diff --git a/nimble/controller/include/controller/ble_hw.h b/nimble/controller/include/controller/ble_hw.h
index 394c3a173c..d2549fd6d2 100644
--- a/nimble/controller/include/controller/ble_hw.h
+++ b/nimble/controller/include/controller/ble_hw.h
@@ -97,12 +97,6 @@ uint8_t ble_hw_resolv_list_size(void);
 /* Returns index of resolved address; -1 if not resolved */
 int ble_hw_resolv_list_match(void);
 
-/* Returns public device address or -1 if not present */
-int ble_hw_get_public_addr(ble_addr_t *addr);
-
-/* Returns random static address or -1 if not present */
-int ble_hw_get_static_addr(ble_addr_t *addr);
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/nimble/controller/include/controller/ble_ll.h b/nimble/controller/include/controller/ble_ll.h
index ab75edcba3..7a5d74a494 100644
--- a/nimble/controller/include/controller/ble_ll.h
+++ b/nimble/controller/include/controller/ble_ll.h
@@ -517,16 +517,6 @@ struct ble_ll_acad_channel_map_update_ind {
 /* Reset the Link Layer */
 int ble_ll_reset(void);
 
-/* 'Boolean' function returning true if address is a valid random address */
-int ble_ll_is_valid_random_addr(const uint8_t *addr);
-
-/*
- * Check if given own_addr_type is valid for current controller configuration
- * given the random address provided (when applicable)
- */
-int ble_ll_is_valid_own_addr_type(uint8_t own_addr_type,
-                                  const uint8_t *random_addr);
-
 /* Calculate maximum octets of PDU payload which can be transmitted during
  * 'usecs' on a PHY 'phy_mode'. */
 uint16_t ble_ll_pdu_max_tx_octets_get(uint32_t usecs, int phy_mode);
@@ -539,12 +529,6 @@ int ble_ll_addr_subtype(const uint8_t *addr, uint8_t addr_type);
 /* Is this address an identity address? */
 int ble_ll_addr_is_id(uint8_t *addr, uint8_t addr_type);
 
-/* Is 'addr' our device address? 'addr_type' is public (0) or random (!=0) */
-int ble_ll_is_our_devaddr(uint8_t *addr, int addr_type);
-
-/* Get identity address 'addr_type' is public (0) or random (!=0) */
-uint8_t *ble_ll_get_our_devaddr(uint8_t addr_type);
-
 /**
  * Called to put a packet on the Link Layer transmit packet queue.
  *
diff --git a/nimble/controller/include/controller/ble_ll_addr.h b/nimble/controller/include/controller/ble_ll_addr.h
new file mode 100644
index 0000000000..93dccda615
--- /dev/null
+++ b/nimble/controller/include/controller/ble_ll_addr.h
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#ifndef H_BLE_LL_ADDR_
+#define H_BLE_LL_ADDR_
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int ble_ll_addr_init(void);
+int ble_ll_addr_public_set(const uint8_t *addr);
+
+const uint8_t *ble_ll_addr_get(uint8_t addr_type);
+const uint8_t *ble_ll_addr_public_get(void);
+const uint8_t *ble_ll_addr_random_get(void);
+int ble_ll_addr_random_set(const uint8_t *addr);
+
+bool ble_ll_addr_is_our(int addr_type, const uint8_t *addr);
+bool ble_ll_addr_is_valid_own_addr_type(uint8_t addr_type,
+                                        const uint8_t *random_addr);
+
+/* Address provider APIs - should be implemented by packages supporting
+ * relevant APIs
+ */
+int ble_ll_addr_provide_public(uint8_t *addr);
+int ble_ll_addr_provide_static(uint8_t *addr);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* H_BLE_LL_ADDR_ */
diff --git a/nimble/controller/include/controller/ble_ll_conn.h b/nimble/controller/include/controller/ble_ll_conn.h
index 2b0c606dd6..fc5d5b63a2 100644
--- a/nimble/controller/include/controller/ble_ll_conn.h
+++ b/nimble/controller/include/controller/ble_ll_conn.h
@@ -483,7 +483,7 @@ void ble_ll_conn_send_connect_req_cancel(void);
 /* Signal connection created via CONNECT_IND */
 void ble_ll_conn_created_on_legacy(struct os_mbuf *rxpdu,
                                    struct ble_ll_scan_addr_data *addrd,
-                                   uint8_t *targeta);
+                                   const uint8_t *targeta);
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 /* Signal connection created via AUX_CONNECT_REQ */
 void ble_ll_conn_created_on_aux(struct os_mbuf *rxpdu,
diff --git a/nimble/controller/include/controller/ble_ll_resolv.h b/nimble/controller/include/controller/ble_ll_resolv.h
index ff28e783ce..75977d2542 100644
--- a/nimble/controller/include/controller/ble_ll_resolv.h
+++ b/nimble/controller/include/controller/ble_ll_resolv.h
@@ -90,8 +90,8 @@ void ble_ll_resolv_list_reset(void);
 void ble_ll_resolv_get_priv_addr(struct ble_ll_resolv_entry *rl, int local,
                                  uint8_t *addr);
 
-void ble_ll_resolv_set_peer_rpa(int index, uint8_t *rpa);
-void ble_ll_resolv_set_local_rpa(int index, uint8_t *rpa);
+void ble_ll_resolv_set_peer_rpa(int index, const uint8_t *rpa);
+void ble_ll_resolv_set_local_rpa(int index, const uint8_t *rpa);
 
 /* Generate a resolvable private address. */
 int ble_ll_resolv_gen_rpa(uint8_t *addr, uint8_t addr_type, uint8_t *rpa,
diff --git a/nimble/controller/include/controller/ble_ll_scan.h b/nimble/controller/include/controller/ble_ll_scan.h
index 47c7437414..76fdc4737a 100644
--- a/nimble/controller/include/controller/ble_ll_scan.h
+++ b/nimble/controller/include/controller/ble_ll_scan.h
@@ -108,9 +108,9 @@ struct ble_ll_scan_vs_config {
 };
 
 struct ble_ll_scan_addr_data {
-    uint8_t *adva;
-    uint8_t *targeta;
-    uint8_t *adv_addr;
+    const uint8_t *adva;
+    const uint8_t *targeta;
+    const uint8_t *adv_addr;
     uint8_t adva_type : 1;
     uint8_t targeta_type : 1;
     uint8_t adv_addr_type : 1;
@@ -223,7 +223,7 @@ ble_ll_scan_initiator_start(struct ble_ll_conn_sm *connsm, uint8_t ext,
 struct ble_ll_scan_pdu_data *ble_ll_scan_get_pdu_data(void);
 
 /* Called to set the resolvable private address of the last connected peer */
-void ble_ll_scan_set_peer_rpa(uint8_t *rpa);
+void ble_ll_scan_set_peer_rpa(const uint8_t *rpa);
 
 /* Returns peer RPA of last connection made */
 uint8_t *ble_ll_scan_get_peer_rpa(void);
@@ -256,14 +256,14 @@ uint8_t ble_ll_scan_get_filt_dups(void);
 uint8_t ble_ll_scan_backoff_kick(void);
 void ble_ll_scan_backoff_update(int success);
 
-int ble_ll_scan_dup_check_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
-                              uint16_t adi);
-int ble_ll_scan_dup_update_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
-                               uint16_t adi);
-int ble_ll_scan_have_rxd_scan_rsp(uint8_t *addr, uint8_t txadd, uint8_t ext_adv,
-                                  uint16_t adi);
-void ble_ll_scan_add_scan_rsp_adv(uint8_t *addr, uint8_t txadd, uint8_t ext_adv,
-                                  uint16_t adi);
+int ble_ll_scan_dup_check_ext(uint8_t addr_type, const uint8_t *addr,
+                              bool has_aux, uint16_t adi);
+int ble_ll_scan_dup_update_ext(uint8_t addr_type, const uint8_t *addr,
+                               bool has_aux, uint16_t adi);
+int ble_ll_scan_have_rxd_scan_rsp(const uint8_t *addr, uint8_t txadd,
+                                  uint8_t ext_adv, uint16_t adi);
+void ble_ll_scan_add_scan_rsp_adv(const uint8_t *addr, uint8_t txadd,
+                                  uint8_t ext_adv, uint16_t adi);
 
 struct ble_ll_scan_sm *ble_ll_scan_sm_get(void);
 
diff --git a/nimble/controller/include/controller/ble_ll_whitelist.h b/nimble/controller/include/controller/ble_ll_whitelist.h
index 2d3b6c5ddd..d2a9110cc0 100644
--- a/nimble/controller/include/controller/ble_ll_whitelist.h
+++ b/nimble/controller/include/controller/ble_ll_whitelist.h
@@ -43,7 +43,7 @@ void ble_ll_whitelist_enable(void);
 void ble_ll_whitelist_disable(void);
 
 /* Boolean function returning true if address matches a whitelist entry */
-int ble_ll_whitelist_match(uint8_t *addr, uint8_t addr_type, int is_ident);
+int ble_ll_whitelist_match(const uint8_t *addr, uint8_t addr_type, int is_ident);
 
 #ifdef __cplusplus
 }
diff --git a/nimble/controller/src/ble_ll.c b/nimble/controller/src/ble_ll.c
index a0d6dbbc03..0c847ec38a 100644
--- a/nimble/controller/src/ble_ll.c
+++ b/nimble/controller/src/ble_ll.c
@@ -45,6 +45,7 @@
 #include "controller/ble_ll_rfmgmt.h"
 #include "controller/ble_ll_trace.h"
 #include "controller/ble_ll_sync.h"
+#include "controller/ble_ll_addr.h"
 #include "controller/ble_fem.h"
 #if MYNEWT_VAL(BLE_LL_ISO)
 #include "controller/ble_ll_iso.h"
@@ -392,12 +393,6 @@ OS_TASK_STACK_DEFINE(g_ble_ll_stack, MYNEWT_VAL(BLE_LL_STACK_SIZE));
 
 #endif /* MYNEWT */
 
-/** Our global device address (public) */
-uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
-
-/** Our random address */
-uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
-
 /**
  * Counts the number of advertising PDU's received, by type. For advertising
  * PDU's that contain a destination address, we still count these packets even
@@ -562,93 +557,11 @@ ble_ll_addr_subtype(const uint8_t *addr, uint8_t addr_type)
     }
 }
 
-static int
-ble_ll_is_valid_addr(const uint8_t *addr)
-{
-    int i;
-
-    for (i = 0; i < BLE_DEV_ADDR_LEN; ++i) {
-        if (addr[i]) {
-            return 1;
-        }
-    }
-
-    return 0;
-}
-
-/* Checks to see that the device is a valid random address */
-int
-ble_ll_is_valid_random_addr(const uint8_t *addr)
-{
-    int i;
-    int rc;
-    uint16_t sum;
-    uint8_t addr_type;
-
-    /* Make sure all bits are neither one nor zero */
-    sum = 0;
-    for (i = 0; i < (BLE_DEV_ADDR_LEN -1); ++i) {
-        sum += addr[i];
-    }
-    sum += addr[5] & 0x3f;
-
-    if ((sum == 0) || (sum == ((5*255) + 0x3f))) {
-        return 0;
-    }
-
-    /* Get the upper two bits of the address */
-    rc = 1;
-    addr_type = addr[5] & 0xc0;
-    if (addr_type == 0xc0) {
-        /* Static random address. No other checks needed */
-    } else if (addr_type == 0x40) {
-        /* Resolvable */
-        sum = addr[3] + addr[4] + (addr[5] & 0x3f);
-        if ((sum == 0) || (sum == (255 + 255 + 0x3f))) {
-            rc = 0;
-        }
-    } else if (addr_type == 0) {
-        /* non-resolvable. Cant be equal to public */
-        if (!memcmp(g_dev_addr, addr, BLE_DEV_ADDR_LEN)) {
-            rc = 0;
-        }
-    } else {
-        /* Invalid upper two bits */
-        rc = 0;
-    }
-
-    return rc;
-}
-int
-ble_ll_is_valid_own_addr_type(uint8_t own_addr_type, const uint8_t *random_addr)
-{
-    int rc;
-
-    switch (own_addr_type) {
-    case BLE_HCI_ADV_OWN_ADDR_PUBLIC:
-#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
-    case BLE_HCI_ADV_OWN_ADDR_PRIV_PUB:
-#endif
-        rc = ble_ll_is_valid_addr(g_dev_addr);
-        break;
-    case BLE_HCI_ADV_OWN_ADDR_RANDOM:
-#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
-    case BLE_HCI_ADV_OWN_ADDR_PRIV_RAND:
-#endif
-        rc = ble_ll_is_valid_addr(random_addr);
-        break;
-    default:
-        rc = 0;
-        break;
-    }
-
-    return rc;
-}
-
+/* FIXME: remove callers */
 int
 ble_ll_set_public_addr(const uint8_t *addr)
 {
-    memcpy(g_dev_addr, addr, BLE_DEV_ADDR_LEN);
+    ble_ll_addr_public_set(addr);
 
     return BLE_ERR_SUCCESS;
 }
@@ -696,7 +609,7 @@ ble_ll_set_random_addr(const uint8_t *cmdbuf, uint8_t len, bool hci_adv_ext)
     }
 #endif
 
-    memcpy(g_random_addr, cmd->addr, BLE_DEV_ADDR_LEN);
+    ble_ll_addr_random_set(cmd->addr);
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 #if MYNEWT_VAL(BLE_LL_ROLE_BROADCASTER)
@@ -712,52 +625,6 @@ ble_ll_set_random_addr(const uint8_t *cmdbuf, uint8_t len, bool hci_adv_ext)
     return BLE_ERR_SUCCESS;
 }
 
-/**
- * Checks to see if an address is our device address (either public or
- * random)
- *
- * @param addr
- * @param addr_type
- *
- * @return int 0: not our device address. 1: is our device address
- */
-int
-ble_ll_is_our_devaddr(uint8_t *addr, int addr_type)
-{
-    int rc;
-    uint8_t *our_addr;
-
-    if (addr_type) {
-        our_addr = g_random_addr;
-    } else {
-        our_addr = g_dev_addr;
-    }
-
-    rc = 0;
-    if (!memcmp(our_addr, addr, BLE_DEV_ADDR_LEN)) {
-        rc = 1;
-    }
-
-    return rc;
-}
-
-/**
- * Get identity address
- *
- * @param addr_type Random (1). Public(0)
- *
- * @return pointer to identity address of given type.
- */
-uint8_t*
-ble_ll_get_our_devaddr(uint8_t addr_type)
-{
-    if (addr_type) {
-        return g_random_addr;
-    }
-
-    return g_dev_addr;
-}
-
 /**
  * Wait for response timeout function
  *
@@ -1677,8 +1544,8 @@ ble_ll_reset(void)
     /* Set state to standby */
     ble_ll_state_set(BLE_LL_STATE_STANDBY);
 
-    /* Reset our random address */
-    memset(g_random_addr, 0, BLE_DEV_ADDR_LEN);
+    /* Initialize addresses */
+    ble_ll_addr_init();
 
     /* Clear the whitelist */
     ble_ll_whitelist_clear();
@@ -1758,12 +1625,6 @@ ble_ll_pdu_max_tx_octets_get(uint32_t usecs, int phy_mode)
     return MAX(27, octets);
 }
 
-static inline bool
-ble_ll_is_addr_empty(const uint8_t *addr)
-{
-    return memcmp(addr, BLE_ADDR_ANY, BLE_DEV_ADDR_LEN) == 0;
-}
-
 #if MYNEWT_VAL(BLE_LL_HCI_VS_EVENT_ON_ASSERT)
 void
 ble_ll_assert(const char *file, unsigned line)
@@ -1788,11 +1649,6 @@ ble_ll_init(void)
 {
     int rc;
     uint64_t features;
-#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
-    uint64_t pub_dev_addr;
-    int i;
-#endif
-    ble_addr_t addr;
     struct ble_ll_obj *lldata;
 
     /* Ensure this function only gets called by sysinit. */
@@ -1801,25 +1657,7 @@ ble_ll_init(void)
     ble_ll_trace_init();
     ble_phy_trace_init();
 
-    /* Set public device address if not already set */
-    if (ble_ll_is_addr_empty(g_dev_addr)) {
-#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
-        pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
-
-        for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
-            g_dev_addr[i] = pub_dev_addr & 0xff;
-            pub_dev_addr >>= 8;
-        }
-#else
-        memcpy(g_dev_addr, MYNEWT_VAL(BLE_PUBLIC_DEV_ADDR), BLE_DEV_ADDR_LEN);
-#endif
-        if (ble_ll_is_addr_empty(g_dev_addr)) {
-            rc = ble_hw_get_public_addr(&addr);
-            if (!rc) {
-                memcpy(g_dev_addr, &addr.val[0], BLE_DEV_ADDR_LEN);
-            }
-        }
-    }
+    ble_ll_addr_init();
 
     ble_ll_rfmgmt_init();
 
diff --git a/nimble/controller/src/ble_ll_addr.c b/nimble/controller/src/ble_ll_addr.c
new file mode 100644
index 0000000000..d6f74899bd
--- /dev/null
+++ b/nimble/controller/src/ble_ll_addr.c
@@ -0,0 +1,149 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include <stdint.h>
+#include <syscfg/syscfg.h>
+#include <controller/ble_ll.h>
+#include <controller/ble_ll_addr.h>
+
+static struct {
+    uint8_t public_addr[BLE_DEV_ADDR_LEN];
+    uint8_t random_addr[BLE_DEV_ADDR_LEN];
+    uint8_t public_addr_hci[BLE_DEV_ADDR_LEN];
+} g_ble_ll_addr;
+
+static bool
+is_addr_empty(const uint8_t *addr)
+{
+    return memcmp(addr, BLE_ADDR_ANY, BLE_DEV_ADDR_LEN) == 0;
+}
+
+int
+ble_ll_addr_public_set(const uint8_t *addr)
+{
+    memcpy(g_ble_ll_addr.public_addr_hci, addr, BLE_DEV_ADDR_LEN);
+
+    return 0;
+}
+
+const uint8_t *
+ble_ll_addr_get(uint8_t addr_type)
+{
+    const uint8_t *addr;
+
+    if (addr_type) {
+        addr = g_ble_ll_addr.random_addr;
+    } else {
+        addr = g_ble_ll_addr.public_addr;
+    }
+
+    return addr;
+}
+
+const uint8_t *
+ble_ll_addr_public_get(void)
+{
+    return g_ble_ll_addr.public_addr;
+}
+
+
+const uint8_t *
+ble_ll_addr_random_get(void)
+{
+    return g_ble_ll_addr.random_addr;
+}
+
+int
+ble_ll_addr_random_set(const uint8_t *addr)
+{
+    memcpy(g_ble_ll_addr.random_addr, addr, BLE_DEV_ADDR_LEN);
+
+    return 0;
+}
+
+bool
+ble_ll_addr_is_our(int addr_type, const uint8_t *addr)
+{
+    const uint8_t *our_addr;
+
+    our_addr = ble_ll_addr_get(addr_type);
+
+    return memcmp(our_addr, addr, BLE_DEV_ADDR_LEN) == 0;
+}
+
+bool
+ble_ll_addr_is_valid_own_addr_type(uint8_t addr_type,
+                                   const uint8_t *random_addr)
+{
+    const uint8_t *addr;
+
+    switch (addr_type) {
+    case BLE_HCI_ADV_OWN_ADDR_PUBLIC:
+#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
+    case BLE_HCI_ADV_OWN_ADDR_PRIV_PUB:
+#endif
+        addr = ble_ll_addr_public_get();
+        break;
+    case BLE_HCI_ADV_OWN_ADDR_RANDOM:
+#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
+    case BLE_HCI_ADV_OWN_ADDR_PRIV_RAND:
+#endif
+        addr = random_addr ? random_addr : ble_ll_addr_random_get();
+        break;
+    default:
+        return false;
+    }
+
+    return !is_addr_empty(addr);
+}
+
+int
+ble_ll_addr_init(void)
+{
+    uint64_t pub_dev_addr;
+    int i;
+
+    /* Set public device address from syscfg. It should be all-zero in normal
+     * build so no need to add special check for that.
+     */
+    pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
+    for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
+        g_ble_ll_addr.public_addr[i] = pub_dev_addr & 0xff;
+        pub_dev_addr >>= 8;
+    }
+
+    if (!is_addr_empty(g_ble_ll_addr.public_addr_hci)) {
+        /* Use public address set externally */
+        memcpy(g_ble_ll_addr.public_addr, g_ble_ll_addr.public_addr_hci, BLE_DEV_ADDR_LEN);
+    } else {
+        /* Set public address from provider API, if available */
+#if MYNEWT_API_ble_addr_provider_public
+        ble_ll_addr_provide_public(g_ble_ll_addr.public_addr);
+#endif
+    }
+
+#if MYNEWT_VAL(BLE_LL_ADDR_INIT_RANDOM)
+    /* Set random address from provider API, if available */
+#if MYNEWT_API_ble_addr_provider_random
+    ble_ll_addr_provide_static(g_ble_ll_addr.random_addr);
+#endif
+#endif
+
+    return 0;
+}
diff --git a/nimble/controller/src/ble_ll_adv.c b/nimble/controller/src/ble_ll_adv.c
index 84f6e789d6..ab8fc0e342 100644
--- a/nimble/controller/src/ble_ll_adv.c
+++ b/nimble/controller/src/ble_ll_adv.c
@@ -35,6 +35,7 @@
 #include "controller/ble_ll_pdu.h"
 #include "controller/ble_ll_hci.h"
 #include "controller/ble_ll_adv.h"
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_sched.h"
 #include "controller/ble_ll_scan.h"
 #include "controller/ble_ll_whitelist.h"
@@ -2791,12 +2792,12 @@ static int
 ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
 {
     uint8_t adv_chan;
-    uint8_t *addr;
+    const uint8_t *adva;
+    const uint8_t *random_addr;
     uint32_t start_delay_us;
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LE_CSA2)
     uint32_t access_addr;
 #endif
-    const uint8_t *random_addr;
     uint32_t earliest_start_time;
     int32_t delta;
 
@@ -2808,10 +2809,10 @@ ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
     random_addr = advsm->adv_random_addr;
 #else
-    random_addr = g_random_addr;
+    random_addr = ble_ll_addr_random_get();
 #endif
 
-    if (!ble_ll_is_valid_own_addr_type(advsm->own_addr_type, random_addr)) {
+    if (!ble_ll_addr_is_valid_own_addr_type(advsm->own_addr_type, random_addr)) {
         return BLE_ERR_INV_HCI_CMD_PARMS;
     }
 
@@ -2833,16 +2834,16 @@ ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
 
     /* Set advertising address */
     if ((advsm->own_addr_type & 1) == 0) {
-        addr = g_dev_addr;
+        adva = ble_ll_addr_public_get();
     } else {
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
-        addr = advsm->adv_random_addr;
+        adva = advsm->adv_random_addr;
 #else
-        addr = g_random_addr;
+        adva = ble_ll_addr_random_get();
 #endif
         advsm->flags |= BLE_LL_ADV_SM_FLAG_TX_ADD;
     }
-    memcpy(advsm->adva, addr, BLE_DEV_ADDR_LEN);
+    memcpy(advsm->adva, adva, BLE_DEV_ADDR_LEN);
 
     if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_DIRECTED) {
         memcpy(advsm->initiator_addr, advsm->peer_addr, BLE_DEV_ADDR_LEN);
diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c
index 52446b6471..7bca3515aa 100644
--- a/nimble/controller/src/ble_ll_conn.c
+++ b/nimble/controller/src/ble_ll_conn.c
@@ -30,6 +30,7 @@
 #include "controller/ble_ll.h"
 #include "controller/ble_ll_pdu.h"
 #include "controller/ble_ll_conn.h"
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_hci.h"
 #include "controller/ble_ll_scan.h"
 #include "controller/ble_ll_whitelist.h"
@@ -3072,7 +3073,8 @@ ble_ll_conn_prepare_connect_ind(struct ble_ll_conn_sm *connsm,
                                 uint8_t channel)
 {
     uint8_t hdr;
-    uint8_t *addr;
+    const uint8_t *inita;
+    bool inita_rnd = false;
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
     struct ble_ll_resolv_entry *rl;
 #endif
@@ -3100,36 +3102,37 @@ ble_ll_conn_prepare_connect_ind(struct ble_ll_conn_sm *connsm,
                  */
                 BLE_LL_ASSERT(addrd->rpa_index >= 0);
                 rl = &g_ble_ll_resolv_list[addrd->rpa_index];
-                hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
                 ble_ll_resolv_get_priv_addr(rl, 1, pdu_data->inita);
+                inita = NULL;
+                inita_rnd = true;
             } else {
                 /* Host does not want us to use RPA so use identity */
                 if ((connsm->own_addr_type & 1) == 0) {
-                    memcpy(pdu_data->inita, g_dev_addr, BLE_DEV_ADDR_LEN);
+                    inita = ble_ll_addr_public_get();
                 } else {
-                    hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
-                    memcpy(pdu_data->inita, g_random_addr, BLE_DEV_ADDR_LEN);
+                    inita = ble_ll_addr_random_get();
+                    inita_rnd = true;
                 }
             }
         } else {
-            memcpy(pdu_data->inita, addrd->targeta, BLE_DEV_ADDR_LEN);
+            inita = addrd->targeta;
             if (addrd->targeta_type) {
-                hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
+                inita_rnd = true;
             }
         }
 #else
-        memcpy(pdu_data->inita, addrd->targeta, BLE_DEV_ADDR_LEN);
+        inita = addrd->targeta;
         if (addrd->targeta_type) {
-            hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
+            inita_rnd = true;
         }
 #endif
     } else {
         /* Get pointer to our device address */
         if ((connsm->own_addr_type & 1) == 0) {
-            addr = g_dev_addr;
+            inita = ble_ll_addr_public_get();
         } else {
-            hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
-            addr = g_random_addr;
+            inita = ble_ll_addr_random_get();
+            inita_rnd = true;
         }
 
     /* XXX: do this ahead of time? Calculate the local rpa I mean */
@@ -3141,25 +3144,32 @@ ble_ll_conn_prepare_connect_ind(struct ble_ll_conn_sm *connsm,
                  */
                 rl = &g_ble_ll_resolv_list[addrd->rpa_index];
                 if (rl->rl_has_local) {
-                    hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
                     ble_ll_resolv_get_priv_addr(rl, 1, pdu_data->inita);
-                    addr = NULL;
+                    inita = NULL;
+                    inita_rnd = true;
                 }
             } else if (ble_ll_resolv_local_rpa_get(connsm->own_addr_type & 1,
                                                    pdu_data->inita) == 0) {
-                hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
-                addr = NULL;
+                inita = NULL;
+                inita_rnd = true;
             }
         }
 #endif
 
-        if (addr) {
-            memcpy(pdu_data->inita, addr, BLE_DEV_ADDR_LEN);
+        if (inita) {
             /* Identity address used */
             connsm->inita_identity_used = 1;
         }
     }
 
+    if (inita) {
+        memcpy(pdu_data->inita, inita, BLE_DEV_ADDR_LEN);
+    }
+
+    if (inita_rnd) {
+        hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
+    }
+
     memcpy(pdu_data->adva, addrd->adva, BLE_DEV_ADDR_LEN);
 
     pdu_data->hdr_byte = hdr;
@@ -3304,7 +3314,8 @@ ble_ll_conn_send_connect_req_cancel(void)
 
 static void
 ble_ll_conn_central_start(uint8_t phy, uint8_t csa,
-                          struct ble_ll_scan_addr_data *addrd, uint8_t *targeta)
+                          struct ble_ll_scan_addr_data *addrd,
+                          const uint8_t *targeta)
 {
     struct ble_ll_conn_sm *connsm;
 
@@ -3340,7 +3351,7 @@ ble_ll_conn_central_start(uint8_t phy, uint8_t csa,
 void
 ble_ll_conn_created_on_legacy(struct os_mbuf *rxpdu,
                               struct ble_ll_scan_addr_data *addrd,
-                              uint8_t *targeta)
+                              const uint8_t *targeta)
 {
     uint8_t *rxbuf;
     uint8_t csa;
diff --git a/nimble/controller/src/ble_ll_hci.c b/nimble/controller/src/ble_ll_hci.c
index 07b0aec1c5..643aa33ddf 100644
--- a/nimble/controller/src/ble_ll_hci.c
+++ b/nimble/controller/src/ble_ll_hci.c
@@ -30,6 +30,7 @@
 #include "controller/ble_ll_scan.h"
 #include "controller/ble_ll.h"
 #include "controller/ble_ll_hci.h"
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_whitelist.h"
 #include "controller/ble_ll_resolv.h"
 #include "controller/ble_ll_sync.h"
@@ -283,9 +284,10 @@ ble_ll_hci_rd_bd_addr(uint8_t *rspbuf, uint8_t *rsplen)
 {
     struct ble_hci_ip_rd_bd_addr_rp *rsp = (void *) rspbuf;
 
-    memcpy(rsp->addr, g_dev_addr, BLE_DEV_ADDR_LEN);
+    memcpy(rsp->addr, ble_ll_addr_public_get(), BLE_DEV_ADDR_LEN);
 
     *rsplen = sizeof(*rsp);
+
     return BLE_ERR_SUCCESS;
 }
 
diff --git a/nimble/controller/src/ble_ll_hci_vs.c b/nimble/controller/src/ble_ll_hci_vs.c
index df8b688697..53690a438d 100644
--- a/nimble/controller/src/ble_ll_hci_vs.c
+++ b/nimble/controller/src/ble_ll_hci_vs.c
@@ -18,6 +18,8 @@
  */
 
 #include <stdint.h>
+#include <controller/ble_ll_addr.h>
+
 #include "syscfg/syscfg.h"
 #include "controller/ble_ll_utils.h"
 #include "controller/ble_ll.h"
@@ -42,17 +44,18 @@ ble_ll_hci_vs_rd_static_addr(uint16_t ocf,
                              uint8_t *rspbuf, uint8_t *rsplen)
 {
     struct ble_hci_vs_rd_static_addr_rp *rsp = (void *) rspbuf;
-    ble_addr_t addr;
 
     if (cmdlen != 0) {
         return BLE_ERR_INV_HCI_CMD_PARMS;
     }
 
-    if (ble_hw_get_static_addr(&addr) < 0) {
+#if MYNEWT_API_ble_addr_provider_static
+    if (ble_ll_addr_provide_static(rsp->addr) < 0) {
         return BLE_ERR_UNSPECIFIED;
     }
-
-    memcpy(rsp->addr, addr.val, sizeof(rsp->addr));
+#else
+    return BLE_ERR_UNSUPPORTED;
+#endif
 
     *rsplen = sizeof(*rsp);
 
@@ -387,6 +390,26 @@ ble_ll_hci_vs_set_scan_cfg(uint16_t ocf, const uint8_t *cmdbuf, uint8_t cmdlen,
 }
 #endif
 
+#if MYNEWT_VAL(BLE_LL_HCI_VS_WR_PUBLIC_ADDR)
+static int
+ble_ll_hci_vs_wr_public_addr(uint16_t ocf, const uint8_t *cmdbuf, uint8_t cmdlen,
+                             uint8_t *rspbuf, uint8_t *rsplen)
+{
+    const struct ble_hci_vs_wr_public_addr_cp *cp = (const void *)cmdbuf;
+    int rc;
+
+    if (cmdlen != sizeof(*cp)) {
+        return BLE_ERR_INV_HCI_CMD_PARMS;
+    }
+
+    if (ble_ll_addr_wr_public_addr(cp->addr)) {
+        return BLE_ERR_UNSPECIFIED;
+    }
+
+    return 0;
+}
+#endif
+
 static struct ble_ll_hci_vs_cmd g_ble_ll_hci_vs_cmds[] = {
     BLE_LL_HCI_VS_CMD(BLE_HCI_OCF_VS_RD_STATIC_ADDR,
                       ble_ll_hci_vs_rd_static_addr),
@@ -421,6 +444,10 @@ static struct ble_ll_hci_vs_cmd g_ble_ll_hci_vs_cmds[] = {
     BLE_LL_HCI_VS_CMD(BLE_HCI_OCF_VS_SET_SCAN_CFG,
                       ble_ll_hci_vs_set_scan_cfg)
 #endif
+#if MYNEWT_VAL(BLE_LL_HCI_VS_WR_PUBLIC_ADDR)
+    BLE_LL_HCI_VS_CMD(BLE_HCI_OCF_VS_WR_PUBLIC_ADDR,
+                      ble_ll_hci_vs_wr_public_addr)
+#endif
 };
 
 static struct ble_ll_hci_vs_cmd *
diff --git a/nimble/controller/src/ble_ll_resolv.c b/nimble/controller/src/ble_ll_resolv.c
index 3566876e09..707120a260 100644
--- a/nimble/controller/src/ble_ll_resolv.c
+++ b/nimble/controller/src/ble_ll_resolv.c
@@ -621,7 +621,7 @@ ble_ll_resolv_get_priv_addr(struct ble_ll_resolv_entry *rl, int local,
 }
 
 void
-ble_ll_resolv_set_peer_rpa(int index, uint8_t *rpa)
+ble_ll_resolv_set_peer_rpa(int index, const uint8_t *rpa)
 {
     os_sr_t sr;
     struct ble_ll_resolv_entry *rl;
@@ -633,7 +633,7 @@ ble_ll_resolv_set_peer_rpa(int index, uint8_t *rpa)
 }
 
 void
-ble_ll_resolv_set_local_rpa(int index, uint8_t *rpa)
+ble_ll_resolv_set_local_rpa(int index, const uint8_t *rpa)
 {
     os_sr_t sr;
     struct ble_ll_resolv_entry *rl;
diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c
index 0f73fd2e8c..de3fd5ff70 100644
--- a/nimble/controller/src/ble_ll_scan.c
+++ b/nimble/controller/src/ble_ll_scan.c
@@ -33,6 +33,7 @@
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 #include "controller/ble_ll_scan_aux.h"
 #endif
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_tmr.h"
 #include "controller/ble_ll_hci.h"
 #include "controller/ble_ll_whitelist.h"
@@ -242,7 +243,7 @@ ble_ll_scan_make_req_pdu(struct ble_ll_scan_sm *scansm, uint8_t *pdu,
                          uint8_t *hdr_byte, uint8_t adva_type,
                          const uint8_t *adva, int rpa_index)
 {
-    uint8_t *scana;
+    const uint8_t *scana;
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
     struct ble_ll_resolv_entry *rl;
     uint8_t rpa[BLE_DEV_ADDR_LEN];
@@ -257,9 +258,9 @@ ble_ll_scan_make_req_pdu(struct ble_ll_scan_sm *scansm, uint8_t *pdu,
     /* Determine ScanA */
     if (scansm->own_addr_type & 0x01) {
         *hdr_byte |= BLE_ADV_PDU_HDR_TXADD_RAND;
-        scana = g_random_addr;
+        scana = ble_ll_addr_random_get();
     } else {
-        scana = g_dev_addr;
+        scana = ble_ll_addr_public_get();
     }
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
@@ -391,7 +392,7 @@ ble_ll_scan_halt(void)
  * @return int 0: have not received a scan response; 1 otherwise.
  */
 int
-ble_ll_scan_have_rxd_scan_rsp(uint8_t *addr, uint8_t txadd,
+ble_ll_scan_have_rxd_scan_rsp(const uint8_t *addr, uint8_t txadd,
                               uint8_t ext_adv, uint16_t adi)
 {
     uint8_t num_advs;
@@ -435,7 +436,7 @@ ble_ll_scan_have_rxd_scan_rsp(uint8_t *addr, uint8_t txadd,
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 void
-ble_ll_scan_add_scan_rsp_adv(uint8_t *addr, uint8_t txadd,
+ble_ll_scan_add_scan_rsp_adv(const uint8_t *addr, uint8_t txadd,
                              uint8_t ext_adv, uint16_t adi)
 {
     uint8_t num_advs;
@@ -936,7 +937,7 @@ ble_ll_scan_sm_start(struct ble_ll_scan_sm *scansm)
     struct ble_ll_scan_phy *scanp;
     struct ble_ll_scan_phy *scanp_next;
 
-    if (!ble_ll_is_valid_own_addr_type(scansm->own_addr_type, g_random_addr)) {
+    if (!ble_ll_addr_is_valid_own_addr_type(scansm->own_addr_type, NULL)) {
         return BLE_ERR_INV_HCI_CMD_PARMS;
     }
 
@@ -1354,7 +1355,7 @@ ble_ll_scan_rx_filter(uint8_t own_addr_type, uint8_t scan_filt_policy,
 
             /* Ignore if not directed to us */
             if ((addrd->targeta_type != (own_addr_type & 0x01)) ||
-                !ble_ll_is_our_devaddr(addrd->targeta, addrd->targeta_type)) {
+                !ble_ll_addr_is_our(addrd->targeta_type, addrd->targeta)) {
                 return -1;
             }
             break;
@@ -1800,7 +1801,8 @@ ble_ll_scan_dup_new(void)
 }
 
 static int
-ble_ll_scan_dup_check_legacy(uint8_t addr_type, uint8_t *addr, uint8_t pdu_type)
+ble_ll_scan_dup_check_legacy(uint8_t addr_type, const uint8_t *addr,
+                             uint8_t pdu_type)
 {
     struct ble_ll_scan_dup_entry *e;
     uint8_t type;
@@ -1840,7 +1842,7 @@ ble_ll_scan_dup_check_legacy(uint8_t addr_type, uint8_t *addr, uint8_t pdu_type)
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 int
-ble_ll_scan_dup_check_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
+ble_ll_scan_dup_check_ext(uint8_t addr_type, const uint8_t *addr, bool has_aux,
                           uint16_t adi)
 {
     struct ble_ll_scan_dup_entry *e;
@@ -1889,7 +1891,7 @@ ble_ll_scan_dup_check_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
 }
 
 int
-ble_ll_scan_dup_update_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
+ble_ll_scan_dup_update_ext(uint8_t addr_type, const uint8_t *addr, bool has_aux,
                            uint16_t adi)
 {
     struct ble_ll_scan_dup_entry *e;
@@ -1942,7 +1944,7 @@ ble_ll_scan_rx_pkt_in_restore_addr_data(struct ble_mbuf_hdr *hdr,
     }
 
     if (hdr->rxinfo.flags & BLE_MBUF_HDR_F_TARGETA_RESOLVED) {
-        addrd->targeta = ble_ll_get_our_devaddr(scansm->own_addr_type & 1);
+        addrd->targeta = ble_ll_addr_get(scansm->own_addr_type & 1);
         addrd->targeta_type = scansm->own_addr_type & 1;
         addrd->targeta_resolved = 1;
     } else {
@@ -2010,7 +2012,7 @@ ble_ll_scan_rx_pkt_in(uint8_t ptype, struct os_mbuf *om, struct ble_mbuf_hdr *hd
     struct ble_mbuf_hdr_rxinfo *rxinfo = &hdr->rxinfo;
 #endif
 #if MYNEWT_VAL(BLE_LL_ROLE_CENTRAL)
-    uint8_t *targeta;
+    const uint8_t *targeta;
 #endif
     struct ble_ll_scan_sm *scansm;
     struct ble_ll_scan_addr_data addrd;
@@ -2710,7 +2712,7 @@ ble_ll_scan_get_local_rpa(void)
  * @param rpa
  */
 void
-ble_ll_scan_set_peer_rpa(uint8_t *rpa)
+ble_ll_scan_set_peer_rpa(const uint8_t *rpa)
 {
     struct ble_ll_scan_sm *scansm;
 
diff --git a/nimble/controller/src/ble_ll_scan_aux.c b/nimble/controller/src/ble_ll_scan_aux.c
index 0cb734a240..ca590fd0f9 100644
--- a/nimble/controller/src/ble_ll_scan_aux.c
+++ b/nimble/controller/src/ble_ll_scan_aux.c
@@ -32,6 +32,7 @@
 #include "controller/ble_phy.h"
 #include "controller/ble_hw.h"
 #include "controller/ble_ll.h"
+#include "controller/ble_ll_addr.h"
 #include "controller/ble_ll_pdu.h"
 #include "controller/ble_ll_sched.h"
 #include "controller/ble_ll_scan.h"
@@ -100,14 +101,14 @@ static struct ble_ll_scan_aux_data *aux_data_current;
 
 static void ble_ll_hci_ev_send_ext_adv_truncated_report(struct ble_ll_scan_aux_data *aux);
 
-static inline uint8_t *
+static const uint8_t *
 ble_ll_scan_aux_get_own_addr(void)
 {
     uint8_t own_addr_type;
 
     own_addr_type = ble_ll_scan_get_own_addr_type() & 1;
 
-    return ble_ll_get_our_devaddr(own_addr_type);
+    return ble_ll_addr_get(own_addr_type);
 }
 
 static int
diff --git a/nimble/controller/src/ble_ll_whitelist.c b/nimble/controller/src/ble_ll_whitelist.c
index 12d841a7f8..722c9d6c87 100644
--- a/nimble/controller/src/ble_ll_whitelist.c
+++ b/nimble/controller/src/ble_ll_whitelist.c
@@ -164,7 +164,7 @@ ble_ll_whitelist_search(const uint8_t *addr, uint8_t addr_type)
  * @return int
  */
 int
-ble_ll_whitelist_match(uint8_t *addr, uint8_t addr_type, int is_ident)
+ble_ll_whitelist_match(const uint8_t *addr, uint8_t addr_type, int is_ident)
 {
     int rc;
 #if (BLE_USES_HW_WHITELIST == 1)
diff --git a/nimble/controller/syscfg.defunct.yml b/nimble/controller/syscfg.defunct.yml
index 239861287f..7ed3e6da31 100644
--- a/nimble/controller/syscfg.defunct.yml
+++ b/nimble/controller/syscfg.defunct.yml
@@ -34,10 +34,6 @@ syscfg.defs:
         description: use BLE_LL_HCI_VS_EVENT_ON_ASSERT
         value: 0
         deprecated: 1
-    BLE_PUBLIC_DEV_ADDR:
-        description: use BLE_LL_PUBLIC_DEV_ADDR
-        value: "(uint8_t[6]){0x00, 0x00, 0x00, 0x00, 0x00, 0x00}"
-        deprecated: 1
     BLE_LL_EXT_ADV_AUX_PTR_CNT:
         description: use BLE_LL_SCAN_AUX_SEGMENT_CNT
         value: 0
@@ -104,3 +100,7 @@ syscfg.defs:
         description: Superseded by BLE_LL_CONN_STRICT_SCHED
         value: 0
         defunct: 1
+    BLE_PUBLIC_DEV_ADDR:
+        description: use BLE_LL_PUBLIC_DEV_ADDR
+        value: "(uint8_t[6]){0x00, 0x00, 0x00, 0x00, 0x00, 0x00}"
+        defunct: 1
diff --git a/nimble/controller/syscfg.yml b/nimble/controller/syscfg.yml
index 1e830dbecb..946e53a62a 100644
--- a/nimble/controller/syscfg.yml
+++ b/nimble/controller/syscfg.yml
@@ -395,6 +395,12 @@ syscfg.defs:
                   not intended for production builds.
         value: 0x000000000000
 
+    BLE_LL_ADDR_INIT_RANDOM:
+        description: >
+            Initializes default random address with a static random address
+            retrieved from an address provider, if available.
+        value: 0
+
     BLE_LL_DTM:
         description: >
              Enables HCI Test commands needed for Bluetooth SIG certification
@@ -450,7 +456,14 @@ syscfg.defs:
             - BLE_LL_HCI_VS if 1
             - BLE_LL_CFG_FEAT_LL_EXT_ADV if 1
             - BLE_LL_ROLE_OBSERVER if 1
-
+    BLE_LL_HCI_VS_WR_PUBLIC_ADDR:
+        description: >
+            Enables HCI command to set public device address.
+            The new address is applied after HCI Reset. To revert back to the
+            default public address, set address to 0x000000000000.
+        value: 0
+        restrictions:
+            - BLE_LL_HCI_VS if 1
 
     BLE_LL_HCI_VS_EVENT_ON_ASSERT:
         description: >
diff --git a/nimble/drivers/dialog_cmac/src/ble_hw.c b/nimble/drivers/dialog_cmac/src/ble_hw.c
index 195dcd35dd..4df5c0f729 100644
--- a/nimble/drivers/dialog_cmac/src/ble_hw.c
+++ b/nimble/drivers/dialog_cmac/src/ble_hw.c
@@ -77,18 +77,6 @@ struct ble_hw_resolv_proc {
 static struct ble_hw_resolv_list g_ble_hw_resolv_list;
 static struct ble_hw_resolv_proc g_ble_hw_resolv_proc;
 
-int
-ble_hw_get_public_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
-int
-ble_hw_get_static_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
 void
 ble_hw_whitelist_clear(void)
 {
diff --git a/nimble/drivers/native/src/ble_hw.c b/nimble/drivers/native/src/ble_hw.c
index 8aa29d322b..e367f6b62e 100644
--- a/nimble/drivers/native/src/ble_hw.c
+++ b/nimble/drivers/native/src/ble_hw.c
@@ -37,20 +37,6 @@ static uint8_t g_ble_hw_whitelist_mask;
 static ble_rng_isr_cb_t rng_cb;
 static bool rng_started;
 
-/* Returns public device address or -1 if not present */
-int
-ble_hw_get_public_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
-/* Returns random static address or -1 if not present */
-int
-ble_hw_get_static_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
 /**
  * Clear the whitelist
  *
diff --git a/nimble/drivers/nrf51/pkg.yml b/nimble/drivers/nrf51/pkg.yml
index 9311093b9c..f1a931ff15 100644
--- a/nimble/drivers/nrf51/pkg.yml
+++ b/nimble/drivers/nrf51/pkg.yml
@@ -25,10 +25,16 @@ pkg.keywords:
     - ble
     - bluetooth
 
-pkg.apis: ble_driver
 pkg.deps:
     - nimble
     - nimble/controller
 
+pkg.apis:
+    - ble_driver
+pkg.apis.BLE_PHY_ADDR_PROVIDER_PUBLIC:
+    - ble_addr_provider_public
+pkg.apis.BLE_PHY_ADDR_PROVIDER_STATIC:
+    - ble_addr_provider_static
+
 # allows to override nimble/controller settings
 pkg.subpriority: 1
diff --git a/nimble/drivers/nrf51/src/ble_hw.c b/nimble/drivers/nrf51/src/ble_hw.c
index fb6e844b0f..e77c2c4def 100644
--- a/nimble/drivers/nrf51/src/ble_hw.c
+++ b/nimble/drivers/nrf51/src/ble_hw.c
@@ -62,52 +62,47 @@ uint8_t g_nrf_num_irks;
 
 #endif
 
-/* Returns public device address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_PUBLIC)
 int
-ble_hw_get_public_addr(ble_addr_t *addr)
+ble_ll_addr_provide_public(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
 
-    /* Does FICR have a public address */
     if ((NRF_FICR->DEVICEADDRTYPE & 1) != 0) {
         return -1;
     }
 
-    /* Copy into device address. We can do this because we know platform */
     addr_low = NRF_FICR->DEVICEADDR[0];
     addr_high = NRF_FICR->DEVICEADDR[1];
-    memcpy(addr->val, &addr_low, 4);
-    memcpy(&addr->val[4], &addr_high, 2);
-    addr->type = BLE_ADDR_PUBLIC;
+
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
     return 0;
 }
+#endif
 
-/* Returns random static address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_STATIC)
 int
-ble_hw_get_static_addr(ble_addr_t *addr)
+ble_ll_addr_provide_static(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
-    int rc;
 
-    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 1) {
-        addr_low = NRF_FICR->DEVICEADDR[0];
-        addr_high = NRF_FICR->DEVICEADDR[1];
+    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 0) {
+        return -1;
+    }
 
-        memcpy(addr->val, &addr_low, 4);
-        memcpy(&addr->val[4], &addr_high, 2);
+    addr_low = NRF_FICR->DEVICEADDR[0];
+    addr_high = NRF_FICR->DEVICEADDR[1];
 
-        addr->val[5] |= 0xc0;
-        addr->type = BLE_ADDR_RANDOM;
-        rc = 0;
-    } else {
-        rc = -1;
-    }
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
-    return rc;
+    return 0;
 }
+#endif
 
 /**
  * Clear the whitelist
diff --git a/nimble/drivers/nrf51/syscfg.yml b/nimble/drivers/nrf51/syscfg.yml
index 451742a61a..05ef8419a0 100644
--- a/nimble/drivers/nrf51/syscfg.yml
+++ b/nimble/drivers/nrf51/syscfg.yml
@@ -16,6 +16,13 @@
 # under the License.
 #
 
+syscfg.defs:
+    BLE_PHY_ADDR_PROVIDER_PUBLIC:
+        description: Enables public address provider API
+        value: 0
+    BLE_PHY_ADDR_PROVIDER_STATIC:
+        description: Enables static address provider API
+        value: 1
 
 syscfg.vals.!BLE_LL_CFG_FEAT_LL_EXT_ADV:
     BLE_LL_STACK_SIZE: 96
diff --git a/nimble/drivers/nrf5x/pkg.yml b/nimble/drivers/nrf5x/pkg.yml
index b99e669248..2d6e7b15e9 100644
--- a/nimble/drivers/nrf5x/pkg.yml
+++ b/nimble/drivers/nrf5x/pkg.yml
@@ -25,11 +25,17 @@ pkg.keywords:
     - ble
     - bluetooth
 
-pkg.apis: ble_driver
 pkg.deps:
     - nimble
     - nimble/controller
 
+pkg.apis:
+    - ble_driver
+pkg.apis.BLE_PHY_ADDR_PROVIDER_PUBLIC:
+    - ble_addr_provider_public
+pkg.apis.BLE_PHY_ADDR_PROVIDER_STATIC:
+    - ble_addr_provider_static
+
 pkg.ign_dirs.'MCU_TARGET=="nRF5340_NET"':
     - nrf52
 pkg.ign_dirs.'MCU_TARGET!="nRF5340_NET"':
diff --git a/nimble/drivers/nrf5x/src/ble_hw.c b/nimble/drivers/nrf5x/src/ble_hw.c
index 9a46fa6c85..17c840952f 100644
--- a/nimble/drivers/nrf5x/src/ble_hw.c
+++ b/nimble/drivers/nrf5x/src/ble_hw.c
@@ -70,70 +70,47 @@ uint8_t g_nrf_num_irks;
 
 #endif
 
-/* Returns public device address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_PUBLIC)
 int
-ble_hw_get_public_addr(ble_addr_t *addr)
+ble_ll_addr_provide_public(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
 
-#if MYNEWT_VAL(BLE_PHY_UBLOX_BMD345_PUBLIC_ADDR)
-    /*
-    * The BMD-345 modules are preprogrammed from the factory with a unique public
-    * The  Bluetooth device address stored in the CUSTOMER[0] and CUSTOMER[1]
-    * registers of the User Information Configuration Registers (UICR).
-    * The Bluetooth device address consists of the IEEE Organizationally Unique
-    * Identifier (OUI) combined with the hexadecimal digits that are printed on
-    * a 2D barcode and in human-readable text on the module label.The Bluetooth
-    * device address is stored in little endian format. The most significant
-    * bytes of the CUSTOMER[1] register are 0xFF to complete the 32-bit register.
-    */
-
-    /* Copy into device address. We can do this because we know platform */
-    addr_low = NRF_UICR->CUSTOMER[0];
-    addr_high = NRF_UICR->CUSTOMER[1];
-#else
-    /* Does FICR have a public address */
     if ((NRF_FICR->DEVICEADDRTYPE & 1) != 0) {
         return -1;
     }
 
-    /* Copy into device address. We can do this because we know platform */
     addr_low = NRF_FICR->DEVICEADDR[0];
     addr_high = NRF_FICR->DEVICEADDR[1];
-#endif
 
-    memcpy(addr->val, &addr_low, 4);
-    memcpy(&addr->val[4], &addr_high, 2);
-    addr->type = BLE_ADDR_PUBLIC;
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
     return 0;
 }
+#endif
 
-/* Returns random static address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_STATIC)
 int
-ble_hw_get_static_addr(ble_addr_t *addr)
+ble_ll_addr_provide_static(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
-    int rc;
 
-    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 1) {
-        addr_low = NRF_FICR->DEVICEADDR[0];
-        addr_high = NRF_FICR->DEVICEADDR[1];
+    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 0) {
+        return -1;
+    }
 
-        memcpy(addr->val, &addr_low, 4);
-        memcpy(&addr->val[4], &addr_high, 2);
+    addr_low = NRF_FICR->DEVICEADDR[0];
+    addr_high = NRF_FICR->DEVICEADDR[1];
 
-        addr->val[5] |= 0xc0;
-        addr->type = BLE_ADDR_RANDOM;
-        rc = 0;
-    } else {
-        rc = -1;
-    }
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
-    return rc;
+    return 0;
 }
+#endif
 
 /**
  * Clear the whitelist
diff --git a/nimble/drivers/nrf5x/syscfg.yml b/nimble/drivers/nrf5x/syscfg.yml
index f5a227305c..3699c0ba2b 100644
--- a/nimble/drivers/nrf5x/syscfg.yml
+++ b/nimble/drivers/nrf5x/syscfg.yml
@@ -83,11 +83,16 @@ syscfg.defs:
        value: 0
 
     BLE_PHY_UBLOX_BMD345_PUBLIC_ADDR:
-        description: >
-            Ublox BMD-345 modules come with public address preprogrammed
-            in UICR register. If enabled public address will be read from
-            custom UICR instead of FICR register.
+        description: use nimble/util/addr_ublox package instead
+        value: 0
+        defunct: 1
+
+    BLE_PHY_ADDR_PROVIDER_PUBLIC:
+        description: Enables public address provider API
         value: 0
+    BLE_PHY_ADDR_PROVIDER_STATIC:
+        description: Enables static address provider API
+        value: 1
 
 syscfg.restrictions:
     # code supports turn on times up to 90us due to some optimizations, but it
diff --git a/nimble/include/nimble/ble.h b/nimble/include/nimble/ble.h
index d5e41a37c8..4bc832ffb0 100644
--- a/nimble/include/nimble/ble.h
+++ b/nimble/include/nimble/ble.h
@@ -220,12 +220,6 @@ struct ble_mbuf_hdr
 /** Length of a Bluetooth Device Address. */
 #define BLE_DEV_ADDR_LEN        (6)
 
-/**
- * @cond INTERNAL_DOCS
- */
-extern uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
-extern uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
-
 /* BLE Error Codes (Core v4.2 Vol 2 part D) */
 enum ble_error_codes
 {
diff --git a/nimble/include/nimble/hci_common.h b/nimble/include/nimble/hci_common.h
index 24843de3c2..cefc2c5a2c 100644
--- a/nimble/include/nimble/hci_common.h
+++ b/nimble/include/nimble/hci_common.h
@@ -1406,6 +1406,12 @@ struct ble_hci_vs_set_scan_cfg_cp {
     int8_t rssi_threshold;
 } __attribute__((packed));
 
+/* Set Public Bluetooth Address */
+#define BLE_HCI_OCF_VS_WR_PUBLIC_ADDR                   (MYNEWT_VAL(BLE_HCI_VS_OCF_OFFSET) + (0x000C))
+struct ble_hci_vs_wr_public_addr_cp {
+    uint8_t addr[6];
+} __attribute__((packed));
+
 /* Command Specific Definitions */
 /* --- Set controller to host flow control (OGF 0x03, OCF 0x0031) --- */
 #define BLE_HCI_CTLR_TO_HOST_FC_OFF         (0)
diff --git a/nimble/util/addr_ublox/pkg.yml b/nimble/util/addr_ublox/pkg.yml
new file mode 100644
index 0000000000..143894b179
--- /dev/null
+++ b/nimble/util/addr_ublox/pkg.yml
@@ -0,0 +1,26 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+pkg.name: nimble/util/addr_ublox
+pkg.description: Public address provider for u-blox modules
+pkg.author: "Apache Mynewt <dev@mynewt.apache.org>"
+pkg.homepage: "https://mynewt.apache.org/"
+
+pkg.apis:
+    - ble_addr_provider_public
diff --git a/nimble/util/addr_ublox/src/addr_ublox.c b/nimble/util/addr_ublox/src/addr_ublox.c
new file mode 100644
index 0000000000..28c59d72b6
--- /dev/null
+++ b/nimble/util/addr_ublox/src/addr_ublox.c
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include <stdint.h>
+#include <nrfx.h>
+
+int
+ble_ll_addr_provide_public(uint8_t *addr)
+{
+    uint32_t addr_high;
+    uint32_t addr_low;
+
+    /* The u-blox modules are preprogrammed from the factory with a unique public
+     * device address. The address is stored in the CUSTOMER[0] and CUSTOMER[1]
+     * registers of the UICR in little endian format. The most significant bytes
+     * of the CUSTOMER[1] register are 0xFF to complete the 32-bit register value.
+     *
+     * The Bluetooth device address consists of the registered OUI combined with
+     * the hexadecimal digits printed on a 2D barcode and as a human-readable
+     * text on the module label.
+     */
+
+    addr_low = NRF_UICR->CUSTOMER[0];
+    addr_high = NRF_UICR->CUSTOMER[1];
+
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
+
+    return 0;
+}