[PATCH] Add CodeQL build stage

[Owen Smith <owen.smith@xxxxxxxxxx>]

CodeQL logs will be required for future WHQL submissions. Add a stage
that generates the required SARIF files. CodeQL is a semantic code
analysis engine, which will highlight vunerabilities that will need
fixing.

In order to use CodeQL, the CodeQL binaries must be on the path and the
Windows-Driver-Developer-Supplemental-Tools must be on the path defined
by the CODEQL_QUERY_SUITE environment variable (if defined), or under
the parent folder (if CODEQL_QUERY_SUITE variable is not defined)

Note: Due to the way the codeql command line is built, using quotes in a
MSBuild command line is not possible, so generate a batch file to wrap
the command line.

Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
---
 build.ps1   | 20 ++++++++++++
 msbuild.ps1 | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 107 insertions(+), 1 deletion(-)

diff --git a/build.ps1 b/build.ps1
index 2ea6428..346d187 100644
--- a/build.ps1
+++ b/build.ps1
@@ -6,6 +6,7 @@ param(
        [Parameter(Mandatory = $true)]
        [string]$Type,
        [string]$Arch,
+       [switch]$CodeQL,
        [switch]$Sdv
 )
 
@@ -51,6 +52,21 @@ Function SdvBuild {
        & ".\msbuild.ps1" @params
 }
 
+function CodeQLBuild {
+       $visualstudioversion = $Env:VisualStudioVersion
+       $solutiondir = @{ "14.0" = "vs2015"; "15.0" = "vs2017"; "16.0" = 
"vs2019"; }
+       $configurationbase = @{ "14.0" = "Windows 10"; "15.0" = "Windows 10"; 
"16.0" = "Windows 10"; }
+       $arch = "x64"
+
+       $params = @{
+               SolutionDir = $solutiondir[$visualstudioversion];
+               ConfigurationBase = $configurationbase[$visualstudioversion];
+               Arch = $arch;
+               Type = "codeql"
+               }
+       & ".\msbuild.ps1" @params
+}
+
 if ($Type -ne "free" -and $Type -ne "checked") {
        Write-Host "Invalid Type"
        Exit -1
@@ -99,6 +115,10 @@ if ([string]::IsNullOrEmpty($Arch) -or $Arch -eq "x64") {
        Build "x64" $Type
 }
 
+if ($CodeQL) {
+       CodeQLBuild
+}
+
 if ($Sdv) {
        SdvBuild
 }
diff --git a/msbuild.ps1 b/msbuild.ps1
index 670050c..de7ad52 100644
--- a/msbuild.ps1
+++ b/msbuild.ps1
@@ -67,11 +67,75 @@ Function Run-MSBuildSDV {
        Set-Location $basepath
 }
 
+Function Run-CodeQL {
+       param(
+               [string]$SolutionPath,
+               [string]$Name,
+               [string]$Configuration,
+               [string]$Platform,
+               [string]$SearchPath,
+               [string]$OutputPath
+       )
+
+       $projpath = Resolve-Path (Join-Path $SolutionPath $Name)
+       $project = [string]::Format("{0}.vcxproj", $Name)
+       $output = [string]::Format("{0}.sarif", $Name)
+       $database = Join-Path "database" $Name
+
+       # write a bat file to wrap msbuild parameters
+       $bat = [string]::Format("{0}.bat", $Name)
+       if (Test-Path $bat) {
+               Remove-Item $bat
+       }
+       $a = "msbuild.exe"
+       $a += " /m:4"
+       $a += " /t:Build"
+       $a += [string]::Format(" /p:Configuration=""{0}""", $Configuration)
+       $a += [string]::Format(" /p:Platform=""{0}""", $Platform)
+       $a += " "
+       $a += Join-Path $projpath $project
+       $a | Set-Content $bat
+
+       # generate the database
+       $b = "codeql"
+       $b += " database"
+       $b += " create"
+       $b += " -l=cpp"
+       $b += " -s=src"
+       $b += " -c"
+       $b += ' "' + (Resolve-Path $bat) + '" '
+       $b += $database
+       Invoke-Expression $b
+       if ($LASTEXITCODE -ne 0) {
+               Write-Host -ForegroundColor Red "ERROR: CodeQL failed, code:" 
$LASTEXITCODE
+               Exit $LASTEXITCODE
+       }
+       Remove-Item $bat
+
+       # perform the analysis on the database
+       $c = "codeql"
+       $c += " database"
+       $c += " analyze "
+       $c += $database
+       $c += " windows_driver_recommended.qls"
+       $c += " --format=sarifv2.1.0"
+       $c += " --output="
+       $c += (Join-Path $OutputPath $output)
+       $c += " --search-path="
+       $c += $SearchPath
+
+       Invoke-Expression $c
+       if ($LASTEXITCODE -ne 0) {
+               Write-Host -ForegroundColor Red "ERROR: CodeQL failed, code:" 
$LASTEXITCODE
+               Exit $LASTEXITCODE
+       }
+}
+
 #
 # Script Body
 #
 
-$configuration = @{ "free" = "$ConfigurationBase Release"; "checked" = 
"$ConfigurationBase Debug"; "sdv" = "$ConfigurationBase Release"; }
+$configuration = @{ "free" = "$ConfigurationBase Release"; "checked" = 
"$ConfigurationBase Debug"; "sdv" = "$ConfigurationBase Release"; "codeql" = 
"$ConfigurationBase Release"; }
 $platform = @{ "x86" = "Win32"; "x64" = "x64" }
 $solutionpath = Resolve-Path $SolutionDir
 
@@ -83,6 +147,28 @@ if ($Type -eq "free") {
 elseif ($Type -eq "checked") {
        Run-MSBuild $solutionpath "xenbus.sln" $configuration["checked"] 
$platform[$Arch]
 }
+elseif ($Type -eq "codeql") {
+       $archivepath = "xenbus"
+
+       if (-Not (Test-Path -Path $archivepath)) {
+               New-Item -Name $archivepath -ItemType Directory | Out-Null
+       }
+
+       if ([string]::IsNullOrEmpty($Env:CODEQL_QUERY_SUITE)) {
+               $searchpath = Resolve-Path ".."
+       } else {
+               $searchpath = $Env:CODEQL_QUERY_SUITE
+       }
+
+       if (Test-Path "database") {
+               Remove-Item -Recurse -Force "database"
+       }
+       New-Item -ItemType Directory "database"
+
+       Run-CodeQL $solutionpath "xen" $configuration["codeql"] 
$platform[$Arch] $searchpath $archivepath
+       Run-CodeQL $solutionpath "xenfilt" $configuration["codeql"] 
$platform[$Arch] $searchpath $archivepath
+       Run-CodeQL $solutionpath "xenbus" $configuration["codeql"] 
$platform[$Arch] $searchpath $archivepath
+}
 elseif ($Type -eq "sdv") {
        $archivepath = "xenbus"
 
-- 
2.28.0.windows.1