Compilation error LNK2001:unresolved external symbol "__security_check_cookie"

[xAndr3Ax]

Question description

Operating system:

Windows 10 22H2 build 19045.3808

Issue description:

When I try to compile EfiGuard within EDK2 I got follollowing errors:

"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x64\cl.exe" /Fod:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\EfiGuardDxe\EfiGuardDxe\OUTPUT.\ /showIncludes /nologo /c /WX /GS /W4 /Gs32768 /D UNICODE /O1b2s /GL /Gy /FIAutoGen.h /EHs-c- /GR- /GF /Gw /volatileMetadata- -D ZYAN_NO_LIBC -D ZYCORE_STATIC_BUILD -D ZYDIS_STATIC_BUILD -D ZYDIS_DISABLE_ENCODER -D ZYDIS_DISABLE_FORMATTER -D ZYDIS_DISABLE_AVX512 -D ZYDIS_DISABLE_KNC /wd4201 /O2 /Ot /Zi -D DISABLE_NEW_DEPRECATED_INTERFACES /utf-8 /Qspectre- /Id:\sources\edk2\EfiGuardPkg\EfiGuardDxe\X64 /Id:\sources\edk2\EfiGuardPkg\EfiGuardDxe /Id:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\EfiGuardDxe\EfiGuardDxe\DEBUG /Id:\sources\edk2\MdePkg /Id:\sources\edk2\MdePkg\Include /Id:\sources\edk2\MdePkg\Test\UnitTest\Include /Id:\sources\edk2\MdePkg\Test\Mock\Include /Id:\sources\edk2\MdePkg\Library\MipiSysTLib\mipisyst\library\include /Id:\sources\edk2\MdePkg\Include\X64 /Id:\sources\edk2\EfiGuardPkg /Id:\sources\edk2\EfiGuardPkg\Include /Id:\sources\edk2\EfiGuardPkg\Include\Protocol /Id:\sources\edk2\EfiGuardPkg\EfiGuardDxe\Zydis\dependencies\zycore\include /Id:\sources\edk2\EfiGuardPkg\EfiGuardDxe\Zydis\include /Id:\sources\edk2\EfiGuardPkg\EfiGuardDxe\Zydis\src /Id:\sources\edk2\EfiGuardPkg\EfiGuardDxe\Zydis\msvc /Id:\sources\edk2\MdeModulePkg /Id:\sources\edk2\MdeModulePkg\Include /Id:\sources\edk2\MdeModulePkg\Test\Mock\Include @d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\EfiGuardDxe\EfiGuardDxe\OUTPUT\cc_resp_14.txt
Loader.c
cl : Command line warning D9025 : overriding '/O1' with '/O2'
cl : Command line warning D9025 : overriding '/Os' with '/Ot'
EfiGuardDxe.c
AutoGen.c
"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x64\lib.exe" /NOLOGO /LTCG /OUT:d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\OUTPUT\Loader.lib @d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\OUTPUT\object_files.lst
PatchBootmgr.c
"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x64\link.exe" /OUT:d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\DEBUG\Loader.dll /NOLOGO /NODEFAULTLIB /IGNORE:4001 /IGNORE:4281 /IGNORE:4254 /OPT:REF /OPT:ICF=10 /MAP /ALIGN:32 /SECTION:.xdata,D /SECTION:.pdata,D /Machine:X64 /LTCG /DLL /ENTRY:_ModuleEntryPoint /SUBSYSTEM:EFI_BOOT_SERVICE_DRIVER /SAFESEH:NO /BASE:0 /DRIVER /MERGE:.rdata=.data /ALIGN:4096 /DLL /SUBSYSTEM:EFI_APPLICATION,1.0 /ALIGN:0x1000 /FILEALIGN:0x200 /SECTION:.pdata,!D /SECTION:.xdata,!D /DEBUG:FULL /NOVCFEATURE /NOCOFFGRPINFO /PDBALTPATH:%_PDB% /WHOLEARCHIVE @d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\OUTPUT\static_library_files.lst
util.c
Loader.lib(AutoGen.obj) : error LNK2001: unresolved external symbol __security_check_cookie
d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\DEBUG\Loader.dll : fatal error LNK1120: 1 unresolved externals
AutoGen.c
NMAKE : fatal error U1077: '"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x64\link.exe" /OUT:d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\DEBUG\Loader.dll /NOLOGO /NODEFAULTLIB /IGNORE:4001 /IGNORE:4281 /IGNORE:4254 /OPT:REF /OPT:ICF=10 /MAP /ALIGN:32 /SECTION:.xdata,D /SECTION:.pdata,D /Machine:X64 /LTCG /DLL /ENTRY:_ModuleEntryPoint /SUBSYSTEM:EFI_BOOT_SERVICE_DRIVER /SAFESEH:NO /BASE:0 /DRIVER /MERGE:.rdata=.data /ALIGN:4096 /DLL /SUBSYSTEM:EFI_APPLICATION,1.0 /ALIGN:0x1000 /FILEALIGN:0x200 /SECTION:.pdata,!D /SECTION:.xdata,!D /DEBUG:FULL /NOVCFEATURE /NOCOFFGRPINFO /PDBALTPATH:%_PDB% /WHOLEARCHIVE @d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader\OUTPUT\static_library_files.lst' : return code '0x460'
Stop.

build.py...
: error 7000: Failed to execute command
C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x86\nmake.exe /nologo tbuild [d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\Application\Loader\Loader]

build.py...
: error 7000: Failed to execute command
C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x86\nmake.exe /nologo tbuild [d:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\EfiGuardDxe\EfiGuardDxe]

build.py...
: error F002: Failed to build module
d:\sources\edk2\EfiGuardPkg\Application\Loader\Loader.inf [X64, VS2022, RELEASE]

• Failed -
  Build end time: 11:20:59, Jan.05 2025
  Build total time: 00:00:29

---

Compilation is started with following command:

build -a X64 -t VS2022 -p EfiGuardPkg/EfiGuardPkg.dsc -b RELEASE

---

Missing or Incorrect Runtime Library:

error LNK2001: unresolved external symbol __security_check_cookie:

Do I miss a runtime library? Or is it a configuration error?

---

Inconsistent Compiler and Linker Flags: /O1b2s and /O2:

C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.42.34433\bin\Hostx86\x64\cl.exe" /Fod:\sources\edk2\Build\EfiGuard\RELEASE_VS2022\X64\EfiGuardPkg\EfiGuardDxe\EfiGuardDxe\OUTPUT.\ /showIncludes /nologo /c /WX /GS /W4 /Gs32768 /D UNICODE ### /O1b2s /GL /Gy /FIAutoGen.h /EHs-c- /GR- /GF /Gw /volatileMetadata- -D ZYAN_NO_LIBC -D ZYCORE_STATIC_BUILD -D ZYDIS_STATIC_BUILD -D ZYDIS_DISABLE_ENCODER -D ZYDIS_DISABLE_FORMATTER -D ZYDIS_DISABLE_AVX512 -D ZYDIS_DISABLE_KNC /wd4201 ### /O2

Are the two flags set correctly? Or are they conflicting?

[xAndr3Ax]

I added the following to the [BuildOptions]:

MSVC:__*_CC_FLAGS = /GS-

and everything works fine ;-)

[Mattiwatti]

Thanks for the heads up. I don't normally compile EfiGuard with EDK2 master myself, due to EDK2 master frequently having caused both compile time errors and runtime regressions in the past (with at least one still unfixed - see #112). So I hadn't noticed this change in EDK2.

Your fix (overriding /GS with /GS-) is correct as far as I'm concerned, and I will add it to the other EDK2 build flag overrides already present. I never would have imagined them enabling this option by default - including even in release builds - as it is extremely wasteful both in terms of binary size and performance. Additionally (but fortunately, since it brought the change to your attention), /GS requires runtime support functions to be linked in, in order to initialize and verify the stack cookie values. This is obviously undesirable in EFI images as they should compile and run with no external runtime dependencies such as libc.

---

Re: the 'inconsistent compiler flags' warning emitted: I'm aware of this happening, but I don't consider it an issue. Overriding /O1b2s with /O2 /Ot for MSVC is very much intentional, since EfiGuard is not normally embedded in firmware volumes, which means there is more headroom for performance at a slight cost in binary size. This is a very worthwile tradeoff for EfiGuard that significantly improves Zydis' decoding throughput. I expect overriding /GS with /GS- will cause the same warning to be emitted for the same reason: EfiGuard is intentionally overriding an unwanted EDK2 default build flag. Since this compiler warning cannot be suppressed by design, it will always be generated for any build flags EfiGuard is overriding when compiled with MSVC. For me, these warnings are mostly just a helpful reminder that the unwanted EDK2 build flags are correctly being overridden.

[Mattiwatti]

FWIW, there is currently an open issue for this on the TianoCore EDK2 repository as well: see tianocore/edk2#10547.