Fix linker and API issues for ESP-IDF v6.0 migration

- Disable esp-camera (needs separate v6.0 update)
- Add esp_hal_* components to link line (split from monolithic hal)
- Add tf-psa-crypto and mbed-builtin libraries for mbedtls 4.x
- Add ROM WDT linker scripts (moved from esp_rom to esp_hal_wdt)
- Add -nostartfiles to avoid picolibc crt0.o conflicts
- Migrate hashlib to PSA crypto API (mbedtls 4.x removed direct SHA API
  when hardware acceleration is enabled)
- Guard entropy/ctr_drbg in SSL with MBEDTLS_VERSION_MAJOR < 4
  (RNG is internal in mbedtls 4.x)
- Add missing include paths for esp_hal_pmu, esp_hal_wdt, esp_hal_usb
- Suppress legacy driver deprecation warnings globally

Builds successfully for ESP32-S3 (Xtensa) and ESP32-C6 (RISC-V).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tannewt

ports/espressif/CMakeLists.txt

@@ -5,8 +5,8 @@ cmake_minimum_required(VERSION 3.16)
 set(ENV{IDF_PATH} ${CMAKE_SOURCE_DIR}/esp-idf)
 
 # The component list here determines what options we get in menuconfig and what the ninja file can build.
-set(COMPONENTS bt driver esp_driver_dac esp_driver_gpio esp_driver_gptimer esp_driver_i2c esp_driver_i2s esp_driver_ledc esp_driver_pcnt esp_driver_rmt esp_driver_sdmmc esp_driver_spi esp_driver_tsens esp_driver_uart esp-tls esp_adc esp_event esp_netif esp_psram esp_wifi esptool_py freertos log lwip main mbedtls mdns soc ulp wpa_supplicant esp-camera esp_lcd vfs esp_stdio sdmmc)
-set(EXTRA_COMPONENT_DIRS "esp-protocols/components/mdns" "esp-camera")
+set(COMPONENTS bt driver esp_driver_dac esp_driver_gpio esp_driver_gptimer esp_driver_i2c esp_driver_i2s esp_driver_ledc esp_driver_pcnt esp_driver_rmt esp_driver_sdmmc esp_driver_spi esp_driver_tsens esp_driver_uart esp-tls esp_adc esp_event esp_netif esp_psram esp_wifi esptool_py freertos log lwip main mbedtls mdns soc ulp wpa_supplicant esp_lcd vfs esp_stdio sdmmc)
+set(EXTRA_COMPONENT_DIRS "esp-protocols/components/mdns")
 
 include($ENV{IDF_PATH}/tools/cmake/project.cmake)
 project(circuitpython)

ports/espressif/Makefile

@@ -77,6 +77,7 @@ INC += \
 	-isystem esp-idf/components/esp_event/include \
 	-isystem esp-idf/components/esp_hw_support/include \
 	-isystem esp-idf/components/esp_hw_support/include/soc \
+	-isystem esp-idf/components/esp_hw_support/port/$(IDF_TARGET)/private_include \
 	-isystem esp-idf/components/esp_hw_support/etm/include \
 	-isystem esp-idf/components/esp_mm/include \
 	-isystem esp-idf/components/esp_netif/include \
@@ -126,7 +127,12 @@ INC += \
 	-isystem esp-idf/components/esp_hal_lcd/include \
 	-isystem esp-idf/components/esp_hal_lcd/$(IDF_TARGET)/include \
 	-isystem esp-idf/components/esp_hal_usb/include \
+	-isystem esp-idf/components/esp_hal_usb/$(IDF_TARGET)/include \
 	-isystem esp-idf/components/esp_hal_parlio/include \
+	-isystem esp-idf/components/esp_hal_pmu/include \
+	-isystem esp-idf/components/esp_hal_pmu/$(IDF_TARGET)/include \
+	-isystem esp-idf/components/esp_hal_wdt/include \
+	-isystem esp-idf/components/esp_hal_wdt/$(IDF_TARGET)/include \
 	-isystem esp-idf/components/esp_hal_security/include \
 	-isystem esp-idf/components/heap/include \
 	-isystem esp-idf/components/log/include \
@@ -225,7 +231,7 @@ endif
 # option to override compiler optimization level, set in boards/$(BOARD)/mpconfigboard.mk
 CFLAGS += $(OPTIMIZATION_FLAGS)
 
-CFLAGS += $(INC) -Werror -Wall -std=gnu11 -Wl,--gc-sections $(BASE_CFLAGS) $(C_DEFS) $(CFLAGS_MOD) $(COPT) -Werror=missing-prototypes -Werror=old-style-definition
+CFLAGS += $(INC) -Werror -Wall -std=gnu11 -Wl,--gc-sections $(BASE_CFLAGS) $(C_DEFS) $(CFLAGS_MOD) $(COPT) -Werror=missing-prototypes -Werror=old-style-definition -Wno-error=cpp -Wno-cpp
 
 # ESP-IDF v6.0 uses picolibc instead of newlib.
 CFLAGS += --specs=picolibc.specs
@@ -237,7 +243,7 @@ ifeq ($(IDF_TARGET_ARCH),xtensa)
 # Remove the last two flags once TinyUSB is updated with the `#include <xtensa_api.h>` instead of
 # `#include "xtensa/xtensa_api.h"`.
 
-	CFLAGS += -mlongcalls -isystem esp-idf/components/xtensa/deprecated_include/ -Wno-error=cpp
+	CFLAGS += -mlongcalls -isystem esp-idf/components/xtensa/deprecated_include/
 	CFLAGS += -DMICROPY_GCREGS_SETJMP=1
 
 # Wrap longjmp with a patched version that protects register window update with a critical section
@@ -261,12 +267,13 @@ else ifeq ($(IDF_TARGET_ARCH),riscv)
 endif
 
 
-LDFLAGS += $(CFLAGS) -Wl,-nostdlib -Wl,-Map=$@.map -Wl,-cref -Wl,--undefined=uxTopUsedPriority
+LDFLAGS += $(CFLAGS) -nostartfiles -Wl,-nostdlib -Wl,-Map=$@.map -Wl,-cref -Wl,--undefined=uxTopUsedPriority
 
 LDFLAGS += \
 	-L$(BUILD)/esp-idf/esp-idf/esp_system/ld \
 	-Lesp-idf/components/esp_rom/$(IDF_TARGET)/ld \
 	-Lesp-idf/components/soc/$(IDF_TARGET)/ld \
+	-Lesp-idf/components/esp_hal_wdt/$(IDF_TARGET) \
 	-Tmemory.ld \
 	-Tsections.ld \
 	-T$(IDF_TARGET).peripherals.ld \
@@ -286,7 +293,8 @@ LDFLAGS += \
 	-Tesp32.rom.newlib-reent-funcs.ld
 
 CHIP_COMPONENTS = \
-	esp_driver_dac
+	esp_driver_dac \
+	esp_hal_i2s esp_hal_lcd esp_hal_pcnt esp_hal_touch_sens esp_hal_twai
 
 else ifeq ($(IDF_TARGET),esp32c2)
 LDFLAGS += \
@@ -296,14 +304,16 @@ LDFLAGS += \
 	-Tesp32c2.rom.newlib.ld \
 	-Tesp32c2.rom.newlib-nano.ld \
 	-Tesp32c2.rom.version.ld \
-	-Tesp32c2.rom.systimer.ld
+	-Tesp32c2.rom.systimer.ld \
+	-Trom.wdt.ld
 
 CFLAGS += -DSOC_XTAL_FREQ_MHZ=CONFIG_XTAL_FREQ
 
 CHIP_COMPONENTS = \
 	esp_driver_tsens
 
 else ifeq ($(IDF_TARGET),esp32c3)
+# esp32c2 has none of: esp_hal_i2s esp_hal_lcd esp_hal_pcnt esp_hal_touch_sens esp_hal_twai
 LDFLAGS += \
 	-Tesp32c3.rom.newlib.ld \
 	-Tesp32c3.rom.libc.ld \
@@ -313,7 +323,8 @@ LDFLAGS += \
 	-Tesp32c3.rom.bt_funcs.ld
 
 CHIP_COMPONENTS = \
-	esp_driver_tsens
+	esp_driver_tsens \
+	esp_hal_i2s esp_hal_twai
 
 else ifeq ($(IDF_TARGET),esp32c6)
 LDFLAGS += \
@@ -324,11 +335,13 @@ LDFLAGS += \
 	-Tesp32c6.rom.newlib.ld \
 	-Tesp32c6.rom.coexist.ld \
 	-Tesp32c6.rom.heap.ld \
-	-Tesp32c6.rom.systimer.ld
+	-Tesp32c6.rom.systimer.ld \
+	-Trom.wdt.ld
 
 
 CHIP_COMPONENTS = \
-	esp_driver_tsens
+	esp_driver_tsens \
+	esp_hal_i2s esp_hal_pcnt esp_hal_twai
 
 else ifeq ($(IDF_TARGET),esp32c61)
 LDFLAGS += \
@@ -340,32 +353,38 @@ LDFLAGS += \
 	-Tesp32c61.rom.version.ld \
 	-Tesp32c61.rom.coexist.ld \
 	-Tesp32c61.rom.heap.ld \
-	-Tesp32c61.rom.systimer.ld
+	-Tesp32c61.rom.systimer.ld \
+	-Trom.wdt.ld
 
 
 CHIP_COMPONENTS = \
-	esp_driver_tsens
+	esp_driver_tsens \
+	esp_hal_i2s
 
 else ifeq ($(IDF_TARGET),esp32p4)
 LDFLAGS += \
 	-Tesp32p4.rom.libc.ld \
 	-Tesp32p4.rom.newlib.ld \
-	-Tesp32p4.rom.systimer.ld
+	-Tesp32p4.rom.systimer.ld \
+	-Trom.wdt.ld
 
 
 CHIP_COMPONENTS = \
 	esp_driver_tsens \
-	esp_driver_usb_serial_jtag
+	esp_driver_usb_serial_jtag \
+	esp_hal_i2s esp_hal_lcd esp_hal_pcnt esp_hal_touch_sens esp_hal_twai
 
 else ifeq ($(IDF_TARGET),esp32h2)
 LDFLAGS += \
 	-Tesp32h2.rom.heap.ld \
 	-Tesp32h2.rom.libc.ld \
 	-Tesp32h2.rom.newlib.ld \
-	-Tesp32h2.rom.systimer.ld
+	-Tesp32h2.rom.systimer.ld \
+	-Trom.wdt.ld
 
 CHIP_COMPONENTS = \
-	esp_driver_tsens
+	esp_driver_tsens \
+	esp_hal_i2s esp_hal_pcnt esp_hal_twai
 
 else ifeq ($(IDF_TARGET),esp32s2)
 LDFLAGS += \
@@ -375,18 +394,21 @@ LDFLAGS += \
 
 CHIP_COMPONENTS = \
 	esp_driver_dac \
-	esp_driver_tsens
+	esp_driver_tsens \
+	esp_hal_i2s esp_hal_lcd esp_hal_pcnt esp_hal_touch_sens esp_hal_twai
 
 else ifeq ($(IDF_TARGET),esp32s3)
 LDFLAGS += \
 	-Tesp32s3.rom.libc.ld \
 	-Tesp32s3.rom.newlib.ld \
 	-Tesp32s3.rom.version.ld \
 	-Tesp32s3.rom.systimer.ld \
-	-Tesp32s3.rom.bt_funcs.ld
+	-Tesp32s3.rom.bt_funcs.ld \
+	-Trom.wdt.ld
 
 CHIP_COMPONENTS = \
-	esp_driver_tsens
+	esp_driver_tsens \
+	esp_hal_i2s esp_hal_lcd esp_hal_pcnt esp_hal_touch_sens esp_hal_twai
 
 endif
 
@@ -737,7 +759,7 @@ ifeq ($(IDF_TARGET),esp32)
 BINARY_BLOBS += esp-idf/components/esp_phy/lib/$(IDF_TARGET)/librtc.a
 endif
 
-ESP_IDF_COMPONENTS_LINK = $(IDF_TARGET_ARCH) $(CHIP_COMPONENTS) app_update bootloader_support driver esp_driver_gpio esp_driver_gptimer esp_driver_i2c esp_driver_ledc esp_driver_spi esp_driver_uart efuse esp_adc esp_app_format esp_common esp_event esp_hw_support esp_mm esp_partition esp_pm esp_ringbuf esp_rom esp_system esp_timer freertos hal heap log esp_libc nvs_flash pthread soc spi_flash vfs esp_stdio
+ESP_IDF_COMPONENTS_LINK = $(IDF_TARGET_ARCH) $(CHIP_COMPONENTS) app_update bootloader_support driver esp_driver_dma esp_driver_gpio esp_driver_gptimer esp_driver_i2c esp_driver_ledc esp_driver_spi esp_driver_uart esp_driver_usb_serial_jtag efuse esp_adc esp_app_format esp_common esp_event esp_gdbstub esp_hal_ana_conv esp_hal_clock esp_hal_dma esp_hal_gpio esp_hal_gpspi esp_hal_i2c esp_hal_ledc esp_hal_mspi esp_hal_pmu esp_hal_rmt esp_hal_security esp_hal_timg esp_hal_uart esp_hal_usb esp_hal_wdt esp_hw_support esp_mm esp_partition esp_pm esp_ringbuf esp_rom esp_system esp_timer freertos hal heap log esp_libc nvs_flash nvs_sec_provider pthread soc spi_flash vfs esp_stdio
 ifneq ($(CIRCUITPY_WIFI),0)
 	ESP_IDF_COMPONENTS_LINK += esp_coex esp_netif esp_security esp-tls esp_wifi lwip mbedtls mdns wpa_supplicant esp_phy
 endif
@@ -795,13 +817,17 @@ ifneq ($(CIRCUITPY_QSPIBUS),0)
 	ESP_IDF_COMPONENTS_LINK += esp_lcd
 endif
 ifneq ($(CIRCUITPY_SDIOIO),0)
-	ESP_IDF_COMPONENTS_LINK += sdmmc esp_driver_sdmmc
+	ESP_IDF_COMPONENTS_LINK += sdmmc esp_driver_sdmmc esp_driver_sd_intf
 endif
 
 ESP_IDF_COMPONENTS_EXPANDED = $(foreach component, $(ESP_IDF_COMPONENTS_LINK), $(BUILD)/esp-idf/esp-idf/$(component)/lib$(component).a)
 
 MBEDTLS_COMPONENTS_LINK = crypto tls x509
 MBEDTLS_COMPONENTS_LINK_EXPANDED = $(foreach component, $(MBEDTLS_COMPONENTS_LINK), $(BUILD)/esp-idf/esp-idf/mbedtls/mbedtls/library/libmbed$(component).a)
+MBEDTLS_COMPONENTS_LINK_EXPANDED += $(BUILD)/esp-idf/esp-idf/mbedtls/mbedtls/library/libtfpsacrypto.a
+MBEDTLS_COMPONENTS_LINK_EXPANDED += $(BUILD)/esp-idf/esp-idf/mbedtls/mbedtls/tf-psa-crypto/drivers/builtin/libmbed-builtin.a
+MBEDTLS_COMPONENTS_LINK_EXPANDED += $(BUILD)/esp-idf/esp-idf/mbedtls/mbedtls/tf-psa-crypto/drivers/everest/libeverest.a
+MBEDTLS_COMPONENTS_LINK_EXPANDED += $(BUILD)/esp-idf/esp-idf/mbedtls/mbedtls/tf-psa-crypto/drivers/p256-m/libp256m.a
 
 ifeq ($(IDF_TARGET_ARCH),xtensa)
 BINARY_BLOBS += esp-idf/components/xtensa/$(IDF_TARGET)/libxt_hal.a

ports/espressif/mpconfigport.mk

@@ -73,7 +73,7 @@ CIRCUITPY_BLEIO_HCI = 0
 CIRCUITPY_BLEIO_NATIVE ?= 1
 CIRCUITPY_CANIO ?= 1
 CIRCUITPY_COUNTIO ?= 1
-CIRCUITPY_ESPCAMERA ?= 1
+CIRCUITPY_ESPCAMERA ?= 0
 CIRCUITPY_ESPIDF ?= 1
 CIRCUITPY_ESPULP ?= 1
 CIRCUITPY_FRAMEBUFFERIO ?= 1

shared-module/hashlib/Hash.c

@@ -7,42 +7,23 @@
 #include "shared-bindings/hashlib/Hash.h"
 #include "shared-module/hashlib/__init__.h"
 
-#include "mbedtls/ssl.h"
+#include "psa/crypto.h"
 
 void common_hal_hashlib_hash_update(hashlib_hash_obj_t *self, const uint8_t *data, size_t datalen) {
-    if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) {
-        mbedtls_sha1_update_ret(&self->sha1, data, datalen);
-        return;
-    } else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) {
-        mbedtls_sha256_update_ret(&self->sha256, data, datalen);
-        return;
-    }
+    psa_hash_update(&self->hash_op, data, datalen);
 }
 
 void common_hal_hashlib_hash_digest(hashlib_hash_obj_t *self, uint8_t *data, size_t datalen) {
     if (datalen < common_hal_hashlib_hash_get_digest_size(self)) {
         return;
     }
-    if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) {
-        // We copy the sha1 state so we can continue to update if needed or get
-        // the digest a second time.
-        mbedtls_sha1_context copy;
-        mbedtls_sha1_clone(&copy, &self->sha1);
-        mbedtls_sha1_finish_ret(&self->sha1, data);
-        mbedtls_sha1_clone(&self->sha1, &copy);
-    } else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) {
-        mbedtls_sha256_context copy;
-        mbedtls_sha256_clone(&copy, &self->sha256);
-        mbedtls_sha256_finish_ret(&self->sha256, data);
-        mbedtls_sha256_clone(&self->sha256, &copy);
-    }
+    // Clone the operation so we can continue to update or get digest again.
+    psa_hash_operation_t clone = PSA_HASH_OPERATION_INIT;
+    psa_hash_clone(&self->hash_op, &clone);
+    size_t hash_len;
+    psa_hash_finish(&clone, data, datalen, &hash_len);
 }
 
 size_t common_hal_hashlib_hash_get_digest_size(hashlib_hash_obj_t *self) {
-    if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) {
-        return 20;
-    } else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) {
-        return 32;
-    }
-    return 0;
+    return PSA_HASH_LENGTH(self->hash_alg);
 }

shared-module/hashlib/Hash.h

@@ -6,15 +6,10 @@
 
 #pragma once
 
-#include "mbedtls/private/sha1.h"
-#include "mbedtls/private/sha256.h"
+#include "psa/crypto.h"
 
 typedef struct {
     mp_obj_base_t base;
-    union {
-        mbedtls_sha1_context sha1;
-        mbedtls_sha256_context sha256;
-    };
-    // Of MBEDTLS_SSL_HASH_*
-    uint8_t hash_type;
+    psa_hash_operation_t hash_op;
+    psa_algorithm_t hash_alg;
 } hashlib_hash_obj_t;

shared-module/hashlib/__init__.c

@@ -7,20 +7,17 @@
 #include "shared-bindings/hashlib/__init__.h"
 #include "shared-module/hashlib/__init__.h"
 
-#include "mbedtls/ssl.h"
-
+#include "psa/crypto.h"
 
 bool common_hal_hashlib_new(hashlib_hash_obj_t *self, const char *algorithm) {
     if (strcmp(algorithm, "sha1") == 0) {
-        self->hash_type = MBEDTLS_SSL_HASH_SHA1;
-        mbedtls_sha1_init(&self->sha1);
-        mbedtls_sha1_starts_ret(&self->sha1);
-        return true;
+        self->hash_alg = PSA_ALG_SHA_1;
     } else if (strcmp(algorithm, "sha256") == 0) {
-        self->hash_type = MBEDTLS_SSL_HASH_SHA256;
-        mbedtls_sha256_init(&self->sha256);
-        mbedtls_sha256_starts_ret(&self->sha256, 0);
-        return true;
+        self->hash_alg = PSA_ALG_SHA_256;
+    } else {
+        return false;
     }
-    return false;
+    self->hash_op = psa_hash_operation_init();
+    psa_hash_setup(&self->hash_op, self->hash_alg);
+    return true;
 }

shared-module/ssl/SSLSocket.c

@@ -238,18 +238,24 @@ ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t
     mbedtls_x509_crt_init(&o->cacert);
     mbedtls_x509_crt_init(&o->cert);
     mbedtls_pk_init(&o->pkey);
+    #if MBEDTLS_VERSION_MAJOR < 4
     mbedtls_ctr_drbg_init(&o->ctr_drbg);
+    #endif
     #ifdef MBEDTLS_DEBUG_C
     // Debug level (0-4) 1=warning, 2=info, 3=debug, 4=verbose
     mbedtls_debug_set_threshold(4);
     #endif
 
+    #if MBEDTLS_VERSION_MAJOR < 4
     mbedtls_entropy_init(&o->entropy);
     const byte seed[] = "upy";
     int ret = mbedtls_ctr_drbg_seed(&o->ctr_drbg, mbedtls_entropy_func, &o->entropy, seed, sizeof(seed));
     if (ret != 0) {
         goto cleanup;
     }
+    #else
+    int ret;
+    #endif
 
     ret = mbedtls_ssl_config_defaults(&o->conf,
         server_side ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT,
@@ -322,8 +328,10 @@ ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t
     mbedtls_x509_crt_free(&o->cacert);
     mbedtls_ssl_free(&o->ssl);
     mbedtls_ssl_config_free(&o->conf);
+    #if MBEDTLS_VERSION_MAJOR < 4
     mbedtls_ctr_drbg_free(&o->ctr_drbg);
     mbedtls_entropy_free(&o->entropy);
+    #endif
 
     if (ret == MBEDTLS_ERR_SSL_ALLOC_FAILED) {
         mp_raise_type(&mp_type_MemoryError);
@@ -386,8 +394,10 @@ void common_hal_ssl_sslsocket_close(ssl_sslsocket_obj_t *self) {
     mbedtls_x509_crt_free(&self->cacert);
     mbedtls_ssl_free(&self->ssl);
     mbedtls_ssl_config_free(&self->conf);
+    #if MBEDTLS_VERSION_MAJOR < 4
     mbedtls_ctr_drbg_free(&self->ctr_drbg);
     mbedtls_entropy_free(&self->entropy);
+    #endif
 }
 
 static void do_handshake(ssl_sslsocket_obj_t *self) {
@@ -412,8 +422,10 @@ static void do_handshake(ssl_sslsocket_obj_t *self) {
     mbedtls_x509_crt_free(&self->cacert);
     mbedtls_ssl_free(&self->ssl);
     mbedtls_ssl_config_free(&self->conf);
+    #if MBEDTLS_VERSION_MAJOR < 4
     mbedtls_ctr_drbg_free(&self->ctr_drbg);
     mbedtls_entropy_free(&self->entropy);
+    #endif
 
     if (ret == MBEDTLS_ERR_SSL_ALLOC_FAILED) {
         mp_raise_type(&mp_type_MemoryError);