QSevGuestInfo *
+static SevGuestState *

 lookup_sev_guest_info(const char *id)
 {
     Object *obj;
 lookup_sev_guest_info(const char *id)
 {
     Object *obj;

-    QSevGuestInfo *info;
+    SevGuestState *info;

 
     obj = object_resolve_path_component(object_get_objects_root(), id);
     if (!obj) {
         return NULL;
     }
 
 
     obj = object_resolve_path_component(object_get_objects_root(), id);
     if (!obj) {
         return NULL;
     }
 

-    info = (QSevGuestInfo *)
-            object_dynamic_cast(obj, TYPE_QSEV_GUEST_INFO);
+    info = (SevGuestState *)
+            object_dynamic_cast(obj, TYPE_SEV_GUEST);

     if (!info) {
         return NULL;
     }
     if (!info) {
         return NULL;
     }


@@ -385,25 +357,25 @@ lookup_sev_guest_info(const char *id)
 bool
 sev_enabled(void)
 {
 bool
 sev_enabled(void)
 {

-    return sev_state ? true : false;
+    return !!sev_guest;

 }
 
 uint64_t
 sev_get_me_mask(void)
 {
 }
 
 uint64_t
 sev_get_me_mask(void)
 {

-    return sev_state ? sev_state->me_mask : ~0;
+    return sev_guest ? sev_guest->me_mask : ~0;

 }
 
 uint32_t
 sev_get_cbit_position(void)
 {
 }
 
 uint32_t
 sev_get_cbit_position(void)
 {

-    return sev_state ? sev_state->cbitpos : 0;
+    return sev_guest ? sev_guest->cbitpos : 0;

 }
 
 uint32_t
 sev_get_reduced_phys_bits(void)
 {
 }
 
 uint32_t
 sev_get_reduced_phys_bits(void)
 {

-    return sev_state ? sev_state->reduced_phys_bits : 0;
+    return sev_guest ? sev_guest->reduced_phys_bits : 0;

 }
 
 SevInfo *
 }
 
 SevInfo *


@@ -412,15 +384,15 @@ sev_get_info(void)
     SevInfo *info;
 
     info = g_new0(SevInfo, 1);
     SevInfo *info;
 
     info = g_new0(SevInfo, 1);

-    info->enabled = sev_state ? true : false;
+    info->enabled = sev_enabled();

 
     if (info->enabled) {
 
     if (info->enabled) {

-        info->api_major = sev_state->api_major;
-        info->api_minor = sev_state->api_minor;
-        info->build_id = sev_state->build_id;
-        info->policy = sev_state->policy;
-        info->state = sev_state->state;
-        info->handle = sev_state->handle;
+        info->api_major = sev_guest->api_major;
+        info->api_minor = sev_guest->api_minor;
+        info->build_id = sev_guest->build_id;
+        info->policy = sev_guest->policy;
+        info->state = sev_guest->state;
+        info->handle = sev_guest->handle;

     }
 
     return info;
     }
 
     return info;


@@ -428,7 +400,7 @@ sev_get_info(void)
 
 static int
 sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain,
 
 static int
 sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain,

-                 size_t *cert_chain_len)
+                 size_t *cert_chain_len, Error **errp)

 {
     guchar *pdh_data = NULL;
     guchar *cert_chain_data = NULL;
 {
     guchar *pdh_data = NULL;
     guchar *cert_chain_data = NULL;


@@ -439,8 +411,8 @@ sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain,
     r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err);
     if (r < 0) {
         if (err != SEV_RET_INVALID_LEN) {
     r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err);
     if (r < 0) {
         if (err != SEV_RET_INVALID_LEN) {

-            error_report("failed to export PDH cert ret=%d fw_err=%d (%s)",
-                         r, err, fw_error_to_str(err));
+            error_setg(errp, "failed to export PDH cert ret=%d fw_err=%d (%s)",
+                       r, err, fw_error_to_str(err));

             return 1;
         }
     }
             return 1;
         }
     }


@@ -452,8 +424,8 @@ sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain,
 
     r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err);
     if (r < 0) {
 
     r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err);
     if (r < 0) {

-        error_report("failed to export PDH cert ret=%d fw_err=%d (%s)",
-                     r, err, fw_error_to_str(err));
+        error_setg(errp, "failed to export PDH cert ret=%d fw_err=%d (%s)",
+                   r, err, fw_error_to_str(err));

         goto e_free;
     }
 
         goto e_free;
     }
 


@@ -470,7 +442,7 @@ e_free:
 }
 
 SevCapability *
 }
 
 SevCapability *

-sev_get_capabilities(void)
+sev_get_capabilities(Error **errp)

 {
     SevCapability *cap = NULL;
     guchar *pdh_data = NULL;
 {
     SevCapability *cap = NULL;
     guchar *pdh_data = NULL;


@@ -479,15 +451,24 @@ sev_get_capabilities(void)
     uint32_t ebx;
     int fd;
 
     uint32_t ebx;
     int fd;
 

+    if (!kvm_enabled()) {
+        error_setg(errp, "KVM not enabled");
+        return NULL;
+    }
+    if (kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, NULL) < 0) {
+        error_setg(errp, "SEV is not enabled in KVM");
+        return NULL;
+    }
+

     fd = open(DEFAULT_SEV_DEVICE, O_RDWR);
     if (fd < 0) {
     fd = open(DEFAULT_SEV_DEVICE, O_RDWR);
     if (fd < 0) {

-        error_report("%s: Failed to open %s '%s'", __func__,
-                     DEFAULT_SEV_DEVICE, strerror(errno));
+        error_setg_errno(errp, errno, "Failed to open %s",
+                         DEFAULT_SEV_DEVICE);

         return NULL;
     }
 
     if (sev_get_pdh_info(fd, &pdh_data, &pdh_len,
         return NULL;
     }
 
     if (sev_get_pdh_info(fd, &pdh_data, &pdh_len,

-                         &cert_chain_data, &cert_chain_len)) {
+                         &cert_chain_data, &cert_chain_len, errp)) {

         goto out;
     }
 
         goto out;
     }
 


@@ -520,6 +501,7 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len)
 
     if (!g_file_get_contents(filename, &base64, &sz, &error)) {
         error_report("failed to read '%s' (%s)", filename, error->message);
 
     if (!g_file_get_contents(filename, &base64, &sz, &error)) {
         error_report("failed to read '%s' (%s)", filename, error->message);

+        g_error_free(error);

         return -1;
     }
 
         return -1;
     }
 


@@ -528,21 +510,18 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len)
 }
 
 static int
 }
 
 static int

-sev_launch_start(SEVState *s)
+sev_launch_start(SevGuestState *sev)

 {
     gsize sz;
     int ret = 1;
     int fw_error, rc;
 {
     gsize sz;
     int ret = 1;
     int fw_error, rc;

-    QSevGuestInfo *sev = s->sev_info;

     struct kvm_sev_launch_start *start;
     guchar *session = NULL, *dh_cert = NULL;
 
     start = g_new0(struct kvm_sev_launch_start, 1);
 
     struct kvm_sev_launch_start *start;
     guchar *session = NULL, *dh_cert = NULL;
 
     start = g_new0(struct kvm_sev_launch_start, 1);
 

-    start->handle = object_property_get_int(OBJECT(sev), "handle",
-                                            &error_abort);
-    start->policy = object_property_get_int(OBJECT(sev), "policy",
-                                            &error_abort);
+    start->handle = sev->handle;
+    start->policy = sev->policy;

     if (sev->session_file) {
         if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) {
             goto out;
     if (sev->session_file) {
         if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) {
             goto out;


@@ -560,18 +539,15 @@ sev_launch_start(SEVState *s)
     }
 
     trace_kvm_sev_launch_start(start->policy, session, dh_cert);
     }
 
     trace_kvm_sev_launch_start(start->policy, session, dh_cert);

-    rc = sev_ioctl(s->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_error);
+    rc = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_error);

     if (rc < 0) {
         error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'",
                 __func__, ret, fw_error, fw_error_to_str(fw_error));
         goto out;
     }
 
     if (rc < 0) {
         error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'",
                 __func__, ret, fw_error, fw_error_to_str(fw_error));
         goto out;
     }
 

-    object_property_set_int(OBJECT(sev), start->handle, "handle",
-                            &error_abort);
-    sev_set_guest_state(SEV_STATE_LAUNCH_UPDATE);
-    s->handle = start->handle;
-    s->policy = start->policy;
+    sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE);
+    sev->handle = start->handle;

     ret = 0;
 
 out:
     ret = 0;
 
 out:


@@ -582,7 +558,7 @@ out:
 }
 
 static int
 }
 
 static int

-sev_launch_update_data(uint8_t *addr, uint64_t len)
+sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len)

 {
     int ret, fw_error;
     struct kvm_sev_launch_update_data update;
 {
     int ret, fw_error;
     struct kvm_sev_launch_update_data update;


@@ -594,7 +570,7 @@ sev_launch_update_data(uint8_t *addr, uint64_t len)
     update.uaddr = (__u64)(unsigned long)addr;
     update.len = len;
     trace_kvm_sev_launch_update_data(addr, len);
     update.uaddr = (__u64)(unsigned long)addr;
     update.len = len;
     trace_kvm_sev_launch_update_data(addr, len);

-    ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
+    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,

                     &update, &fw_error);
     if (ret) {
         error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
                     &update, &fw_error);
     if (ret) {
         error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",


@@ -607,19 +583,19 @@ sev_launch_update_data(uint8_t *addr, uint64_t len)
 static void
 sev_launch_get_measure(Notifier *notifier, void *unused)
 {
 static void
 sev_launch_get_measure(Notifier *notifier, void *unused)
 {

+    SevGuestState *sev = sev_guest;

     int ret, error;
     guchar *data;
     int ret, error;
     guchar *data;

-    SEVState *s = sev_state;

     struct kvm_sev_launch_measure *measurement;
 
     struct kvm_sev_launch_measure *measurement;
 

-    if (!sev_check_state(SEV_STATE_LAUNCH_UPDATE)) {
+    if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) {

         return;
     }
 
     measurement = g_new0(struct kvm_sev_launch_measure, 1);
 
     /* query the measurement blob length */
         return;
     }
 
     measurement = g_new0(struct kvm_sev_launch_measure, 1);
 
     /* query the measurement blob length */

-    ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE,
+    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE,

                     measurement, &error);
     if (!measurement->len) {
         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
                     measurement, &error);
     if (!measurement->len) {
         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",


@@ -631,7 +607,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
     measurement->uaddr = (unsigned long)data;
 
     /* get the measurement blob */
     measurement->uaddr = (unsigned long)data;
 
     /* get the measurement blob */

-    ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE,
+    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE,

                     measurement, &error);
     if (ret) {
         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
                     measurement, &error);
     if (ret) {
         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",


@@ -639,11 +615,11 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
         goto free_data;
     }
 
         goto free_data;
     }
 

-    sev_set_guest_state(SEV_STATE_LAUNCH_SECRET);
+    sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET);

 
     /* encode the measurement value and emit the event */
 
     /* encode the measurement value and emit the event */

-    s->measurement = g_base64_encode(data, measurement->len);
-    trace_kvm_sev_launch_measurement(s->measurement);
+    sev->measurement = g_base64_encode(data, measurement->len);
+    trace_kvm_sev_launch_measurement(sev->measurement);

 
 free_data:
     g_free(data);
 
 free_data:
     g_free(data);


@@ -654,9 +630,9 @@ free_measurement:
 char *
 sev_get_launch_measurement(void)
 {
 char *
 sev_get_launch_measurement(void)
 {

-    if (sev_state &&
-        sev_state->state >= SEV_STATE_LAUNCH_SECRET) {
-        return g_strdup(sev_state->measurement);
+    if (sev_guest &&
+        sev_guest->state >= SEV_STATE_LAUNCH_SECRET) {
+        return g_strdup(sev_guest->measurement);

     }
 
     return NULL;
     }
 
     return NULL;


@@ -667,20 +643,20 @@ static Notifier sev_machine_done_notify = {
 };
 
 static void
 };
 
 static void

-sev_launch_finish(SEVState *s)
+sev_launch_finish(SevGuestState *sev)

 {
     int ret, error;
     Error *local_err = NULL;
 
     trace_kvm_sev_launch_finish();
 {
     int ret, error;
     Error *local_err = NULL;
 
     trace_kvm_sev_launch_finish();

-    ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, &error);
+    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, &error);

     if (ret) {
         error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'",
                      __func__, ret, error, fw_error_to_str(error));
         exit(1);
     }
 
     if (ret) {
         error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'",
                      __func__, ret, error, fw_error_to_str(error));
         exit(1);
     }
 

-    sev_set_guest_state(SEV_STATE_RUNNING);
+    sev_set_guest_state(sev, SEV_STATE_RUNNING);

 
     /* add migration blocker */
     error_setg(&sev_mig_blocker,
 
     /* add migration blocker */
     error_setg(&sev_mig_blocker,


@@ -696,11 +672,11 @@ sev_launch_finish(SEVState *s)
 static void
 sev_vm_state_change(void *opaque, int running, RunState state)
 {
 static void
 sev_vm_state_change(void *opaque, int running, RunState state)
 {

-    SEVState *s = opaque;
+    SevGuestState *sev = opaque;

 
     if (running) {
 
     if (running) {

-        if (!sev_check_state(SEV_STATE_RUNNING)) {
-            sev_launch_finish(s);
+        if (!sev_check_state(sev, SEV_STATE_RUNNING)) {
+            sev_launch_finish(sev);

         }
     }
 }
         }
     }
 }


@@ -708,75 +684,78 @@ sev_vm_state_change(void *opaque, int running, RunState state)
 void *
 sev_guest_init(const char *id)
 {
 void *
 sev_guest_init(const char *id)
 {

-    SEVState *s;
+    SevGuestState *sev;

     char *devname;
     int ret, fw_error;
     uint32_t ebx;
     uint32_t host_cbitpos;
     struct sev_user_data_status status = {};
 
     char *devname;
     int ret, fw_error;
     uint32_t ebx;
     uint32_t host_cbitpos;
     struct sev_user_data_status status = {};
 

-    sev_state = s = g_new0(SEVState, 1);
-    s->sev_info = lookup_sev_guest_info(id);
-    if (!s->sev_info) {
+    ret = ram_block_discard_disable(true);
+    if (ret) {
+        error_report("%s: cannot disable RAM discard", __func__);
+        return NULL;
+    }
+
+    sev = lookup_sev_guest_info(id);
+    if (!sev) {

         error_report("%s: '%s' is not a valid '%s' object",
         error_report("%s: '%s' is not a valid '%s' object",

-                     __func__, id, TYPE_QSEV_GUEST_INFO);
+                     __func__, id, TYPE_SEV_GUEST);

         goto err;
     }
 
         goto err;
     }
 

-    s->state = SEV_STATE_UNINIT;
+    sev_guest = sev;
+    sev->state = SEV_STATE_UNINIT;

 
     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
     host_cbitpos = ebx & 0x3f;
 
 
     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
     host_cbitpos = ebx & 0x3f;
 

-    s->cbitpos = object_property_get_int(OBJECT(s->sev_info), "cbitpos", NULL);
-    if (host_cbitpos != s->cbitpos) {
+    if (host_cbitpos != sev->cbitpos) {

         error_report("%s: cbitpos check failed, host '%d' requested '%d'",
         error_report("%s: cbitpos check failed, host '%d' requested '%d'",

-                     __func__, host_cbitpos, s->cbitpos);
+                     __func__, host_cbitpos, sev->cbitpos);

         goto err;
     }
 
         goto err;
     }
 

-    s->reduced_phys_bits = object_property_get_int(OBJECT(s->sev_info),
-                                        "reduced-phys-bits", NULL);
-    if (s->reduced_phys_bits < 1) {
+    if (sev->reduced_phys_bits < 1) {

         error_report("%s: reduced_phys_bits check failed, it should be >=1,"
         error_report("%s: reduced_phys_bits check failed, it should be >=1,"

-                     "' requested '%d'", __func__, s->reduced_phys_bits);
+                     " requested '%d'", __func__, sev->reduced_phys_bits);

         goto err;
     }
 
         goto err;
     }
 

-    s->me_mask = ~(1UL << s->cbitpos);
+    sev->me_mask = ~(1UL << sev->cbitpos);

 
 

-    devname = object_property_get_str(OBJECT(s->sev_info), "sev-device", NULL);
-    s->sev_fd = open(devname, O_RDWR);
-    if (s->sev_fd < 0) {
+    devname = object_property_get_str(OBJECT(sev), "sev-device", NULL);
+    sev->sev_fd = open(devname, O_RDWR);
+    if (sev->sev_fd < 0) {

         error_report("%s: Failed to open %s '%s'", __func__,
                      devname, strerror(errno));
     }
     g_free(devname);
         error_report("%s: Failed to open %s '%s'", __func__,
                      devname, strerror(errno));
     }
     g_free(devname);

-    if (s->sev_fd < 0) {
+    if (sev->sev_fd < 0) {

         goto err;
     }
 
         goto err;
     }
 

-    ret = sev_platform_ioctl(s->sev_fd, SEV_PLATFORM_STATUS, &status,
+    ret = sev_platform_ioctl(sev->sev_fd, SEV_PLATFORM_STATUS, &status,

                              &fw_error);
     if (ret) {
                              &fw_error);
     if (ret) {

-        error_report("%s: failed to get platform status ret=%d"
+        error_report("%s: failed to get platform status ret=%d "

                      "fw_error='%d: %s'", __func__, ret, fw_error,
                      fw_error_to_str(fw_error));
         goto err;
     }
                      "fw_error='%d: %s'", __func__, ret, fw_error,
                      fw_error_to_str(fw_error));
         goto err;
     }

-    s->build_id = status.build;
-    s->api_major = status.api_major;
-    s->api_minor = status.api_minor;
+    sev->build_id = status.build;
+    sev->api_major = status.api_major;
+    sev->api_minor = status.api_minor;

 
     trace_kvm_sev_init();
 
     trace_kvm_sev_init();

-    ret = sev_ioctl(s->sev_fd, KVM_SEV_INIT, NULL, &fw_error);
+    ret = sev_ioctl(sev->sev_fd, KVM_SEV_INIT, NULL, &fw_error);

     if (ret) {
         error_report("%s: failed to initialize ret=%d fw_error=%d '%s'",
                      __func__, ret, fw_error, fw_error_to_str(fw_error));
         goto err;
     }
 
     if (ret) {
         error_report("%s: failed to initialize ret=%d fw_error=%d '%s'",
                      __func__, ret, fw_error, fw_error_to_str(fw_error));
         goto err;
     }
 

-    ret = sev_launch_start(s);
+    ret = sev_launch_start(sev);

     if (ret) {
         error_report("%s: failed to create encryption context", __func__);
         goto err;
     if (ret) {
         error_report("%s: failed to create encryption context", __func__);
         goto err;


@@ -784,23 +763,25 @@ sev_guest_init(const char *id)
 
     ram_block_notifier_add(&sev_ram_notifier);
     qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
 
     ram_block_notifier_add(&sev_ram_notifier);
     qemu_add_machine_init_done_notifier(&sev_machine_done_notify);

-    qemu_add_vm_change_state_handler(sev_vm_state_change, s);
+    qemu_add_vm_change_state_handler(sev_vm_state_change, sev);

 
 

-    return s;
+    return sev;

 err:
 err:

-    g_free(sev_state);
-    sev_state = NULL;
+    sev_guest = NULL;
+    ram_block_discard_disable(false);

     return NULL;
 }
 
 int
 sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
 {
     return NULL;
 }
 
 int
 sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
 {

-    assert(handle);
+    SevGuestState *sev = handle;
+
+    assert(sev);

 
     /* if SEV is in update state then encrypt the data else do nothing */
 
     /* if SEV is in update state then encrypt the data else do nothing */

-    if (sev_check_state(SEV_STATE_LAUNCH_UPDATE)) {
-        return sev_launch_update_data(ptr, len);
+    if (sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) {
+        return sev_launch_update_data(sev, ptr, len);

     }
 
     return 0;
     }
 
     return 0;


@@ -809,7 +790,7 @@ sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
 static void
 sev_register_types(void)
 {
 static void
 sev_register_types(void)
 {

-    type_register_static(&qsev_guest_info);
+    type_register_static(&sev_guest_info);

 }
 
 type_init(sev_register_types);
 }
 
 type_init(sev_register_types);