libpayload: Fix b0b4a52b70f0d7c09241f0f718a179fc55d85179

The removal of bitfields came with some glitches in the UHCI driver. This
fixes it.

Change-Id: Iba8ea3b56b03c526eca7b6388c019568e00be6f5
Signed-off-by: Nico Huber <nico.huber@secunet.com>
Reviewed-on: http://review.coreboot.org/1069
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <patrick@georgi-clan.de>
diff --git a/payloads/libpayload/drivers/usb/uhci.c b/payloads/libpayload/drivers/usb/uhci.c
index 07a0742..d9a1a10 100644
--- a/payloads/libpayload/drivers/usb/uhci.c
+++ b/payloads/libpayload/drivers/usb/uhci.c
@@ -339,13 +339,13 @@
 		data += mlen;
 	}
 
-	tds[count].token = (dir == OUT) ? UHCI_IN : UHCI_OUT |
+	tds[count].token = ((dir == OUT) ? UHCI_IN : UHCI_OUT) |
 		dev->address << TD_DEVADDR_SHIFT |
 		endp << TD_EP_SHIFT |
 		maxlen(0) << TD_MAXLEN_SHIFT |
 		TD_TOGGLE_DATA1;
 	tds[count].bufptr = 0;
-	tds[0].ctrlsts = (0 << TD_COUNTER_SHIFT) | /* as Linux 2.4.10 does */
+	tds[count].ctrlsts = (0 << TD_COUNTER_SHIFT) | /* as Linux 2.4.10 does */
 		(dev->speed?TD_LOWSPEED:0) |
 		TD_STATUS_ACTIVE;
 	UHCI_INST (dev->controller)->qh_data->elementlinkptr =
@@ -395,7 +395,7 @@
 		(*toggle & 1) << TD_TOGGLE_SHIFT;
 	td->bufptr = virt_to_phys (data);
 	td->ctrlsts = ((ep->direction == SETUP?3:0) << TD_COUNTER_SHIFT) |
-		ep->dev->speed?TD_LOWSPEED:0 |
+		(ep->dev->speed?TD_LOWSPEED:0) |
 		TD_STATUS_ACTIVE;
 	*toggle ^= 1;
 }
@@ -495,7 +495,7 @@
 			(ep->toggle & 1) << TD_TOGGLE_SHIFT;
 		tds[i].bufptr = virt_to_phys (data);
 		tds[i].ctrlsts = (0 << TD_COUNTER_SHIFT) |
-			ep->dev->speed?TD_LOWSPEED:0 |
+			(ep->dev->speed?TD_LOWSPEED:0) |
 			TD_STATUS_ACTIVE;
 		ep->toggle ^= 1;
 		data += reqsize;