Enable LTO without weakening secure isolation

[aidangarske]

enables LTO by default while excluding assembly, CMSE, and isolation-band objects whose placement must remain stable. It adds post-link secure-layout validation, removes rejected image artifacts, and tests configuration toggles and failure paths.

Crypto engine	Flash without LTO	Flash with LTO	Flash saved	Reduction	RAM change
wolfHSM	106,336 B	93,192 B	13,144 B	12.36%	59,105 → 59,080 B
Native wolfCrypt	87,296 B	78,264 B	9,032 B	10.35%	27,253 → 27,260 B

[Copilot]

Copilot review overview

🟡 Changes recommended

Two critical secure-layout and zero-heap validation issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• LTO can move HSM NVM state outside protected sections · New
• Zero-heap check omits reentrant newlib allocation symbols · New

What changed in this PR

Enables Secure-image LTO by default while preserving isolation-sensitive placement and validating final ELF layout.

Changes:

• Adds LTO configuration, exclusions, map output, and cleanup.
• Adds post-link validation and host/CI coverage.
• Updates linker placement and documentation.

File	Summary	Final review comment
tools/​check_secure_layout.py	Validates ELF layout and heap policy.	Critical (1 vote): Add _calloc_r, _realloc_r, and _sbrk_r to the zero-heap denylist and generated tests.
tests/​host/​secure_layout/​Makefile	Runs validator and configuration tests.	No final findings.
tests/​host/​Makefile	Registers the secure-layout suite.	No final findings.
src/​services/​wolfhsm/​runner/​secure.ld	Preserves isolation-sensitive data placement.	Critical (2 votes): Ensure conformance NVM state remains in the protected section under LTO by adding matching patterns or keeping the object non-LTO.
mk/​common.mk	Configures LTO, exclusions, maps, and cleanup.	Nit (1 vote): Wire exclusions to the actual native object list or remove the unsupported path.
mk/​arch-armv8m.mk	Adds post-link validation.	No final findings.
docs/​Testing.md	Documents LTO validation coverage.	No final findings.
docs/​Security-Model.md	Documents LTO isolation safeguards.	No final findings.
docs/​Macros.md	Documents WT_LTO.	No final findings.
docs/​Building.md	Documents LTO builds and outputs.	No final findings.
.github/​workflows/​cross-compile.yml	Tests LTO builds, size reduction, and cleanup.	No final findings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #18

No scan targets match the changed files in this PR. Review skipped.