refactor hcd, get both control and interrupt endpoint working

4 files changed, 288 insertions, 254 deletions

diff --git a/src/portable/raspberrypi/rp2040/dcd_rp2040.c b/src/portable/raspberrypi/rp2040/dcd_rp2040.c
index 240e6c727..8c7dc83b8 100644
--- a/src/portable/raspberrypi/rp2040/dcd_rp2040.c
+++ b/src/portable/raspberrypi/rp2040/dcd_rp2040.c
@@ -69,6 +69,22 @@ TU_ATTR_ALWAYS_INLINE static inline hw_endpoint_t *hw_endpoint_get_by_addr(uint8
   return hw_endpoint_get(num, dir);
 }
 
+TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwep_ctrl_reg_device(struct hw_endpoint *ep) {
+  const uint8_t epnum = tu_edpt_number(ep->ep_addr);
+  const uint8_t dir   = (uint8_t)tu_edpt_dir(ep->ep_addr);
+  if (epnum == 0) {
+    // EP0 has no endpoint control register because the buffer offsets are fixed and always enabled
+    return NULL;
+  }
+  return (dir == TUSB_DIR_IN) ? &usb_dpram->ep_ctrl[epnum - 1].in : &usb_dpram->ep_ctrl[epnum - 1].out;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwbuf_ctrl_reg_device(struct hw_endpoint *ep) {
+  const uint8_t epnum = tu_edpt_number(ep->ep_addr);
+  const uint8_t dir   = (uint8_t)tu_edpt_dir(ep->ep_addr);
+  return (dir == TUSB_DIR_IN) ? &usb_dpram->ep_buf_ctrl[epnum].in : &usb_dpram->ep_buf_ctrl[epnum].out;
+}
+
 // main processing for dcd_edpt_iso_activate
 static void hw_endpoint_init(hw_endpoint_t *ep, uint8_t ep_addr, uint16_t wMaxPacketSize, uint8_t transfer_type) {
   ep->ep_addr        = ep_addr;
@@ -170,7 +186,10 @@ static void __tusb_irq_path_func(handle_hw_buff_status)(void) {
       const tusb_dir_t dir   = (i & 1u) ? TUSB_DIR_OUT : TUSB_DIR_IN;
       hw_endpoint_t   *ep    = hw_endpoint_get(epnum, dir);
 
-      const bool done = hw_endpoint_xfer_continue(ep);
+      io_rw_32  *ep_reg  = hwep_ctrl_reg_device(ep);
+      io_rw_32  *buf_reg = hwbuf_ctrl_reg_device(ep);
+      const bool done    = hw_endpoint_xfer_continue(ep, ep_reg, buf_reg);
+
       if (done) {
         // Notify usbd
         const uint16_t xferred_len = ep->xferred_len;
@@ -232,7 +251,9 @@ static void __tusb_irq_path_func(dcd_rp2040_irq)(void) {
         hw_endpoint_lock_update(ep, 1);
         if (ep->pending) {
           ep->pending = 0;
-          hw_endpoint_start_next_buffer(ep);
+          io_rw_32 *ep_reg  = hwep_ctrl_reg_device(ep);
+          io_rw_32 *buf_reg = hwbuf_ctrl_reg_device(ep);
+          hw_endpoint_start_next_buffer(ep, ep_reg, buf_reg);
         }
         hw_endpoint_lock_update(ep, -1);
       }
@@ -501,7 +522,9 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_t to
   (void)rhport;
   (void)is_isr;
   hw_endpoint_t *ep = hw_endpoint_get_by_addr(ep_addr);
-  hw_endpoint_xfer_start(ep, buffer, NULL, total_bytes);
+  io_rw_32      *ep_reg  = hwep_ctrl_reg_device(ep);
+  io_rw_32      *buf_reg = hwbuf_ctrl_reg_device(ep);
+  hw_endpoint_xfer_start(ep, ep_reg, buf_reg, buffer, NULL, total_bytes);
   return true;
 }
 
@@ -509,7 +532,9 @@ bool dcd_edpt_xfer_fifo(uint8_t rhport, uint8_t ep_addr, tu_fifo_t *ff, uint16_t
   (void)rhport;
   (void)is_isr;
   hw_endpoint_t *ep = hw_endpoint_get_by_addr(ep_addr);
-  hw_endpoint_xfer_start(ep, NULL, ff, total_bytes);
+  io_rw_32      *ep_reg  = hwep_ctrl_reg_device(ep);
+  io_rw_32      *buf_reg = hwbuf_ctrl_reg_device(ep);
+  hw_endpoint_xfer_start(ep, ep_reg, buf_reg, NULL, ff, total_bytes);
   return true;
 }
 
diff --git a/src/portable/raspberrypi/rp2040/hcd_rp2040.c b/src/portable/raspberrypi/rp2040/hcd_rp2040.c
index 8e3379622..ff2db2499 100644
--- a/src/portable/raspberrypi/rp2040/hcd_rp2040.c
+++ b/src/portable/raspberrypi/rp2040/hcd_rp2040.c
@@ -47,42 +47,42 @@
 // Low level rp2040 controller functions
 //--------------------------------------------------------------------+
 
-#ifndef PICO_USB_HOST_INTERRUPT_ENDPOINTS
-#define PICO_USB_HOST_INTERRUPT_ENDPOINTS (USB_MAX_ENDPOINTS - 1)
-#endif
-static_assert(PICO_USB_HOST_INTERRUPT_ENDPOINTS <= USB_MAX_ENDPOINTS, "");
-
 // Host mode uses one shared endpoint register for non-interrupt endpoint
-static struct hw_endpoint ep_pool[1 + PICO_USB_HOST_INTERRUPT_ENDPOINTS];
-#define epx (ep_pool[0])
-
-static hw_endpoint_t *ep_active = NULL;
+static hcd_endpoint_t  ep_pool[USB_MAX_ENDPOINTS];
+static hcd_endpoint_t *epx = &ep_pool[0]; // current active endpoint
 
 // Flags we set by default in sie_ctrl (we add other bits on top)
 enum {
-  SIE_CTRL_BASE = USB_SIE_CTRL_SOF_EN_BITS      | USB_SIE_CTRL_KEEP_ALIVE_EN_BITS |
-                  USB_SIE_CTRL_PULLDOWN_EN_BITS | USB_SIE_CTRL_EP0_INT_1BUF_BITS
+  SIE_CTRL_BASE      = USB_SIE_CTRL_PULLDOWN_EN_BITS | USB_SIE_CTRL_EP0_INT_1BUF_BITS,
+  SIE_CTRL_BASE_MASK = USB_SIE_CTRL_PULLDOWN_EN_BITS | USB_SIE_CTRL_EP0_INT_1BUF_BITS | USB_SIE_CTRL_SOF_EN_BITS |
+                       USB_SIE_CTRL_KEEP_ALIVE_EN_BITS
+};
+
+enum {
+  SIE_CTRL_SPEED_DISCONNECT = 0,
+  SIE_CTRL_SPEED_LOW        = 1,
+  SIE_CTRL_SPEED_FULL       = 2,
 };
 
 //--------------------------------------------------------------------+
 //
 //--------------------------------------------------------------------+
 
-static hw_endpoint_t *edpt_alloc(void) {
+static hcd_endpoint_t *edpt_alloc(void) {
   for (uint i = 0; i < TU_ARRAY_SIZE(ep_pool); i++) {
-    hw_endpoint_t *ep = &ep_pool[i];
-    if (ep->wMaxPacketSize == 0) {
+    hcd_endpoint_t *ep = &ep_pool[i];
+    if (ep->hwep.wMaxPacketSize == 0) {
       return ep;
     }
   }
   return NULL;
 }
 
-static hw_endpoint_t *edpt_find(uint8_t daddr, uint8_t ep_addr) {
+static hcd_endpoint_t *edpt_find(uint8_t daddr, uint8_t ep_addr) {
   for (uint32_t i = 0; i < TU_ARRAY_SIZE(ep_pool); i++) {
-    struct hw_endpoint *ep = &ep_pool[i];
-    if ((ep->dev_addr == daddr) && (ep->wMaxPacketSize > 0) &&
-        (ep->ep_addr == ep_addr || (tu_edpt_number(ep_addr) == 0 && tu_edpt_number(ep->ep_addr) == 0))) {
+    hcd_endpoint_t *ep = &ep_pool[i];
+    if ((ep->dev_addr == daddr) && (ep->hwep.wMaxPacketSize > 0) &&
+        (ep->hwep.ep_addr == ep_addr || (tu_edpt_number(ep_addr) == 0 && tu_edpt_number(ep->hwep.ep_addr) == 0))) {
       return ep;
     }
   }
@@ -90,6 +90,24 @@ static hw_endpoint_t *edpt_find(uint8_t daddr, uint8_t ep_addr) {
   return NULL;
 }
 
+// static hcd_endpoint_t* epdt_find_interrupt(uint8_t )
+
+TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwep_ctrl_reg_host(hw_endpoint_t *ep) {
+  if (tu_edpt_number(ep->ep_addr) == 0) {
+    return &usbh_dpram->epx_ctrl;
+  }
+  // return &usbh_dpram->int_ep_ctrl[ep->interrupt_num].ctrl;
+  return NULL;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwbuf_ctrl_reg_host(hw_endpoint_t *ep) {
+  if (tu_edpt_number(ep->ep_addr) == 0) {
+    return &usbh_dpram->epx_buf_ctrl;
+  }
+  // return &usbh_dpram->int_ep_buffer_ctrl[ep->interrupt_num].ctrl;
+  return NULL;
+}
+
 //--------------------------------------------------------------------+
 //
 //--------------------------------------------------------------------+
@@ -104,18 +122,17 @@ TU_ATTR_ALWAYS_INLINE static inline bool need_pre(uint8_t dev_addr) {
   return hcd_port_speed_get(0) != tuh_speed_get(dev_addr);
 }
 
-static void __tusb_irq_path_func(hw_xfer_complete)(struct hw_endpoint *ep, xfer_result_t xfer_result) {
+static void __tusb_irq_path_func(hw_xfer_complete)(hcd_endpoint_t *ep, xfer_result_t xfer_result) {
   // Mark transfer as done before we tell the tinyusb stack
-  uint8_t dev_addr = ep->dev_addr;
-  uint8_t ep_addr = ep->ep_addr;
-  uint xferred_len = ep->xferred_len;
-  hw_endpoint_reset_transfer(ep);
+  uint8_t dev_addr    = ep->dev_addr;
+  uint8_t ep_addr     = ep->hwep.ep_addr;
+  uint    xferred_len = ep->hwep.xferred_len;
+  hw_endpoint_reset_transfer(&ep->hwep);
   hcd_event_xfer_complete(dev_addr, ep_addr, xferred_len, xfer_result, true);
 }
 
-static void __tusb_irq_path_func(handle_hwbuf_status_bit)(uint bit, struct hw_endpoint *ep) {
-  usb_hw_clear->buf_status = bit;
-  const bool done          = hw_endpoint_xfer_continue(ep);
+static void __tusb_irq_path_func(handle_hwbuf_status_bit)(hcd_endpoint_t *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg) {
+  const bool done = hw_endpoint_xfer_continue(&ep->hwep, ep_reg, buf_reg);
   if (done) {
     hw_xfer_complete(ep, XFER_RESULT_SUCCESS);
   }
@@ -129,25 +146,35 @@ static void __tusb_irq_path_func(handle_hwbuf_status)(void) {
   uint32_t bit = 1u;
   if (buf_status & bit) {
     buf_status &= ~bit;
-    hw_endpoint_t *ep = ep_active;
-    handle_hwbuf_status_bit(bit, ep);
+    usb_hw_clear->buf_status = bit;
+
+    io_rw_32 *ep_reg  = &usbh_dpram->epx_ctrl;
+    io_rw_32 *buf_reg = &usbh_dpram->epx_buf_ctrl;
+    handle_hwbuf_status_bit(epx, ep_reg, buf_reg);
   }
 
   // Check "interrupt" (asynchronous) endpoints for both IN and OUT
+  // TODO use clz for better efficiency
   for (uint i = 1; i <= USB_HOST_INTERRUPT_ENDPOINTS && buf_status; i++) {
-    // EPX is bit 0 & 1
-    // IEP1 IN  is bit 2
-    // IEP1 OUT is bit 3
-    // IEP2 IN  is bit 4
-    // IEP2 OUT is bit 5
-    // IEP3 IN  is bit 6
-    // IEP3 OUT is bit 7
+    // EPX  IN/OUT is bit 0, 1
+    // IEP1 IN/OUT is bit 2, 3
+    // IEP2 IN/OUT is bit 4, 5
     // etc
     for (uint j = 0; j < 2; j++) {
       bit = 1 << (i * 2 + j);
       if (buf_status & bit) {
         buf_status &= ~bit;
-        handle_hwbuf_status_bit(bit, &ep_pool[i]);
+        usb_hw_clear->buf_status = bit;
+
+        for (uint8_t e = 0; e < USB_MAX_ENDPOINTS; e++) {
+          hcd_endpoint_t *ep = &ep_pool[e];
+          if (ep->interrupt_num == i) {
+            io_rw_32 *ep_reg  = &usbh_dpram->int_ep_ctrl[ep->interrupt_num - 1].ctrl;
+            io_rw_32 *buf_reg = &usbh_dpram->int_ep_buffer_ctrl[ep->interrupt_num - 1].ctrl;
+            handle_hwbuf_status_bit(ep, ep_reg, buf_reg);
+            break;
+          }
+        }
       }
     }
   }
@@ -157,27 +184,24 @@ static void __tusb_irq_path_func(handle_hwbuf_status)(void) {
   }
 }
 
-static void __tusb_irq_path_func(hw_trans_complete)(void) {
-  if (usb_hw->sie_ctrl & USB_SIE_CTRL_SEND_SETUP_BITS) {
-    hw_endpoint_t *ep = ep_active;
-    ep->xferred_len = 8;
-    hw_xfer_complete(ep, XFER_RESULT_SUCCESS);
-  } else {
-    // Don't care. Will handle this in buff status
-    return;
-  }
-}
+// static void edpt_scheduler(void) {
+// }
 
 static void __tusb_irq_path_func(hcd_rp2040_irq)(void) {
   const uint32_t status = usb_hw->ints;
 
   if (status & USB_INTS_HOST_CONN_DIS_BITS) {
-    if (dev_speed()) {
-      hcd_event_device_attach(RHPORT_NATIVE, true);
-    } else {
+    uint8_t speed = dev_speed();
+    if (speed == SIE_CTRL_SPEED_DISCONNECT) {
       hcd_event_device_remove(RHPORT_NATIVE, true);
+    } else {
+      if (speed == SIE_CTRL_SPEED_LOW) {
+        usb_hw->sie_ctrl = SIE_CTRL_BASE | USB_SIE_CTRL_KEEP_ALIVE_EN_BITS;
+      } else {
+        usb_hw->sie_ctrl = SIE_CTRL_BASE | USB_SIE_CTRL_SOF_EN_BITS;
+      }
+      hcd_event_device_attach(RHPORT_NATIVE, true);
     }
-
     usb_hw_clear->sie_status = USB_SIE_STATUS_SPEED_BITS;
   }
 
@@ -187,7 +211,7 @@ static void __tusb_irq_path_func(hcd_rp2040_irq)(void) {
     // AND TRANS_COMPLETE as the stall is an alternative response
     // to one of those events
     usb_hw_clear->sie_status = USB_SIE_STATUS_STALL_REC_BITS;
-    hw_xfer_complete(&epx, XFER_RESULT_STALLED);
+    hw_xfer_complete(epx, XFER_RESULT_STALLED);
   }
 
   if (status & USB_INTS_BUFF_STATUS_BITS) {
@@ -196,7 +220,14 @@ static void __tusb_irq_path_func(hcd_rp2040_irq)(void) {
 
   if (status & USB_INTS_TRANS_COMPLETE_BITS) {
     usb_hw_clear->sie_status = USB_SIE_STATUS_TRANS_COMPLETE_BITS;
-    hw_trans_complete();
+
+    // only handle setup packet
+    if (usb_hw->sie_ctrl & USB_SIE_CTRL_SEND_SETUP_BITS) {
+      epx->hwep.xferred_len = 8;
+      hw_xfer_complete(epx, XFER_RESULT_SUCCESS);
+    } else {
+      // Don't care. Will handle this in buff status
+    }
   }
 
   if (status & USB_INTS_ERROR_RX_TIMEOUT_BITS) {
@@ -205,36 +236,69 @@ static void __tusb_irq_path_func(hcd_rp2040_irq)(void) {
 
   if (status & USB_INTS_ERROR_DATA_SEQ_BITS) {
     usb_hw_clear->sie_status = USB_SIE_STATUS_DATA_SEQ_ERROR_BITS;
-    TU_LOG(3, "  Seq Error: [0] = 0x%04u  [1] = 0x%04x\r\n", tu_u32_low16(*hwbuf_ctrl_reg_host(&epx)),
-           tu_u32_high16(*hwbuf_ctrl_reg_host(&epx)));
     panic("Data Seq Error \n");
   }
 }
 
 void __tusb_irq_path_func(hcd_int_handler)(uint8_t rhport, bool in_isr) {
-  (void) rhport;
-  (void) in_isr;
+  (void)rhport;
+  (void)in_isr;
   hcd_rp2040_irq();
 }
 
-static void hw_endpoint_init(hw_endpoint_t *ep, uint8_t dev_addr, const tusb_desc_endpoint_t *ep_desc) {
+static void hw_endpoint_init(hcd_endpoint_t *ep, uint8_t dev_addr, const tusb_desc_endpoint_t *ep_desc) {
   const uint8_t    ep_addr        = ep_desc->bEndpointAddress;
   const uint16_t   wMaxPacketSize = tu_edpt_packet_size(ep_desc);
   const uint8_t    transfer_type  = ep_desc->bmAttributes.xfer;
-  const uint8_t    bmInterval     = ep_desc->bInterval;
-  const uint8_t    num            = tu_edpt_number(ep_addr);
-  const tusb_dir_t dir            = tu_edpt_dir(ep_addr);
-  ep->ep_addr                     = ep_addr;
-  ep->dev_addr                    = dev_addr;
-  ep->transfer_type               = transfer_type;
+  // const uint8_t    bmInterval     = ep_desc->bInterval;
+
+  ep->hwep.ep_addr        = ep_addr;
+  ep->dev_addr            = dev_addr;
+  ep->transfer_type       = transfer_type;
+  ep->need_pre            = need_pre(dev_addr);
+  ep->hwep.next_pid       = 0u;
+  ep->hwep.wMaxPacketSize = wMaxPacketSize;
+
+  if (transfer_type != TUSB_XFER_INTERRUPT) {
+    ep->hwep.hw_data_buf = usbh_dpram->epx_data;
+  } else {
+    // from 15 interrupt endpoints pool
+    uint8_t int_idx;
+    for (int_idx = 0; int_idx < USB_HOST_INTERRUPT_ENDPOINTS; int_idx++) {
+      if (!tu_bit_test(usb_hw_set->int_ep_ctrl, 1 + int_idx)) {
+        ep->interrupt_num = int_idx + 1;
+        break;
+      }
+    }
+    assert(int_idx < USB_HOST_INTERRUPT_ENDPOINTS);
+    assert(ep_desc->bInterval > 0);
+
+    //------------- dpram buf -------------//
+    // 15x64 last bytes of DPRAM for interrupt endpoint buffers
+    ep->hwep.hw_data_buf = (uint8_t *)(USBCTRL_DPRAM_BASE + USB_DPRAM_MAX - (int_idx + 1u) * 64u);
+    uint32_t ep_ctrl     = EP_CTRL_ENABLE_BITS | EP_CTRL_INTERRUPT_PER_BUFFER |
+                       (TUSB_XFER_INTERRUPT << EP_CTRL_BUFFER_TYPE_LSB) | hw_data_offset(ep->hwep.hw_data_buf) |
+                       (uint32_t)((ep_desc->bInterval - 1) << EP_CTRL_HOST_INTERRUPT_INTERVAL_LSB);
+    usbh_dpram->int_ep_ctrl[int_idx].ctrl = ep_ctrl;
 
-  // Response to a setup packet on EP0 starts with pid of 1
-  ep->next_pid = (num == 0 ? 1u : 0u);
-  ep->wMaxPacketSize = wMaxPacketSize;
+    //------------- address control -------------//
+    const uint8_t epnum     = tu_edpt_number(ep_addr);
+    uint32_t      addr_ctrl = (uint32_t)(dev_addr | (epnum << USB_ADDR_ENDP1_ENDPOINT_LSB));
+    if (tu_edpt_dir(ep_addr) == TUSB_DIR_OUT) {
+      addr_ctrl |= USB_ADDR_ENDP1_INTEP_DIR_BITS;
+    }
+    if (ep->need_pre) {
+      addr_ctrl |= USB_ADDR_ENDP1_INTEP_PREAMBLE_BITS;
+    }
+    usb_hw->int_ep_addr_ctrl[int_idx] = addr_ctrl;
 
-  pico_trace("hw_endpoint_init dev %d ep %02X xfer %d\n", ep->dev_addr, ep->ep_addr, transfer_type);
-  pico_trace("dev %d ep %02X setup buffer @ 0x%p\n", ep->dev_addr, ep->ep_addr, ep->hw_data_buf);
-  uint dpram_offset = hw_data_offset(ep->hw_data_buf);
+    // Finally, activate interrupt endpoint
+    usb_hw_set->int_ep_ctrl |= 1u << ep->interrupt_num;
+  }
+  #if 0
+  pico_trace("hw_endpoint_init dev %d ep %02X xfer %d\n", ep->dev_addr, ep->hwep.ep_addr, transfer_type);
+  pico_trace("dev %d ep %02X setup buffer @ 0x%p\n", ep->dev_addr, ep->hwep.ep_addr, ep->hwep.hw_data_buf);
+  uint dpram_offset = hw_data_offset(ep->hwep.hw_data_buf);
   // Bits 0-5 should be 0
   assert(!(dpram_offset & 0b111111));
 
@@ -271,6 +335,7 @@ static void hw_endpoint_init(hw_endpoint_t *ep, uint8_t dev_addr, const tusb_des
 
     // If it's an interrupt endpoint we need to set up the buffer control register
   }
+  #endif
 }
 
 //--------------------------------------------------------------------+
@@ -312,11 +377,9 @@ bool hcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
 
 bool hcd_deinit(uint8_t rhport) {
   (void) rhport;
-
   irq_remove_handler(USBCTRL_IRQ, hcd_rp2040_irq);
   reset_block(RESETS_RESET_USBCTRL_BITS);
   unreset_block_wait(RESETS_RESET_USBCTRL_BITS);
-
   return true;
 }
 
@@ -330,58 +393,54 @@ void hcd_port_reset_end(uint8_t rhport) {
 }
 
 bool hcd_port_connect_status(uint8_t rhport) {
-  (void) rhport;
+  (void)rhport;
   return usb_hw->sie_status & USB_SIE_STATUS_SPEED_BITS;
 }
 
-tusb_speed_t hcd_port_speed_get(uint8_t rhport)
-{
-  (void) rhport;
-  assert(rhport == 0);
-
-  // TODO: Should enumval this register
-  switch ( dev_speed() )
-  {
-    case 1:
+tusb_speed_t hcd_port_speed_get(uint8_t rhport) {
+  (void)rhport;
+  switch (dev_speed()) {
+    case SIE_CTRL_SPEED_LOW:
       return TUSB_SPEED_LOW;
-    case 2:
+    case SIE_CTRL_SPEED_FULL:
       return TUSB_SPEED_FULL;
     default:
-      panic("Invalid speed\n");
-      // return TUSB_SPEED_INVALID;
+      return TUSB_SPEED_INVALID;
   }
 }
 
 // Close all opened endpoint belong to this device
 void hcd_device_close(uint8_t rhport, uint8_t dev_addr) {
-  pico_trace("hcd_device_close %d\n", dev_addr);
-  (void) rhport;
+  (void)rhport;
+  (void)dev_addr;
 
+  #if 0
   // reset epx if it is currently active with unplugged device
-  if (epx.wMaxPacketSize > 0 && epx.active && epx.dev_addr == dev_addr) {
-    epx.wMaxPacketSize         = 0;
+  if (epx.hw_ep.wMaxPacketSize > 0 && epx.hw_ep.active && epx.dev_addr == dev_addr) {
+    epx.hw_ep.wMaxPacketSize   = 0;
     *hwep_ctrl_reg_host(&epx)  = 0;
     *hwbuf_ctrl_reg_host(&epx) = 0;
-    hw_endpoint_reset_transfer(&epx);
+    hw_endpoint_reset_transfer(&epx.hw_ep);
   }
 
   // dev0 only has ep0
   if (dev_addr != 0) {
     for (size_t i = 1; i < TU_ARRAY_SIZE(ep_pool); i++) {
-      hw_endpoint_t *ep = &ep_pool[i];
-      if (ep->dev_addr == dev_addr && ep->wMaxPacketSize > 0) {
+      hcd_endpoint_t *ep = &ep_pool[i];
+      if (ep->dev_addr == dev_addr && ep->hwep.wMaxPacketSize > 0) {
         // in case it is an interrupt endpoint, disable it
         usb_hw_clear->int_ep_ctrl = (1 << (ep->interrupt_num + 1));
         usb_hw->int_ep_addr_ctrl[ep->interrupt_num] = 0;
 
         // unconfigure the endpoint
-        ep->wMaxPacketSize       = 0;
+        ep->hwep.wMaxPacketSize = 0;
         *hwep_ctrl_reg_host(ep)  = 0;
         *hwbuf_ctrl_reg_host(ep) = 0;
-        hw_endpoint_reset_transfer(ep);
+        hw_endpoint_reset_transfer(&ep->hwep);
       }
     }
   }
+  #endif
 }
 
 uint32_t hcd_frame_number(uint8_t rhport) {
@@ -405,9 +464,9 @@ void hcd_int_disable(uint8_t rhport) {
 //--------------------------------------------------------------------+
 bool hcd_edpt_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_endpoint_t *ep_desc) {
   (void)rhport;
-  hw_endpoint_t *ep = edpt_alloc();
+  pico_trace("hcd_edpt_open dev_addr %d, ep_addr %d\n", dev_addr, ep_desc->bEndpointAddress);
+  hcd_endpoint_t *ep = edpt_alloc();
   TU_ASSERT(ep);
-
   hw_endpoint_init(ep, dev_addr, ep_desc);
 
   return true;
@@ -420,46 +479,49 @@ bool hcd_edpt_close(uint8_t rhport, uint8_t daddr, uint8_t ep_addr) {
   return false; // TODO not implemented yet
 }
 
-// xfer using epx
-static bool edpt_xfer(hw_endpoint_t *ep, uint8_t *buffer, tu_fifo_t *ff, uint16_t total_len) {
-  const uint8_t    ep_num = tu_edpt_number(ep->ep_addr);
-  const tusb_dir_t ep_dir = tu_edpt_dir(ep->ep_addr);
+TU_ATTR_ALWAYS_INLINE static inline void sie_start_xfer(uint32_t value) {
+  value |= (usb_hw->sie_ctrl & SIE_CTRL_BASE_MASK); // preserve base bits
 
-  ep->remaining_len = total_len;
-  ep->xferred_len   = 0;
-  ep->active        = true;
+  // START_TRANS bit on SIE_CTRL has the same behavior as the AVAILABLE bit
+  // described in RP2040 Datasheet, release 2.1, section "4.1.2.5.1. Concurrent access".
+  // We write everything except the START_TRANS bit first, then wait some cycles.
+  usb_hw->sie_ctrl = value;
+  busy_wait_at_least_cycles(12);
+  usb_hw->sie_ctrl = value | USB_SIE_CTRL_START_TRANS_BITS;
+}
 
-  if (ff != NULL) {
-    ep->user_fifo    = ff;
-    ep->is_xfer_fifo = true;
+// xfer using epx
+static bool edpt_xfer(hcd_endpoint_t *ep, uint8_t *buffer, tu_fifo_t *ff, uint16_t total_len) {
+  if (ep->transfer_type == TUSB_XFER_INTERRUPT) {
+    // For interrupt endpoint control and buffer is already configured
+    // Note: Interrupt is single buffered only
+    io_rw_32 *ep_reg  = &usbh_dpram->int_ep_ctrl[ep->interrupt_num - 1].ctrl;
+    io_rw_32 *buf_reg = &usbh_dpram->int_ep_buffer_ctrl[ep->interrupt_num - 1].ctrl;
+    hw_endpoint_xfer_start(&ep->hwep, ep_reg, buf_reg, buffer, ff, total_len);
   } else {
-    ep->user_buf     = buffer;
-    ep->is_xfer_fifo = false;
-  }
+    const uint8_t    ep_num = tu_edpt_number(ep->hwep.ep_addr);
+    const tusb_dir_t ep_dir = tu_edpt_dir(ep->hwep.ep_addr);
 
-  ep_active = ep;
+    // ep control
+    const uint32_t dpram_offset = hw_data_offset(ep->hwep.hw_data_buf);
+    const uint32_t ep_ctrl      = EP_CTRL_ENABLE_BITS | EP_CTRL_INTERRUPT_PER_BUFFER |
+                             ((uint32_t)ep->transfer_type << EP_CTRL_BUFFER_TYPE_LSB) | dpram_offset;
+    usbh_dpram->epx_ctrl = ep_ctrl;
 
-  ep->hw_data_buf   = &usbh_dpram->epx_data[0];
-  uint dpram_offset = hw_data_offset(ep->hw_data_buf);
-
-  // Fill in endpoint control register with buffer offset
-  uint32_t ctrl_value = EP_CTRL_ENABLE_BITS | EP_CTRL_INTERRUPT_PER_BUFFER |
-                        ((uint32_t)ep->transfer_type << EP_CTRL_BUFFER_TYPE_LSB) | dpram_offset;
-  usbh_dpram->epx_ctrl = ctrl_value;
+    io_rw_32 *ep_reg  = &usbh_dpram->epx_ctrl;
+    io_rw_32 *buf_reg = &usbh_dpram->epx_buf_ctrl;
+    hw_endpoint_xfer_start(&ep->hwep, ep_reg, buf_reg, buffer, ff, total_len);
 
-  hw_endpoint_start_next_buffer(ep);
+    // addr control
+    usb_hw->dev_addr_ctrl = (uint32_t)(ep->dev_addr | (ep_num << USB_ADDR_ENDP_ENDPOINT_LSB));
 
-  usb_hw->dev_addr_ctrl = (uint32_t)(ep->dev_addr | (ep_num << USB_ADDR_ENDP_ENDPOINT_LSB));
-  uint32_t flags        = USB_SIE_CTRL_START_TRANS_BITS | SIE_CTRL_BASE |
-                   (ep_dir ? USB_SIE_CTRL_RECEIVE_DATA_BITS : USB_SIE_CTRL_SEND_DATA_BITS) |
-                   (need_pre(ep->dev_addr) ? USB_SIE_CTRL_PREAMBLE_EN_BITS : 0);
+    epx = ep;
 
-  // START_TRANS bit on SIE_CTRL seems to exhibit the same behavior as the AVAILABLE bit
-  // described in RP2040 Datasheet, release 2.1, section "4.1.2.5.1. Concurrent access".
-  // We write everything except the START_TRANS bit first, then wait some cycles.
-  usb_hw->sie_ctrl = flags & ~USB_SIE_CTRL_START_TRANS_BITS;
-  busy_wait_at_least_cycles(12);
-  usb_hw->sie_ctrl = flags;
+    // start transfer
+    const uint32_t sie_ctrl = (ep_dir ? USB_SIE_CTRL_RECEIVE_DATA_BITS : USB_SIE_CTRL_SEND_DATA_BITS) |
+                              (ep->need_pre ? USB_SIE_CTRL_PREAMBLE_EN_BITS : 0);
+    sie_start_xfer(sie_ctrl);
+  }
 
   return true;
 }
@@ -467,13 +529,13 @@ static bool edpt_xfer(hw_endpoint_t *ep, uint8_t *buffer, tu_fifo_t *ff, uint16_
 bool hcd_edpt_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr, uint8_t *buffer, uint16_t buflen) {
   (void)rhport;
 
-  hw_endpoint_t *ep = edpt_find(dev_addr, ep_addr);
+  hcd_endpoint_t *ep = edpt_find(dev_addr, ep_addr);
   TU_ASSERT(ep);
 
   // Control endpoint can change direction 0x00 <-> 0x80
-  if (tu_edpt_number(ep_addr) == 0) {
-    ep->ep_addr  = ep_addr;
-    ep->next_pid = 1; // data and status stage start with DATA1
+  if (ep_addr != ep->hwep.ep_addr) {
+    ep->hwep.ep_addr  = ep_addr;
+    ep->hwep.next_pid = 1; // data and status stage start with DATA1
   }
 
   edpt_xfer(ep, buffer, NULL, buflen);
@@ -518,9 +580,9 @@ bool hcd_edpt_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr, uint8_t *b
 }
 
 bool hcd_edpt_abort_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr) {
-  (void) rhport;
-  (void) dev_addr;
-  (void) ep_addr;
+  (void)rhport;
+  (void)dev_addr;
+  (void)ep_addr;
   // TODO not implemented yet
   return false;
 }
@@ -533,38 +595,30 @@ bool hcd_setup_send(uint8_t rhport, uint8_t dev_addr, const uint8_t setup_packet
     usbh_dpram->setup_packet[i] = setup_packet[i];
   }
 
-  // Configure EP0 struct with setup info for the trans complete
-  // hw_endpoint_t *ep = hw_endpoint_allocate((uint8_t)TUSB_XFER_CONTROL);
-  hw_endpoint_t *ep = edpt_find(dev_addr, 0x00);
+  hcd_endpoint_t *ep = edpt_find(dev_addr, 0x00);
   TU_ASSERT(ep);
 
-  ep->ep_addr       = 0; // setup is OUT
-  ep->remaining_len = 8;
-  ep->active        = true;
+  ep->hwep.ep_addr       = 0; // setup is OUT
+  ep->hwep.remaining_len = 8;
+  ep->hwep.xferred_len   = 0;
+  ep->hwep.active        = true;
 
-  ep_active = ep;
+  epx = ep;
 
   // Set device address
   usb_hw->dev_addr_ctrl = dev_addr;
 
   // Set pre if we are a low speed device on full speed hub
-  uint32_t const flags = SIE_CTRL_BASE | USB_SIE_CTRL_SEND_SETUP_BITS | USB_SIE_CTRL_START_TRANS_BITS |
-                         (need_pre(dev_addr) ? USB_SIE_CTRL_PREAMBLE_EN_BITS : 0);
-
-  // START_TRANS bit on SIE_CTRL seems to exhibit the same behavior as the AVAILABLE bit
-  // described in RP2040 Datasheet, release 2.1, section "4.1.2.5.1. Concurrent access".
-  // We write everything except the START_TRANS bit first, then wait some cycles.
-  usb_hw->sie_ctrl = flags & ~USB_SIE_CTRL_START_TRANS_BITS;
-  busy_wait_at_least_cycles(12);
-  usb_hw->sie_ctrl = flags;
+  const uint32_t sie_ctrl = USB_SIE_CTRL_SEND_SETUP_BITS | (ep->need_pre ? USB_SIE_CTRL_PREAMBLE_EN_BITS : 0);
+  sie_start_xfer(sie_ctrl);
 
   return true;
 }
 
 bool hcd_edpt_clear_stall(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr) {
-  (void) rhport;
-  (void) dev_addr;
-  (void) ep_addr;
+  (void)rhport;
+  (void)dev_addr;
+  (void)ep_addr;
 
   panic("hcd_clear_stall");
   // return true;
diff --git a/src/portable/raspberrypi/rp2040/rp2040_usb.c b/src/portable/raspberrypi/rp2040/rp2040_usb.c
index 3b65f57a4..74c6bf655 100644
--- a/src/portable/raspberrypi/rp2040/rp2040_usb.c
+++ b/src/portable/raspberrypi/rp2040/rp2040_usb.c
@@ -35,7 +35,7 @@
 //--------------------------------------------------------------------+
 // MACRO CONSTANT TYPEDEF PROTOTYPE
 //--------------------------------------------------------------------+
-static void sync_xfer(hw_endpoint_t *ep);
+static void sync_xfer(hw_endpoint_t *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg);
 
   #if TUD_OPT_RP2040_USB_DEVICE_UFRAME_FIX
 static bool e15_is_critical_frame_period(struct hw_endpoint *ep);
@@ -92,6 +92,7 @@ void __tusb_irq_path_func(hw_endpoint_reset_transfer)(struct hw_endpoint* ep) {
   ep->remaining_len = 0;
   ep->xferred_len = 0;
   ep->user_buf = 0;
+  ep->is_xfer_fifo  = false;
 }
 
 void __tusb_irq_path_func(hwbuf_ctrl_update)(io_rw_32 *buf_ctrl_reg, uint32_t and_mask, uint32_t or_mask) {
@@ -124,7 +125,7 @@ void __tusb_irq_path_func(hwbuf_ctrl_update)(io_rw_32 *buf_ctrl_reg, uint32_t an
 }
 
 // prepare buffer, move data if tx, return buffer control
-static uint32_t __tusb_irq_path_func(prepare_ep_buffer)(struct hw_endpoint *ep, uint8_t buf_id, bool is_rx) {
+uint32_t __tusb_irq_path_func(hwbuf_prepare)(struct hw_endpoint *ep, uint8_t buf_id, bool is_rx) {
   const uint16_t buflen = tu_min16(ep->remaining_len, ep->wMaxPacketSize);
   ep->remaining_len = (uint16_t) (ep->remaining_len - buflen);
 
@@ -166,33 +167,23 @@ static uint32_t __tusb_irq_path_func(prepare_ep_buffer)(struct hw_endpoint *ep,
 }
 
 // Prepare buffer control register value
-void __tusb_irq_path_func(hw_endpoint_start_next_buffer)(struct hw_endpoint* ep) {
+void __tusb_irq_path_func(hw_endpoint_start_next_buffer)(struct hw_endpoint *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg) {
   const tusb_dir_t dir = tu_edpt_dir(ep->ep_addr);
-  bool      is_rx;
-  bool      is_host = false;
-  io_rw_32 *ep_ctrl_reg;
-  io_rw_32 *buf_ctrl_reg;
+  const bool       is_host = rp2usb_is_host_mode();
 
-  #if CFG_TUH_ENABLED
-  is_host = rp2usb_is_host_mode();
+  bool is_rx;
   if (is_host) {
-    buf_ctrl_reg = hwbuf_ctrl_reg_host(ep);
-    ep_ctrl_reg  = hwep_ctrl_reg_host(ep);
-    is_rx        = (dir == TUSB_DIR_IN);
-  } else
-  #endif
-  {
-    buf_ctrl_reg = hwbuf_ctrl_reg_device(ep);
-    ep_ctrl_reg  = hwep_ctrl_reg_device(ep);
-    is_rx        = (dir == TUSB_DIR_OUT);
+    is_rx = (dir == TUSB_DIR_IN);
+  } else {
+    is_rx = (dir == TUSB_DIR_OUT);
   }
 
   // always compute and start with buffer 0
-  uint32_t buf_ctrl = prepare_ep_buffer(ep, 0, is_rx) | USB_BUF_CTRL_SEL;
+  uint32_t buf_ctrl = hwbuf_prepare(ep, 0, is_rx) | USB_BUF_CTRL_SEL;
 
   // EP0 has no endpoint control register, also usbd only schedule 1 packet at a time (single buffer)
-  if (ep_ctrl_reg != NULL) {
-    uint32_t ep_ctrl = *ep_ctrl_reg;
+  if (ep_reg != NULL) {
+    uint32_t ep_ctrl = *ep_reg;
 
     // For now: skip double buffered for RX e.g OUT endpoint in Device mode, since host could send < 64 bytes and cause
     // short packet on buffer0
@@ -205,7 +196,7 @@ void __tusb_irq_path_func(hw_endpoint_start_next_buffer)(struct hw_endpoint* ep)
       // Use buffer 1 (double buffered) if there is still data
       // TODO: Isochronous for buffer1 bit-field is different than CBI (control bulk, interrupt)
 
-      buf_ctrl |= prepare_ep_buffer(ep, 1, is_rx);
+      buf_ctrl |= hwbuf_prepare(ep, 1, is_rx);
 
       // Set endpoint control double buffered bit if needed
       ep_ctrl &= ~EP_CTRL_INTERRUPT_PER_BUFFER;
@@ -216,17 +207,18 @@ void __tusb_irq_path_func(hw_endpoint_start_next_buffer)(struct hw_endpoint* ep)
       ep_ctrl |= EP_CTRL_INTERRUPT_PER_BUFFER;
     }
 
-    *ep_ctrl_reg = ep_ctrl;
+    *ep_reg = ep_ctrl;
   }
 
   TU_LOG(3, "  Prepare BufCtrl: [0] = 0x%04x  [1] = 0x%04x\r\n", tu_u32_low16(buf_ctrl), tu_u32_high16(buf_ctrl));
 
   // Finally, write to buffer_control which will trigger the transfer
   // the next time the controller polls this dpram address
-  hwbuf_ctrl_set(buf_ctrl_reg, buf_ctrl);
+  hwbuf_ctrl_set(buf_reg, buf_ctrl);
 }
 
-void hw_endpoint_xfer_start(struct hw_endpoint *ep, uint8_t *buffer, tu_fifo_t *ff, uint16_t total_len) {
+void hw_endpoint_xfer_start(struct hw_endpoint *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg, uint8_t *buffer, tu_fifo_t *ff,
+                            uint16_t total_len) {
   hw_endpoint_lock_update(ep, 1);
 
   if (ep->active) {
@@ -258,15 +250,14 @@ void hw_endpoint_xfer_start(struct hw_endpoint *ep, uint8_t *buffer, tu_fifo_t *
   } else
   #endif
   {
-    hw_endpoint_start_next_buffer(ep);
+    hw_endpoint_start_next_buffer(ep, ep_reg, buf_reg);
   }
 
   hw_endpoint_lock_update(ep, -1);
 }
 
 // sync endpoint buffer and return transferred bytes
-static uint16_t __tusb_irq_path_func(sync_ep_buffer)(hw_endpoint_t *ep, io_rw_32 *buf_ctrl_reg, uint8_t buf_id,
-                                                     bool is_rx) {
+uint16_t __tusb_irq_path_func(hwbuf_sync)(hw_endpoint_t *ep, io_rw_32 *buf_ctrl_reg, uint8_t buf_id, bool is_rx) {
   uint32_t buf_ctrl = *buf_ctrl_reg;
   if (buf_id) {
     buf_ctrl = buf_ctrl >> 16;
@@ -304,37 +295,26 @@ static uint16_t __tusb_irq_path_func(sync_ep_buffer)(hw_endpoint_t *ep, io_rw_32
 }
 
 // Update hw endpoint struct with info from hardware after a buff status interrupt
-static void __tusb_irq_path_func(sync_xfer)(hw_endpoint_t *ep) {
+static void __tusb_irq_path_func(sync_xfer)(hw_endpoint_t *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg) {
   // const uint8_t    ep_num  = tu_edpt_number(ep->ep_addr);
   const tusb_dir_t dir     = tu_edpt_dir(ep->ep_addr);
+  const bool       is_host = rp2usb_is_host_mode();
+  bool             is_rx;
 
-  io_rw_32 *buf_ctrl_reg;
-  io_rw_32 *ep_ctrl_reg;
-  bool      is_rx;
-
-  #if CFG_TUH_ENABLED
-  const bool is_host = rp2usb_is_host_mode();
   if (is_host) {
-    buf_ctrl_reg = hwbuf_ctrl_reg_host(ep);
-    ep_ctrl_reg  = hwep_ctrl_reg_host(ep);
-    is_rx        = (dir == TUSB_DIR_IN);
-  } else
-  #endif
-  {
-    buf_ctrl_reg = hwbuf_ctrl_reg_device(ep);
-    ep_ctrl_reg  = hwep_ctrl_reg_device(ep);
-    is_rx        = (dir == TUSB_DIR_OUT);
+    is_rx = (dir == TUSB_DIR_IN);
+  } else {
+    is_rx = (dir == TUSB_DIR_OUT);
   }
 
-  TU_LOG(3, "  Sync BufCtrl: [0] = 0x%04x  [1] = 0x%04x\r\n", tu_u32_low16(*buf_ctrl_reg),
-         tu_u32_high16(*buf_ctrl_reg));
-  uint16_t buf0_bytes = sync_ep_buffer(ep, buf_ctrl_reg, 0, is_rx); // always sync buffer 0
+  TU_LOG(3, "  Sync BufCtrl: [0] = 0x%04x  [1] = 0x%04x\r\n", tu_u32_low16(*buf_reg), tu_u32_high16(*buf_reg));
+  uint16_t buf0_bytes = hwbuf_sync(ep, buf_reg, 0, is_rx); // always sync buffer 0
 
   // sync buffer 1 if double buffered
-  if (ep_ctrl_reg != NULL && (*ep_ctrl_reg) & EP_CTRL_DOUBLE_BUFFERED_BITS) {
+  if (ep_reg != NULL && (*ep_reg) & EP_CTRL_DOUBLE_BUFFERED_BITS) {
     if (buf0_bytes == ep->wMaxPacketSize) {
       // sync buffer 1 if not short packet
-      sync_ep_buffer(ep, buf_ctrl_reg, 1, is_rx);
+      hwbuf_sync(ep, buf_reg, 1, is_rx);
     } else {
       // short packet on buffer 0
       // TODO couldn't figure out how to handle this case which happen with net_lwip_webserver example
@@ -368,7 +348,7 @@ static void __tusb_irq_path_func(sync_xfer)(hw_endpoint_t *ep) {
 }
 
 // Returns true if transfer is complete
-bool __tusb_irq_path_func(hw_endpoint_xfer_continue)(struct hw_endpoint* ep) {
+bool __tusb_irq_path_func(hw_endpoint_xfer_continue)(struct hw_endpoint *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg) {
   hw_endpoint_lock_update(ep, 1);
 
   // Part way through a transfer
@@ -376,7 +356,7 @@ bool __tusb_irq_path_func(hw_endpoint_xfer_continue)(struct hw_endpoint* ep) {
     panic("Can't continue xfer on inactive ep %02X", ep->ep_addr);
   }
 
-  sync_xfer(ep); // Update EP struct from hardware state
+  sync_xfer(ep, ep_reg, buf_reg); // Update EP struct from hardware state
 
   // Now we have synced our state with the hardware. Is there more data to transfer?
   // If we are done then notify tinyusb
@@ -392,7 +372,7 @@ bool __tusb_irq_path_func(hw_endpoint_xfer_continue)(struct hw_endpoint* ep) {
     } else
   #endif
     {
-      hw_endpoint_start_next_buffer(ep);
+      hw_endpoint_start_next_buffer(ep, ep_reg, buf_reg);
     }
   }
 
diff --git a/src/portable/raspberrypi/rp2040/rp2040_usb.h b/src/portable/raspberrypi/rp2040/rp2040_usb.h
index 682e9dab4..ac1d8610a 100644
--- a/src/portable/raspberrypi/rp2040/rp2040_usb.h
+++ b/src/portable/raspberrypi/rp2040/rp2040_usb.h
@@ -72,13 +72,6 @@ typedef struct hw_endpoint {
   uint8_t pending;     // Transfer scheduled but not active
 #endif
 
-#if CFG_TUH_ENABLED
-  uint8_t dev_addr;
-  uint8_t interrupt_num; // for host interrupt endpoints
-  uint8_t transfer_type;
-  bool    need_pre;        // need preamble for low speed device behind full speed hub
-#endif
-
   uint16_t wMaxPacketSize; // max packet size also indicates configured
   uint8_t *hw_data_buf; // Buffer pointer in usb dpram
 
@@ -92,6 +85,15 @@ typedef struct hw_endpoint {
 
 } hw_endpoint_t;
 
+// Host controller endpoint
+typedef struct {
+  hw_endpoint_t hwep;
+  uint8_t       dev_addr;
+  uint8_t       interrupt_num; // 1-15 for interrupt endpoints
+  uint8_t       transfer_type;
+  bool          need_pre;      // need preamble for low speed device behind full speed hub
+} hcd_endpoint_t;
+
 #if TUD_OPT_RP2040_USB_DEVICE_UFRAME_FIX
 extern volatile uint32_t e15_last_sof;
 #endif
@@ -103,10 +105,14 @@ TU_ATTR_ALWAYS_INLINE static inline bool rp2usb_is_host_mode(void) {
   return (usb_hw->main_ctrl & USB_MAIN_CTRL_HOST_NDEVICE_BITS) ? true : false;
 }
 
-void hw_endpoint_xfer_start(struct hw_endpoint *ep, uint8_t *buffer, tu_fifo_t *ff, uint16_t total_len);
-bool hw_endpoint_xfer_continue(struct hw_endpoint *ep);
+//--------------------------------------------------------------------+
+// Hardware Endpoint
+//--------------------------------------------------------------------+
+void hw_endpoint_xfer_start(struct hw_endpoint *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg, uint8_t *buffer, tu_fifo_t *ff,
+                            uint16_t total_len);
+bool hw_endpoint_xfer_continue(struct hw_endpoint *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg);
 void hw_endpoint_reset_transfer(struct hw_endpoint *ep);
-void hw_endpoint_start_next_buffer(struct hw_endpoint *ep);
+void hw_endpoint_start_next_buffer(struct hw_endpoint *ep, io_rw_32 *ep_reg, io_rw_32 *buf_reg);
 
 TU_ATTR_ALWAYS_INLINE static inline void hw_endpoint_lock_update(__unused struct hw_endpoint * ep, __unused int delta) {
   // todo add critsec as necessary to prevent issues between worker and IRQ...
@@ -114,43 +120,12 @@ TU_ATTR_ALWAYS_INLINE static inline void hw_endpoint_lock_update(__unused struct
   //  sense to have worker and IRQ on same core, however I think using critsec is about equivalent.
 }
 
-// #if CFG_TUD_ENABLED
-TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwep_ctrl_reg_device(struct hw_endpoint *ep) {
-  uint8_t const epnum = tu_edpt_number(ep->ep_addr);
-  const uint8_t dir   = (uint8_t)tu_edpt_dir(ep->ep_addr);
-  if (epnum == 0) {
-    // EP0 has no endpoint control register because the buffer offsets are fixed and always enabled
-    return NULL;
-  }
-  return (dir == TUSB_DIR_IN) ? &usb_dpram->ep_ctrl[epnum - 1].in : &usb_dpram->ep_ctrl[epnum - 1].out;
-}
-
-TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwbuf_ctrl_reg_device(struct hw_endpoint *ep) {
-  const uint8_t epnum = tu_edpt_number(ep->ep_addr);
-  const uint8_t dir   = (uint8_t)tu_edpt_dir(ep->ep_addr);
-  return (dir == TUSB_DIR_IN) ? &usb_dpram->ep_buf_ctrl[epnum].in : &usb_dpram->ep_buf_ctrl[epnum].out;
-}
-// #endif
-
-#if CFG_TUH_ENABLED
-TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwep_ctrl_reg_host(struct hw_endpoint *ep) {
-  if (tu_edpt_number(ep->ep_addr) == 0) {
-    return &usbh_dpram->epx_ctrl;
-  }
-  return &usbh_dpram->int_ep_ctrl[ep->interrupt_num].ctrl;
-}
-
-TU_ATTR_ALWAYS_INLINE static inline io_rw_32 *hwbuf_ctrl_reg_host(struct hw_endpoint *ep) {
-  if (tu_edpt_number(ep->ep_addr) == 0) {
-    return &usbh_dpram->epx_buf_ctrl;
-  }
-  return &usbh_dpram->int_ep_buffer_ctrl[ep->interrupt_num].ctrl;
-}
-#endif
-
 //--------------------------------------------------------------------+
-//
+// Hardware Buffer
 //--------------------------------------------------------------------+
+uint32_t hwbuf_prepare(struct hw_endpoint *ep, uint8_t buf_id, bool is_rx);
+uint16_t hwbuf_sync(hw_endpoint_t *ep, io_rw_32 *buf_ctrl_reg, uint8_t buf_id, bool is_rx);
+
 void hwbuf_ctrl_update(io_rw_32 *buf_ctrl_reg, uint32_t and_mask, uint32_t or_mask);
 
 TU_ATTR_ALWAYS_INLINE static inline void hwbuf_ctrl_set(io_rw_32 *buf_ctrl_reg, uint32_t value) {