Many of the license and Intel copyright headers include the "All rights
reserved" string. It is not relevant in the context of the BSD-3-Clause
license that the code is released under. This patch removes those strings
throughout the code (hypervisor, devicemodel and misc).
Tracked-On: #7254
Signed-off-by: Geoffroy Van Cutsem <geoffroy.vancutsem@intel.com>
The coding guideline rule C-TY-12 requires that 'all type conversions shall
be explicit'. Especially implicit cases on the signedness of variables
shall be avoided.
This patch either adds explicit type casts or adjust local variable types
to make sure that Booleans, signed and unsigned integers are not used
mixedly.
This patch has no semantic changes.
Tracked-On: #6776
Signed-off-by: Junjie Mao <junjie.mao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Add a standard string api strncat_s() to replace merge_cmdline() to make code
more readable.
Another change is that the multiboot cmdline will be appended to the end of
configured SOS bootargs instead of the beginning, this would enable a feature
that some kernel cmdline paramter items could be overriden by multiboot cmdline
since the later one would win if same parameters configured in kernel cmdline.
Tracked-On: #4885
Signed-off-by: Victor Sun <victor.sun@intel.com>
Reviewed-by: Yonghua Huang <yonghua.huang@intel.com>
Reviewed-by: Yin Fengwei <fengwei.yin@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Per C11 standard (ISO/IEC 9899:2011): K.3.7.1.4
1. Copying shall not take place between objects that overlap;
2. If there is a runtime-constraint violation, the strncpy_s function sets
s1[0] to '\0\;
3. The strncpy_s function returns zero if there was no runtime-constraint
violation. Otherwise, a nonzero value is returned.
4. The function is implemented with memcpy_s() because the runtime-constraint
detection is almost same.
Tracked-On: #4885
Signed-off-by: Victor Sun <victor.sun@intel.com>
Reviewed-by: Yonghua Huang <yonghua.huang@intel.com>
Reviewed-by: Yin Fengwei <fengwei.yin@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
-- remove some unnecessary includes
-- fix a typo
-- remove unnecessary void before launch_vms
Tracked-On: #1842
Signed-off-by: Mingqiang Chi <mingqiang.chi@intel.com>
In lib/string.c, strncmp doesn't consider condition "n_arg=0",
just add a process to "n_arg=0".
Tracked-On: projectacrn/acrn-hypervisor#3466
Signed-off-by: YanX Fu <yanx.fu@intel.com>
Reviewed-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
-- move this api from misc.c to timer.c to avoid
reverse dependency, and remove misc.c
Tracked-On: #1842
Signed-off-by: Mingqiang Chi <mingqiang.chi@intel.com>
Refer to sha256 description to rename function name
Tracked-On: #861
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Commit 005546 introduces some functions like s0, s1, s2.
This patch renames `s1` and `s2` in string.c to avoid the name conflict.
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
-Remove upper case
-Modify/fix code style violations
-fix value need U suffix
-Assignment operation in expression
-remove function like macros
v1->v2 fix assignment operation in expression
v2->v3 fix function like macros
Tracked-On: #861
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Typedefs that indicate size and signedness should be used in place of
the basic numerical types
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
-remove goto
-remove multiple return
-Modify assignment operator in boolean expression
-Modify/fix code style violations
-fix attempt to change parameters passed by value
-fix value need U suffix
-fix use of mixed arithmetic
-fix assigment in expression
-other fixes
Tracked-On: #861
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Reviewed-by: Bing Zhu <bing.zhu@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
-remove goto
-remove multiple return
-Modify assignment operator in boolean expression
-Modify/fix code style violations
-fix attempt to change parameters passed by value
-fix value need U suffix
-fix use of mixed arithmetic
-fix assigment in expression
-other fixes
Tracked-On: #861
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Reviewed-by: Bing Zhu <bing.zhu@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
-remove goto
-remove multiple return
-Modify assignment operator in boolean expression
-Modify/fix code style violations
-fix attempt to change parameters passed by value
-fix value need U suffix
-fix use of mixed arithmetic
-fix assigment in expression
-other fix
Tracked-On: #861
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Reviewed-by: Bing Zhu <bing.zhu@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Fix the violations list below:
1.Procedure has more than one exit point.
2.Use of sizeof on an array parameter.
3.Expression needs brackets.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This patch moves `atoi` and `strtol_dec` to debug directory
since they are only used by code under debug directory.
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
This patch fixes the MISRA-C violations in lib/string.c
* add the required brackets for logical conjunctions
* replace the basic type `long` with defined type `int64_t`
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
This patch fixes the MISRA-C violations in lib/string.c
* make the while loop have only one `break`
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
1) Variable names shall start with a lower-case letter.
2) Multiplication and division come before addition and subtraction.
Everything else should be in parentheses.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
No one uses it and it's some duplicated with strchr.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
Use enhanced rep fast-string operation to refine memcpy_s.
And assume that the destination and the source would not overlap.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Fix procedure has more than one exit point
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Reviewed-by: Huang, Yonghua <yonghua.huang@intel.com>
Reassign reference parameter may lead to possibly serious errors
and unmaintainability. This patch wants to fix this by avoiding
do this.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Implicit conversion may result in loss of information or undefined behaviour.
So make it with explicit conversion.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
There may the theoretic infinite loop with some code. But actually it doesn't.
This patch make these code more obvious it's not a potentially infinite loop.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
The code in comments was removed from md_wrap.c, so modify comments
to avoid confusion
Tracked-On: #1966
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This patch adds the necessary space before or after binary operator.
v1 -> v2:
* minor fix related to integer
[i - 1] ====> [i - 1U]
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
replace CPU_PAGE_SIZE with PAGE_SIZE
These two MACROs are duplicated and PAGE_SIZE is a more reasonable name.
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
IEC 61508,ISO 26262 standards highly recommend single-exit rule.
Reduce the count of the "return entries".
Fix the violations which is comply with the cases list below:
1.Function has 2 return entries.
2.The first return entry is used to return the error code of
checking variable whether is valid.
Fix the violations in "if else" format.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
v1-v2:
Bypass this case:
When binary arithmetic operators of different precedence (e.g. '+'
and '*') are mixed in an expression, parentheses are added to the
sub-expressions using the operator with a higher precedence.
v1:
The operator precedence rules are complicated and it is easy to make a mistake.
So add brackets to make operator expression more readable.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Remove dynamic memory allocation in crypto lib, use array to
replace them.
Tracked-On: #1900
Reviewed-by: Bing Zhu <bing.zhu@intel.com>
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
CSE FW uses an AEK (Attestation keybox Encryption Key) to encrypt the keybox
with AES-256-GCM algorithm before sending it to Android/Trusty. This key is
derived from the latest platform Seed by CSE FW with KDF (key derivation function)
HMAC-SHA256. After Trusty retrieves this encrypted keybox over HECI/MEI driver,
Trusty needs the same AEKkey to decrypt it. Hence, before Trusty launches,
Hypervisor derives the same AEK key from Platform Seed with the same algorithm
and the same derivation parameters, then sends this AEK along with Trusty vSeed
to Trusty world memory.
Since Platform Seed is only visible to Hypervisor and it must not be
sent to any guest VM, only Hypervisor can derive this AEK from this
Platform Seed, just like previous per-Trusty virtual Seed derivation.
Please note that Android Attestation Keybox is shared in a single hardware
platform, so all the Trusty instance/world can get the same AEK for
decryption even if there are multiple Android User OS/VMs running
on top of Hypervisor.
v1 --> v2:
Add detailed description why we need the patch to derive an extra key
v2 --> v3:
Convert API descriptions to Doxygen
Tracked-On: #1812
Reviewed-by: Bing Zhu <bing.zhu@intel.com>
Reviewed-by: Kai Wang <kai.z.wang@intel.com>
Signed-off-by: Chen Gang G <gang.g.chen@intel.com>
Acked-by: Bing Zhu <bing.zhu@intel.com>
The print_param struct's member emit who is used for callback,
the forth parameter of it is used for transmit the private data
of the "print_param".
The type translation between "void *" and private date broke the
violations.
Use the same type to fix it out.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Xu Anthony <anthony.xu@intel.com>
%x could be used to replace the %o print option.
%x could be used to replace the %p print option also.
Tracked-On: #1656
Signed-off-by: Yin Fengwei <fengwei.yin@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Fix violations for function whose parameter can be read-only.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
Geoffroy Van Cutsem