From 8ea7fe0df95afb674240e831ae1fa6d8b10fc98e Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 12:47:23 +0100
Subject: [PATCH 1/7] nimble/ll: Introduce ble_ll_addr

This introduces new ble_ll_addr module which should be used to keep
track of addressed used by NimBLE LL.

For now we just move globals g_dev_addr and g_random_addr to this file,
but eventually those variables should be static and accessed only via
setters and getters.
---
 .../include/controller/ble_ll_addr.h          | 33 +++++++++
 nimble/controller/src/ble_ll.c                | 42 ++----------
 nimble/controller/src/ble_ll_addr.c           | 68 +++++++++++++++++++
 3 files changed, 105 insertions(+), 38 deletions(-)
 create mode 100644 nimble/controller/include/controller/ble_ll_addr.h
 create mode 100644 nimble/controller/src/ble_ll_addr.c

diff --git a/nimble/controller/include/controller/ble_ll_addr.h b/nimble/controller/include/controller/ble_ll_addr.h
new file mode 100644
index 0000000000..f28186c25f
--- /dev/null
+++ b/nimble/controller/include/controller/ble_ll_addr.h
@@ -0,0 +1,33 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#ifndef H_BLE_LL_ADDR_
+#define H_BLE_LL_ADDR_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int ble_ll_addr_init(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* H_BLE_LL_ADDR_ */
diff --git a/nimble/controller/src/ble_ll.c b/nimble/controller/src/ble_ll.c
index a0d6dbbc03..3cea0f97e0 100644
--- a/nimble/controller/src/ble_ll.c
+++ b/nimble/controller/src/ble_ll.c
@@ -45,6 +45,7 @@
 #include "controller/ble_ll_rfmgmt.h"
 #include "controller/ble_ll_trace.h"
 #include "controller/ble_ll_sync.h"
+#include "controller/ble_ll_addr.h"
 #include "controller/ble_fem.h"
 #if MYNEWT_VAL(BLE_LL_ISO)
 #include "controller/ble_ll_iso.h"
@@ -392,12 +393,6 @@ OS_TASK_STACK_DEFINE(g_ble_ll_stack, MYNEWT_VAL(BLE_LL_STACK_SIZE));
 
 #endif /* MYNEWT */
 
-/** Our global device address (public) */
-uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
-
-/** Our random address */
-uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
-
 /**
  * Counts the number of advertising PDU's received, by type. For advertising
  * PDU's that contain a destination address, we still count these packets even
@@ -1677,8 +1672,8 @@ ble_ll_reset(void)
     /* Set state to standby */
     ble_ll_state_set(BLE_LL_STATE_STANDBY);
 
-    /* Reset our random address */
-    memset(g_random_addr, 0, BLE_DEV_ADDR_LEN);
+    /* Initialize addresses */
+    ble_ll_addr_init();
 
     /* Clear the whitelist */
     ble_ll_whitelist_clear();
@@ -1758,12 +1753,6 @@ ble_ll_pdu_max_tx_octets_get(uint32_t usecs, int phy_mode)
     return MAX(27, octets);
 }
 
-static inline bool
-ble_ll_is_addr_empty(const uint8_t *addr)
-{
-    return memcmp(addr, BLE_ADDR_ANY, BLE_DEV_ADDR_LEN) == 0;
-}
-
 #if MYNEWT_VAL(BLE_LL_HCI_VS_EVENT_ON_ASSERT)
 void
 ble_ll_assert(const char *file, unsigned line)
@@ -1788,11 +1777,6 @@ ble_ll_init(void)
 {
     int rc;
     uint64_t features;
-#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
-    uint64_t pub_dev_addr;
-    int i;
-#endif
-    ble_addr_t addr;
     struct ble_ll_obj *lldata;
 
     /* Ensure this function only gets called by sysinit. */
@@ -1801,25 +1785,7 @@ ble_ll_init(void)
     ble_ll_trace_init();
     ble_phy_trace_init();
 
-    /* Set public device address if not already set */
-    if (ble_ll_is_addr_empty(g_dev_addr)) {
-#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
-        pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
-
-        for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
-            g_dev_addr[i] = pub_dev_addr & 0xff;
-            pub_dev_addr >>= 8;
-        }
-#else
-        memcpy(g_dev_addr, MYNEWT_VAL(BLE_PUBLIC_DEV_ADDR), BLE_DEV_ADDR_LEN);
-#endif
-        if (ble_ll_is_addr_empty(g_dev_addr)) {
-            rc = ble_hw_get_public_addr(&addr);
-            if (!rc) {
-                memcpy(g_dev_addr, &addr.val[0], BLE_DEV_ADDR_LEN);
-            }
-        }
-    }
+    ble_ll_addr_init();
 
     ble_ll_rfmgmt_init();
 
diff --git a/nimble/controller/src/ble_ll_addr.c b/nimble/controller/src/ble_ll_addr.c
new file mode 100644
index 0000000000..cc8e2d2934
--- /dev/null
+++ b/nimble/controller/src/ble_ll_addr.c
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include <stdint.h>
+#include <syscfg/syscfg.h>
+#include <controller/ble_ll.h>
+#include <controller/ble_hw.h>
+
+/* FIXME: both should be static and accessible only via dedicated set/get APIs;
+ *        extern declared in nimble/ble.h should be removed
+ */
+uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
+uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
+
+static bool
+ble_ll_addr_is_empty(const uint8_t *addr)
+{
+    return memcmp(addr, BLE_ADDR_ANY, BLE_DEV_ADDR_LEN) == 0;
+}
+
+int
+ble_ll_addr_init(void)
+{
+#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
+    uint64_t pub_dev_addr;
+    int i;
+#endif
+    ble_addr_t addr;
+    int rc;
+
+    /* Set public device address if not already set */
+    if (ble_ll_addr_is_empty(g_dev_addr)) {
+#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
+        pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
+
+        for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
+            g_dev_addr[i] = pub_dev_addr & 0xff;
+            pub_dev_addr >>= 8;
+        }
+#else
+        memcpy(g_dev_addr, MYNEWT_VAL(BLE_PUBLIC_DEV_ADDR), BLE_DEV_ADDR_LEN);
+#endif
+        if (ble_ll_addr_is_empty(g_dev_addr)) {
+            rc = ble_hw_get_public_addr(&addr);
+            if (!rc) {
+                memcpy(g_dev_addr, &addr.val[0], BLE_DEV_ADDR_LEN);
+            }
+        }
+    }
+
+    return 0;
+}

From 1ed7dab56f8e061a22954fb2dad09bae03268999 Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 14:38:44 +0100
Subject: [PATCH 2/7] nimble/ll: Add address provider APIs

This adds 2 new APIs that can be implemented by packages: provide public
or static device address. This allows for better support of provisioning
of Bluetooth devices address on different devices.

The nrf5x driver can act as a provider of both public and static address
which is configurable by syscfg settings. By default provider for a
static address is enabled since all nRF5x have factory programmed random
address in FICR registers. The provider for a public address can be
optionally enabled since the same registers can be also be factory
programmed with a public address (on request).
---
 nimble/controller/include/controller/ble_hw.h |  6 ---
 .../include/controller/ble_ll_addr.h          |  6 +++
 nimble/controller/src/ble_ll_addr.c           | 40 ++++++-------------
 nimble/controller/src/ble_ll_hci_vs.c         | 11 +++--
 nimble/controller/syscfg.defunct.yml          |  8 ++--
 nimble/drivers/dialog_cmac/src/ble_hw.c       | 12 ------
 nimble/drivers/native/src/ble_hw.c            | 14 -------
 nimble/drivers/nrf51/pkg.yml                  |  8 +++-
 nimble/drivers/nrf51/src/ble_hw.c             | 39 ++++++++----------
 nimble/drivers/nrf51/syscfg.yml               |  7 ++++
 nimble/drivers/nrf5x/pkg.yml                  |  8 +++-
 nimble/drivers/nrf5x/src/ble_hw.c             | 38 ++++++++----------
 nimble/drivers/nrf5x/syscfg.yml               |  8 ++++
 13 files changed, 91 insertions(+), 114 deletions(-)

diff --git a/nimble/controller/include/controller/ble_hw.h b/nimble/controller/include/controller/ble_hw.h
index 394c3a173c..d2549fd6d2 100644
--- a/nimble/controller/include/controller/ble_hw.h
+++ b/nimble/controller/include/controller/ble_hw.h
@@ -97,12 +97,6 @@ uint8_t ble_hw_resolv_list_size(void);
 /* Returns index of resolved address; -1 if not resolved */
 int ble_hw_resolv_list_match(void);
 
-/* Returns public device address or -1 if not present */
-int ble_hw_get_public_addr(ble_addr_t *addr);
-
-/* Returns random static address or -1 if not present */
-int ble_hw_get_static_addr(ble_addr_t *addr);
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/nimble/controller/include/controller/ble_ll_addr.h b/nimble/controller/include/controller/ble_ll_addr.h
index f28186c25f..d6779fc68c 100644
--- a/nimble/controller/include/controller/ble_ll_addr.h
+++ b/nimble/controller/include/controller/ble_ll_addr.h
@@ -26,6 +26,12 @@ extern "C" {
 
 int ble_ll_addr_init(void);
 
+/* Address provider APIs - should be implemented by packages supporting
+ * relevant APIs
+ */
+int ble_ll_addr_provide_public(uint8_t *addr);
+int ble_ll_addr_provide_static(uint8_t *addr);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/nimble/controller/src/ble_ll_addr.c b/nimble/controller/src/ble_ll_addr.c
index cc8e2d2934..a431a795db 100644
--- a/nimble/controller/src/ble_ll_addr.c
+++ b/nimble/controller/src/ble_ll_addr.c
@@ -20,7 +20,7 @@
 #include <stdint.h>
 #include <syscfg/syscfg.h>
 #include <controller/ble_ll.h>
-#include <controller/ble_hw.h>
+#include <controller/ble_ll_addr.h>
 
 /* FIXME: both should be static and accessible only via dedicated set/get APIs;
  *        extern declared in nimble/ble.h should be removed
@@ -28,41 +28,25 @@
 uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
 uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
 
-static bool
-ble_ll_addr_is_empty(const uint8_t *addr)
-{
-    return memcmp(addr, BLE_ADDR_ANY, BLE_DEV_ADDR_LEN) == 0;
-}
-
 int
 ble_ll_addr_init(void)
 {
-#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
     uint64_t pub_dev_addr;
     int i;
-#endif
-    ble_addr_t addr;
-    int rc;
 
-    /* Set public device address if not already set */
-    if (ble_ll_addr_is_empty(g_dev_addr)) {
-#if MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR)
-        pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
+    /* Set public device address from syscfg. It should be all-zero in normal
+     * build so no need to add special check for that.
+     */
+    pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
+    for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
+        g_dev_addr[i] = pub_dev_addr & 0xff;
+        pub_dev_addr >>= 8;
+    }
 
-        for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
-            g_dev_addr[i] = pub_dev_addr & 0xff;
-            pub_dev_addr >>= 8;
-        }
-#else
-        memcpy(g_dev_addr, MYNEWT_VAL(BLE_PUBLIC_DEV_ADDR), BLE_DEV_ADDR_LEN);
+    /* Set public address from provider API, if available */
+#if MYNEWT_API_ble_addr_provider_public
+    ble_ll_addr_provide_public(g_dev_addr);
 #endif
-        if (ble_ll_addr_is_empty(g_dev_addr)) {
-            rc = ble_hw_get_public_addr(&addr);
-            if (!rc) {
-                memcpy(g_dev_addr, &addr.val[0], BLE_DEV_ADDR_LEN);
-            }
-        }
-    }
 
     return 0;
 }
diff --git a/nimble/controller/src/ble_ll_hci_vs.c b/nimble/controller/src/ble_ll_hci_vs.c
index df8b688697..b1560bd71e 100644
--- a/nimble/controller/src/ble_ll_hci_vs.c
+++ b/nimble/controller/src/ble_ll_hci_vs.c
@@ -18,6 +18,8 @@
  */
 
 #include <stdint.h>
+#include <controller/ble_ll_addr.h>
+
 #include "syscfg/syscfg.h"
 #include "controller/ble_ll_utils.h"
 #include "controller/ble_ll.h"
@@ -42,17 +44,18 @@ ble_ll_hci_vs_rd_static_addr(uint16_t ocf,
                              uint8_t *rspbuf, uint8_t *rsplen)
 {
     struct ble_hci_vs_rd_static_addr_rp *rsp = (void *) rspbuf;
-    ble_addr_t addr;
 
     if (cmdlen != 0) {
         return BLE_ERR_INV_HCI_CMD_PARMS;
     }
 
-    if (ble_hw_get_static_addr(&addr) < 0) {
+#if MYNEWT_API_ble_addr_provider_static
+    if (ble_ll_addr_provide_static(rsp->addr) < 0) {
         return BLE_ERR_UNSPECIFIED;
     }
-
-    memcpy(rsp->addr, addr.val, sizeof(rsp->addr));
+#else
+    return BLE_ERR_UNSUPPORTED;
+#endif
 
     *rsplen = sizeof(*rsp);
 
diff --git a/nimble/controller/syscfg.defunct.yml b/nimble/controller/syscfg.defunct.yml
index 239861287f..7ed3e6da31 100644
--- a/nimble/controller/syscfg.defunct.yml
+++ b/nimble/controller/syscfg.defunct.yml
@@ -34,10 +34,6 @@ syscfg.defs:
         description: use BLE_LL_HCI_VS_EVENT_ON_ASSERT
         value: 0
         deprecated: 1
-    BLE_PUBLIC_DEV_ADDR:
-        description: use BLE_LL_PUBLIC_DEV_ADDR
-        value: "(uint8_t[6]){0x00, 0x00, 0x00, 0x00, 0x00, 0x00}"
-        deprecated: 1
     BLE_LL_EXT_ADV_AUX_PTR_CNT:
         description: use BLE_LL_SCAN_AUX_SEGMENT_CNT
         value: 0
@@ -104,3 +100,7 @@ syscfg.defs:
         description: Superseded by BLE_LL_CONN_STRICT_SCHED
         value: 0
         defunct: 1
+    BLE_PUBLIC_DEV_ADDR:
+        description: use BLE_LL_PUBLIC_DEV_ADDR
+        value: "(uint8_t[6]){0x00, 0x00, 0x00, 0x00, 0x00, 0x00}"
+        defunct: 1
diff --git a/nimble/drivers/dialog_cmac/src/ble_hw.c b/nimble/drivers/dialog_cmac/src/ble_hw.c
index 195dcd35dd..4df5c0f729 100644
--- a/nimble/drivers/dialog_cmac/src/ble_hw.c
+++ b/nimble/drivers/dialog_cmac/src/ble_hw.c
@@ -77,18 +77,6 @@ struct ble_hw_resolv_proc {
 static struct ble_hw_resolv_list g_ble_hw_resolv_list;
 static struct ble_hw_resolv_proc g_ble_hw_resolv_proc;
 
-int
-ble_hw_get_public_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
-int
-ble_hw_get_static_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
 void
 ble_hw_whitelist_clear(void)
 {
diff --git a/nimble/drivers/native/src/ble_hw.c b/nimble/drivers/native/src/ble_hw.c
index 8aa29d322b..e367f6b62e 100644
--- a/nimble/drivers/native/src/ble_hw.c
+++ b/nimble/drivers/native/src/ble_hw.c
@@ -37,20 +37,6 @@ static uint8_t g_ble_hw_whitelist_mask;
 static ble_rng_isr_cb_t rng_cb;
 static bool rng_started;
 
-/* Returns public device address or -1 if not present */
-int
-ble_hw_get_public_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
-/* Returns random static address or -1 if not present */
-int
-ble_hw_get_static_addr(ble_addr_t *addr)
-{
-    return -1;
-}
-
 /**
  * Clear the whitelist
  *
diff --git a/nimble/drivers/nrf51/pkg.yml b/nimble/drivers/nrf51/pkg.yml
index 9311093b9c..f1a931ff15 100644
--- a/nimble/drivers/nrf51/pkg.yml
+++ b/nimble/drivers/nrf51/pkg.yml
@@ -25,10 +25,16 @@ pkg.keywords:
     - ble
     - bluetooth
 
-pkg.apis: ble_driver
 pkg.deps:
     - nimble
     - nimble/controller
 
+pkg.apis:
+    - ble_driver
+pkg.apis.BLE_PHY_ADDR_PROVIDER_PUBLIC:
+    - ble_addr_provider_public
+pkg.apis.BLE_PHY_ADDR_PROVIDER_STATIC:
+    - ble_addr_provider_static
+
 # allows to override nimble/controller settings
 pkg.subpriority: 1
diff --git a/nimble/drivers/nrf51/src/ble_hw.c b/nimble/drivers/nrf51/src/ble_hw.c
index fb6e844b0f..e77c2c4def 100644
--- a/nimble/drivers/nrf51/src/ble_hw.c
+++ b/nimble/drivers/nrf51/src/ble_hw.c
@@ -62,52 +62,47 @@ uint8_t g_nrf_num_irks;
 
 #endif
 
-/* Returns public device address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_PUBLIC)
 int
-ble_hw_get_public_addr(ble_addr_t *addr)
+ble_ll_addr_provide_public(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
 
-    /* Does FICR have a public address */
     if ((NRF_FICR->DEVICEADDRTYPE & 1) != 0) {
         return -1;
     }
 
-    /* Copy into device address. We can do this because we know platform */
     addr_low = NRF_FICR->DEVICEADDR[0];
     addr_high = NRF_FICR->DEVICEADDR[1];
-    memcpy(addr->val, &addr_low, 4);
-    memcpy(&addr->val[4], &addr_high, 2);
-    addr->type = BLE_ADDR_PUBLIC;
+
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
     return 0;
 }
+#endif
 
-/* Returns random static address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_STATIC)
 int
-ble_hw_get_static_addr(ble_addr_t *addr)
+ble_ll_addr_provide_static(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
-    int rc;
 
-    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 1) {
-        addr_low = NRF_FICR->DEVICEADDR[0];
-        addr_high = NRF_FICR->DEVICEADDR[1];
+    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 0) {
+        return -1;
+    }
 
-        memcpy(addr->val, &addr_low, 4);
-        memcpy(&addr->val[4], &addr_high, 2);
+    addr_low = NRF_FICR->DEVICEADDR[0];
+    addr_high = NRF_FICR->DEVICEADDR[1];
 
-        addr->val[5] |= 0xc0;
-        addr->type = BLE_ADDR_RANDOM;
-        rc = 0;
-    } else {
-        rc = -1;
-    }
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
-    return rc;
+    return 0;
 }
+#endif
 
 /**
  * Clear the whitelist
diff --git a/nimble/drivers/nrf51/syscfg.yml b/nimble/drivers/nrf51/syscfg.yml
index 451742a61a..05ef8419a0 100644
--- a/nimble/drivers/nrf51/syscfg.yml
+++ b/nimble/drivers/nrf51/syscfg.yml
@@ -16,6 +16,13 @@
 # under the License.
 #
 
+syscfg.defs:
+    BLE_PHY_ADDR_PROVIDER_PUBLIC:
+        description: Enables public address provider API
+        value: 0
+    BLE_PHY_ADDR_PROVIDER_STATIC:
+        description: Enables static address provider API
+        value: 1
 
 syscfg.vals.!BLE_LL_CFG_FEAT_LL_EXT_ADV:
     BLE_LL_STACK_SIZE: 96
diff --git a/nimble/drivers/nrf5x/pkg.yml b/nimble/drivers/nrf5x/pkg.yml
index b99e669248..2d6e7b15e9 100644
--- a/nimble/drivers/nrf5x/pkg.yml
+++ b/nimble/drivers/nrf5x/pkg.yml
@@ -25,11 +25,17 @@ pkg.keywords:
     - ble
     - bluetooth
 
-pkg.apis: ble_driver
 pkg.deps:
     - nimble
     - nimble/controller
 
+pkg.apis:
+    - ble_driver
+pkg.apis.BLE_PHY_ADDR_PROVIDER_PUBLIC:
+    - ble_addr_provider_public
+pkg.apis.BLE_PHY_ADDR_PROVIDER_STATIC:
+    - ble_addr_provider_static
+
 pkg.ign_dirs.'MCU_TARGET=="nRF5340_NET"':
     - nrf52
 pkg.ign_dirs.'MCU_TARGET!="nRF5340_NET"':
diff --git a/nimble/drivers/nrf5x/src/ble_hw.c b/nimble/drivers/nrf5x/src/ble_hw.c
index 9a46fa6c85..fec11d4c97 100644
--- a/nimble/drivers/nrf5x/src/ble_hw.c
+++ b/nimble/drivers/nrf5x/src/ble_hw.c
@@ -70,9 +70,9 @@ uint8_t g_nrf_num_irks;
 
 #endif
 
-/* Returns public device address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_PUBLIC)
 int
-ble_hw_get_public_addr(ble_addr_t *addr)
+ble_ll_addr_provide_public(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
@@ -93,47 +93,41 @@ ble_hw_get_public_addr(ble_addr_t *addr)
     addr_low = NRF_UICR->CUSTOMER[0];
     addr_high = NRF_UICR->CUSTOMER[1];
 #else
-    /* Does FICR have a public address */
     if ((NRF_FICR->DEVICEADDRTYPE & 1) != 0) {
         return -1;
     }
 
-    /* Copy into device address. We can do this because we know platform */
     addr_low = NRF_FICR->DEVICEADDR[0];
     addr_high = NRF_FICR->DEVICEADDR[1];
 #endif
 
-    memcpy(addr->val, &addr_low, 4);
-    memcpy(&addr->val[4], &addr_high, 2);
-    addr->type = BLE_ADDR_PUBLIC;
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
     return 0;
 }
+#endif
 
-/* Returns random static address or -1 if not present */
+#if MYNEWT_VAL(BLE_PHY_ADDR_PROVIDER_STATIC)
 int
-ble_hw_get_static_addr(ble_addr_t *addr)
+ble_ll_addr_provide_static(uint8_t *addr)
 {
     uint32_t addr_high;
     uint32_t addr_low;
-    int rc;
 
-    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 1) {
-        addr_low = NRF_FICR->DEVICEADDR[0];
-        addr_high = NRF_FICR->DEVICEADDR[1];
+    if ((NRF_FICR->DEVICEADDRTYPE & 1) == 0) {
+        return -1;
+    }
 
-        memcpy(addr->val, &addr_low, 4);
-        memcpy(&addr->val[4], &addr_high, 2);
+    addr_low = NRF_FICR->DEVICEADDR[0];
+    addr_high = NRF_FICR->DEVICEADDR[1];
 
-        addr->val[5] |= 0xc0;
-        addr->type = BLE_ADDR_RANDOM;
-        rc = 0;
-    } else {
-        rc = -1;
-    }
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
 
-    return rc;
+    return 0;
 }
+#endif
 
 /**
  * Clear the whitelist
diff --git a/nimble/drivers/nrf5x/syscfg.yml b/nimble/drivers/nrf5x/syscfg.yml
index f5a227305c..0104215a11 100644
--- a/nimble/drivers/nrf5x/syscfg.yml
+++ b/nimble/drivers/nrf5x/syscfg.yml
@@ -88,6 +88,14 @@ syscfg.defs:
             in UICR register. If enabled public address will be read from
             custom UICR instead of FICR register.
         value: 0
+        restrictions: BLE_PHY_ADDR_PROVIDER_PUBLIC
+
+    BLE_PHY_ADDR_PROVIDER_PUBLIC:
+        description: Enables public address provider API
+        value: 0
+    BLE_PHY_ADDR_PROVIDER_STATIC:
+        description: Enables static address provider API
+        value: 1
 
 syscfg.restrictions:
     # code supports turn on times up to 90us due to some optimizations, but it

From 5eabc17606823c96525640f2e3e0c75dad886098 Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 17:10:18 +0100
Subject: [PATCH 3/7] nimble/ll: Add option to initialize random device address
 by default

This adds an option to initialize random device address by default using
an address retrieved from an address provider.
---
 nimble/controller/src/ble_ll_addr.c | 7 +++++++
 nimble/controller/syscfg.yml        | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/nimble/controller/src/ble_ll_addr.c b/nimble/controller/src/ble_ll_addr.c
index a431a795db..9e71723993 100644
--- a/nimble/controller/src/ble_ll_addr.c
+++ b/nimble/controller/src/ble_ll_addr.c
@@ -48,5 +48,12 @@ ble_ll_addr_init(void)
     ble_ll_addr_provide_public(g_dev_addr);
 #endif
 
+#if MYNEWT_VAL(BLE_LL_ADDR_INIT_RANDOM)
+    /* Set random address from provider API, if available */
+#if MYNEWT_API_ble_addr_provider_random
+    ble_ll_addr_provide_static(g_random_addr);
+#endif
+#endif
+
     return 0;
 }
diff --git a/nimble/controller/syscfg.yml b/nimble/controller/syscfg.yml
index 1e830dbecb..e19136c66f 100644
--- a/nimble/controller/syscfg.yml
+++ b/nimble/controller/syscfg.yml
@@ -395,6 +395,12 @@ syscfg.defs:
                   not intended for production builds.
         value: 0x000000000000
 
+    BLE_LL_ADDR_INIT_RANDOM:
+        description: >
+            Initializes default random address with a static random address
+            retrieved from an address provider, if available.
+        value: 0
+
     BLE_LL_DTM:
         description: >
              Enables HCI Test commands needed for Bluetooth SIG certification

From 4bf65ac857bcee635317c63e0a932103a6cbec4b Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 16:59:49 +0100
Subject: [PATCH 4/7] nimble/util: Add public address provider for u-blox
 modules

Modules from u-blox AG are preprogrammed with a valid public device
address stored in UICR registers. This package makes this address usable
by NimBLE LL.
---
 nimble/drivers/nrf5x/src/ble_hw.c       | 17 ---------
 nimble/drivers/nrf5x/syscfg.yml         |  7 ++--
 nimble/util/addr_ublox/pkg.yml          | 26 ++++++++++++++
 nimble/util/addr_ublox/src/addr_ublox.c | 46 +++++++++++++++++++++++++
 4 files changed, 74 insertions(+), 22 deletions(-)
 create mode 100644 nimble/util/addr_ublox/pkg.yml
 create mode 100644 nimble/util/addr_ublox/src/addr_ublox.c

diff --git a/nimble/drivers/nrf5x/src/ble_hw.c b/nimble/drivers/nrf5x/src/ble_hw.c
index fec11d4c97..17c840952f 100644
--- a/nimble/drivers/nrf5x/src/ble_hw.c
+++ b/nimble/drivers/nrf5x/src/ble_hw.c
@@ -77,29 +77,12 @@ ble_ll_addr_provide_public(uint8_t *addr)
     uint32_t addr_high;
     uint32_t addr_low;
 
-#if MYNEWT_VAL(BLE_PHY_UBLOX_BMD345_PUBLIC_ADDR)
-    /*
-    * The BMD-345 modules are preprogrammed from the factory with a unique public
-    * The  Bluetooth device address stored in the CUSTOMER[0] and CUSTOMER[1]
-    * registers of the User Information Configuration Registers (UICR).
-    * The Bluetooth device address consists of the IEEE Organizationally Unique
-    * Identifier (OUI) combined with the hexadecimal digits that are printed on
-    * a 2D barcode and in human-readable text on the module label.The Bluetooth
-    * device address is stored in little endian format. The most significant
-    * bytes of the CUSTOMER[1] register are 0xFF to complete the 32-bit register.
-    */
-
-    /* Copy into device address. We can do this because we know platform */
-    addr_low = NRF_UICR->CUSTOMER[0];
-    addr_high = NRF_UICR->CUSTOMER[1];
-#else
     if ((NRF_FICR->DEVICEADDRTYPE & 1) != 0) {
         return -1;
     }
 
     addr_low = NRF_FICR->DEVICEADDR[0];
     addr_high = NRF_FICR->DEVICEADDR[1];
-#endif
 
     memcpy(&addr[0], &addr_low, 4);
     memcpy(&addr[4], &addr_high, 2);
diff --git a/nimble/drivers/nrf5x/syscfg.yml b/nimble/drivers/nrf5x/syscfg.yml
index 0104215a11..3699c0ba2b 100644
--- a/nimble/drivers/nrf5x/syscfg.yml
+++ b/nimble/drivers/nrf5x/syscfg.yml
@@ -83,12 +83,9 @@ syscfg.defs:
        value: 0
 
     BLE_PHY_UBLOX_BMD345_PUBLIC_ADDR:
-        description: >
-            Ublox BMD-345 modules come with public address preprogrammed
-            in UICR register. If enabled public address will be read from
-            custom UICR instead of FICR register.
+        description: use nimble/util/addr_ublox package instead
         value: 0
-        restrictions: BLE_PHY_ADDR_PROVIDER_PUBLIC
+        defunct: 1
 
     BLE_PHY_ADDR_PROVIDER_PUBLIC:
         description: Enables public address provider API
diff --git a/nimble/util/addr_ublox/pkg.yml b/nimble/util/addr_ublox/pkg.yml
new file mode 100644
index 0000000000..143894b179
--- /dev/null
+++ b/nimble/util/addr_ublox/pkg.yml
@@ -0,0 +1,26 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+pkg.name: nimble/util/addr_ublox
+pkg.description: Public address provider for u-blox modules
+pkg.author: "Apache Mynewt <dev@mynewt.apache.org>"
+pkg.homepage: "https://mynewt.apache.org/"
+
+pkg.apis:
+    - ble_addr_provider_public
diff --git a/nimble/util/addr_ublox/src/addr_ublox.c b/nimble/util/addr_ublox/src/addr_ublox.c
new file mode 100644
index 0000000000..28c59d72b6
--- /dev/null
+++ b/nimble/util/addr_ublox/src/addr_ublox.c
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include <stdint.h>
+#include <nrfx.h>
+
+int
+ble_ll_addr_provide_public(uint8_t *addr)
+{
+    uint32_t addr_high;
+    uint32_t addr_low;
+
+    /* The u-blox modules are preprogrammed from the factory with a unique public
+     * device address. The address is stored in the CUSTOMER[0] and CUSTOMER[1]
+     * registers of the UICR in little endian format. The most significant bytes
+     * of the CUSTOMER[1] register are 0xFF to complete the 32-bit register value.
+     *
+     * The Bluetooth device address consists of the registered OUI combined with
+     * the hexadecimal digits printed on a 2D barcode and as a human-readable
+     * text on the module label.
+     */
+
+    addr_low = NRF_UICR->CUSTOMER[0];
+    addr_high = NRF_UICR->CUSTOMER[1];
+
+    memcpy(&addr[0], &addr_low, 4);
+    memcpy(&addr[4], &addr_high, 2);
+
+    return 0;
+}

From 8ee043cad1dd979416268dd76feb575018252745 Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 17:36:26 +0100
Subject: [PATCH 5/7] nimble/ll: Add VS HCI command to set public device
 address

The public device address set by this command is applied only after HCI
Reset, thus it can be issues at any time.

To revert back to original public address set address to 0x000000000000.
---
 .../include/controller/ble_ll_addr.h          |  1 +
 nimble/controller/src/ble_ll_addr.c           | 25 +++++++++++++++++--
 nimble/controller/src/ble_ll_hci_vs.c         | 24 ++++++++++++++++++
 nimble/controller/syscfg.yml                  |  9 ++++++-
 nimble/include/nimble/hci_common.h            |  6 +++++
 5 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/nimble/controller/include/controller/ble_ll_addr.h b/nimble/controller/include/controller/ble_ll_addr.h
index d6779fc68c..835875591c 100644
--- a/nimble/controller/include/controller/ble_ll_addr.h
+++ b/nimble/controller/include/controller/ble_ll_addr.h
@@ -25,6 +25,7 @@ extern "C" {
 #endif
 
 int ble_ll_addr_init(void);
+int ble_ll_addr_public_set(const uint8_t *addr);
 
 /* Address provider APIs - should be implemented by packages supporting
  * relevant APIs
diff --git a/nimble/controller/src/ble_ll_addr.c b/nimble/controller/src/ble_ll_addr.c
index 9e71723993..104ef2e6ef 100644
--- a/nimble/controller/src/ble_ll_addr.c
+++ b/nimble/controller/src/ble_ll_addr.c
@@ -28,6 +28,22 @@
 uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
 uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
 
+static uint8_t g_dev_addr_hci[BLE_DEV_ADDR_LEN];
+
+static bool
+is_addr_empty(const uint8_t *addr)
+{
+    return memcmp(addr, BLE_ADDR_ANY, BLE_DEV_ADDR_LEN) == 0;
+}
+
+int
+ble_ll_addr_public_set(const uint8_t *addr)
+{
+    memcpy(g_dev_addr_hci, addr, BLE_DEV_ADDR_LEN);
+
+    return 0;
+}
+
 int
 ble_ll_addr_init(void)
 {
@@ -43,10 +59,15 @@ ble_ll_addr_init(void)
         pub_dev_addr >>= 8;
     }
 
-    /* Set public address from provider API, if available */
+    if (!is_addr_empty(g_dev_addr_hci)) {
+        /* Use public address set externally */
+        memcpy(g_dev_addr, g_dev_addr_hci, BLE_DEV_ADDR_LEN);
+    } else {
+        /* Set public address from provider API, if available */
 #if MYNEWT_API_ble_addr_provider_public
-    ble_ll_addr_provide_public(g_dev_addr);
+        ble_ll_addr_provide_public(g_dev_addr);
 #endif
+    }
 
 #if MYNEWT_VAL(BLE_LL_ADDR_INIT_RANDOM)
     /* Set random address from provider API, if available */
diff --git a/nimble/controller/src/ble_ll_hci_vs.c b/nimble/controller/src/ble_ll_hci_vs.c
index b1560bd71e..53690a438d 100644
--- a/nimble/controller/src/ble_ll_hci_vs.c
+++ b/nimble/controller/src/ble_ll_hci_vs.c
@@ -390,6 +390,26 @@ ble_ll_hci_vs_set_scan_cfg(uint16_t ocf, const uint8_t *cmdbuf, uint8_t cmdlen,
 }
 #endif
 
+#if MYNEWT_VAL(BLE_LL_HCI_VS_WR_PUBLIC_ADDR)
+static int
+ble_ll_hci_vs_wr_public_addr(uint16_t ocf, const uint8_t *cmdbuf, uint8_t cmdlen,
+                             uint8_t *rspbuf, uint8_t *rsplen)
+{
+    const struct ble_hci_vs_wr_public_addr_cp *cp = (const void *)cmdbuf;
+    int rc;
+
+    if (cmdlen != sizeof(*cp)) {
+        return BLE_ERR_INV_HCI_CMD_PARMS;
+    }
+
+    if (ble_ll_addr_wr_public_addr(cp->addr)) {
+        return BLE_ERR_UNSPECIFIED;
+    }
+
+    return 0;
+}
+#endif
+
 static struct ble_ll_hci_vs_cmd g_ble_ll_hci_vs_cmds[] = {
     BLE_LL_HCI_VS_CMD(BLE_HCI_OCF_VS_RD_STATIC_ADDR,
                       ble_ll_hci_vs_rd_static_addr),
@@ -424,6 +444,10 @@ static struct ble_ll_hci_vs_cmd g_ble_ll_hci_vs_cmds[] = {
     BLE_LL_HCI_VS_CMD(BLE_HCI_OCF_VS_SET_SCAN_CFG,
                       ble_ll_hci_vs_set_scan_cfg)
 #endif
+#if MYNEWT_VAL(BLE_LL_HCI_VS_WR_PUBLIC_ADDR)
+    BLE_LL_HCI_VS_CMD(BLE_HCI_OCF_VS_WR_PUBLIC_ADDR,
+                      ble_ll_hci_vs_wr_public_addr)
+#endif
 };
 
 static struct ble_ll_hci_vs_cmd *
diff --git a/nimble/controller/syscfg.yml b/nimble/controller/syscfg.yml
index e19136c66f..946e53a62a 100644
--- a/nimble/controller/syscfg.yml
+++ b/nimble/controller/syscfg.yml
@@ -456,7 +456,14 @@ syscfg.defs:
             - BLE_LL_HCI_VS if 1
             - BLE_LL_CFG_FEAT_LL_EXT_ADV if 1
             - BLE_LL_ROLE_OBSERVER if 1
-
+    BLE_LL_HCI_VS_WR_PUBLIC_ADDR:
+        description: >
+            Enables HCI command to set public device address.
+            The new address is applied after HCI Reset. To revert back to the
+            default public address, set address to 0x000000000000.
+        value: 0
+        restrictions:
+            - BLE_LL_HCI_VS if 1
 
     BLE_LL_HCI_VS_EVENT_ON_ASSERT:
         description: >
diff --git a/nimble/include/nimble/hci_common.h b/nimble/include/nimble/hci_common.h
index 24843de3c2..cefc2c5a2c 100644
--- a/nimble/include/nimble/hci_common.h
+++ b/nimble/include/nimble/hci_common.h
@@ -1406,6 +1406,12 @@ struct ble_hci_vs_set_scan_cfg_cp {
     int8_t rssi_threshold;
 } __attribute__((packed));
 
+/* Set Public Bluetooth Address */
+#define BLE_HCI_OCF_VS_WR_PUBLIC_ADDR                   (MYNEWT_VAL(BLE_HCI_VS_OCF_OFFSET) + (0x000C))
+struct ble_hci_vs_wr_public_addr_cp {
+    uint8_t addr[6];
+} __attribute__((packed));
+
 /* Command Specific Definitions */
 /* --- Set controller to host flow control (OGF 0x03, OCF 0x0031) --- */
 #define BLE_HCI_CTLR_TO_HOST_FC_OFF         (0)

From 052b603957a15670e9d49aedb516a4960e6466f7 Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 20:44:29 +0100
Subject: [PATCH 6/7] nimble/ll: Use const for addr parameters

In general we should pass any addr parameter to function as const since
we only rarely need to modify its contents and the address itself may
point to our device address which we never want to be able to modify
from outsied ble_ll_addr by mistake...
---
 nimble/controller/include/controller/ble_ll.h |  2 +-
 .../include/controller/ble_ll_conn.h          |  2 +-
 .../include/controller/ble_ll_resolv.h        |  4 ++--
 .../include/controller/ble_ll_scan.h          | 24 +++++++++----------
 .../include/controller/ble_ll_whitelist.h     |  2 +-
 nimble/controller/src/ble_ll.c                |  2 +-
 nimble/controller/src/ble_ll_conn.c           |  5 ++--
 nimble/controller/src/ble_ll_resolv.c         |  4 ++--
 nimble/controller/src/ble_ll_scan.c           | 15 ++++++------
 nimble/controller/src/ble_ll_whitelist.c      |  2 +-
 10 files changed, 32 insertions(+), 30 deletions(-)

diff --git a/nimble/controller/include/controller/ble_ll.h b/nimble/controller/include/controller/ble_ll.h
index ab75edcba3..7bce74558a 100644
--- a/nimble/controller/include/controller/ble_ll.h
+++ b/nimble/controller/include/controller/ble_ll.h
@@ -540,7 +540,7 @@ int ble_ll_addr_subtype(const uint8_t *addr, uint8_t addr_type);
 int ble_ll_addr_is_id(uint8_t *addr, uint8_t addr_type);
 
 /* Is 'addr' our device address? 'addr_type' is public (0) or random (!=0) */
-int ble_ll_is_our_devaddr(uint8_t *addr, int addr_type);
+int ble_ll_is_our_devaddr(const uint8_t* addr, int addr_type);
 
 /* Get identity address 'addr_type' is public (0) or random (!=0) */
 uint8_t *ble_ll_get_our_devaddr(uint8_t addr_type);
diff --git a/nimble/controller/include/controller/ble_ll_conn.h b/nimble/controller/include/controller/ble_ll_conn.h
index 2b0c606dd6..03615e28f6 100644
--- a/nimble/controller/include/controller/ble_ll_conn.h
+++ b/nimble/controller/include/controller/ble_ll_conn.h
@@ -483,7 +483,7 @@ void ble_ll_conn_send_connect_req_cancel(void);
 /* Signal connection created via CONNECT_IND */
 void ble_ll_conn_created_on_legacy(struct os_mbuf *rxpdu,
                                    struct ble_ll_scan_addr_data *addrd,
-                                   uint8_t *targeta);
+                                   const uint8_t* targeta);
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 /* Signal connection created via AUX_CONNECT_REQ */
 void ble_ll_conn_created_on_aux(struct os_mbuf *rxpdu,
diff --git a/nimble/controller/include/controller/ble_ll_resolv.h b/nimble/controller/include/controller/ble_ll_resolv.h
index ff28e783ce..75977d2542 100644
--- a/nimble/controller/include/controller/ble_ll_resolv.h
+++ b/nimble/controller/include/controller/ble_ll_resolv.h
@@ -90,8 +90,8 @@ void ble_ll_resolv_list_reset(void);
 void ble_ll_resolv_get_priv_addr(struct ble_ll_resolv_entry *rl, int local,
                                  uint8_t *addr);
 
-void ble_ll_resolv_set_peer_rpa(int index, uint8_t *rpa);
-void ble_ll_resolv_set_local_rpa(int index, uint8_t *rpa);
+void ble_ll_resolv_set_peer_rpa(int index, const uint8_t *rpa);
+void ble_ll_resolv_set_local_rpa(int index, const uint8_t *rpa);
 
 /* Generate a resolvable private address. */
 int ble_ll_resolv_gen_rpa(uint8_t *addr, uint8_t addr_type, uint8_t *rpa,
diff --git a/nimble/controller/include/controller/ble_ll_scan.h b/nimble/controller/include/controller/ble_ll_scan.h
index 47c7437414..76fdc4737a 100644
--- a/nimble/controller/include/controller/ble_ll_scan.h
+++ b/nimble/controller/include/controller/ble_ll_scan.h
@@ -108,9 +108,9 @@ struct ble_ll_scan_vs_config {
 };
 
 struct ble_ll_scan_addr_data {
-    uint8_t *adva;
-    uint8_t *targeta;
-    uint8_t *adv_addr;
+    const uint8_t *adva;
+    const uint8_t *targeta;
+    const uint8_t *adv_addr;
     uint8_t adva_type : 1;
     uint8_t targeta_type : 1;
     uint8_t adv_addr_type : 1;
@@ -223,7 +223,7 @@ ble_ll_scan_initiator_start(struct ble_ll_conn_sm *connsm, uint8_t ext,
 struct ble_ll_scan_pdu_data *ble_ll_scan_get_pdu_data(void);
 
 /* Called to set the resolvable private address of the last connected peer */
-void ble_ll_scan_set_peer_rpa(uint8_t *rpa);
+void ble_ll_scan_set_peer_rpa(const uint8_t *rpa);
 
 /* Returns peer RPA of last connection made */
 uint8_t *ble_ll_scan_get_peer_rpa(void);
@@ -256,14 +256,14 @@ uint8_t ble_ll_scan_get_filt_dups(void);
 uint8_t ble_ll_scan_backoff_kick(void);
 void ble_ll_scan_backoff_update(int success);
 
-int ble_ll_scan_dup_check_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
-                              uint16_t adi);
-int ble_ll_scan_dup_update_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
-                               uint16_t adi);
-int ble_ll_scan_have_rxd_scan_rsp(uint8_t *addr, uint8_t txadd, uint8_t ext_adv,
-                                  uint16_t adi);
-void ble_ll_scan_add_scan_rsp_adv(uint8_t *addr, uint8_t txadd, uint8_t ext_adv,
-                                  uint16_t adi);
+int ble_ll_scan_dup_check_ext(uint8_t addr_type, const uint8_t *addr,
+                              bool has_aux, uint16_t adi);
+int ble_ll_scan_dup_update_ext(uint8_t addr_type, const uint8_t *addr,
+                               bool has_aux, uint16_t adi);
+int ble_ll_scan_have_rxd_scan_rsp(const uint8_t *addr, uint8_t txadd,
+                                  uint8_t ext_adv, uint16_t adi);
+void ble_ll_scan_add_scan_rsp_adv(const uint8_t *addr, uint8_t txadd,
+                                  uint8_t ext_adv, uint16_t adi);
 
 struct ble_ll_scan_sm *ble_ll_scan_sm_get(void);
 
diff --git a/nimble/controller/include/controller/ble_ll_whitelist.h b/nimble/controller/include/controller/ble_ll_whitelist.h
index 2d3b6c5ddd..d2a9110cc0 100644
--- a/nimble/controller/include/controller/ble_ll_whitelist.h
+++ b/nimble/controller/include/controller/ble_ll_whitelist.h
@@ -43,7 +43,7 @@ void ble_ll_whitelist_enable(void);
 void ble_ll_whitelist_disable(void);
 
 /* Boolean function returning true if address matches a whitelist entry */
-int ble_ll_whitelist_match(uint8_t *addr, uint8_t addr_type, int is_ident);
+int ble_ll_whitelist_match(const uint8_t *addr, uint8_t addr_type, int is_ident);
 
 #ifdef __cplusplus
 }
diff --git a/nimble/controller/src/ble_ll.c b/nimble/controller/src/ble_ll.c
index 3cea0f97e0..5e23a91bfb 100644
--- a/nimble/controller/src/ble_ll.c
+++ b/nimble/controller/src/ble_ll.c
@@ -717,7 +717,7 @@ ble_ll_set_random_addr(const uint8_t *cmdbuf, uint8_t len, bool hci_adv_ext)
  * @return int 0: not our device address. 1: is our device address
  */
 int
-ble_ll_is_our_devaddr(uint8_t *addr, int addr_type)
+ble_ll_is_our_devaddr(const uint8_t* addr, int addr_type)
 {
     int rc;
     uint8_t *our_addr;
diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c
index 52446b6471..83d3011452 100644
--- a/nimble/controller/src/ble_ll_conn.c
+++ b/nimble/controller/src/ble_ll_conn.c
@@ -3304,7 +3304,8 @@ ble_ll_conn_send_connect_req_cancel(void)
 
 static void
 ble_ll_conn_central_start(uint8_t phy, uint8_t csa,
-                          struct ble_ll_scan_addr_data *addrd, uint8_t *targeta)
+                          struct ble_ll_scan_addr_data *addrd,
+                          const uint8_t *targeta)
 {
     struct ble_ll_conn_sm *connsm;
 
@@ -3340,7 +3341,7 @@ ble_ll_conn_central_start(uint8_t phy, uint8_t csa,
 void
 ble_ll_conn_created_on_legacy(struct os_mbuf *rxpdu,
                               struct ble_ll_scan_addr_data *addrd,
-                              uint8_t *targeta)
+                              const uint8_t *targeta)
 {
     uint8_t *rxbuf;
     uint8_t csa;
diff --git a/nimble/controller/src/ble_ll_resolv.c b/nimble/controller/src/ble_ll_resolv.c
index 3566876e09..707120a260 100644
--- a/nimble/controller/src/ble_ll_resolv.c
+++ b/nimble/controller/src/ble_ll_resolv.c
@@ -621,7 +621,7 @@ ble_ll_resolv_get_priv_addr(struct ble_ll_resolv_entry *rl, int local,
 }
 
 void
-ble_ll_resolv_set_peer_rpa(int index, uint8_t *rpa)
+ble_ll_resolv_set_peer_rpa(int index, const uint8_t *rpa)
 {
     os_sr_t sr;
     struct ble_ll_resolv_entry *rl;
@@ -633,7 +633,7 @@ ble_ll_resolv_set_peer_rpa(int index, uint8_t *rpa)
 }
 
 void
-ble_ll_resolv_set_local_rpa(int index, uint8_t *rpa)
+ble_ll_resolv_set_local_rpa(int index, const uint8_t *rpa)
 {
     os_sr_t sr;
     struct ble_ll_resolv_entry *rl;
diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c
index 0f73fd2e8c..a85919bf66 100644
--- a/nimble/controller/src/ble_ll_scan.c
+++ b/nimble/controller/src/ble_ll_scan.c
@@ -391,7 +391,7 @@ ble_ll_scan_halt(void)
  * @return int 0: have not received a scan response; 1 otherwise.
  */
 int
-ble_ll_scan_have_rxd_scan_rsp(uint8_t *addr, uint8_t txadd,
+ble_ll_scan_have_rxd_scan_rsp(const uint8_t *addr, uint8_t txadd,
                               uint8_t ext_adv, uint16_t adi)
 {
     uint8_t num_advs;
@@ -435,7 +435,7 @@ ble_ll_scan_have_rxd_scan_rsp(uint8_t *addr, uint8_t txadd,
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 void
-ble_ll_scan_add_scan_rsp_adv(uint8_t *addr, uint8_t txadd,
+ble_ll_scan_add_scan_rsp_adv(const uint8_t *addr, uint8_t txadd,
                              uint8_t ext_adv, uint16_t adi)
 {
     uint8_t num_advs;
@@ -1800,7 +1800,8 @@ ble_ll_scan_dup_new(void)
 }
 
 static int
-ble_ll_scan_dup_check_legacy(uint8_t addr_type, uint8_t *addr, uint8_t pdu_type)
+ble_ll_scan_dup_check_legacy(uint8_t addr_type, const uint8_t *addr,
+                             uint8_t pdu_type)
 {
     struct ble_ll_scan_dup_entry *e;
     uint8_t type;
@@ -1840,7 +1841,7 @@ ble_ll_scan_dup_check_legacy(uint8_t addr_type, uint8_t *addr, uint8_t pdu_type)
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 int
-ble_ll_scan_dup_check_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
+ble_ll_scan_dup_check_ext(uint8_t addr_type, const uint8_t *addr, bool has_aux,
                           uint16_t adi)
 {
     struct ble_ll_scan_dup_entry *e;
@@ -1889,7 +1890,7 @@ ble_ll_scan_dup_check_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
 }
 
 int
-ble_ll_scan_dup_update_ext(uint8_t addr_type, uint8_t *addr, bool has_aux,
+ble_ll_scan_dup_update_ext(uint8_t addr_type, const uint8_t *addr, bool has_aux,
                            uint16_t adi)
 {
     struct ble_ll_scan_dup_entry *e;
@@ -2010,7 +2011,7 @@ ble_ll_scan_rx_pkt_in(uint8_t ptype, struct os_mbuf *om, struct ble_mbuf_hdr *hd
     struct ble_mbuf_hdr_rxinfo *rxinfo = &hdr->rxinfo;
 #endif
 #if MYNEWT_VAL(BLE_LL_ROLE_CENTRAL)
-    uint8_t *targeta;
+    const uint8_t *targeta;
 #endif
     struct ble_ll_scan_sm *scansm;
     struct ble_ll_scan_addr_data addrd;
@@ -2710,7 +2711,7 @@ ble_ll_scan_get_local_rpa(void)
  * @param rpa
  */
 void
-ble_ll_scan_set_peer_rpa(uint8_t *rpa)
+ble_ll_scan_set_peer_rpa(const uint8_t *rpa)
 {
     struct ble_ll_scan_sm *scansm;
 
diff --git a/nimble/controller/src/ble_ll_whitelist.c b/nimble/controller/src/ble_ll_whitelist.c
index 12d841a7f8..722c9d6c87 100644
--- a/nimble/controller/src/ble_ll_whitelist.c
+++ b/nimble/controller/src/ble_ll_whitelist.c
@@ -164,7 +164,7 @@ ble_ll_whitelist_search(const uint8_t *addr, uint8_t addr_type)
  * @return int
  */
 int
-ble_ll_whitelist_match(uint8_t *addr, uint8_t addr_type, int is_ident)
+ble_ll_whitelist_match(const uint8_t *addr, uint8_t addr_type, int is_ident)
 {
     int rc;
 #if (BLE_USES_HW_WHITELIST == 1)

From 9199f368efeebf269b9a83635367b3e947b0bed5 Mon Sep 17 00:00:00 2001
From: Andrzej Kaczmarek <andrzej.kaczmarek@codecoup.pl>
Date: Thu, 27 Mar 2025 20:44:33 +0100
Subject: [PATCH 7/7] nimble/ll: Make public and random addresses private in
 ble_ll_addr

We should now only use helpers from ble_ll_addr to access public and
random addresses across all LL code.
---
 nimble/controller/include/controller/ble_ll.h |  16 ---
 .../include/controller/ble_ll_addr.h          |  12 ++
 .../include/controller/ble_ll_conn.h          |   2 +-
 nimble/controller/src/ble_ll.c                | 134 +-----------------
 nimble/controller/src/ble_ll_addr.c           |  95 +++++++++++--
 nimble/controller/src/ble_ll_adv.c            |  17 +--
 nimble/controller/src/ble_ll_conn.c           |  46 +++---
 nimble/controller/src/ble_ll_hci.c            |   4 +-
 nimble/controller/src/ble_ll_scan.c           |  13 +-
 nimble/controller/src/ble_ll_scan_aux.c       |   5 +-
 nimble/include/nimble/ble.h                   |   6 -
 11 files changed, 148 insertions(+), 202 deletions(-)

diff --git a/nimble/controller/include/controller/ble_ll.h b/nimble/controller/include/controller/ble_ll.h
index 7bce74558a..7a5d74a494 100644
--- a/nimble/controller/include/controller/ble_ll.h
+++ b/nimble/controller/include/controller/ble_ll.h
@@ -517,16 +517,6 @@ struct ble_ll_acad_channel_map_update_ind {
 /* Reset the Link Layer */
 int ble_ll_reset(void);
 
-/* 'Boolean' function returning true if address is a valid random address */
-int ble_ll_is_valid_random_addr(const uint8_t *addr);
-
-/*
- * Check if given own_addr_type is valid for current controller configuration
- * given the random address provided (when applicable)
- */
-int ble_ll_is_valid_own_addr_type(uint8_t own_addr_type,
-                                  const uint8_t *random_addr);
-
 /* Calculate maximum octets of PDU payload which can be transmitted during
  * 'usecs' on a PHY 'phy_mode'. */
 uint16_t ble_ll_pdu_max_tx_octets_get(uint32_t usecs, int phy_mode);
@@ -539,12 +529,6 @@ int ble_ll_addr_subtype(const uint8_t *addr, uint8_t addr_type);
 /* Is this address an identity address? */
 int ble_ll_addr_is_id(uint8_t *addr, uint8_t addr_type);
 
-/* Is 'addr' our device address? 'addr_type' is public (0) or random (!=0) */
-int ble_ll_is_our_devaddr(const uint8_t* addr, int addr_type);
-
-/* Get identity address 'addr_type' is public (0) or random (!=0) */
-uint8_t *ble_ll_get_our_devaddr(uint8_t addr_type);
-
 /**
  * Called to put a packet on the Link Layer transmit packet queue.
  *
diff --git a/nimble/controller/include/controller/ble_ll_addr.h b/nimble/controller/include/controller/ble_ll_addr.h
index 835875591c..93dccda615 100644
--- a/nimble/controller/include/controller/ble_ll_addr.h
+++ b/nimble/controller/include/controller/ble_ll_addr.h
@@ -20,6 +20,9 @@
 #ifndef H_BLE_LL_ADDR_
 #define H_BLE_LL_ADDR_
 
+#include <stdbool.h>
+#include <stdint.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -27,6 +30,15 @@ extern "C" {
 int ble_ll_addr_init(void);
 int ble_ll_addr_public_set(const uint8_t *addr);
 
+const uint8_t *ble_ll_addr_get(uint8_t addr_type);
+const uint8_t *ble_ll_addr_public_get(void);
+const uint8_t *ble_ll_addr_random_get(void);
+int ble_ll_addr_random_set(const uint8_t *addr);
+
+bool ble_ll_addr_is_our(int addr_type, const uint8_t *addr);
+bool ble_ll_addr_is_valid_own_addr_type(uint8_t addr_type,
+                                        const uint8_t *random_addr);
+
 /* Address provider APIs - should be implemented by packages supporting
  * relevant APIs
  */
diff --git a/nimble/controller/include/controller/ble_ll_conn.h b/nimble/controller/include/controller/ble_ll_conn.h
index 03615e28f6..fc5d5b63a2 100644
--- a/nimble/controller/include/controller/ble_ll_conn.h
+++ b/nimble/controller/include/controller/ble_ll_conn.h
@@ -483,7 +483,7 @@ void ble_ll_conn_send_connect_req_cancel(void);
 /* Signal connection created via CONNECT_IND */
 void ble_ll_conn_created_on_legacy(struct os_mbuf *rxpdu,
                                    struct ble_ll_scan_addr_data *addrd,
-                                   const uint8_t* targeta);
+                                   const uint8_t *targeta);
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 /* Signal connection created via AUX_CONNECT_REQ */
 void ble_ll_conn_created_on_aux(struct os_mbuf *rxpdu,
diff --git a/nimble/controller/src/ble_ll.c b/nimble/controller/src/ble_ll.c
index 5e23a91bfb..0c847ec38a 100644
--- a/nimble/controller/src/ble_ll.c
+++ b/nimble/controller/src/ble_ll.c
@@ -557,93 +557,11 @@ ble_ll_addr_subtype(const uint8_t *addr, uint8_t addr_type)
     }
 }
 
-static int
-ble_ll_is_valid_addr(const uint8_t *addr)
-{
-    int i;
-
-    for (i = 0; i < BLE_DEV_ADDR_LEN; ++i) {
-        if (addr[i]) {
-            return 1;
-        }
-    }
-
-    return 0;
-}
-
-/* Checks to see that the device is a valid random address */
-int
-ble_ll_is_valid_random_addr(const uint8_t *addr)
-{
-    int i;
-    int rc;
-    uint16_t sum;
-    uint8_t addr_type;
-
-    /* Make sure all bits are neither one nor zero */
-    sum = 0;
-    for (i = 0; i < (BLE_DEV_ADDR_LEN -1); ++i) {
-        sum += addr[i];
-    }
-    sum += addr[5] & 0x3f;
-
-    if ((sum == 0) || (sum == ((5*255) + 0x3f))) {
-        return 0;
-    }
-
-    /* Get the upper two bits of the address */
-    rc = 1;
-    addr_type = addr[5] & 0xc0;
-    if (addr_type == 0xc0) {
-        /* Static random address. No other checks needed */
-    } else if (addr_type == 0x40) {
-        /* Resolvable */
-        sum = addr[3] + addr[4] + (addr[5] & 0x3f);
-        if ((sum == 0) || (sum == (255 + 255 + 0x3f))) {
-            rc = 0;
-        }
-    } else if (addr_type == 0) {
-        /* non-resolvable. Cant be equal to public */
-        if (!memcmp(g_dev_addr, addr, BLE_DEV_ADDR_LEN)) {
-            rc = 0;
-        }
-    } else {
-        /* Invalid upper two bits */
-        rc = 0;
-    }
-
-    return rc;
-}
-int
-ble_ll_is_valid_own_addr_type(uint8_t own_addr_type, const uint8_t *random_addr)
-{
-    int rc;
-
-    switch (own_addr_type) {
-    case BLE_HCI_ADV_OWN_ADDR_PUBLIC:
-#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
-    case BLE_HCI_ADV_OWN_ADDR_PRIV_PUB:
-#endif
-        rc = ble_ll_is_valid_addr(g_dev_addr);
-        break;
-    case BLE_HCI_ADV_OWN_ADDR_RANDOM:
-#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
-    case BLE_HCI_ADV_OWN_ADDR_PRIV_RAND:
-#endif
-        rc = ble_ll_is_valid_addr(random_addr);
-        break;
-    default:
-        rc = 0;
-        break;
-    }
-
-    return rc;
-}
-
+/* FIXME: remove callers */
 int
 ble_ll_set_public_addr(const uint8_t *addr)
 {
-    memcpy(g_dev_addr, addr, BLE_DEV_ADDR_LEN);
+    ble_ll_addr_public_set(addr);
 
     return BLE_ERR_SUCCESS;
 }
@@ -691,7 +609,7 @@ ble_ll_set_random_addr(const uint8_t *cmdbuf, uint8_t len, bool hci_adv_ext)
     }
 #endif
 
-    memcpy(g_random_addr, cmd->addr, BLE_DEV_ADDR_LEN);
+    ble_ll_addr_random_set(cmd->addr);
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 #if MYNEWT_VAL(BLE_LL_ROLE_BROADCASTER)
@@ -707,52 +625,6 @@ ble_ll_set_random_addr(const uint8_t *cmdbuf, uint8_t len, bool hci_adv_ext)
     return BLE_ERR_SUCCESS;
 }
 
-/**
- * Checks to see if an address is our device address (either public or
- * random)
- *
- * @param addr
- * @param addr_type
- *
- * @return int 0: not our device address. 1: is our device address
- */
-int
-ble_ll_is_our_devaddr(const uint8_t* addr, int addr_type)
-{
-    int rc;
-    uint8_t *our_addr;
-
-    if (addr_type) {
-        our_addr = g_random_addr;
-    } else {
-        our_addr = g_dev_addr;
-    }
-
-    rc = 0;
-    if (!memcmp(our_addr, addr, BLE_DEV_ADDR_LEN)) {
-        rc = 1;
-    }
-
-    return rc;
-}
-
-/**
- * Get identity address
- *
- * @param addr_type Random (1). Public(0)
- *
- * @return pointer to identity address of given type.
- */
-uint8_t*
-ble_ll_get_our_devaddr(uint8_t addr_type)
-{
-    if (addr_type) {
-        return g_random_addr;
-    }
-
-    return g_dev_addr;
-}
-
 /**
  * Wait for response timeout function
  *
diff --git a/nimble/controller/src/ble_ll_addr.c b/nimble/controller/src/ble_ll_addr.c
index 104ef2e6ef..d6f74899bd 100644
--- a/nimble/controller/src/ble_ll_addr.c
+++ b/nimble/controller/src/ble_ll_addr.c
@@ -22,13 +22,11 @@
 #include <controller/ble_ll.h>
 #include <controller/ble_ll_addr.h>
 
-/* FIXME: both should be static and accessible only via dedicated set/get APIs;
- *        extern declared in nimble/ble.h should be removed
- */
-uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
-uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
-
-static uint8_t g_dev_addr_hci[BLE_DEV_ADDR_LEN];
+static struct {
+    uint8_t public_addr[BLE_DEV_ADDR_LEN];
+    uint8_t random_addr[BLE_DEV_ADDR_LEN];
+    uint8_t public_addr_hci[BLE_DEV_ADDR_LEN];
+} g_ble_ll_addr;
 
 static bool
 is_addr_empty(const uint8_t *addr)
@@ -39,11 +37,82 @@ is_addr_empty(const uint8_t *addr)
 int
 ble_ll_addr_public_set(const uint8_t *addr)
 {
-    memcpy(g_dev_addr_hci, addr, BLE_DEV_ADDR_LEN);
+    memcpy(g_ble_ll_addr.public_addr_hci, addr, BLE_DEV_ADDR_LEN);
 
     return 0;
 }
 
+const uint8_t *
+ble_ll_addr_get(uint8_t addr_type)
+{
+    const uint8_t *addr;
+
+    if (addr_type) {
+        addr = g_ble_ll_addr.random_addr;
+    } else {
+        addr = g_ble_ll_addr.public_addr;
+    }
+
+    return addr;
+}
+
+const uint8_t *
+ble_ll_addr_public_get(void)
+{
+    return g_ble_ll_addr.public_addr;
+}
+
+
+const uint8_t *
+ble_ll_addr_random_get(void)
+{
+    return g_ble_ll_addr.random_addr;
+}
+
+int
+ble_ll_addr_random_set(const uint8_t *addr)
+{
+    memcpy(g_ble_ll_addr.random_addr, addr, BLE_DEV_ADDR_LEN);
+
+    return 0;
+}
+
+bool
+ble_ll_addr_is_our(int addr_type, const uint8_t *addr)
+{
+    const uint8_t *our_addr;
+
+    our_addr = ble_ll_addr_get(addr_type);
+
+    return memcmp(our_addr, addr, BLE_DEV_ADDR_LEN) == 0;
+}
+
+bool
+ble_ll_addr_is_valid_own_addr_type(uint8_t addr_type,
+                                   const uint8_t *random_addr)
+{
+    const uint8_t *addr;
+
+    switch (addr_type) {
+    case BLE_HCI_ADV_OWN_ADDR_PUBLIC:
+#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
+    case BLE_HCI_ADV_OWN_ADDR_PRIV_PUB:
+#endif
+        addr = ble_ll_addr_public_get();
+        break;
+    case BLE_HCI_ADV_OWN_ADDR_RANDOM:
+#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
+    case BLE_HCI_ADV_OWN_ADDR_PRIV_RAND:
+#endif
+        addr = random_addr ? random_addr : ble_ll_addr_random_get();
+        break;
+    default:
+        return false;
+    }
+
+    return !is_addr_empty(addr);
+}
+
 int
 ble_ll_addr_init(void)
 {
@@ -55,24 +124,24 @@ ble_ll_addr_init(void)
      */
     pub_dev_addr = MYNEWT_VAL(BLE_LL_PUBLIC_DEV_ADDR);
     for (i = 0; i < BLE_DEV_ADDR_LEN; i++) {
-        g_dev_addr[i] = pub_dev_addr & 0xff;
+        g_ble_ll_addr.public_addr[i] = pub_dev_addr & 0xff;
         pub_dev_addr >>= 8;
     }
 
-    if (!is_addr_empty(g_dev_addr_hci)) {
+    if (!is_addr_empty(g_ble_ll_addr.public_addr_hci)) {
         /* Use public address set externally */
-        memcpy(g_dev_addr, g_dev_addr_hci, BLE_DEV_ADDR_LEN);
+        memcpy(g_ble_ll_addr.public_addr, g_ble_ll_addr.public_addr_hci, BLE_DEV_ADDR_LEN);
     } else {
         /* Set public address from provider API, if available */
 #if MYNEWT_API_ble_addr_provider_public
-        ble_ll_addr_provide_public(g_dev_addr);
+        ble_ll_addr_provide_public(g_ble_ll_addr.public_addr);
 #endif
     }
 
 #if MYNEWT_VAL(BLE_LL_ADDR_INIT_RANDOM)
     /* Set random address from provider API, if available */
 #if MYNEWT_API_ble_addr_provider_random
-    ble_ll_addr_provide_static(g_random_addr);
+    ble_ll_addr_provide_static(g_ble_ll_addr.random_addr);
 #endif
 #endif
 
diff --git a/nimble/controller/src/ble_ll_adv.c b/nimble/controller/src/ble_ll_adv.c
index 84f6e789d6..ab8fc0e342 100644
--- a/nimble/controller/src/ble_ll_adv.c
+++ b/nimble/controller/src/ble_ll_adv.c
@@ -35,6 +35,7 @@
 #include "controller/ble_ll_pdu.h"
 #include "controller/ble_ll_hci.h"
 #include "controller/ble_ll_adv.h"
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_sched.h"
 #include "controller/ble_ll_scan.h"
 #include "controller/ble_ll_whitelist.h"
@@ -2791,12 +2792,12 @@ static int
 ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
 {
     uint8_t adv_chan;
-    uint8_t *addr;
+    const uint8_t *adva;
+    const uint8_t *random_addr;
     uint32_t start_delay_us;
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LE_CSA2)
     uint32_t access_addr;
 #endif
-    const uint8_t *random_addr;
     uint32_t earliest_start_time;
     int32_t delta;
 
@@ -2808,10 +2809,10 @@ ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
     random_addr = advsm->adv_random_addr;
 #else
-    random_addr = g_random_addr;
+    random_addr = ble_ll_addr_random_get();
 #endif
 
-    if (!ble_ll_is_valid_own_addr_type(advsm->own_addr_type, random_addr)) {
+    if (!ble_ll_addr_is_valid_own_addr_type(advsm->own_addr_type, random_addr)) {
         return BLE_ERR_INV_HCI_CMD_PARMS;
     }
 
@@ -2833,16 +2834,16 @@ ble_ll_adv_sm_start(struct ble_ll_adv_sm *advsm)
 
     /* Set advertising address */
     if ((advsm->own_addr_type & 1) == 0) {
-        addr = g_dev_addr;
+        adva = ble_ll_addr_public_get();
     } else {
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
-        addr = advsm->adv_random_addr;
+        adva = advsm->adv_random_addr;
 #else
-        addr = g_random_addr;
+        adva = ble_ll_addr_random_get();
 #endif
         advsm->flags |= BLE_LL_ADV_SM_FLAG_TX_ADD;
     }
-    memcpy(advsm->adva, addr, BLE_DEV_ADDR_LEN);
+    memcpy(advsm->adva, adva, BLE_DEV_ADDR_LEN);
 
     if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_DIRECTED) {
         memcpy(advsm->initiator_addr, advsm->peer_addr, BLE_DEV_ADDR_LEN);
diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c
index 83d3011452..7bca3515aa 100644
--- a/nimble/controller/src/ble_ll_conn.c
+++ b/nimble/controller/src/ble_ll_conn.c
@@ -30,6 +30,7 @@
 #include "controller/ble_ll.h"
 #include "controller/ble_ll_pdu.h"
 #include "controller/ble_ll_conn.h"
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_hci.h"
 #include "controller/ble_ll_scan.h"
 #include "controller/ble_ll_whitelist.h"
@@ -3072,7 +3073,8 @@ ble_ll_conn_prepare_connect_ind(struct ble_ll_conn_sm *connsm,
                                 uint8_t channel)
 {
     uint8_t hdr;
-    uint8_t *addr;
+    const uint8_t *inita;
+    bool inita_rnd = false;
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
     struct ble_ll_resolv_entry *rl;
 #endif
@@ -3100,36 +3102,37 @@ ble_ll_conn_prepare_connect_ind(struct ble_ll_conn_sm *connsm,
                  */
                 BLE_LL_ASSERT(addrd->rpa_index >= 0);
                 rl = &g_ble_ll_resolv_list[addrd->rpa_index];
-                hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
                 ble_ll_resolv_get_priv_addr(rl, 1, pdu_data->inita);
+                inita = NULL;
+                inita_rnd = true;
             } else {
                 /* Host does not want us to use RPA so use identity */
                 if ((connsm->own_addr_type & 1) == 0) {
-                    memcpy(pdu_data->inita, g_dev_addr, BLE_DEV_ADDR_LEN);
+                    inita = ble_ll_addr_public_get();
                 } else {
-                    hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
-                    memcpy(pdu_data->inita, g_random_addr, BLE_DEV_ADDR_LEN);
+                    inita = ble_ll_addr_random_get();
+                    inita_rnd = true;
                 }
             }
         } else {
-            memcpy(pdu_data->inita, addrd->targeta, BLE_DEV_ADDR_LEN);
+            inita = addrd->targeta;
             if (addrd->targeta_type) {
-                hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
+                inita_rnd = true;
             }
         }
 #else
-        memcpy(pdu_data->inita, addrd->targeta, BLE_DEV_ADDR_LEN);
+        inita = addrd->targeta;
         if (addrd->targeta_type) {
-            hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
+            inita_rnd = true;
         }
 #endif
     } else {
         /* Get pointer to our device address */
         if ((connsm->own_addr_type & 1) == 0) {
-            addr = g_dev_addr;
+            inita = ble_ll_addr_public_get();
         } else {
-            hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
-            addr = g_random_addr;
+            inita = ble_ll_addr_random_get();
+            inita_rnd = true;
         }
 
     /* XXX: do this ahead of time? Calculate the local rpa I mean */
@@ -3141,25 +3144,32 @@ ble_ll_conn_prepare_connect_ind(struct ble_ll_conn_sm *connsm,
                  */
                 rl = &g_ble_ll_resolv_list[addrd->rpa_index];
                 if (rl->rl_has_local) {
-                    hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
                     ble_ll_resolv_get_priv_addr(rl, 1, pdu_data->inita);
-                    addr = NULL;
+                    inita = NULL;
+                    inita_rnd = true;
                 }
             } else if (ble_ll_resolv_local_rpa_get(connsm->own_addr_type & 1,
                                                    pdu_data->inita) == 0) {
-                hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
-                addr = NULL;
+                inita = NULL;
+                inita_rnd = true;
             }
         }
 #endif
 
-        if (addr) {
-            memcpy(pdu_data->inita, addr, BLE_DEV_ADDR_LEN);
+        if (inita) {
             /* Identity address used */
             connsm->inita_identity_used = 1;
         }
     }
 
+    if (inita) {
+        memcpy(pdu_data->inita, inita, BLE_DEV_ADDR_LEN);
+    }
+
+    if (inita_rnd) {
+        hdr |= BLE_ADV_PDU_HDR_TXADD_RAND;
+    }
+
     memcpy(pdu_data->adva, addrd->adva, BLE_DEV_ADDR_LEN);
 
     pdu_data->hdr_byte = hdr;
diff --git a/nimble/controller/src/ble_ll_hci.c b/nimble/controller/src/ble_ll_hci.c
index 07b0aec1c5..643aa33ddf 100644
--- a/nimble/controller/src/ble_ll_hci.c
+++ b/nimble/controller/src/ble_ll_hci.c
@@ -30,6 +30,7 @@
 #include "controller/ble_ll_scan.h"
 #include "controller/ble_ll.h"
 #include "controller/ble_ll_hci.h"
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_whitelist.h"
 #include "controller/ble_ll_resolv.h"
 #include "controller/ble_ll_sync.h"
@@ -283,9 +284,10 @@ ble_ll_hci_rd_bd_addr(uint8_t *rspbuf, uint8_t *rsplen)
 {
     struct ble_hci_ip_rd_bd_addr_rp *rsp = (void *) rspbuf;
 
-    memcpy(rsp->addr, g_dev_addr, BLE_DEV_ADDR_LEN);
+    memcpy(rsp->addr, ble_ll_addr_public_get(), BLE_DEV_ADDR_LEN);
 
     *rsplen = sizeof(*rsp);
+
     return BLE_ERR_SUCCESS;
 }
 
diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c
index a85919bf66..de3fd5ff70 100644
--- a/nimble/controller/src/ble_ll_scan.c
+++ b/nimble/controller/src/ble_ll_scan.c
@@ -33,6 +33,7 @@
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
 #include "controller/ble_ll_scan_aux.h"
 #endif
+#include <controller/ble_ll_addr.h>
 #include "controller/ble_ll_tmr.h"
 #include "controller/ble_ll_hci.h"
 #include "controller/ble_ll_whitelist.h"
@@ -242,7 +243,7 @@ ble_ll_scan_make_req_pdu(struct ble_ll_scan_sm *scansm, uint8_t *pdu,
                          uint8_t *hdr_byte, uint8_t adva_type,
                          const uint8_t *adva, int rpa_index)
 {
-    uint8_t *scana;
+    const uint8_t *scana;
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
     struct ble_ll_resolv_entry *rl;
     uint8_t rpa[BLE_DEV_ADDR_LEN];
@@ -257,9 +258,9 @@ ble_ll_scan_make_req_pdu(struct ble_ll_scan_sm *scansm, uint8_t *pdu,
     /* Determine ScanA */
     if (scansm->own_addr_type & 0x01) {
         *hdr_byte |= BLE_ADV_PDU_HDR_TXADD_RAND;
-        scana = g_random_addr;
+        scana = ble_ll_addr_random_get();
     } else {
-        scana = g_dev_addr;
+        scana = ble_ll_addr_public_get();
     }
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_PRIVACY)
@@ -936,7 +937,7 @@ ble_ll_scan_sm_start(struct ble_ll_scan_sm *scansm)
     struct ble_ll_scan_phy *scanp;
     struct ble_ll_scan_phy *scanp_next;
 
-    if (!ble_ll_is_valid_own_addr_type(scansm->own_addr_type, g_random_addr)) {
+    if (!ble_ll_addr_is_valid_own_addr_type(scansm->own_addr_type, NULL)) {
         return BLE_ERR_INV_HCI_CMD_PARMS;
     }
 
@@ -1354,7 +1355,7 @@ ble_ll_scan_rx_filter(uint8_t own_addr_type, uint8_t scan_filt_policy,
 
             /* Ignore if not directed to us */
             if ((addrd->targeta_type != (own_addr_type & 0x01)) ||
-                !ble_ll_is_our_devaddr(addrd->targeta, addrd->targeta_type)) {
+                !ble_ll_addr_is_our(addrd->targeta_type, addrd->targeta)) {
                 return -1;
             }
             break;
@@ -1943,7 +1944,7 @@ ble_ll_scan_rx_pkt_in_restore_addr_data(struct ble_mbuf_hdr *hdr,
     }
 
     if (hdr->rxinfo.flags & BLE_MBUF_HDR_F_TARGETA_RESOLVED) {
-        addrd->targeta = ble_ll_get_our_devaddr(scansm->own_addr_type & 1);
+        addrd->targeta = ble_ll_addr_get(scansm->own_addr_type & 1);
         addrd->targeta_type = scansm->own_addr_type & 1;
         addrd->targeta_resolved = 1;
     } else {
diff --git a/nimble/controller/src/ble_ll_scan_aux.c b/nimble/controller/src/ble_ll_scan_aux.c
index 0cb734a240..ca590fd0f9 100644
--- a/nimble/controller/src/ble_ll_scan_aux.c
+++ b/nimble/controller/src/ble_ll_scan_aux.c
@@ -32,6 +32,7 @@
 #include "controller/ble_phy.h"
 #include "controller/ble_hw.h"
 #include "controller/ble_ll.h"
+#include "controller/ble_ll_addr.h"
 #include "controller/ble_ll_pdu.h"
 #include "controller/ble_ll_sched.h"
 #include "controller/ble_ll_scan.h"
@@ -100,14 +101,14 @@ static struct ble_ll_scan_aux_data *aux_data_current;
 
 static void ble_ll_hci_ev_send_ext_adv_truncated_report(struct ble_ll_scan_aux_data *aux);
 
-static inline uint8_t *
+static const uint8_t *
 ble_ll_scan_aux_get_own_addr(void)
 {
     uint8_t own_addr_type;
 
     own_addr_type = ble_ll_scan_get_own_addr_type() & 1;
 
-    return ble_ll_get_our_devaddr(own_addr_type);
+    return ble_ll_addr_get(own_addr_type);
 }
 
 static int
diff --git a/nimble/include/nimble/ble.h b/nimble/include/nimble/ble.h
index d5e41a37c8..4bc832ffb0 100644
--- a/nimble/include/nimble/ble.h
+++ b/nimble/include/nimble/ble.h
@@ -220,12 +220,6 @@ struct ble_mbuf_hdr
 /** Length of a Bluetooth Device Address. */
 #define BLE_DEV_ADDR_LEN        (6)
 
-/**
- * @cond INTERNAL_DOCS
- */
-extern uint8_t g_dev_addr[BLE_DEV_ADDR_LEN];
-extern uint8_t g_random_addr[BLE_DEV_ADDR_LEN];
-
 /* BLE Error Codes (Core v4.2 Vol 2 part D) */
 enum ble_error_codes
 {