Skip to content

[Development RI] Improve IRQL queries and bump to 1.8.2#203

Merged
NateD-MSFT merged 5 commits into
mainfrom
development
Jan 23, 2026
Merged

[Development RI] Improve IRQL queries and bump to 1.8.2#203
NateD-MSFT merged 5 commits into
mainfrom
development

Conversation

@NateD-MSFT
Copy link
Copy Markdown
Collaborator

RI our development branch which has fixes for the following two issues related to our IRQL queries, based off internal feedback:

#199
#201

This bumps our query pack version to 1.8.2.

Checklist for Pull Requests

  • Description is filled out.
  • Only one query or related query group is in this pull request.
  • The version number on changed queries has been increased via the @version comment in the file header.
  • All unit tests have been run: (Test README.md).
  • Commands codeql database create and codeql database analyze have completed successfully.
  • A .qhelp file has been added for any new queries or updated if changes have been made to an existing query.

FI from main to development branch
FI from main to development
* Make IRQLTooLow's behavior consistent with IRQLTooHigh

* Bump IrqlTooLow query version
* Make IRQLTooLow's behavior consistent with IRQLTooHigh

* Bump IrqlTooLow query version

* Improve output message for IrqlSet queries

* Clean baseline for IrqlSetTooLow

* Bump QLPack to 1.8.2

* Revert "Bump QLPack to 1.8.2"

This reverts commit cce7b9c.
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Windows drivers CodeQL pack to improve IRQL query correctness/clarity (per #199/#201) and bumps the pack version to 1.8.2.

Changes:

  • Bump microsoft/windows-drivers qlpack version from 1.8.1 to 1.8.2.
  • Update IrqlTooLow to use the max estimated predecessor IRQL and bump query version to v3.
  • Improve diagnostic messaging for IrqlSetTooLow / IrqlSetTooHigh and refresh associated SARIF/test baselines.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
src/qlpack.yml Pack version bump to 1.8.2.
src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql Adjusts IRQL comparison to use max(...) and bumps query version.
src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql Rewords result message to clarify “annotated function constraint vs statement effect”.
src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.ql Rewords result message similarly for “set too high”.
src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.sarif Updated expected SARIF output reflecting new messaging/tool metadata.
src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.sarif Updated expected SARIF output reflecting new messaging/tool metadata.
src/drivers/test/diff/IrqlSetTooLow.sarif Updates unit test diff expectations for IrqlSetTooLow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.sarif
Comment thread src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.sarif
Comment thread src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql
Comment thread src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.ql
@NateD-MSFT
Copy link
Copy Markdown
Collaborator Author

Failed pipelines are due to known issues with our CI test pipelines (see #197). Running test commands locally does not show errors.

@NateD-MSFT NateD-MSFT merged commit 2256139 into main Jan 23, 2026
23 of 29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants