bootloader: Add option to build with Link Time Optimisation enabled

components/bootloader/Kconfig.projbuild

@@ -43,7 +43,16 @@ config BOOTLOADER_SPI_WP_PIN
 
         The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
 
-endmenu  # Bootloader
+config BOOTLOADER_LTO
+       bool "Build bootloader with Link Time Optimisation"
+       default n
+       help
+           Setting this option enables gcc Link Time Optimisation for the bootloader build & link pass.
+
+           This gives a smaller bootloader binary (can be useful if secure boot & flash encryption & logging are all enabled), and can
+           give faster boot times, but it makes the bootloader harder to debug.
+
+endmenu  # Bootloader config
 
 
 menu "Security features"
@@ -217,7 +226,7 @@ config FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_CACHE
 config SECURE_BOOT_TEST_MODE
        bool "Secure boot test mode: don't permanently set any efuses"
        depends on SECURE_BOOT_INSECURE
-       default N
+       default n
        help
           If this option is set, all permanent secure boot changes (via Efuse) are disabled.
 

components/bootloader/subproject/main/Makefile.projbuild

@@ -2,3 +2,8 @@
 # paths can be added at this level (we need binary librtc to be
 # available to link bootloader).
 COMPONENT_SUBMODULES += $(IDF_PATH)/components/esp32/lib
+
+ifdef CONFIG_BOOTLOADER_LTO
+CFLAGS += -flto
+EXTRA_LDFLAGS += -Wl,-flto
+endif

make/project.mk

@@ -290,7 +290,7 @@ export HOSTCC HOSTLD HOSTAR HOSTOBJCOPY SIZE
 CC := $(call dequote,$(CONFIG_TOOLPREFIX))gcc
 CXX := $(call dequote,$(CONFIG_TOOLPREFIX))c++
 LD := $(call dequote,$(CONFIG_TOOLPREFIX))ld
-AR := $(call dequote,$(CONFIG_TOOLPREFIX))ar
+AR := $(call dequote,$(CONFIG_TOOLPREFIX))gcc-ar
 OBJCOPY := $(call dequote,$(CONFIG_TOOLPREFIX))objcopy
 SIZE := $(call dequote,$(CONFIG_TOOLPREFIX))size
 export CC CXX LD AR OBJCOPY SIZE