_hw_endpoint_start_next_buffer behaviour when calling with EP0

[conkerkh]

A function below when called with endpoint 0 or 0x80 will clearly access Null ptr, since there is no control ep for ep0. Am I missing something or it's a bug?

tinyusb/src/portable/raspberrypi/rp2040/rp2040_usb.c

Lines 142 to 178 in d6fb185

	static void _hw_endpoint_start_next_buffer(struct hw_endpoint *ep)
	{
	uint32_t ep_ctrl = *ep->endpoint_control;
	// always compute and start with buffer 0
	uint32_t buf_ctrl = prepare_ep_buffer(ep, 0) | USB_BUF_CTRL_SEL;
	// For now: skip double buffered for Device mode, OUT endpoint since
	// host could send < 64 bytes and cause short packet on buffer0
	// NOTE this could happen to Host mode IN endpoint
	bool const force_single = !(usb_hw->main_ctrl & USB_MAIN_CTRL_HOST_NDEVICE_BITS) && !tu_edpt_dir(ep->ep_addr);
	if(ep->remaining_len && !force_single)
	{
	// Use buffer 1 (double buffered) if there is still data
	// TODO: Isochronous for buffer1 bit-field is different than CBI (control bulk, interrupt)
	buf_ctrl |= prepare_ep_buffer(ep, 1);
	// Set endpoint control double buffered bit if needed
	ep_ctrl &= ~EP_CTRL_INTERRUPT_PER_BUFFER;
	ep_ctrl |= EP_CTRL_DOUBLE_BUFFERED_BITS | EP_CTRL_INTERRUPT_PER_DOUBLE_BUFFER;
	}else
	{
	// Single buffered since 1 is enough
	ep_ctrl &= ~(EP_CTRL_DOUBLE_BUFFERED_BITS | EP_CTRL_INTERRUPT_PER_DOUBLE_BUFFER);
	ep_ctrl |= EP_CTRL_INTERRUPT_PER_BUFFER;
	}
	*ep->endpoint_control = ep_ctrl;
	TU_LOG(3, " Prepare BufCtrl: [0] = 0x%04u [1] = 0x%04x\r\n", tu_u32_low16(buf_ctrl), tu_u32_high16(buf_ctrl));
	// Finally, write to buffer_control which will trigger the transfer
	// the next time the controller polls this dpram address
	_hw_endpoint_buffer_control_set_value32(ep, buf_ctrl);
	}

[hathach]

sorry, late to response, I don't quite understand your point. Can you provide the context also a bit of explanation in which it would cause the null ptr access.