Update to Mynewt-NimBLE 1.10.0

src/NimBLEUtils.cpp

@@ -533,8 +533,8 @@ const char* NimBLEUtils::gapEventToString(uint8_t eventType) {
             return "BLE_GAP_EVENT_PATHLOSS_THRESHOLD";
         case BLE_GAP_EVENT_TRANSMIT_POWER: // 26
             return "BLE_GAP_EVENT_TRANSMIT_POWER";
-        case BLE_GAP_EVENT_PARING_COMPLETE: // 27
-            return "BLE_GAP_EVENT_PARING_COMPLETE";
+        case BLE_GAP_EVENT_PAIRING_COMPLETE: // 27
+            return "BLE_GAP_EVENT_PAIRING_COMPLETE";
         case BLE_GAP_EVENT_SUBRATE_CHANGE: // 28
             return "BLE_GAP_EVENT_SUBRATE_CHANGE";
 #   ifdef BLE_GAP_EVENT_VS_HCI

src/nimble/NOTICE

@@ -1,5 +1,5 @@
 Apache Mynewt NimBLE
-Copyright 2015-2025 The Apache Software Foundation
+Copyright 2015-2026 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

src/nimble/README.md

@@ -29,14 +29,22 @@
   <img src="https://github.com/apache/mynewt-nimble/actions/workflows/build_targets.yml/badge.svg">
 <a/>
 
+<a href="https://github.com/apache/mynewt-nimble/actions/workflows/build_cc_target.yml">
+  <img src="https://github.com/apache/mynewt-nimble/actions/workflows/build_cc_target.yml/badge.svg">
+<a/>
+
 <a href="https://github.com/apache/mynewt-nimble/actions/workflows/build_ports.yml">
   <img src="https://github.com/apache/mynewt-nimble/actions/workflows/build_ports.yml/badge.svg">
 <a/>
 
-<a href="https://github.com/apache/mynewt-nimble/actions/workflows/newt_test_all.yml/badge.svg">
+<a href="https://github.com/apache/mynewt-nimble/actions/workflows/newt_test_all.yml">
   <img src="https://github.com/apache/mynewt-nimble/actions/workflows/newt_test_all.yml/badge.svg">
 <a/>
 
+<a href="https://github.com/apache/mynewt-nimble/actions/workflows/build_all_apps.yml">
+  <img src="https://github.com/apache/mynewt-nimble/actions/workflows/build_all_apps.yml/badge.svg">
+<a/>
+
 <p>
 
 Apache NimBLE is an open-source Bluetooth 5.4 stack (both Host & Controller)

src/nimble/RELEASE_NOTES.md

@@ -1,17 +1,17 @@
 # RELEASE NOTES
 
-15 December 2025 - Apache NimBLE v1.9.0
+10 July 2026 - Apache NimBLE v1.10.0
 
 For full release notes, please visit the
 [Apache Mynewt Wiki](https://cwiki.apache.org/confluence/display/MYNEWT/Release+Notes).
 
 Apache NimBLE is an open-source Bluetooth 5.4 stack (both Host & Controller) that completely
 replaces the proprietary SoftDevice on Nordic chipsets.
 
-New features in this version of NimBLE include:
+Major changes in this version of NimBLE include:
 
-* Characteristic Extended Properties descriptor in GATT server
-* Framed PDUs in ISO Adaptation Layer
+* Removal of Tinycrypt support
+* Removal of deprecated code
 
 If working on next-generation RTOS and Bluetooth protocol stack
 sounds exciting to you, get in touch, by sending a mail to the Apache Mynewt

src/nimble/nimble/controller/src/ble_ll.c

@@ -1191,6 +1191,9 @@ ble_ll_rx_end(uint8_t *rxbuf, struct ble_mbuf_hdr *rxhdr)
     ble_ll_trace_u32x3(BLE_LL_TRACE_ID_RX_END, pdu_type, len,
                        rxhdr->rxinfo.flags);
 
+    /* Update RSSI */
+    rxhdr->rxinfo.rssi -= ble_ll_rx_gain();
+
 #if MYNEWT_VAL(BLE_LL_EXT)
     if (BLE_MBUF_HDR_RX_STATE(rxhdr) == BLE_LL_STATE_EXTERNAL) {
         rc = ble_ll_ext_rx_isr_end(rxbuf, rxhdr);
@@ -1812,8 +1815,6 @@ ble_ll_init(void)
             g_dev_addr[i] = pub_dev_addr & 0xff;
             pub_dev_addr >>= 8;
         }
-#else
-        memcpy(g_dev_addr, MYNEWT_VAL(BLE_PUBLIC_DEV_ADDR), BLE_DEV_ADDR_LEN);
 #endif
         if (ble_ll_is_addr_empty(g_dev_addr)) {
             rc = ble_hw_get_public_addr(&addr);

src/nimble/nimble/controller/src/ble_ll_adv.c

@@ -1131,7 +1131,7 @@ ble_ll_adv_tx_start_cb(struct ble_ll_sched_item *sch)
     uint8_t end_trans;
     uint32_t txstart;
     struct ble_ll_adv_sm *advsm;
-#if MYNEWT_VAL(BLE_LL_PHY) && MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
+#if MYNEWT_VAL(BLE_LL_PHY)
     uint8_t phy_mode __attribute__((unused));
 #endif
 
@@ -1161,13 +1161,12 @@ ble_ll_adv_tx_start_cb(struct ble_ll_sched_item *sch)
     phy_mode = ble_ll_phy_to_phy_mode(advsm->pri_phy, BLE_HCI_LE_PHY_CODED_ANY);
 #endif
     if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_LEGACY) {
-        ble_phy_mode_set(BLE_PHY_MODE_1M, BLE_PHY_MODE_1M);
-    } else {
-        ble_phy_mode_set(phy_mode, phy_mode);
+        phy_mode = BLE_PHY_MODE_1M;
     }
 #else
-    ble_phy_mode_set(BLE_PHY_MODE_1M, BLE_PHY_MODE_1M);
+    phy_mode = BLE_PHY_MODE_1M;
 #endif
+    ble_phy_mode_set(phy_mode, phy_mode);
 #endif
 
     /* Set the power */
@@ -2322,7 +2321,7 @@ ble_ll_adv_sync_tx_start_cb(struct ble_ll_sched_item *sch)
 
 #if MYNEWT_VAL(BLE_LL_PHY)
     /* Set phy mode */
-     ble_phy_mode_set(advsm->sec_phy, advsm->sec_phy);
+    ble_phy_mode_set(advsm->sec_phy, advsm->sec_phy);
 #endif
 
     /* Set the power */

src/nimble/nimble/controller/src/ble_ll_conn.c

@@ -3582,7 +3582,7 @@ ble_ll_conn_rx_data_pdu(struct os_mbuf *rxpdu, struct ble_mbuf_hdr *hdr)
 #endif
 
     /* Update RSSI */
-    connsm->conn_rssi = hdr->rxinfo.rssi - ble_ll_rx_gain();
+    connsm->conn_rssi = hdr->rxinfo.rssi;
 
     /*
      * If we are a peripheral, we can only start to use peripheral latency

src/nimble/nimble/controller/src/ble_ll_crypto.c

@@ -23,13 +23,25 @@
 #include "nimble/nimble/include/nimble/ble.h"
 #include "nimble/nimble/controller/include/controller/ble_ll_crypto.h"
 #include "nimble/nimble/controller/include/controller/ble_hw.h"
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+#include <mbedtls/cmac.h>
+#else
 #include "nimble/ext/tinycrypt/include/tinycrypt/constants.h"
 #include "nimble/ext/tinycrypt/include/tinycrypt/cmac_mode.h"
+#endif
 
 int
 ble_ll_crypto_cmac(const uint8_t *key, const uint8_t *in, int len,
                    uint8_t *out)
 {
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+    if (mbedtls_cipher_cmac(mbedtls_cipher_info_from_type(MBEDTLS_CIPHER_AES_128_ECB),
+                            key, 128, in, len, out)) {
+        return -1;
+    }
+
+    return 0;
+#else
     struct tc_aes_key_sched_struct sched;
     struct tc_cmac_struct state;
 
@@ -46,6 +58,7 @@ ble_ll_crypto_cmac(const uint8_t *key, const uint8_t *in, int len,
     }
 
     return 0;
+#endif
 }
 
 int

src/nimble/nimble/controller/src/ble_ll_cs_drbg.c

@@ -25,7 +25,7 @@
 #include <assert.h>
 #include "nimble/porting/nimble/include/os/endian.h"
 #include "nimble/nimble/include/nimble/ble.h"
-#include "nimble/ext/tinycrypt/include/tinycrypt/aes.h"
+#include "mbedtls/aes.h"
 #include "ble_ll_cs_drbg_priv.h"
 #if !(BABBLESIM || MYNEWT_VAL(SELFTEST))
 #include "nimble/nimble/controller/include/controller/ble_hw.h"

src/nimble/nimble/controller/src/ble_ll_ctrl.c

@@ -2098,6 +2098,47 @@ ble_ll_ctrl_rx_reject_ind(struct ble_ll_conn_sm *connsm, uint8_t *dptr,
     return rsp_opcode;
 }
 
+static bool
+ble_ll_conn_chk_conn_update_req(const struct ble_ll_conn_upd_req *req)
+{
+    uint32_t timeout_usecs;
+    uint32_t min_timeout_usecs;
+
+    if ((req->interval < BLE_HCI_CONN_ITVL_MIN) ||
+        (req->interval > BLE_HCI_CONN_ITVL_MAX) ||
+        (req->latency > BLE_HCI_CONN_LATENCY_MAX) ||
+        (req->timeout < BLE_HCI_CONN_SPVN_TIMEOUT_MIN) ||
+        (req->timeout > BLE_HCI_CONN_SPVN_TIMEOUT_MAX)) {
+        return false;
+    }
+
+    /* Supervision timeout (in msecs) must be more than:
+     * (1 + connLatency) * connIntervalMax * 1.25 msecs * 2.
+     */
+    timeout_usecs = req->timeout;
+    timeout_usecs *= (BLE_HCI_CONN_SPVN_TMO_UNITS * 1000);
+    min_timeout_usecs = (uint32_t)req->interval * 2 * BLE_LL_CONN_ITVL_USECS;
+    min_timeout_usecs *= (1 + req->latency);
+    if (timeout_usecs <= min_timeout_usecs) {
+        return false;
+    }
+
+    /* The transmitWindowOffset shall be a multiple of 1.25 ms in the range
+     * 0 ms to connInterval.
+     */
+    if (req->winoffset > req->interval) {
+        return false;
+    }
+
+    /* The transmitWindowSize shall be a multiple of 1.25 ms in the range
+     * 1.25 ms to the lesser of 10 ms and (connInterval - 1.25 ms).
+     */
+    if ((req->winsize < 1) || (req->winsize > MIN(8, req->interval - 1))) {
+        return false;
+    }
+
+    return true;
+}
 /**
  * Called when we receive a connection update event
  *
@@ -2109,7 +2150,6 @@ ble_ll_ctrl_rx_reject_ind(struct ble_ll_conn_sm *connsm, uint8_t *dptr,
 static int
 ble_ll_ctrl_rx_conn_update(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
 {
-    uint8_t rsp_opcode;
     uint16_t conn_events;
     struct ble_ll_conn_upd_req *reqdata;
 
@@ -2129,9 +2169,11 @@ ble_ll_ctrl_rx_conn_update(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
     reqdata->timeout = get_le16(dptr + 7);
     reqdata->instant = get_le16(dptr + 9);
 
-    /* XXX: validate them at some point. If they dont check out, we
-       return the unknown response */
-    rsp_opcode = BLE_ERR_MAX;
+    /* Check if parameters are valid */
+    if (!ble_ll_conn_chk_conn_update_req(reqdata)) {
+        ble_ll_conn_timeout(connsm, BLE_ERR_INV_LMP_LL_PARM);
+        return BLE_ERR_MAX;
+    }
 
     /* If instant is in the past, we have to end the connection */
     conn_events = (reqdata->instant - connsm->event_cntr) & 0xFFFF;
@@ -2156,7 +2198,7 @@ ble_ll_ctrl_rx_conn_update(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
         }
     }
 
-    return rsp_opcode;
+    return BLE_ERR_MAX;
 }
 
 void
@@ -2485,6 +2527,17 @@ ble_ll_ctrl_rx_chanmap_req(struct ble_ll_conn_sm *connsm, uint8_t *dptr)
     }
 #endif
 
+    /* Minimum number of channels is 2.
+     * If invalid map was provided we have to end the connection.
+     */
+    if (ble_ll_utils_chan_map_used_get(dptr) < 2) {
+        ble_ll_conn_timeout(connsm, BLE_ERR_INV_LMP_LL_PARM);
+        return BLE_ERR_MAX;
+    }
+
+    /* The bits in positions 37, 38 and 39 are reserved for future use */
+    dptr[4] &= 0x1f;
+
     /* If instant is in the past, we have to end the connection */
     instant = get_le16(dptr + BLE_LL_CHAN_MAP_LEN);
     conn_events = (instant - connsm->event_cntr) & 0xFFFF;

src/nimble/nimble/controller/src/ble_ll_resolv.c

@@ -140,25 +140,23 @@ static void
 ble_ll_resolv_rpa_timer_cb(struct ble_npl_event *ev)
 {
     int i;
-    os_sr_t sr;
+    uint8_t rpa[6];
     struct ble_ll_resolv_entry *rl;
 #if MYNEWT_VAL(BLE_LL_HCI_VS_LOCAL_IRK)
     struct local_irk_data *irk_data;
-    uint8_t rpa[6];
+    os_sr_t sr;
 #endif
 
     rl = &g_ble_ll_resolv_list[0];
     for (i = 0; i < g_ble_ll_resolv_data.rl_cnt; ++i) {
         if (rl->rl_has_local) {
-            OS_ENTER_CRITICAL(sr);
-            ble_ll_resolv_gen_priv_addr(rl, 1);
-            OS_EXIT_CRITICAL(sr);
+            generate_rpa(rl->rl_local_irk, rpa);
+            ble_ll_resolv_set_local_rpa(i, rpa);
         }
 
         if (rl->rl_has_peer) {
-            OS_ENTER_CRITICAL(sr);
-            ble_ll_resolv_gen_priv_addr(rl, 0);
-            OS_EXIT_CRITICAL(sr);
+            generate_rpa(rl->rl_peer_irk, rpa);
+            ble_ll_resolv_set_peer_rpa(i, rpa);
         }
         ++rl;
     }

src/nimble/nimble/controller/src/ble_ll_scan.c

@@ -720,7 +720,7 @@ ble_ll_scan_send_adv_report(uint8_t pdu_type,
     if (scansm->ext_scanning) {
         rc = ble_ll_hci_send_legacy_ext_adv_report(evtype,
                                                    adva, adva_type,
-                                                   hdr->rxinfo.rssi - ble_ll_rx_gain(),
+                                                   hdr->rxinfo.rssi,
                                                    adv_data_len, om,
                                                    inita, inita_type);
 goto done;
@@ -729,12 +729,12 @@ goto done;
 
     if (subev == BLE_HCI_LE_SUBEV_DIRECT_ADV_RPT) {
         rc = ble_ll_hci_send_dir_adv_report(adva, adva_type, inita, inita_type,
-                                            hdr->rxinfo.rssi - ble_ll_rx_gain());
+                                            hdr->rxinfo.rssi);
         goto done;
     }
 
     rc = ble_ll_hci_send_adv_report(evtype, adva, adva_type,
-                                    hdr->rxinfo.rssi - ble_ll_rx_gain(),
+                                    hdr->rxinfo.rssi,
                                     adv_data_len, om);
 done:
     if (!rc && scansm->scan_filt_dups) {

src/nimble/nimble/controller/src/ble_ll_scan_aux.c

@@ -437,7 +437,7 @@ ble_ll_hci_ev_update_ext_adv_report_from_ext(struct ble_hci_ev *hci_ev,
     report->pri_phy = rxinfo->phy;
     report->sec_phy = 0;
     report->sid = 0xff;
-    report->rssi = rxhdr->rxinfo.rssi - ble_ll_rx_gain();
+    report->rssi = rxhdr->rxinfo.rssi;
     report->periodic_itvl = 0;
     report->data_len = 0;
 
@@ -566,7 +566,7 @@ ble_ll_hci_ev_send_ext_adv_report(struct os_mbuf *rxpdu,
         hci_subev = (void *)(*hci_ev)->data;
         report = hci_subev->reports;
 
-        report->rssi = rxinfo->rssi - ble_ll_rx_gain();
+        report->rssi = rxinfo->rssi;
 
         report->data_len = MIN(max_data_len, data_len - offset);
         os_mbuf_copydata(rxpdu, offset, report->data_len, report->data);

src/nimble/nimble/controller/src/ble_ll_sched.c

@@ -529,7 +529,9 @@ ble_ll_sched_conn_central_new(struct ble_ll_conn_sm *connsm,
         OS_ENTER_CRITICAL(sr);
 
         if (!g_ble_ll_conn_css_ref) {
-            css->period_anchor_ticks = earliest_start;
+            css->period_anchor_ticks = earliest_start +
+                                       MYNEWT_VAL(BLE_LL_CONN_INIT_MIN_WIN_OFFSET) *
+                                       BLE_LL_SCHED_USECS_PER_SLOT;
             css->period_anchor_rem_us = 0;
             css->period_anchor_idx = 0;
             css->period_anchor_slot_idx = connsm->css_slot_idx;

src/nimble/nimble/drivers/nrf5x/src/ble_phy.c

@@ -1665,7 +1665,7 @@ ble_phy_init(void)
 #if PHY_USE_HEADERMASK_WORKAROUND
     NVIC_SetVector(CCM_AAR_IRQn, (uint32_t)ble_phy_ccm_isr);
     NVIC_EnableIRQ(CCM_AAR_IRQn);
-    NRF_CCM->INTENCLR = CCM_INTENCLR_ENDKSGEN_Msk;;
+    NRF_CCM->INTENCLR = CCM_INTENCLR_ENDKSGEN_Msk;
 #endif
 #endif
 

src/nimble/nimble/host/include/host/ble_gap.h

@@ -249,9 +249,6 @@ struct hci_conn_update;
 /** GAP event: Pairing complete */
 #define BLE_GAP_EVENT_PAIRING_COMPLETE      27
 
-/** GAP event: Pairing complete (deprecated) */
-#define BLE_GAP_EVENT_PARING_COMPLETE BLE_GAP_EVENT_PAIRING_COMPLETE
-
 /** GAP event: Subrate change */
 #define BLE_GAP_EVENT_SUBRATE_CHANGE        28
 
@@ -1249,7 +1246,6 @@ struct ble_gap_event {
          *
          * Valid for the following event types:
          *     o BLE_GAP_EVENT_PAIRING_COMPLETE
-         *     o BLE_GAP_EVENT_PARING_COMPLETE (deprecated)
          */
         struct {
             /**