xhci: Fix incorrect direction setting on status transmissions.

The status part of a control message was likely to have an incorrect
direction set.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
diff --git a/src/hw/usb-xhci.c b/src/hw/usb-xhci.c
index d0df6ee..0833cb9 100644
--- a/src/hw/usb-xhci.c
+++ b/src/hw/usb-xhci.c
@@ -621,7 +621,7 @@
     xhci_xfer_queue(pipe, &trb);
 }
 
-static void xhci_xfer_status(struct xhci_pipe *pipe, int dir)
+static void xhci_xfer_status(struct xhci_pipe *pipe, int dir, int datalen)
 {
     ASSERT32FLAT();
     struct xhci_trb trb;
@@ -629,7 +629,7 @@
     memset(&trb, 0, sizeof(trb));
     trb.control  |= (TR_STATUS << 10); // trb type
     trb.control  |= TRB_TR_IOC;
-    if (dir)
+    if (!datalen || !dir)
         trb.control |= (1 << 16);
 
     xhci_xfer_queue(pipe, &trb);
@@ -1007,7 +1007,7 @@
     xhci_xfer_setup(pipe, req, dir, datalen);
     if (datalen)
         xhci_xfer_data(pipe, dir, data, datalen);
-    xhci_xfer_status(pipe, dir);
+    xhci_xfer_status(pipe, dir, datalen);
 
     cc = xhci_event_wait(xhci, &pipe->reqs, 1000);
     if (cc != CC_SUCCESS) {