From 62fcb136a36c45a62076f3d5808dffb93c265c3b Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Tue, 9 Jun 2026 21:32:02 +0530 Subject: [PATCH 01/10] feat(lws): mbedTLS 4 / IDF v6 support Pin the libwebsockets submodule at warmcat main (mbedTLS 4 + the FreeRTOS/ESP-IDF v6 build fixes), allow IDF v6.0, and force lws's mbedTLS 4 code path on IDF: lws's own V4 probe doesn't run on FreeRTOS, so detect the version from the IDF mbedtls component and inject the tf-psa-crypto include dirs. --- .github/workflows/lws_build.yml | 4 ++-- components/libwebsockets/CMakeLists.txt | 28 ++++++++++++++++++++++ components/libwebsockets/idf_component.yml | 2 +- components/libwebsockets/libwebsockets | 2 +- 4 files changed, 32 insertions(+), 4 deletions(-) diff --git a/.github/workflows/lws_build.yml b/.github/workflows/lws_build.yml index a0aac2815f..d55f08c741 100644 --- a/.github/workflows/lws_build.yml +++ b/.github/workflows/lws_build.yml @@ -13,7 +13,7 @@ jobs: name: Libwebsockets build strategy: matrix: - idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5"] + idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5", "release-v6.0"] test: [ { app: example, path: "examples/client" }] runs-on: ubuntu-22.04 container: espressif/idf:${{ matrix.idf_ver }} @@ -51,7 +51,7 @@ jobs: strategy: fail-fast: false matrix: - idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5"] + idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5", "release-v6.0"] idf_target: ["esp32"] test: [ { app: example, path: "examples/client" }] runs-on: diff --git a/components/libwebsockets/CMakeLists.txt b/components/libwebsockets/CMakeLists.txt index 6c802940ff..8fbbb35475 100644 --- a/components/libwebsockets/CMakeLists.txt +++ b/components/libwebsockets/CMakeLists.txt @@ -50,6 +50,20 @@ target_link_libraries(${COMPONENT_LIB} INTERFACE websockets) target_sources(${COMPONENT_LIB} INTERFACE "port/lws_port.c") +idf_component_get_property(mbedtls_dir mbedtls COMPONENT_DIR) + +# lws's mbedtls 4 detection probe is gated by `if (LWS_MBEDTLS_INCLUDE_DIRS)` +# in lib/tls/mbedtls/CMakeLists.txt:120, which on FreeRTOS is empty (the +# find_path call only runs on non-FreeRTOS). Result: on ESP-IDF, lws never +# sets `LWS_HAVE_MBEDTLS_V4` even when the mbedtls submodule is v4 — and +# lws's mbedtls-4-aware source (libwebsockets.h:414 etc.) goes down the +# v3 branch and breaks. Pre-set the cache var when we know IDF mbedtls is +# v4 so lws picks the right branch. Verified empirically against IDF v6. +file(STRINGS "${mbedtls_dir}/mbedtls/include/mbedtls/build_info.h" + _mbedtls_major REGEX "^#define MBEDTLS_VERSION_MAJOR[ \t]+[0-9]+") +if(_mbedtls_major MATCHES "[ \t]+([0-9]+)" AND CMAKE_MATCH_1 GREATER_EQUAL 4) + set(LWS_HAVE_MBEDTLS_V4 1 CACHE INTERNAL "mbedtls 4 detected on IDF") +endif() add_subdirectory(libwebsockets) @@ -68,3 +82,17 @@ target_compile_options(websockets PRIVATE "-include${CMAKE_CURRENT_SOURCE_DIR}/p if(CONFIG_LWS_WITH_CUSTOM_HEADERS) target_compile_definitions(websockets PUBLIC LWS_WITH_CUSTOM_HEADERS=1 LWS_WITH_CUSTOM_HTTP_HEADERS=1) endif() + +# mbedTLS 4 (IDF v6) split public headers across tf-psa-crypto/. The inner +# `websockets` target reaches mbedtls headers via lws's hardcoded +# $ENV{IDF_PATH}/components/mbedtls/... list (lib/CMakeLists.txt:60), which +# only mentions mbedtls/include + port/include. Inject the new dirs here +# when present so the IDF v6 (mbedtls 4) chain resolves; the EXISTS guard +# keeps IDF v5.x (mbedtls 3) builds untouched. +# Drop once upstream lws covers tf-psa-crypto in its ESP_PLATFORM block. +if(EXISTS "${mbedtls_dir}/mbedtls/tf-psa-crypto/include") + target_include_directories(websockets PRIVATE + "${mbedtls_dir}/mbedtls/tf-psa-crypto/include" + "${mbedtls_dir}/mbedtls/tf-psa-crypto/drivers/builtin/include" + "${mbedtls_dir}/port/psa_driver/include") +endif() diff --git a/components/libwebsockets/idf_component.yml b/components/libwebsockets/idf_component.yml index 49d06153cb..eafe5e06d7 100644 --- a/components/libwebsockets/idf_component.yml +++ b/components/libwebsockets/idf_component.yml @@ -2,4 +2,4 @@ version: "4.3.3~3" url: https://github.com/espressif/esp-protocols/tree/master/components/libwebsockets description: The component provides a simple ESP-IDF port of libwebsockets client. dependencies: - idf: '>=5.3,<6.0' + idf: '>=5.3' diff --git a/components/libwebsockets/libwebsockets b/components/libwebsockets/libwebsockets index d659d4f257..46886c8d85 160000 --- a/components/libwebsockets/libwebsockets +++ b/components/libwebsockets/libwebsockets @@ -1 +1 @@ -Subproject commit d659d4f2579709570f1a36ab989372db5e6e7d89 +Subproject commit 46886c8d85346aff52c091b5622d8a325219c2da From 609ca2b7fb936f8342bfb9e1962a936b38762702 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Fri, 19 Jun 2026 22:51:58 +0530 Subject: [PATCH 02/10] feat(lws): bump submodule to main (mbedTLS 4 / IDF v6 support landed upstream) The mbedTLS 4 / ESP-IDF v6 build support (warmcat/libwebsockets#3603) is now on libwebsockets main, so point the submodule at upstream main instead of the PR branch. Verified: examples/client builds clean on ESP-IDF v6.0 (esp32, stock mbedtls). --- components/libwebsockets/libwebsockets | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/libwebsockets/libwebsockets b/components/libwebsockets/libwebsockets index 46886c8d85..b4f9c5cbf2 160000 --- a/components/libwebsockets/libwebsockets +++ b/components/libwebsockets/libwebsockets @@ -1 +1 @@ -Subproject commit 46886c8d85346aff52c091b5622d8a325219c2da +Subproject commit b4f9c5cbf230aac091e24942ec524c36d3efe152 From 32e1fc314ace5a8153305c4ba9b3026aec151425 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Fri, 19 Jun 2026 22:59:58 +0530 Subject: [PATCH 03/10] fix(lws): IDF v6 build adaptations for the libwebsockets component Make the component + client example build under ESP-IDF v6 (mbedTLS 4): - keep upstream lws warnings non-fatal under IDF's global -Werror (-Wno-error) so harmless format/redefinition warnings in lws sources don't fail the build - expose tf-psa-crypto/include + the split-out v6 component includes lws needs - point lwip errno at and prefer esp_libc TLS errno (picolibc) - set LWS_HAVE_MBEDTLS_V4 when IDF mbedtls is v4 so lws takes the v4 code paths - example: add espressif/cjson (left IDF built-ins in v6) + large single-app partition All additions are EXISTS-guarded / version-gated, so IDF v5.x is unaffected. --- components/libwebsockets/CMakeLists.txt | 43 ++++++++++++++++++- .../examples/client/main/idf_component.yml | 3 ++ .../examples/client/sdkconfig.defaults | 3 ++ 3 files changed, 47 insertions(+), 2 deletions(-) create mode 100644 components/libwebsockets/examples/client/sdkconfig.defaults diff --git a/components/libwebsockets/CMakeLists.txt b/components/libwebsockets/CMakeLists.txt index 8fbbb35475..75f3a23624 100644 --- a/components/libwebsockets/CMakeLists.txt +++ b/components/libwebsockets/CMakeLists.txt @@ -65,10 +65,27 @@ if(_mbedtls_major MATCHES "[ \t]+([0-9]+)" AND CMAKE_MATCH_1 GREATER_EQUAL 4) set(LWS_HAVE_MBEDTLS_V4 1 CACHE INTERNAL "mbedtls 4 detected on IDF") endif() +# Stop lws adding its own -Werror (the IDF build already sets -Werror globally). +set(DISABLE_WERROR ON CACHE BOOL "lws: don't treat warnings as errors" FORCE) + add_subdirectory(libwebsockets) -# pollfd.c at this lws pin has an unused 'vpt' on FreeRTOS; drop after the next bump. -target_compile_options(websockets PRIVATE -Wno-unused-variable) +# The IDF build compiles everything with a global -Werror. IDF v6's mbedtls +# headers emit a harmless MBEDTLS_PSA_BUILTIN_ALG_HMAC redefinition warning +# (esp_config.h vs tf-psa-crypto) that lws's sources pull in via libwebsockets.h +# -> mbedtls/ssl.h; -Wno-error keeps that (and the unused 'vpt' in this pin's +# pollfd.c) from failing the build. See esp-idf esp_config.h redefinition bug. +target_compile_options(websockets PRIVATE -Wno-unused-variable -Wno-error) + +# IDF v6's libc (picolibc) makes errno thread-local. With lws's LWIP_PROVIDE_ERRNO +# now gated off on v6, lwip's errno.h forwards to the system errno - but lws's +# hardcoded include list (lib/CMakeLists.txt) puts .../lwip/src/include/lwip on the +# path, so a bare resolves to lwip's own errno.h (LWIP_ERRNO_STDINCLUDE +# would re-include itself). Point lwip at instead, which is not +# shadowed and pulls picolibc's TLS errno + E* macros via esp_libc's #include_next. +# Otherwise lws objects fail with "errno undeclared" (compile) or "TLS definition +# ... mismatches non-TLS reference" (link). +target_compile_definitions(websockets PRIVATE "LWIP_ERRNO_INCLUDE=") # Supply a UTC timegm() for lws (LWS_HAVE_TIMEGM set above). lws_http_date_parse_unix() # calls timegm(); the port source defines it and the shim force-includes a prototype @@ -96,3 +113,25 @@ if(EXISTS "${mbedtls_dir}/mbedtls/tf-psa-crypto/include") "${mbedtls_dir}/mbedtls/tf-psa-crypto/drivers/builtin/include" "${mbedtls_dir}/port/psa_driver/include") endif() + +# lib/misc/romfs.c pulls esp_flash.h, whose IDF v6 include chain spans +# components split out in v6 (esp_hal_mspi for hal/spi_flash_types.h, +# esp_blockdev) that aren't on lws's hardcoded include list. Add their include +# dirs (not link, which would re-inherit IDF's -Werror). EXISTS-guarded so +# IDF v5.x is untouched. +foreach(_lws_extra_comp esp_hal_mspi esp_blockdev) + idf_component_get_property(_lws_cdir ${_lws_extra_comp} COMPONENT_DIR) + if(_lws_cdir AND EXISTS "${_lws_cdir}/include") + target_include_directories(websockets PRIVATE "${_lws_cdir}/include") + endif() +endforeach() + +# lws's hardcoded ESP include list still points at the legacy 'newlib' +# component, whose non-TLS errno.h shadows IDF v6's esp_libc (picolibc) TLS +# errno - which then fails to link ("TLS definition ... mismatches non-TLS +# reference in async-dns.c.obj"). Prepend esp_libc's platform_include so its +# TLS errno.h wins. EXISTS-guarded so IDF v5.x is untouched. +idf_component_get_property(_esp_libc_dir esp_libc COMPONENT_DIR) +if(_esp_libc_dir AND EXISTS "${_esp_libc_dir}/platform_include") + target_include_directories(websockets BEFORE PRIVATE "${_esp_libc_dir}/platform_include") +endif() diff --git a/components/libwebsockets/examples/client/main/idf_component.yml b/components/libwebsockets/examples/client/main/idf_component.yml index 959a1dfb33..0e4f9eacb5 100644 --- a/components/libwebsockets/examples/client/main/idf_component.yml +++ b/components/libwebsockets/examples/client/main/idf_component.yml @@ -4,3 +4,6 @@ dependencies: override_path: "../../../" protocol_examples_common: path: ${IDF_PATH}/examples/common_components/protocol_examples_common + # cJSON moved out of IDF's built-in components in v6; the example uses it + espressif/cjson: + version: "*" diff --git a/components/libwebsockets/examples/client/sdkconfig.defaults b/components/libwebsockets/examples/client/sdkconfig.defaults new file mode 100644 index 0000000000..d934e3eaf7 --- /dev/null +++ b/components/libwebsockets/examples/client/sdkconfig.defaults @@ -0,0 +1,3 @@ +# The libwebsockets client (mbedTLS + TLS) exceeds the 1 MB default single-app +# partition. Use the large single-app layout so a plain `idf.py build` fits. +CONFIG_PARTITION_TABLE_SINGLE_APP_LARGE=y From e2de0ab35a08ebcf5ef7db8c800df7427a9d0e9a Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Fri, 19 Jun 2026 23:05:40 +0530 Subject: [PATCH 04/10] fix(lws): gate v6-only component lookups on BUILD_COMPONENTS idf_component_get_property() hard-errors when the component isn't in the build, so the esp_hal_mspi / esp_blockdev / esp_libc include workarounds broke CMake configure on IDF v5.x (those components are v6-only). Check BUILD_COMPONENTS membership before each lookup; v6 still picks them up by bare name (verified), v5.x cleanly skips them. --- components/libwebsockets/CMakeLists.txt | 27 ++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/components/libwebsockets/CMakeLists.txt b/components/libwebsockets/CMakeLists.txt index 75f3a23624..ca79d496ed 100644 --- a/components/libwebsockets/CMakeLists.txt +++ b/components/libwebsockets/CMakeLists.txt @@ -114,15 +114,22 @@ if(EXISTS "${mbedtls_dir}/mbedtls/tf-psa-crypto/include") "${mbedtls_dir}/port/psa_driver/include") endif() +# The include workarounds below reach into components that only exist on +# IDF v6 (esp_hal_mspi, esp_blockdev, esp_libc). idf_component_get_property +# hard-errors if the component isn't in the build, so gate every lookup on +# BUILD_COMPONENTS membership first - that keeps IDF v5.x untouched. +idf_build_get_property(_lws_build_comps BUILD_COMPONENTS) + # lib/misc/romfs.c pulls esp_flash.h, whose IDF v6 include chain spans # components split out in v6 (esp_hal_mspi for hal/spi_flash_types.h, # esp_blockdev) that aren't on lws's hardcoded include list. Add their include -# dirs (not link, which would re-inherit IDF's -Werror). EXISTS-guarded so -# IDF v5.x is untouched. +# dirs (not link, which would re-inherit IDF's -Werror). foreach(_lws_extra_comp esp_hal_mspi esp_blockdev) - idf_component_get_property(_lws_cdir ${_lws_extra_comp} COMPONENT_DIR) - if(_lws_cdir AND EXISTS "${_lws_cdir}/include") - target_include_directories(websockets PRIVATE "${_lws_cdir}/include") + if(_lws_extra_comp IN_LIST _lws_build_comps) + idf_component_get_property(_lws_cdir ${_lws_extra_comp} COMPONENT_DIR) + if(_lws_cdir AND EXISTS "${_lws_cdir}/include") + target_include_directories(websockets PRIVATE "${_lws_cdir}/include") + endif() endif() endforeach() @@ -130,8 +137,10 @@ endforeach() # component, whose non-TLS errno.h shadows IDF v6's esp_libc (picolibc) TLS # errno - which then fails to link ("TLS definition ... mismatches non-TLS # reference in async-dns.c.obj"). Prepend esp_libc's platform_include so its -# TLS errno.h wins. EXISTS-guarded so IDF v5.x is untouched. -idf_component_get_property(_esp_libc_dir esp_libc COMPONENT_DIR) -if(_esp_libc_dir AND EXISTS "${_esp_libc_dir}/platform_include") - target_include_directories(websockets BEFORE PRIVATE "${_esp_libc_dir}/platform_include") +# TLS errno.h wins. +if(esp_libc IN_LIST _lws_build_comps) + idf_component_get_property(_esp_libc_dir esp_libc COMPONENT_DIR) + if(_esp_libc_dir AND EXISTS "${_esp_libc_dir}/platform_include") + target_include_directories(websockets BEFORE PRIVATE "${_esp_libc_dir}/platform_include") + endif() endif() From 68896bf0cfb641e489ab7216a70d6fcc0c6e5761 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Fri, 19 Jun 2026 23:15:20 +0530 Subject: [PATCH 05/10] fix(lws): pin submodule to 906de57a0 (main minus the QUIC tip) The previous pin (b4f9c5cb 'h2-h3-happy-eyeballs') introduced an unrelated format-specifier warning in lib/core-net/client/connect3.c ('%u' vs uint32_t) that is fatal under -Werror on the v5.3/v5.4 toolchains (where uint32_t is 'long unsigned int'). Its parent 906de57a0 still carries the mbedTLS 4 / IDF v6 support (e6f4d0ec) and the wrapper-removal refactor, without the QUIC regression. Upstream fix to be filed separately. --- components/libwebsockets/libwebsockets | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/libwebsockets/libwebsockets b/components/libwebsockets/libwebsockets index b4f9c5cbf2..906de57a03 160000 --- a/components/libwebsockets/libwebsockets +++ b/components/libwebsockets/libwebsockets @@ -1 +1 @@ -Subproject commit b4f9c5cbf230aac091e24942ec524c36d3efe152 +Subproject commit 906de57a03cfb8becf75e3ec085dbce5690680c7 From 1286b647d5548b302cc7d4955c5a03e50205db19 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Sat, 20 Jun 2026 20:43:32 +0530 Subject: [PATCH 06/10] feat(lws): bump submodule to main with the QUIC format fix warmcat/libwebsockets#3618 (cast uint32_t grace_us for the %u format specifier in connect3.c) is now on main, so move the pin forward from the temporary parent-commit pin to current main (00130694a). Verified: examples/client builds clean on ESP-IDF v6.0 (esp32). --- components/libwebsockets/libwebsockets | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/libwebsockets/libwebsockets b/components/libwebsockets/libwebsockets index 906de57a03..00130694ab 160000 --- a/components/libwebsockets/libwebsockets +++ b/components/libwebsockets/libwebsockets @@ -1 +1 @@ -Subproject commit 906de57a03cfb8becf75e3ec085dbce5690680c7 +Subproject commit 00130694abcc357c77a304049d406d8e8ca266ed From bf3ddbfe56f6d02f15f87549af7c41af87c1bf18 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Sat, 20 Jun 2026 20:49:06 +0530 Subject: [PATCH 07/10] fix(lws): provide if_nametoindex fallback for IDF <= v5.3 Recent libwebsockets uses if_nametoindex() in lws_get_addr_scope(). ESP-IDF <= v5.3 builds lwip with LWIP_NETIF_API==0, so if_api.c isn't compiled and the symbol - declared in newlib's - is never defined, breaking the link. Provide a fallback in the port shim that mirrors lwip's own implementation (the ungated core netif_name_to_index helper), gated on !LWIP_NETIF_API so v5.4+ (where lwip supplies it) is untouched. Verified no regression on v6.0. --- components/libwebsockets/port/lws_port.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/components/libwebsockets/port/lws_port.c b/components/libwebsockets/port/lws_port.c index be3d80df3e..c86388aab7 100644 --- a/components/libwebsockets/port/lws_port.c +++ b/components/libwebsockets/port/lws_port.c @@ -55,3 +55,20 @@ struct lws *__wrap_lws_adopt_descriptor_vhost(struct lws_vhost *vh, lws_adoption return lws_adopt_descriptor_vhost_via_info(&info); } + +#include "lwip/opt.h" +#if !LWIP_NETIF_API +#include "lwip/netif.h" +/* + * Older ESP-IDF lwip (<= v5.3) builds with LWIP_NETIF_API==0, so if_api.c is + * not compiled and if_nametoindex() - declared in newlib's - is + * never defined. Recent libwebsockets uses it in lws_get_addr_scope(), which + * then fails to link. Provide the same fallback lwip's own if_nametoindex() + * uses: resolve the name through the ungated core helper. On v5.4+ lwip + * supplies the symbol (LWIP_NETIF_API==1), so this is compiled out. + */ +unsigned int if_nametoindex(const char *ifname) +{ + return netif_name_to_index(ifname); +} +#endif From 98c9b133813928dc8821468461bd1b7d147a45fd Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Sat, 20 Jun 2026 20:54:17 +0530 Subject: [PATCH 08/10] ci(lws): ignore harmless MBEDTLS_PSA_BUILTIN_* redefine warning on IDF v6 IDF v6's mbedtls port esp_config.h redefines MBEDTLS_PSA_BUILTIN_ALG_HMAC (and siblings) that tf-psa-crypto already defines. The build compiles and links fine (our -Wno-error keeps it non-fatal), but idf-build-apps' check_warnings flags the 'warning: redefined' line and fails the job. It's a harmless IDF-side redefinition; add it to the CI ignore list. --- ci/ignore_build_warnings.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/ci/ignore_build_warnings.txt b/ci/ignore_build_warnings.txt index 72e106f135..41149b7924 100644 --- a/ci/ignore_build_warnings.txt +++ b/ci/ignore_build_warnings.txt @@ -7,3 +7,4 @@ Warning: Deprecated: Command 'extract_public_key' is deprecated. Use 'extract-pu warning: unknown kconfig symbol 'EXAMPLE_ETH_PHY_IP101' WARNING: The following Kconfig variables were used in "if" clauses, but not warning: unknown kconfig symbol 'LIBC_NEWLIB' +warning: 'MBEDTLS_PSA_BUILTIN_[A-Z0-9_]+' redefined From 18b7c04f60fe73eff3945b6e536deb3821e78b35 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Tue, 14 Jul 2026 20:15:31 +0530 Subject: [PATCH 09/10] fix(lws): propagate esp_driver_gpio + esp_security includes for IDF v6/mbedTLS-4 lws-freertos.h pulls (esp_driver_gpio) into every consumer, and the mbedTLS-4 PSA header chain needs esp_security/esp_hal_security include dirs that mbedtls links PRIVATE. Add them so the add_subdirectory websockets target and consumers resolve on IDF v6. --- components/libwebsockets/CMakeLists.txt | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/components/libwebsockets/CMakeLists.txt b/components/libwebsockets/CMakeLists.txt index ca79d496ed..35a2f1ea56 100644 --- a/components/libwebsockets/CMakeLists.txt +++ b/components/libwebsockets/CMakeLists.txt @@ -1,4 +1,7 @@ -idf_component_register(REQUIRES mbedtls) +# esp_driver_gpio is a PUBLIC requirement: the public header lws-freertos.h +# includes , so every consumer of libwebsockets.h needs it on +# its include path. Declaring it here propagates to all consumers. +idf_component_register(REQUIRES mbedtls esp_driver_gpio) set(LWS_WITH_EXPORT_LWSTARGETS OFF CACHE BOOL "Export libwebsockets CMake targets. Disable if they conflict with an outer cmake project.") set(LWS_WITH_MBEDTLS ON CACHE BOOL "Use mbedTLS (>=2.0) replacement for OpenSSL.") @@ -124,7 +127,12 @@ idf_build_get_property(_lws_build_comps BUILD_COMPONENTS) # components split out in v6 (esp_hal_mspi for hal/spi_flash_types.h, # esp_blockdev) that aren't on lws's hardcoded include list. Add their include # dirs (not link, which would re-inherit IDF's -Werror). -foreach(_lws_extra_comp esp_hal_mspi esp_blockdev) +# esp_security / esp_hal_security: the mbedTLS-4 PSA header chain (psa/crypto.h +# -> driver-context composites) pulls the ESP HW-crypto driver context headers, +# which include esp_ds.h / esp_key_mgr.h (esp_security); those in turn include +# hal/key_mgr_types.h (esp_hal_security). mbedtls links these PRIVATE so they +# aren't propagated to this add_subdirectory target — add both here. +foreach(_lws_extra_comp esp_hal_mspi esp_blockdev esp_security esp_hal_security) if(_lws_extra_comp IN_LIST _lws_build_comps) idf_component_get_property(_lws_cdir ${_lws_extra_comp} COMPONENT_DIR) if(_lws_cdir AND EXISTS "${_lws_cdir}/include") @@ -133,6 +141,13 @@ foreach(_lws_extra_comp esp_hal_mspi esp_blockdev) endif() endforeach() +# lws-freertos.h includes driver/gpio.h (IDF v6 esp_driver_gpio). That component +# isn't in BUILD_COMPONENTS yet when this file runs (ordering), so the IN_LIST +# guard above would skip it — reference the IDF path directly instead. +if(EXISTS "$ENV{IDF_PATH}/components/esp_driver_gpio/include/driver/gpio.h") + target_include_directories(websockets PRIVATE "$ENV{IDF_PATH}/components/esp_driver_gpio/include") +endif() + # lws's hardcoded ESP include list still points at the legacy 'newlib' # component, whose non-TLS errno.h shadows IDF v6's esp_libc (picolibc) TLS # errno - which then fails to link ("TLS definition ... mismatches non-TLS From 9bbf1abc85e01361dd7acec82c58d5716981a53e Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Tue, 14 Jul 2026 20:22:55 +0530 Subject: [PATCH 10/10] fix(lws): pin submodule to stable main snapshot da5d6f5f9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the moving-main churn pins with a single settled warmcat main commit (v4.5.0-590-gda5d6f5f9, 2026-07-13) that carries the mbedTLS-4/IDF-v6 support the v4.5.x release tags lack. Older, so likelier to survive warmcat's main force-pushes. (Version bump is the maintainer's call — see PR discussion.) --- components/libwebsockets/libwebsockets | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/libwebsockets/libwebsockets b/components/libwebsockets/libwebsockets index 00130694ab..da5d6f5f95 160000 --- a/components/libwebsockets/libwebsockets +++ b/components/libwebsockets/libwebsockets @@ -1 +1 @@ -Subproject commit 00130694abcc357c77a304049d406d8e8ca266ed +Subproject commit da5d6f5f9570018dbc1c1a1c7757ee2e433409bc