[PATCH 4/7] USB: gadget: Fix bug in endpoint feature request processing in ci13xxx_udc

[Pavankumar Kondeti <pkondeti@codeaurora.org>]

The OUT endpoints are stored in 0 - hw_ep_max/2 and IN endpoints are
stored from hw_ep_max/2 - hw_ep_max in ci13xxx_ep array.  Retrieve
the IN endpoint correctly while processing endpoint feature requests.

Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
---
 drivers/usb/gadget/ci13xxx_udc.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
index 92498ae..1b095cb 100644
--- a/drivers/usb/gadget/ci13xxx_udc.c
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -1894,7 +1894,7 @@ __acquires(udc->lock)
 
 	for (i = 0; i < hw_ep_max; i++) {
 		struct ci13xxx_ep *mEp  = &udc->ci13xxx_ep[i];
-		int type, num, err = -EINVAL;
+		int type, num, dir, err = -EINVAL;
 		struct usb_ctrlrequest req;
 
 		if (mEp->desc == NULL)
@@ -1952,7 +1952,10 @@ __acquires(udc->lock)
 				if (req.wLength != 0)
 					break;
 				num  = le16_to_cpu(req.wIndex);
+				dir = num & USB_ENDPOINT_DIR_MASK;
 				num &= USB_ENDPOINT_NUMBER_MASK;
+				if (dir) /* TX */
+					num += hw_ep_max/2;
 				if (!udc->ci13xxx_ep[num].wedge) {
 					spin_unlock(udc->lock);
 					err = usb_ep_clear_halt(
@@ -2001,7 +2004,10 @@ __acquires(udc->lock)
 				if (req.wLength != 0)
 					break;
 				num  = le16_to_cpu(req.wIndex);
+				dir = num & USB_ENDPOINT_DIR_MASK;
 				num &= USB_ENDPOINT_NUMBER_MASK;
+				if (dir) /* TX */
+					num += hw_ep_max/2;
 
 				spin_unlock(udc->lock);
 				err = usb_ep_set_halt(&udc->ci13xxx_ep[num].ep);
-- 
Sent by a consultant of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.