Further optimization for space (-Os -> -Oz): musl-cross-make-> bump to gcc 15.1.0 & related changes

[tlaurion]

• MERGE Add CBFS/IFD validation + CBFS free space for coreboot builds #2041 first!
• test oem factory reset + tpm duk + kexec on nv4x_adl
• build is reproducible

---

• bumps musl-cross-make to latest commit, bump gcc 9.4.0 -> 15.1.0; rename/bump kexec-tools to latest version (2.0.32) + gcc 15.1.0, switch/patch modules to switch from -Os to -Oz

Stats diff since #2041 got merged for x220-hotp-maximized

Master

As can be seen on CircleCI x220-hotp-maximized build :

Jan 06 22:44:08 "/root/heads/build/x86/coreboot-25.09/EOL_t420-hotp-maximized/cbfstool" "/root/heads/build/x86/coreboot-25.09/EOL_t420-hotp-maximized/coreboot.rom" print
Jan 06 22:44:08 FMAP REGION: COREBOOT
Jan 06 22:44:08 Name                           Offset     Type           Size   Comp
Jan 06 22:44:08 cbfs_master_header             0x0        cbfs header        32 none
Jan 06 22:44:08 cpu_microcode_blob.bin         0x80       microcode       26624 none
Jan 06 22:44:08 fallback/romstage              0x68c0     stage          101016 none
Jan 06 22:44:08 fallback/ramstage              0x1f3c0    stage          151125 LZMA (323316 decompressed)
Jan 06 22:44:08 config                         0x44280    raw              3526 LZMA (11252 decompressed)
Jan 06 22:44:08 revision                       0x45080    raw               766 none
Jan 06 22:44:08 build_info                     0x453c0    raw               101 none
Jan 06 22:44:08 bootsplash.jpg                 0x45480    bootsplash      43282 none
Jan 06 22:44:08 fallback/dsdt.aml              0x4fdc0    raw             14520 none
Jan 06 22:44:08 vbt.bin                        0x536c0    raw              1368 LZMA (3985 decompressed)
Jan 06 22:44:08 cmos.default                   0x53c80    cmos_default      256 none
Jan 06 22:44:08 cmos_layout.bin                0x53dc0    cmos_layout      2120 none
Jan 06 22:44:08 fallback/postcar               0x54640    stage           31180 none
Jan 06 22:44:08 fallback/payload               0x5c080    simple elf    7714640 none
Jan 06 22:44:08 (empty)                        0x7b7800   null            71076 none
Jan 06 22:44:08 bootblock                      0x7c8dc0   bootblock       28672 none
Jan 06 22:44:08 
Jan 06 22:44:08 Validating final CBFS/IFD configuration...
Jan 06 22:44:08 ===================================================================
Jan 06 22:44:08 IFD vs CBFS Size Validation
Jan 06 22:44:08 ===================================================================
Jan 06 22:44:08 IFD BIOS Region: 0x00018000 - 0x007fffff
Jan 06 22:44:08 IFD BIOS Size:   0x7E8000 (8096 KiB)
Jan 06 22:44:08 CONFIG_CBFS_SIZE: 0x7E7FFF (8095 KiB)
Jan 06 22:44:08 
Jan 06 22:44:08 ✓ CONFIG_CBFS_SIZE fits within IFD BIOS region
Jan 06 22:44:08    Unused IFD capacity: 1 bytes (< 1 KiB)
Jan 06 22:44:08 
Jan 06 22:44:08 CBFS Free Space: 71076 bytes (69 KiB)
Jan 06 22:44:08 
Jan 06 22:44:08 ===================================================================
Jan 06 22:44:08 ✓ Validation complete
Jan 06 22:44:08 ===================================================================

This PR

"/home/user/heads/build/x86/coreboot-25.09/EOL_x220-hotp-maximized/cbfstool" "/home/user/heads/build/x86/coreboot-25.09/EOL_x220-hotp-maximized/coreboot.rom" print
FMAP REGION: COREBOOT
Name                           Offset     Type           Size   Comp
cbfs_master_header             0x0        cbfs header        32 none
cpu_microcode_blob.bin         0x80       microcode       26624 none
fallback/romstage              0x68c0     stage           99128 none
fallback/ramstage              0x1ec80    stage          148459 LZMA (316668 decompressed)
config                         0x430c0    raw              3558 LZMA (11286 decompressed)
revision                       0x43f00    raw               772 none
build_info                     0x44240    raw               101 none
bootsplash.jpg                 0x44300    bootsplash      43282 none
fallback/dsdt.aml              0x4ec40    raw             14520 none
vbt.bin                        0x52540    raw              1400 LZMA (3985 decompressed)
cmos_layout.bin                0x52b00    cmos_layout      1976 none
fallback/postcar               0x53300    stage           30564 none
fallback/payload               0x5aac0    simple elf    7573984 none
(empty)                        0x793d00   null           217252 none
bootblock                      0x7c8dc0   bootblock       28672 none

Validating final CBFS/IFD configuration...
===================================================================
IFD vs CBFS Size Validation
===================================================================
IFD BIOS Region: 0x00018000 - 0x007fffff
IFD BIOS Size:   0x7E8000 (8096 KiB)
CONFIG_CBFS_SIZE: 0x7E7FFF (8095 KiB)

✓ CONFIG_CBFS_SIZE fits within IFD BIOS region
   Unused IFD capacity: 1 bytes (< 1 KiB)

CBFS Free Space: 217252 bytes (212 KiB)

===================================================================
✓ Validation complete
===================================================================

Gain of 212 - 69 = 143 KiB free for most constrained board

Continues #590

[tlaurion]

This PR will be needed soon, since xx20 (t420/x220) are near space exhaustion (less than 100kb free left) as can be seen at #2041 (comment) : the t420-hotp-maximized rom has 67kb free left in CBFS region.

[tlaurion]

https://app.circleci.com/pipelines/github/tlaurion/heads/3449/workflows/6b0bd1cc-8d3f-43f4-b176-1c4f6435a36b/jobs/76833/parallel-runs/0/steps/0-102?invite=true#step-102-2244532_182

2d073289ba2bb5ba6be6650c055928faf8020931f61eeb35c1b3bfe3625f55b8 /root/heads/build/x86/EOL_x220-hotp-maximized/heads-EOL_x220-hotp-maximized-v0.2.0-2902-g6b403e0.rom

Local build:

2d073289ba2bb5ba6be6650c055928faf8020931f61eeb35c1b3bfe3625f55b8 /home/user/heads/build/x86/EOL_x220-hotp-maximized/heads-EOL_x220-hotp-maximized-v0.2.0-2902-g6b403e0.rom

Builds are reproducible if built clean (./docker_repro.sh make BOARD=xyz real.clean && make BOARD=xyz )

[Copilot]

Pull request overview

This PR upgrades the Heads build toolchain from GCC 9.4.0 to GCC 15.1.0 and systematically switches compiler optimization flags from -Os (optimize for size) to -Oz (optimize aggressively for size) across 30+ modules. The changes deliver a 1.44% space reduction (115 KB) in the final firmware payload through improved compiler optimization and enhanced binary stripping.

Key changes include:

• GCC toolchain upgrade via musl-cross-make bump to latest commit with GCC 15.1.0
• C23 compatibility patches for multiple modules (tpmtotp, powerpc-utils, bash, e2fsprogs, gpg2, cairo, linux kernel)
• Systematic -Os to -Oz optimization flag conversion across all modules
• New CBFS/IFD validation script with automatic size fixing capability
• Module version bumps: kexec-tools (2.0.26→2.0.31), dropbear (2016.74→2025.88)
• Enhanced Makefile with GPG injection caching and improved stripping flags
• Disabled features in OpenSSL and LVM2 for additional space savings

Reviewed changes

Copilot reviewed 59 out of 60 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
modules/musl-cross-make	Bumps commit hash and GCC version from 9.4.0 to 15.1.0 with upgrade notes
patches/musl-cross-make-3635262e4524c991552789af6f36211a335a77b3/0001-use-gcc-15_1_0.patch	Updates musl-cross-make Makefile to use GCC 15.1.0
patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/*.patch	Three patches fixing GCC 15.1.0 compatibility issues (function signatures, printf formats, AES macro)
patches/powerpc-utils-1.3.5/0001-fix-rtas-function-pointer-signatures-gcc15.patch	Fixes function pointer declarations for C23 compatibility
patches/kexec-tools-2.0.31/*.patch	Six patches for kexec-tools 2.0.31: disables unused modules, improves framebuffer support, adds EBDA workaround, fixes purgatory build, uses build compiler for utils, adds x86-64 baseline flags
patches/lvm2-2.03.23.patch	Adds libgen.h include for basename() function required by GCC 15.1.0
patches/linux-6.6.16-openpower/0008-powerpc-boot-Fix-C23-bool-compatibility-for-GCC-15.patch	Adds -std=gnu11 to PowerPC boot Makefile for C23 bool keyword conflicts
patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch	Updates patch paths for dropbear 2025.88 source tree restructuring
patches/coreboot-talos_2/0003-ugly_skiboot-patch_fix_for_newer_gcc_from_musl_125.patch	Adds additional GCC 15.1.0 warning suppressions for skiboot (-Wno-error=unterminated-string-initialization, -Wno-error=misleading-indentation)
patches/bash-5.1.16.patch	Adds unistd.h include to lib/termcap/tparam.c for write() declaration
modules/kexec	Deleted - replaced by modules/kexec-tools
modules/kexec-tools	New module file for kexec-tools 2.0.31 with -Oz optimization
modules/dropbear	Updates to version 2025.88 with additional configure options for space savings
modules/openssl	Switches to -Oz and disables additional protocols/algorithms (dtls, ec2m, engine, gost, md2, srp, ssl3, tls1, tls1_1)
modules/lvm2	Switches to -Oz and disables advanced features (thin, cache, VDO, writecache, integrity, snapshots, mirrors)
modules/linux	Adds -std=gnu11 flag and PowerPC-specific GCC 15.1.0 compatibility flags
modules/bash	Changes to -Oz with -std=gnu11 for C23 compatibility
modules/cairo	Changes to -Oz with -std=gnu11, -Wno-inline, -Wno-incompatible-pointer-types
modules/coreboot	Adds validation script calls and extensive GCC 15.1.0 compatibility documentation
modules/e2fsprogs	Changes to -Oz with -std=gnu11 for C23 bool keyword conflicts
modules/gpg2	Changes to -Oz with -std=gnu11 and adds -DDISABLE_PHOTO_VIEWER
modules/libgcrypt	Changes to -Oz and disables jent-support
modules/zstd, modules/util-linux, modules/tpmtotp, modules/qrencode, modules/powerpc-utils, modules/pixman, modules/pinentry, modules/newt, modules/ncurses, modules/mbedtls, modules/libusb-compat, modules/libusb, modules/libpng, modules/libnitrokey, modules/libksba, modules/libhidapi-libusb, modules/libgpg-error, modules/libassuan, modules/kbd, modules/ioport, modules/io386, modules/gpg, modules/flashtools, modules/flashrom, modules/flashprog, modules/fbwhiptail, modules/exfatprogs, modules/cryptsetup2, modules/cryptsetup	All changed from -Os to -Oz optimization
bin/validate_cbfs_ifd_fit.sh	New validation script that checks CONFIG_CBFS_SIZE against IFD BIOS region with auto-fix capability
Makefile	Adds validation targets, enhances strip flags (--strip-all), implements GPG injection caching, adds verbose build hints, fixes kexec module reference, adds coreboot cbmem GCC 15.1.0 compatibility flag

Comments suppressed due to low confidence (2)

patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch:1

• The patch header line references the old path "dropbear-2016.74" but this module is being updated to "dropbear-2025.88". The patch should use paths that match the new version to avoid confusion during patch application.
  patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch:12
• Commenting out the dropbear_exit calls when setgid/initgroups or setuid fail means the server will continue executing the user session even if it could not drop privileges to ses.authstate.pw_uid/pw_gid, so a user who authenticated as an unprivileged account could end up with a shell running under the original (likely root) UID/GID. This silently bypasses the operating system’s privilege separation mechanisms and can turn any failure in the privilege-dropping path (for example due to security policy or environment issues) into a remote privilege escalation to the Dropbear daemon’s UID. The fix is to keep these failures fatal (e.g., by retaining dropbear_exit or otherwise aborting the session) so that no user commands are executed when user/group changes fail.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tlaurion]

If we decided to be prescriptive, we could economize ~310KB of precious SPI space.

[tlaurion]

Putting back to draft, kexec to next kernel fails.

Heads says
Failed to load the new kernel

which in debug.log shows that kexec fails with

Try gzip decompression
Failed to copy decompressed buf

[Copilot]

Pull request overview

Copilot reviewed 71 out of 71 changed files in this pull request and generated 10 comments.

Comments suppressed due to low confidence (3)

patches/kexec-tools-2.0.32/0002-improve-framebuffer-setup-with-intel-drm-support.patch:2

• The patch header shows a future date "2025-08-11" which appears to be inconsistent with the current date (January 2026). Patch timestamps should reflect when the patch was actually created or when the code change occurred.
  patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch:2
• The patch path in the dropbear module has changed from referencing "dropbear-2016.74" to a more generic "src/" path. This suggests the directory structure of dropbear has changed between versions. Verify that the patch applies correctly to the new version 2025.88's actual directory structure.
  patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch:13
• This patch disables the fatal error handling when setgid, initgroups, or setuid fail, meaning the server will silently continue the session without actually dropping privileges to the requested user. If any non-root account is ever allowed to log in (or if privilege changes unexpectedly fail due to environment or LSM restrictions), a user who should get an unprivileged session could instead inherit the current (often root) privileges, leading to a silent privilege escalation. Preserve the existing behavior of terminating the session on failure (or at least aborting the child before executing any user command) and log the error instead of continuing execution with incorrect credentials.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The sed command to replace hardcode_into_libs is applied in-place to the configure script without checking if the pattern exists or if the substitution succeeds. Consider adding error checking or using a more robust approach (such as a proper patch file) to ensure the modification is applied correctly and fails gracefully if the configure script structure has changed.

[Copilot]

The TODO comment references "GCC_15_POWERPC_UTILS" as an identifier, but the more conventional format would be "TODO(GCC15_POWERPC_UTILS)" or simply "TODO:". Consider using a consistent TODO format throughout the codebase for better searchability and tooling support.

[Copilot]

Disabling advanced LVM features (thin provisioning, cache, VDO, writecache, integrity, snapshots, mirrors) significantly reduces LVM functionality. While this achieves space optimization goals, it may break existing configurations or scripts that expect these features. Consider documenting which LVM operations are still supported and which will fail with this minimal build.

[Copilot]

Adding "--strip-all" flag is more aggressive than the previous default strip behavior. While this achieves better space optimization, it removes all symbol and relocation information which may make debugging more difficult. Ensure this doesn't break any tools or scripts that expect certain symbol information to be present in the binaries.

[Copilot]

The sed command to force cross_compiling=yes in the configure script is a workaround that modifies the build detection logic. While this may be necessary for the cross-compilation setup, it's a fragile approach that could break if the configure script structure changes. Consider whether there's a cleaner way to signal cross-compilation to the configure script (such as setting appropriate environment variables or configure flags).

Suggested change

	sed -i 's/cross_compiling=no/cross_compiling=yes/' configure \
	&& $(CROSS_TOOLS) \
	$(CROSS_TOOLS) \

[Copilot]

The sed command to replace hardcode_into_libs is applied in-place to the configure script without checking if the pattern exists or if the substitution succeeds. Consider adding error checking or using a more robust approach (such as a proper patch file) to ensure the modification is applied correctly and fails gracefully if the configure script structure has changed.

Suggested change

	sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure \
	&& CFLAGS="-Oz" \
	$(CROSS_TOOLS) \
	./configure \
	grep -q 'hardcode_into_libs=yes' configure || { echo "ERROR: Expected pattern 'hardcode_into_libs=yes' not found in configure; aborting."; exit 1; }; \
	sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure \
	&& CFLAGS="-Oz" \
	$(CROSS_TOOLS) \

[Copilot]

The sed command to replace hardcode_into_libs is applied in-place to the configure script without checking if the pattern exists or if the substitution succeeds. Consider adding error checking or using a more robust approach (such as a proper patch file) to ensure the modification is applied correctly and fails gracefully if the configure script structure has changed.

[Copilot]

The documentation comment uses an unconventional identifier format "GCC_15_PPC64_COREBOOT". For consistency with other TODO comments in the PR that use the format "TODO(GCC15-MODULE)", consider using "TODO(GCC15_PPC64_COREBOOT)" or similar consistent format.

Suggested change

	# GCC_15_PPC64_COREBOOT: PowerPC64 dual-compiler architecture GCC 15.1 compatibility
	# TODO(GCC15_PPC64_COREBOOT): PowerPC64 dual-compiler architecture GCC 15.1 compatibility

[Copilot]

Enabling TMPFS and MEMFD_CREATE across all kernel configurations is a significant functional change. While these features are generally useful, this change should be documented in the PR description as it alters kernel capabilities beyond just the GCC upgrade and optimization changes. Ensure this change is intentional and not an accidental side effect of kernel config regeneration.

Suggested change

	CONFIG_MEMFD_CREATE=y
	# CONFIG_MEMFD_CREATE is not set

[tlaurion]

Don't use yet. Can't boot multiboot Xen + kernel (qubesos) yet.