diff --git a/.clang-tidy b/.clang-tidy
new file mode 100644
index 0000000..55d135e
--- /dev/null
+++ b/.clang-tidy
@@ -0,0 +1,2 @@
+Checks: 'readability-braces-around-statements'
+HeaderFilterRegex: '.*'
diff --git a/Makefile b/Makefile
index 5419741..a41e0c8 100644
--- a/Makefile
+++ b/Makefile
@@ -13,6 +13,7 @@
 
 # Toolchain
 CROSS_COMPILE ?= aarch64-linux-gnu-
+TARGET := $(patsubst %-,%,$(CROSS_COMPILE))
 
 ifeq ($(CLANG),1)
   CLANG := clang
@@ -20,7 +21,7 @@
 GCC ?= gcc
 
 ifdef CLANG
-  CC := $(CLANG) -target $(patsubst %-,%,$(CROSS_COMPILE))
+  CC := $(CLANG) -target $(TARGET)
 else
   CC := $(CROSS_COMPILE)$(GCC)
 endif
@@ -63,7 +64,6 @@
 COPTS += -Wall -Wpedantic -Werror
 COPTS += -Wno-extended-offsetof
 COPTS += -DDEBUG=$(DEBUG)
-COPTS += -MMD -MP -MF $$(patsubst %,%.d,$$@)
 COPTS += -DMAX_CPUS=8
 COPTS += -DMAX_VMS=16
 COPTS += -DSTACK_SIZE=4096
@@ -79,13 +79,15 @@
   COPTS += -DPL011_BASE=$(PL011_BASE)
 endif
 
+DEP_GEN = -MMD -MP -MF $$(patsubst %,%.d,$$@)
+
 define build_c
   TGT := $(patsubst %.c,%.o,$(OUT)/$(patsubst src/%,%,$(1)))
   GLOBAL_OBJS += $$(TGT)
   REMAIN_SRCS := $$(filter-out $(1),$$(REMAIN_SRCS))
 $$(TGT): $(ROOT_DIR)$(1) | $$(dir $$(TGT))
 	$$(info CC $(ROOT_DIR)$1)
-	@$(CC) $(COPTS) -c $(ROOT_DIR)$(1) -o $$@
+	@$(CC) $(COPTS) $(DEP_GEN) -c $(ROOT_DIR)$(1) -o $$@
 endef
 
 #
@@ -98,10 +100,11 @@
   GLOBAL_OFFSETS += $$(TGT)
 $$(TGT): $(ROOT_DIR)$(1) | $$(dir $$(TGT))
 	$$(info GENOFFSET $(ROOT_DIR)$1)
-	@$(CC) $(COPTS) -MT $$@ -S -c $(ROOT_DIR)$(1) -o - | \
+	@$(CC) $(COPTS) $(DEP_GEN) -MT $$@ -S -c $(ROOT_DIR)$(1) -o - | \
 		grep ^DEFINE_OFFSET -A1 | \
 		grep -v ^--$ | \
-		sed 's/^DEFINE_OFFSET__\([^:]*\):/#define \1 \\/g' | sed 's/\.xword//g' > $$@
+		sed 's/^DEFINE_OFFSET__\([^:]*\):/#define \1 \\/g' | \
+		sed 's/\.xword//g' > $$@
 endef
 
 #
@@ -113,7 +116,7 @@
   REMAIN_SRCS := $$(filter-out $(1),$$(REMAIN_SRCS))
 $$(TGT): $(ROOT_DIR)$(1) $(GLOBAL_OFFSETS) | $$(dir $$(TGT))
 	$$(info AS $(ROOT_DIR)$1)
-	@$(CC) $(COPTS) -c $(ROOT_DIR)$(1) -o $$@
+	@$(CC) $(COPTS) $(DEP_GEN) -c $(ROOT_DIR)$(1) -o $$@
 endef
 
 #
@@ -157,8 +160,17 @@
 clean:
 	rm -rf $(ROOT_DIR)out
 
+#
+# Rules for code health
+#
+
+# see .clang-format
 format:
 	find $(ROOT_DIR)src/ -name *.c -o -name *.h | xargs clang-format -style file -i
 	find $(ROOT_DIR)inc/ -name *.c -o -name *.h | xargs clang-format -style file -i
 
+# see .clang-tidy
+tidy:
+	find $(ROOT_DIR)src/ -name *.c -exec clang-tidy {} -fix -- -target $(TARGET) $(COPTS) \;
+
 -include $(patsubst %,%.d,$(GLOBAL_OBJS),$(GLOBAL_OFFSETS))
diff --git a/inc/spinlock.h b/inc/spinlock.h
index dca3efb..1061fb3 100644
--- a/inc/spinlock.h
+++ b/inc/spinlock.h
@@ -19,8 +19,9 @@
 
 static inline void sl_lock(struct spinlock *l)
 {
-	while (atomic_flag_test_and_set_explicit(&l->v, memory_order_acquire))
-		;
+	while (atomic_flag_test_and_set_explicit(&l->v, memory_order_acquire)) {
+		/* do nothing */
+	}
 }
 
 static inline void sl_unlock(struct spinlock *l)
diff --git a/src/alloc.c b/src/alloc.c
index b9dc585..cd6844a 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -69,10 +69,11 @@
 	end = begin + size;
 
 	/* Check for overflows, and that there is enough free mem. */
-	if (end > begin && begin >= alloc_base && end <= alloc_limit)
+	if (end > begin && begin >= alloc_base && end <= alloc_limit) {
 		alloc_base = end;
-	else
+	} else {
 		begin = 0;
+	}
 
 	return (void *)begin;
 }
diff --git a/src/api.c b/src/api.c
index a105f6d..31ff376 100644
--- a/src/api.c
+++ b/src/api.c
@@ -20,8 +20,9 @@
  */
 int32_t api_vcpu_get_count(uint32_t vm_idx)
 {
-	if (vm_idx >= secondary_vm_count)
+	if (vm_idx >= secondary_vm_count) {
 		return -1;
+	}
 
 	return secondary_vm[vm_idx].vcpu_count;
 }
@@ -35,15 +36,18 @@
 	struct vcpu *vcpu;
 
 	/* Only the primary VM can switch vcpus. */
-	if (cpu()->current->vm != &primary_vm)
+	if (cpu()->current->vm != &primary_vm) {
 		return HF_VCPU_WAIT_FOR_INTERRUPT;
+	}
 
-	if (vm_idx >= secondary_vm_count)
+	if (vm_idx >= secondary_vm_count) {
 		return HF_VCPU_WAIT_FOR_INTERRUPT;
+	}
 
 	vcpu = vm->vcpus + vcpu_idx;
-	if (vcpu_idx >= vm->vcpu_count || !vcpu->is_on)
+	if (vcpu_idx >= vm->vcpu_count || !vcpu->is_on) {
 		return HF_VCPU_WAIT_FOR_INTERRUPT;
+	}
 
 	arch_set_vm_mm(&vm->page_table);
 	*next = vcpu;
diff --git a/src/arch/aarch64/handler.c b/src/arch/aarch64/handler.c
index 7fe2ead..8999403 100644
--- a/src/arch/aarch64/handler.c
+++ b/src/arch/aarch64/handler.c
@@ -14,8 +14,9 @@
 void irq_current(void)
 {
 	dlog("IRQ from current\n");
-	for (;;)
-		;
+	for (;;) {
+		/* do nothing */
+	}
 }
 
 void sync_current_exception(uint64_t esr, uint64_t elr)
@@ -24,24 +25,28 @@
 	case 0x25: /* EC = 100101, Data abort. */
 		dlog("Data abort: pc=0x%x, esr=0x%x, ec=0x%x", elr, esr,
 		     esr >> 26);
-		if (!(esr & (1u << 10))) /* Check FnV bit. */
+		if (!(esr & (1u << 10))) { /* Check FnV bit. */
 			dlog(", far=0x%x, hpfar=0x%x", read_msr(far_el2),
 			     read_msr(hpfar_el2) << 8);
-		else
+		} else {
 			dlog(", far=invalid");
+		}
 
 		dlog("\n");
-		for (;;)
-			;
+		for (;;) {
+			/* do nothing */
+		}
 
 	default:
 		dlog("Unknown sync exception pc=0x%x, esr=0x%x, ec=0x%x\n", elr,
 		     esr, esr >> 26);
-		for (;;)
-			;
+		for (;;) {
+			/* do nothing */
+		}
 	}
-	for (;;)
-		;
+	for (;;) {
+		/* do nothing */
+	}
 }
 
 struct hvc_handler_return hvc_handler(size_t arg0, size_t arg1, size_t arg2,
@@ -97,28 +102,32 @@
 	switch (esr >> 26) {
 	case 0x01: /* EC = 000001, WFI or WFE. */
 		/* Check TI bit of ISS, 0 = WFI, 1 = WFE. */
-		if (esr & 1)
+		if (esr & 1) {
 			return NULL;
+		}
 		return api_wait_for_interrupt();
 
 	case 0x24: /* EC = 100100, Data abort. */
 		dlog("Data abort: pc=0x%x, esr=0x%x, ec=0x%x", vcpu->regs.pc,
 		     esr, esr >> 26);
-		if (!(esr & (1u << 10))) /* Check FnV bit. */
+		if (!(esr & (1u << 10))) { /* Check FnV bit. */
 			dlog(", far=0x%x, hpfar=0x%x", read_msr(far_el2),
 			     read_msr(hpfar_el2) << 8);
-		else
+		} else {
 			dlog(", far=invalid");
+		}
 
 		dlog("\n");
-		for (;;)
-			;
+		for (;;) {
+			/* do nothing */
+		}
 
 	default:
 		dlog("Unknown sync exception pc=0x%x, esr=0x%x, ec=0x%x\n",
 		     vcpu->regs.pc, esr, esr >> 26);
-		for (;;)
-			;
+		for (;;) {
+			/* do nothing */
+		}
 	}
 
 	return NULL;
diff --git a/src/arch/aarch64/inc/arch_cpu.h b/src/arch/aarch64/inc/arch_cpu.h
index e199b0d..c886844 100644
--- a/src/arch/aarch64/inc/arch_cpu.h
+++ b/src/arch/aarch64/inc/arch_cpu.h
@@ -75,9 +75,10 @@
 			  (1u << 2) |  /* PTW, Protected Table Walk. */
 			  (1u << 0);   /* VM: enable stage-2 translation. */
 
-	if (!is_primary)
+	if (!is_primary) {
 		r->lazy.hcr_el2 |= (7u << 3) | /* AMO, IMO, FMO bits. */
 				   (3u << 13); /* TWI, TWE bits. */
+	}
 }
 
 static inline void arch_regs_set_retval(struct arch_regs *r, size_t v)
diff --git a/src/arch/aarch64/inc/arch_mm.h b/src/arch/aarch64/inc/arch_mm.h
index 4ea627d..689665c 100644
--- a/src/arch/aarch64/inc/arch_mm.h
+++ b/src/arch/aarch64/inc/arch_mm.h
@@ -159,8 +159,9 @@
 
 	__asm__ volatile("dsb ishst");
 
-	for (it = begin; it < end; it += (1ull << (PAGE_BITS - 12)))
+	for (it = begin; it < end; it += (1ull << (PAGE_BITS - 12))) {
 		__asm__("tlbi vae2is, %0" : : "r"(it));
+	}
 
 	__asm__ volatile("dsb ish");
 }
@@ -177,8 +178,9 @@
 
 	__asm__ volatile("dsb ishst");
 
-	for (it = begin; it < end; it += (1ull << (PAGE_BITS - 12)))
+	for (it = begin; it < end; it += (1ull << (PAGE_BITS - 12))) {
 		__asm__("tlbi ipas2e1, %0" : : "r"(it));
+	}
 
 	__asm__ volatile(
 		"dsb ish\n"
diff --git a/src/arch/aarch64/mm.c b/src/arch/aarch64/mm.c
index 1331cbf..d4898d4 100644
--- a/src/arch/aarch64/mm.c
+++ b/src/arch/aarch64/mm.c
@@ -89,46 +89,53 @@
 		attrs |= STAGE1_AF | STAGE1_SH(OUTER_SHAREABLE);
 
 		/* Define the execute bits. */
-		if (!(mode & MM_MODE_X))
+		if (!(mode & MM_MODE_X)) {
 			attrs |= STAGE1_XN;
+		}
 
 		/* Define the read/write bits. */
-		if (mode & MM_MODE_W)
+		if (mode & MM_MODE_W) {
 			attrs |= STAGE1_AP(STAGE1_READWRITE);
-		else
+		} else {
 			attrs |= STAGE1_AP(STAGE1_READONLY);
+		}
 
 		/* Define the memory attribute bits. */
-		if (mode & MM_MODE_D)
+		if (mode & MM_MODE_D) {
 			attrs |= STAGE1_ATTRINDX(STAGE1_DEVICEINDX);
-		else
+		} else {
 			attrs |= STAGE1_ATTRINDX(STAGE1_NORMALINDX);
+		}
 	} else {
 		uint64_t access = 0;
 
 		attrs |= STAGE2_AF | STAGE2_SH(OUTER_SHAREABLE);
 
 		/* Define the read/write bits. */
-		if (mode & MM_MODE_R)
+		if (mode & MM_MODE_R) {
 			access |= STAGE2_ACCESS_READ;
+		}
 
-		if (mode & MM_MODE_W)
+		if (mode & MM_MODE_W) {
 			access |= STAGE2_ACCESS_WRITE;
+		}
 
 		attrs |= STAGE2_S2AP(access);
 
 		/* Define the execute bits. */
-		if (mode & MM_MODE_X)
+		if (mode & MM_MODE_X) {
 			attrs |= STAGE2_XN(STAGE2_EXECUTE_ALL);
-		else
+		} else {
 			attrs |= STAGE2_XN(STAGE2_EXECUTE_NONE);
+		}
 
 		/* Define the memory attribute bits. */
-		if (mode & MM_MODE_D)
+		if (mode & MM_MODE_D) {
 			attrs |= STAGE2_MEMATTR_DEVICE_nGnRnE;
-		else
+		} else {
 			attrs |= STAGE2_MEMATTR_NORMAL(STAGE2_WRITEBACK,
 						       STAGE2_WRITEBACK);
+		}
 	}
 
 	return attrs;
diff --git a/src/arch/aarch64/pl011.c b/src/arch/aarch64/pl011.c
index 24a3460..cf2f465 100644
--- a/src/arch/aarch64/pl011.c
+++ b/src/arch/aarch64/pl011.c
@@ -16,12 +16,14 @@
 void arch_putchar(char c)
 {
 	/* Print a carriage-return as well. */
-	if (c == '\n')
+	if (c == '\n') {
 		arch_putchar('\r');
+	}
 
 	/* Wait until there is room in the tx buffer. */
-	while (io_read(PL011_BASE + UARTFR) & UARTFR_TXFF)
-		;
+	while (io_read(PL011_BASE + UARTFR) & UARTFR_TXFF) {
+		/* do nothing */
+	}
 
 	dmb();
 
@@ -31,6 +33,7 @@
 	dmb();
 
 	/* Wait until the UART is no longer busy. */
-	while (io_read_mb(PL011_BASE + UARTFR) & UARTFR_BUSY)
-		;
+	while (io_read_mb(PL011_BASE + UARTFR) & UARTFR_BUSY) {
+		/* do nothing */
+	}
 }
diff --git a/src/cpio.c b/src/cpio.c
index e8e95ec..2a00837 100644
--- a/src/cpio.c
+++ b/src/cpio.c
@@ -41,27 +41,31 @@
 	size_t namelen;
 
 	size_left = iter->size_left;
-	if (size_left < sizeof(struct cpio_header))
+	if (size_left < sizeof(struct cpio_header)) {
 		return false;
+	}
 
 	/* TODO: Check magic. */
 
 	size_left -= sizeof(struct cpio_header);
 	namelen = (h->namesize + 1) & ~1;
-	if (size_left < namelen)
+	if (size_left < namelen) {
 		return false;
+	}
 
 	size_left -= namelen;
 	filelen = (size_t)h->filesize[0] << 16 | h->filesize[1];
-	if (size_left < filelen)
+	if (size_left < filelen) {
 		return false;
+	}
 
 	/* TODO: Check that string is null-terminated. */
 	/* TODO: Check that trailler is not returned. */
 
 	/* Stop enumerating files when we hit the end marker. */
-	if (!strcmp((const char *)(iter->cur + 1), "TRAILER!!!"))
+	if (!strcmp((const char *)(iter->cur + 1), "TRAILER!!!")) {
 		return false;
+	}
 
 	size_left -= filelen;
 
diff --git a/src/cpu.c b/src/cpu.c
index bb84bbb..cab40b8 100644
--- a/src/cpu.c
+++ b/src/cpu.c
@@ -44,14 +44,16 @@
 void cpu_irq_enable(struct cpu *c)
 {
 	c->irq_disable_count--;
-	if (!c->irq_disable_count)
+	if (!c->irq_disable_count) {
 		arch_irq_enable();
+	}
 }
 
 void cpu_irq_disable(struct cpu *c)
 {
-	if (!c->irq_disable_count)
+	if (!c->irq_disable_count) {
 		arch_irq_disable();
+	}
 	c->irq_disable_count++;
 }
 
diff --git a/src/dlog.c b/src/dlog.c
index 0af7eb5..38ccc85 100644
--- a/src/dlog.c
+++ b/src/dlog.c
@@ -27,8 +27,9 @@
 static size_t print_raw_string(const char *str)
 {
 	const char *c = str;
-	while (*c != '\0')
+	while (*c != '\0') {
 		arch_putchar(*c++);
+	}
 	return c - str;
 }
 
@@ -47,8 +48,9 @@
 	size_t len = suffix - str;
 
 	/* Print the string up to the beginning of the suffix. */
-	while (str != suffix)
+	while (str != suffix) {
 		arch_putchar(*str++);
+	}
 
 	if (flags & FLAG_MINUS) {
 		/* Left-aligned. Print suffix, then print padding if needed. */
@@ -110,17 +112,18 @@
 	}
 
 	/* Add sign if requested. */
-	if (flags & FLAG_NEG)
+	if (flags & FLAG_NEG) {
 		*--ptr = '-';
-	else if (flags & FLAG_PLUS)
+	} else if (flags & FLAG_PLUS) {
 		*--ptr = '+';
-	else if (flags & FLAG_SPACE)
+	} else if (flags & FLAG_SPACE) {
 		*--ptr = ' ';
-
-	if (flags & FLAG_ZERO)
+	}
+	if (flags & FLAG_ZERO) {
 		print_string(ptr, num, width, flags, '0');
-	else
+	} else {
 		print_string(ptr, ptr, width, flags, ' ');
+	}
 }
 
 /*
diff --git a/src/fdt.c b/src/fdt.c
index 162b606..fbcf641 100644
--- a/src/fdt.c
+++ b/src/fdt.c
@@ -56,8 +56,9 @@
 static bool fdt_tokenizer_uint32(struct fdt_tokenizer *t, uint32_t *res)
 {
 	const char *next = t->cur + sizeof(*res);
-	if (next > t->end)
+	if (next > t->end) {
 		return false;
+	}
 
 	*res = be32toh(*(uint32_t *)t->cur);
 	t->cur = next;
@@ -82,8 +83,9 @@
 				size_t size)
 {
 	const char *next = t->cur + size;
-	if (next > t->end)
+	if (next > t->end) {
 		return false;
+	}
 
 	*res = t->cur;
 	t->cur = next;
@@ -118,14 +120,16 @@
 	memset(node, 0, sizeof(*node));
 
 	/* Check the magic number before anything else. */
-	if (hdr->magic != be32toh(FDT_MAGIC))
+	if (hdr->magic != be32toh(FDT_MAGIC)) {
 		return;
+	}
 
 	/* Check the version. */
 	max_ver = be32toh(hdr->version);
 	min_ver = be32toh(hdr->last_comp_version);
-	if (FDT_VERSION < min_ver || FDT_VERSION > max_ver)
+	if (FDT_VERSION < min_ver || FDT_VERSION > max_ver) {
 		return;
+	}
 
 	/* TODO: Verify that it is all within the fdt. */
 	node->begin = (const char *)hdr + begin;
@@ -141,8 +145,9 @@
 	uint32_t token;
 	uint32_t nameoff;
 
-	if (!fdt_tokenizer_token(t, &token))
+	if (!fdt_tokenizer_token(t, &token)) {
 		return false;
+	}
 
 	if (token != FDT_PROP) {
 		/* Rewind so that caller will get the same token. */
@@ -171,8 +176,9 @@
 {
 	uint32_t token;
 
-	if (!fdt_tokenizer_token(t, &token))
+	if (!fdt_tokenizer_token(t, &token)) {
 		return false;
+	}
 
 	if (token != FDT_BEGIN_NODE) {
 		/* Rewind so that caller will get the same token. */
@@ -197,8 +203,9 @@
 	const char *name;
 	const char *buf;
 	uint32_t size;
-	while (fdt_next_property(t, &name, &buf, &size))
-		;
+	while (fdt_next_property(t, &name, &buf, &size)) {
+		/* do nothing */
+	}
 }
 
 static bool fdt_skip_node(struct fdt_tokenizer *t)
@@ -215,8 +222,9 @@
 			pending++;
 		}
 
-		if (!fdt_tokenizer_token(t, &token))
+		if (!fdt_tokenizer_token(t, &token)) {
 			return false;
+		}
 
 		if (token != FDT_END_NODE) {
 			t->cur = t->end;
@@ -238,8 +246,9 @@
 	fdt_tokenizer_init(&t, node->strs, node->begin, node->end);
 
 	while (fdt_next_property(&t, &prop_name, buf, size)) {
-		if (!strcmp(prop_name, name))
+		if (!strcmp(prop_name, name)) {
 			return true;
+		}
 	}
 
 	return false;
@@ -253,8 +262,9 @@
 
 	fdt_skip_properties(&t);
 
-	if (!fdt_next_subnode(&t, child_name))
+	if (!fdt_next_subnode(&t, child_name)) {
 		return false;
+	}
 
 	node->begin = t.cur;
 
@@ -267,11 +277,13 @@
 
 	fdt_tokenizer_init(&t, node->strs, node->begin, node->end);
 
-	if (!fdt_skip_node(&t))
+	if (!fdt_skip_node(&t)) {
 		return false;
+	}
 
-	if (!fdt_next_subnode(&t, sibling_name))
+	if (!fdt_next_subnode(&t, sibling_name)) {
 		return false;
+	}
 
 	node->begin = t.cur;
 
@@ -323,18 +335,21 @@
 				size_t i;
 				dlog("%*sproperty: \"%s\" (", 2 * depth, "",
 				     name);
-				for (i = 0; i < size; i++)
+				for (i = 0; i < size; i++) {
 					dlog("%s%02x", i == 0 ? "" : " ",
 					     buf[i]);
+				}
 				dlog(")\n");
 			}
 		}
 
-		if (!fdt_tokenizer_token(&t, &token))
+		if (!fdt_tokenizer_token(&t, &token)) {
 			return;
+		}
 
-		if (token != FDT_END_NODE)
+		if (token != FDT_END_NODE) {
 			return;
+		}
 
 		depth--;
 	} while (depth);
diff --git a/src/main.c b/src/main.c
index e7639f5..a23c7e8 100644
--- a/src/main.c
+++ b/src/main.c
@@ -18,8 +18,9 @@
 bool fdt_find_node(struct fdt_node *node, const char *path)
 {
 	while (*path) {
-		if (!fdt_find_child(node, path))
+		if (!fdt_find_child(node, path)) {
 			return false;
+		}
 		path += strlen(path);
 	}
 
@@ -50,8 +51,9 @@
 	const char *data;
 	uint32_t size;
 
-	if (!fdt_read_property(node, name, &data, &size))
+	if (!fdt_read_property(node, name, &data, &size)) {
 		return false;
+	}
 
 	switch (size) {
 	case sizeof(uint32_t):
@@ -75,8 +77,9 @@
 		char a[8];
 	} t;
 
-	if (!fdt_read_property(node, name, &data, &size))
+	if (!fdt_read_property(node, name, &data, &size)) {
 		return false;
+	}
 
 	switch (size) {
 	case sizeof(uint32_t):
@@ -102,8 +105,9 @@
 static bool copy_to_unmaped(paddr_t to, const void *from, size_t size)
 {
 	if (!mm_ptable_map(&ptable, (vaddr_t)to, (vaddr_t)to + size, to,
-			   MM_MODE_W | MM_MODE_STAGE1))
+			   MM_MODE_W | MM_MODE_STAGE1)) {
 		return false;
+	}
 
 	memcpy((void *)to, from, size);
 
@@ -132,21 +136,24 @@
 	uint64_t entry_size;
 
 	/* Get the sizes of memory range addresses and sizes. */
-	if (fdt_read_number(&n, "#address-cells", &address_size))
+	if (fdt_read_number(&n, "#address-cells", &address_size)) {
 		address_size *= sizeof(uint32_t);
-	else
+	} else {
 		address_size = sizeof(uint32_t);
+	}
 
-	if (fdt_read_number(&n, "#size-cells", &size_size))
+	if (fdt_read_number(&n, "#size-cells", &size_size)) {
 		size_size *= sizeof(uint32_t);
-	else
+	} else {
 		size_size = sizeof(uint32_t);
+	}
 
 	entry_size = address_size + size_size;
 
 	/* Look for nodes with the device_type set to "memory". */
-	if (!fdt_first_child(&n, &name))
+	if (!fdt_first_child(&n, &name)) {
 		return;
+	}
 
 	do {
 		const char *data;
@@ -228,15 +235,17 @@
 
 static void memiter_skip_space(struct memiter *it)
 {
-	while (it->next < it->limit && memiter_isspace(it))
+	while (it->next < it->limit && memiter_isspace(it)) {
 		it->next++;
+	}
 }
 
 static bool memiter_iseq(const struct memiter *it, const char *str)
 {
 	size_t len = strlen(str);
-	if (len != it->limit - it->next)
+	if (len != it->limit - it->next) {
 		return false;
+	}
 	return memcmp(it->next, str, len) == 0;
 }
 
@@ -244,14 +253,16 @@
 {
 	/* Skip all white space and fail if we reach the end of the buffer. */
 	memiter_skip_space(it);
-	if (it->next >= it->limit)
+	if (it->next >= it->limit) {
 		return false;
+	}
 
 	str->next = it->next;
 
 	/* Find the end of the string. */
-	while (it->next < it->limit && !memiter_isspace(it))
+	while (it->next < it->limit && !memiter_isspace(it)) {
 		it->next++;
+	}
 
 	str->limit = it->next;
 
@@ -264,12 +275,14 @@
 
 	/* Skip all white space and fail if we reach the end of the buffer. */
 	memiter_skip_space(it);
-	if (it->next >= it->limit)
+	if (it->next >= it->limit) {
 		return false;
+	}
 
 	/* Fail if it's not a number. */
-	if (*it->next < '0' && *it->next > '9')
+	if (*it->next < '0' && *it->next > '9') {
 		return false;
+	}
 
 	/* Parse the number. */
 	do {
@@ -441,8 +454,9 @@
 
 	if (!mm_ptable_init(&ptable, MM_MODE_NOSYNC | MM_MODE_STAGE1)) {
 		dlog("Unable to allocate memory for page table.\n");
-		for (;;)
-			;
+		for (;;) {
+			/* do nothing */
+		}
 	}
 
 	dlog("text: 0x%x - 0x%x\n", text_begin, text_end);
@@ -505,8 +519,9 @@
 		uint64_t begin;
 		uint64_t end;
 
-		if (!find_initrd(&n, &begin, &end))
+		if (!find_initrd(&n, &begin, &end)) {
 			break;
+		}
 
 		dlog("Ramdisk range: 0x%x - 0x%x\n", begin, end - 1);
 		mm_ptable_map(&ptable, begin, end, begin,
diff --git a/src/mm.c b/src/mm.c
index 8bfd6f4..8942ec5 100644
--- a/src/mm.c
+++ b/src/mm.c
@@ -58,8 +58,9 @@
 	size_t inc;
 
 	/* Just return pointer to table if it's already populated. */
-	if (arch_mm_pte_is_table(v))
+	if (arch_mm_pte_is_table(v)) {
 		return arch_mm_pte_to_table(v);
+	}
 
 	/* Allocate a new table. */
 	ntable = (sync_alloc ? halloc_aligned : halloc_aligned_nosync)(
@@ -75,10 +76,11 @@
 		new_pte = arch_mm_absent_pte();
 	} else {
 		inc = mm_entry_size(level - 1);
-		if (level == 1)
+		if (level == 1) {
 			new_pte = arch_mm_block_to_page_pte(v);
-		else
+		} else {
 			new_pte = v;
+		}
 	}
 
 	/* Initialise entries in the new table. */
@@ -128,14 +130,16 @@
 	bool sync = flags & MAP_FLAG_SYNC;
 
 	/* Cap va_end so that we don't go over the current level max. */
-	if (va_end > va_level_end)
+	if (va_end > va_level_end) {
 		va_end = va_level_end;
+	}
 
 	/* Fill each entry in the table. */
 	while (va < va_end) {
 		if (level == 0) {
-			if (commit)
+			if (commit) {
 				table[i] = arch_mm_pa_to_page_pte(pa, attrs);
+			}
 		} else if ((va_end - va) >= entry_size &&
 			   arch_mm_is_block_allowed(level) &&
 			   (va & (entry_size - 1)) == 0) {
@@ -149,12 +153,14 @@
 		} else {
 			pte_t *nt =
 				mm_populate_table_pte(table + i, level, sync);
-			if (!nt)
+			if (!nt) {
 				return false;
+			}
 
 			if (!mm_map_level(va, va_end, pa, attrs, nt, level - 1,
-					  flags))
+					  flags)) {
 				return false;
+			}
 		}
 
 		va = (va + entry_size) & ~(entry_size - 1);
@@ -170,10 +176,11 @@
  */
 static void mm_invalidate_tlb(vaddr_t begin, vaddr_t end, bool stage1)
 {
-	if (stage1)
+	if (stage1) {
 		arch_mm_invalidate_stage1_range(begin, end);
-	else
+	} else {
 		arch_mm_invalidate_stage2_range(begin, end);
+	}
 }
 
 /**
@@ -197,8 +204,9 @@
 	 * state. In such a two-step implementation, the table may be left with
 	 * extra internal tables, but no different mapping on failure.
 	 */
-	if (!mm_map_level(begin, end, paddr, attrs, t->table, level, flags))
+	if (!mm_map_level(begin, end, paddr, attrs, t->table, level, flags)) {
 		return false;
+	}
 
 	mm_map_level(begin, end, paddr, attrs, t->table, level,
 		     flags | MAP_FLAG_COMMIT);
@@ -222,8 +230,9 @@
 	end = arch_mm_clear_va(end + PAGE_SIZE - 1);
 
 	/* Also do updates in two steps, similarly to mm_ptable_map. */
-	if (!mm_map_level(begin, end, begin, 0, t->table, level, flags))
+	if (!mm_map_level(begin, end, begin, 0, t->table, level, flags)) {
 		return false;
+	}
 
 	mm_map_level(begin, end, begin, 0, t->table, level,
 		     flags | MAP_FLAG_COMMIT);
@@ -250,8 +259,9 @@
 
 	for (i = arch_mm_max_level(&t->arch); i > 0; i--) {
 		table = mm_populate_table_pte(table + mm_index(va, i), i, sync);
-		if (!table)
+		if (!table) {
 			return false;
+		}
 	}
 
 	i = mm_index(va, 0);
@@ -267,12 +277,14 @@
 {
 	uint64_t i;
 	for (i = 0; i < PAGE_SIZE / sizeof(pte_t); i++) {
-		if (!arch_mm_pte_is_present(table[i]))
+		if (!arch_mm_pte_is_present(table[i])) {
 			continue;
+		}
 
 		dlog("%*s%x: %x\n", 4 * (max_level - level), "", i, table[i]);
-		if (!level)
+		if (!level) {
 			continue;
+		}
 
 		if (arch_mm_pte_is_table(table[i])) {
 			mm_dump_table_recursive(arch_mm_pte_to_table(table[i]),
@@ -307,16 +319,19 @@
 	size_t i;
 	pte_t *table;
 
-	if (mode & MM_MODE_NOSYNC)
+	if (mode & MM_MODE_NOSYNC) {
 		table = halloc_aligned_nosync(PAGE_SIZE, PAGE_SIZE);
-	else
+	} else {
 		table = halloc_aligned(PAGE_SIZE, PAGE_SIZE);
+	}
 
-	if (!table)
+	if (!table) {
 		return false;
+	}
 
-	for (i = 0; i < PAGE_SIZE / sizeof(pte_t); i++)
+	for (i = 0; i < PAGE_SIZE / sizeof(pte_t); i++) {
 		table[i] = arch_mm_absent_pte();
+	}
 
 	t->table = table;
 	arch_mm_ptable_init(&t->arch);
diff --git a/src/std.c b/src/std.c
index 39ba972..9ea1591 100644
--- a/src/std.c
+++ b/src/std.c
@@ -3,8 +3,9 @@
 void *memset(void *s, int c, size_t n)
 {
 	char *p = (char *)s;
-	while (n--)
+	while (n--) {
 		*p++ = c;
+	}
 	return s;
 }
 
@@ -14,8 +15,9 @@
 size_t strlen(const char *str)
 {
 	const char *p = str;
-	while (*p)
+	while (*p) {
 		p++;
+	}
 	return p - str;
 }
 
@@ -38,8 +40,9 @@
 	char *x;
 	const char *y;
 
-	if (dst < src)
+	if (dst < src) {
 		return memcpy(dst, src, n);
+	}
 
 	x = (char *)dst + n - 1;
 	y = (const char *)src + n - 1;
@@ -59,8 +62,9 @@
 	const char *y = b;
 
 	while (n--) {
-		if (*x != *y)
+		if (*x != *y) {
 			return *x - *y;
+		}
 		x++;
 		y++;
 	}
@@ -74,8 +78,9 @@
 	const char *y = b;
 
 	while (*x != 0 && *y != 0) {
-		if (*x != *y)
+		if (*x != *y) {
 			return *x - *y;
+		}
 		x++;
 		y++;
 	}
diff --git a/src/vm.c b/src/vm.c
index 05dd2e3..0b5101c 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -9,8 +9,9 @@
 	vm->vcpu_count = vcpu_count;
 
 	/* Do basic initialization of vcpus. */
-	for (i = 0; i < vcpu_count; i++)
+	for (i = 0; i < vcpu_count; i++) {
 		vcpu_init(vm->vcpus + i, vm);
+	}
 
 	arch_vptable_init(&vm->page_table);
 }