ci/workflows: add build automation, release pipeline, and branch protection rules

.github/workflows/windows-driver-analysis.yml

@@ -0,0 +1,247 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause
+name: Windows Driver Analysis
+
+# Runs two complementary static analysis tools on every PR that touches
+# Windows driver source code:
+#
+#   1. Code Analysis (/analyze) — MSBuild-integrated MSVC static analyser.
+#      Catches buffer overruns, null dereferences, IRQL violations, and
+#      SAL annotation mismatches at compile time. Fast (~minutes).
+#
+#   2. Static Driver Verifier (SDV) — formal verification engine shipped
+#      with the WDK. Exhaustively checks driver source against rule sets
+#      specific to the driver model (KMDF / WDM / NDIS). Slow (~hours),
+#      so it runs only on the four kernel driver projects and is scoped
+#      to the most critical rule sets to keep CI time reasonable.
+#
+# Driver Verifier (runtime) is intentionally excluded — it requires a
+# live kernel and cannot run in a hosted CI environment.
+#
+# Only driver projects are analysed. Tool projects (qdinstall, qdclr,
+# qdcfg, qcdev, wwansvc) are user-mode executables and are excluded.
+
+on:
+  pull_request:
+    branches:
+      - develop
+    paths:
+      - 'src/windows/filter/**'
+      - 'src/windows/ndis/**'
+      - 'src/windows/wdfserial/**'
+      - 'src/windows/qdss/**'
+
+permissions:
+  contents: read
+
+jobs:
+
+  # ============================================================
+  # Shared setup — install WDK once, cache it across jobs
+  # ============================================================
+
+  # ============================================================
+  # Code Analysis (/analyze) — all four driver projects
+  # ============================================================
+  code-analysis:
+    name: Code Analysis — ${{ matrix.project.name }}
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        project:
+          - name: qcusbfilter (WDM)
+            vcxproj: src/windows/filter/qcusbfilter.vcxproj
+            driver_type: WDM
+          - name: qcusbnet (WDM)
+            vcxproj: src/windows/ndis/qcusbnet.vcxproj
+            driver_type: WDM
+          - name: qcwdfserial (KMDF)
+            vcxproj: src/windows/wdfserial/qcwdfserial.vcxproj
+            driver_type: KMDF
+          - name: qdbusb (KMDF)
+            vcxproj: src/windows/qdss/qdbusb.vcxproj
+            driver_type: KMDF
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Add MSBuild to PATH
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce  # v2
+
+      - name: Install WDK
+        shell: pwsh
+        run: |
+          $wdkUrl       = "https://go.microsoft.com/fwlink/?linkid=2335869"
+          $wdkInstaller = "$env:TEMP\wdksetup.exe"
+          Write-Host "Downloading WDK..."
+          & curl.exe -L --retry 3 --retry-delay 5 -o $wdkInstaller $wdkUrl
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          if ((Get-Item $wdkInstaller).Length -lt 1MB) {
+            Write-Host "ERROR: WDK installer download appears corrupt." -ForegroundColor Red; exit 1
+          }
+          Write-Host "Installing WDK silently..."
+          $proc = Start-Process -FilePath $wdkInstaller -ArgumentList "/quiet /norestart" -PassThru -Wait
+          if ($proc.ExitCode -ne 0) {
+            Write-Host "ERROR: WDK installer exited with $($proc.ExitCode)" -ForegroundColor Red
+            exit $proc.ExitCode
+          }
+          Write-Host "WDK installed."
+
+      - name: Run Code Analysis
+        shell: pwsh
+        run: |
+          # /analyze enables MSVC static analysis.
+          # /analyze:ruleset uses the WDK-supplied driver-specific rule set.
+          # RunCodeAnalysis=true tells the WDK targets to enable /analyze.
+          # AnalysisStopOnError=true fails the build on any Code Analysis warning.
+          msbuild "${{ matrix.project.vcxproj }}" `
+            /p:Configuration=Release `
+            /p:Platform=x64 `
+            /p:RunCodeAnalysis=true `
+            /p:AnalysisStopOnError=true `
+            /p:EnablePREfast=true `
+            /p:CodeAnalysisRuleSet=NativeRecommendedRules.ruleset `
+            /p:CA_PlugInDir="$(${env:WindowsSdkDir})\..\..\WDK\CodeAnalysis\Plugins" `
+            /t:Build `
+            /m `
+            /nologo `
+            /filelogger `
+            /fileloggerparameters:LogFile=ca_${{ matrix.project.driver_type }}.log
+
+      - name: Upload Code Analysis log
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: code-analysis-${{ matrix.project.name }}
+          path: ca_${{ matrix.project.driver_type }}.log
+          retention-days: 14
+
+  # ============================================================
+  # Static Driver Verifier (SDV)
+  # ============================================================
+  static-driver-verifier:
+    name: Static Driver Verifier — ${{ matrix.project.name }}
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        project:
+          # KMDF rule set for KMDF drivers
+          - name: qcwdfserial (KMDF)
+            vcxproj: src/windows/wdfserial/qcwdfserial.vcxproj
+            dir: src/windows/wdfserial
+            rule_set: KMDF
+          - name: qdbusb (KMDF)
+            vcxproj: src/windows/qdss/qdbusb.vcxproj
+            dir: src/windows/qdss
+            rule_set: KMDF
+          # WDM rule set for WDM drivers
+          - name: qcusbfilter (WDM)
+            vcxproj: src/windows/filter/qcusbfilter.vcxproj
+            dir: src/windows/filter
+            rule_set: WDM
+          - name: qcusbnet (WDM)
+            vcxproj: src/windows/ndis/qcusbnet.vcxproj
+            dir: src/windows/ndis
+            rule_set: WDM
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Add MSBuild to PATH
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce  # v2
+
+      - name: Install WDK
+        shell: pwsh
+        run: |
+          $wdkUrl       = "https://go.microsoft.com/fwlink/?linkid=2335869"
+          $wdkInstaller = "$env:TEMP\wdksetup.exe"
+          Write-Host "Downloading WDK..."
+          & curl.exe -L --retry 3 --retry-delay 5 -o $wdkInstaller $wdkUrl
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          if ((Get-Item $wdkInstaller).Length -lt 1MB) {
+            Write-Host "ERROR: WDK installer download appears corrupt." -ForegroundColor Red; exit 1
+          }
+          Write-Host "Installing WDK silently..."
+          $proc = Start-Process -FilePath $wdkInstaller -ArgumentList "/quiet /norestart" -PassThru -Wait
+          if ($proc.ExitCode -ne 0) {
+            Write-Host "ERROR: WDK installer exited with $($proc.ExitCode)" -ForegroundColor Red
+            exit $proc.ExitCode
+          }
+          Write-Host "WDK installed."
+
+      - name: Run Static Driver Verifier
+        shell: pwsh
+        run: |
+          # SDV is invoked via the WDK MSBuild targets.
+          # /t:sdv runs the SDV analysis phase.
+          # /p:Inputs="/check:*" runs all rules for the given driver model.
+          # Scoping to the most impactful rule sets per driver type keeps
+          # runtime within CI limits while covering the highest-risk areas:
+          #   KMDF — covers WDF object lifetime, locking, IRQL, I/O handling
+          #   WDM  — covers IRP handling, cancellation, locking, power management
+          msbuild "${{ matrix.project.vcxproj }}" `
+            /t:sdv `
+            /p:Configuration=Release `
+            /p:Platform=x64 `
+            /p:Inputs="/check:${{ matrix.project.rule_set }}" `
+            /p:RerunSDV=true `
+            /nologo
+
+      - name: Check SDV results
+        shell: pwsh
+        run: |
+          # Build an absolute, slash-consistent path using Join-Path and
+          # $env:GITHUB_WORKSPACE so it is unambiguous regardless of how
+          # the matrix variable was interpolated.
+          $projectDir = Join-Path $env:GITHUB_WORKSPACE "${{ matrix.project.dir }}"
+          $sdvDir     = Join-Path $projectDir "SDV"
+          $dvlPath    = Join-Path $sdvDir "SDV.DVL.xml"
+
+          Write-Host "Expecting SDV results at: $dvlPath"
+
+          # List what SDV actually produced to aid diagnosis if the file is missing.
+          if (Test-Path $sdvDir) {
+            Write-Host "SDV output directory contents:"
+            Get-ChildItem -Path $sdvDir -Recurse | Select-Object FullName
+          } else {
+            Write-Host "WARNING: SDV output directory does not exist: $sdvDir" -ForegroundColor Yellow
+          }
+
+          if (-not (Test-Path $dvlPath)) {
+            Write-Host "ERROR: SDV.DVL.xml not found — SDV may not have completed successfully." -ForegroundColor Red
+            exit 1
+          }
+
+          [xml]$dvl = Get-Content $dvlPath
+          $defects = $dvl.DVL.Driver.Defects.Defect
+          $count   = if ($defects) { @($defects).Count } else { 0 }
+          Write-Host "SDV defects found: $count"
+
+          if ($count -gt 0) {
+            Write-Host "ERROR: SDV found $count defect(s) in ${{ matrix.project.name }}" -ForegroundColor Red
+            foreach ($d in $defects) {
+              Write-Host "  Rule     : $($d.RuleName)"
+              Write-Host "  File     : $($d.File)"
+              Write-Host "  Line     : $($d.Line)"
+              Write-Host "  Category : $($d.Category)"
+              Write-Host ""
+            }
+            exit 1
+          }
+          Write-Host "SDV passed — no defects found." -ForegroundColor Green
+
+      - name: Upload SDV results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: sdv-results-${{ matrix.project.name }}
+          path: ${{ matrix.project.dir }}/SDV/
+          retention-days: 14

build/build_drivers.ps1

@@ -20,9 +20,8 @@ $Script:DriversDir = "drivers"
 # Build configuration defaults
 $Script:BuildConfiguration = "Release"
 $Script:BuildPlatforms = @(
-    @{ Platform = "x86";   OutDir = "Win32"; CopyDir = "x86";   OSList = "10_X86" }
     @{ Platform = "x64";   OutDir = "x64";   CopyDir = "amd64"; OSList = "10_X64" }
-    @{ Platform = "arm64"; OutDir = "arm64"; CopyDir = "arm64"; OSList = "10_RS4_ARM64,10_RS5_ARM64,10_19H1_ARM64,10_VB_ARM64" }
+    @{ Platform = "ARM64"; OutDir = "arm64"; CopyDir = "arm64"; OSList = "10_RS4_ARM64,10_RS5_ARM64,10_19H1_ARM64,10_VB_ARM64" }
 )
 $Script:DriverProjects = @(
     @{ Name = "qcadb";     PackageName = "qcadb";       SolutionPath = $null }

src/windows/filter/qcusbfilter.sln

@@ -9,10 +9,10 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM64 = Debug|ARM64
 		Debug|x64 = Debug|x64
-		Debug|x86 = Debug|x86
+
 		Release|ARM64 = Release|ARM64
 		Release|x64 = Release|x64
-		Release|x86 = Release|x86
+
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|ARM64.ActiveCfg = Debug|ARM64
@@ -21,18 +21,14 @@ Global
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|x64.ActiveCfg = Debug|x64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|x64.Build.0 = Debug|x64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|x64.Deploy.0 = Debug|x64
-		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|x86.ActiveCfg = Debug|Win32
-		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|x86.Build.0 = Debug|Win32
-		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Debug|x86.Deploy.0 = Debug|Win32
+
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|ARM64.ActiveCfg = Release|ARM64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|ARM64.Build.0 = Release|ARM64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|ARM64.Deploy.0 = Release|ARM64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|x64.ActiveCfg = Release|x64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|x64.Build.0 = Release|x64
 		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|x64.Deploy.0 = Release|x64
-		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|x86.ActiveCfg = Release|Win32
-		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|x86.Build.0 = Release|Win32
-		{AAC5BB08-77C0-4626-A944-7FB0ADC3E4F1}.Release|x86.Deploy.0 = Release|Win32
+
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

src/windows/ndis/qcusbnet.sln

@@ -9,10 +9,10 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM64 = Debug|ARM64
 		Debug|x64 = Debug|x64
-		Debug|x86 = Debug|x86
+
 		Release|ARM64 = Release|ARM64
 		Release|x64 = Release|x64
-		Release|x86 = Release|x86
+
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|ARM64.ActiveCfg = Debug|ARM64
@@ -21,18 +21,14 @@ Global
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|x64.ActiveCfg = Debug|x64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|x64.Build.0 = Debug|x64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|x64.Deploy.0 = Debug|x64
-		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|x86.ActiveCfg = Debug|Win32
-		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|x86.Build.0 = Debug|Win32
-		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Debug|x86.Deploy.0 = Debug|Win32
+
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|ARM64.ActiveCfg = Release|ARM64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|ARM64.Build.0 = Release|ARM64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|ARM64.Deploy.0 = Release|ARM64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|x64.ActiveCfg = Release|x64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|x64.Build.0 = Release|x64
 		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|x64.Deploy.0 = Release|x64
-		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|x86.ActiveCfg = Release|Win32
-		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|x86.Build.0 = Release|Win32
-		{A12CE693-9BBA-45C6-A40E-7CDCB41E0946}.Release|x86.Deploy.0 = Release|Win32
+
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

src/windows/qdss/qdbusb.sln

@@ -9,10 +9,10 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM64 = Debug|ARM64
 		Debug|x64 = Debug|x64
-		Debug|x86 = Debug|x86
+
 		Release|ARM64 = Release|ARM64
 		Release|x64 = Release|x64
-		Release|x86 = Release|x86
+
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Debug|ARM64.ActiveCfg = Debug|ARM64
@@ -21,16 +21,14 @@ Global
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Debug|x64.ActiveCfg = Debug|x64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Debug|x64.Build.0 = Debug|x64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Debug|x64.Deploy.0 = Debug|x64
-		{A4901F04-A502-407B-A405-A7C3E1B69733}.Debug|x86.ActiveCfg = Debug|Win32
-		{A4901F04-A502-407B-A405-A7C3E1B69733}.Debug|x86.Build.0 = Debug|Win32
+
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|ARM64.ActiveCfg = Release|ARM64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|ARM64.Build.0 = Release|ARM64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|ARM64.Deploy.0 = Release|ARM64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|x64.ActiveCfg = Release|x64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|x64.Build.0 = Release|x64
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|x64.Deploy.0 = Release|x64
-		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|x86.ActiveCfg = Release|Win32
-		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|x86.Build.0 = Release|Win32
+
 		{A4901F04-A502-407B-A405-A7C3E1B69733}.Release|x86.Deploy.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution

src/windows/tools/qdclr/infdev.h

@@ -13,6 +13,14 @@ GENERAL DESCRIPTION
 #define INFDEV_H
 
 #include <stdlib.h>
+// Workaround for a bug in Windows SDK 10.0.26100.0 where winnt.h references
+// _CountOneBits64, an intrinsic that is not available in the ARM64 MSVC
+// compiler. Defining it as __popcnt64 (the correct ARM64 equivalent) before
+// windows.h is included prevents the C3861 "identifier not found" error.
+#if defined(_M_ARM64) && !defined(_CountOneBits64)
+#include <intrin.h>
+#define _CountOneBits64 __popcnt64
+#endif
 #include <windows.h>
 #include <cfgmgr32.h>
 #include <setupapi.h>

src/windows/tools/qdclr/qdclr.vcxproj

@@ -52,18 +52,18 @@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
-    <PlatformToolset>v142</PlatformToolset>
+    <PlatformToolset>v143</PlatformToolset>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
-    <PlatformToolset>v142</PlatformToolset>
+    <PlatformToolset>v143</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
-    <PlatformToolset>v142</PlatformToolset>
+    <PlatformToolset>v143</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />