}
        raw_event_queue_destroy(&dev->queue);
        for (i = 0; i < dev->eps_num; i++) {
-               if (dev->eps[i].state != STATE_EP_ENABLED)
+               if (dev->eps[i].state == STATE_EP_DISABLED)
                        continue;
                usb_ep_disable(dev->eps[i].ep);
                usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
        return ret;
 }
 
+static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value)
+{
+       int ret = 0;
+       unsigned long flags;
+
+       if (value)
+               return -EINVAL;
+       spin_lock_irqsave(&dev->lock, flags);
+       if (dev->state != STATE_DEV_RUNNING) {
+               dev_dbg(dev->dev, "fail, device is not running\n");
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+       if (!dev->gadget) {
+               dev_dbg(dev->dev, "fail, gadget is not bound\n");
+               ret = -EBUSY;
+               goto out_unlock;
+       }
+       if (dev->ep0_urb_queued) {
+               dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
+               ret = -EBUSY;
+               goto out_unlock;
+       }
+       if (!dev->ep0_in_pending && !dev->ep0_out_pending) {
+               dev_dbg(&dev->gadget->dev, "fail, no request pending\n");
+               ret = -EBUSY;
+               goto out_unlock;
+       }
+
+       ret = usb_ep_set_halt(dev->gadget->ep0);
+       if (ret < 0)
+               dev_err(&dev->gadget->dev,
+                               "fail, usb_ep_set_halt returned %d\n", ret);
+
+       if (dev->ep0_in_pending)
+               dev->ep0_in_pending = false;
+       else
+               dev->ep0_out_pending = false;
+
+out_unlock:
+       spin_unlock_irqrestore(&dev->lock, flags);
+       return ret;
+}
+
 static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 {
        int ret = 0, i;
                ret = -EBUSY;
                goto out_unlock;
        }
-       if (dev->eps[i].state != STATE_EP_ENABLED) {
+       if (dev->eps[i].state == STATE_EP_DISABLED) {
                dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
                ret = -EINVAL;
                goto out_unlock;
        return ret;
 }
 
+static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev,
+               unsigned long value, bool set, bool halt)
+{
+       int ret = 0, i = value;
+       unsigned long flags;
+
+       spin_lock_irqsave(&dev->lock, flags);
+       if (dev->state != STATE_DEV_RUNNING) {
+               dev_dbg(dev->dev, "fail, device is not running\n");
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+       if (!dev->gadget) {
+               dev_dbg(dev->dev, "fail, gadget is not bound\n");
+               ret = -EBUSY;
+               goto out_unlock;
+       }
+       if (i < 0 || i >= dev->eps_num) {
+               dev_dbg(dev->dev, "fail, invalid endpoint\n");
+               ret = -EBUSY;
+               goto out_unlock;
+       }
+       if (dev->eps[i].state == STATE_EP_DISABLED) {
+               dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+       if (dev->eps[i].disabling) {
+               dev_dbg(&dev->gadget->dev,
+                               "fail, disable is in progress\n");
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+       if (dev->eps[i].urb_queued) {
+               dev_dbg(&dev->gadget->dev,
+                               "fail, waiting for urb completion\n");
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+       if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) {
+               dev_dbg(&dev->gadget->dev,
+                               "fail, can't halt/wedge ISO endpoint\n");
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+
+       if (set && halt) {
+               ret = usb_ep_set_halt(dev->eps[i].ep);
+               if (ret < 0)
+                       dev_err(&dev->gadget->dev,
+                               "fail, usb_ep_set_halt returned %d\n", ret);
+       } else if (!set && halt) {
+               ret = usb_ep_clear_halt(dev->eps[i].ep);
+               if (ret < 0)
+                       dev_err(&dev->gadget->dev,
+                               "fail, usb_ep_clear_halt returned %d\n", ret);
+       } else if (set && !halt) {
+               ret = usb_ep_set_wedge(dev->eps[i].ep);
+               if (ret < 0)
+                       dev_err(&dev->gadget->dev,
+                               "fail, usb_ep_set_wedge returned %d\n", ret);
+       }
+
+out_unlock:
+       spin_unlock_irqrestore(&dev->lock, flags);
+       return ret;
+}
+
 static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req)
 {
        struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data;
        case USB_RAW_IOCTL_EPS_INFO:
                ret = raw_ioctl_eps_info(dev, value);
                break;
+       case USB_RAW_IOCTL_EP0_STALL:
+               ret = raw_ioctl_ep0_stall(dev, value);
+               break;
+       case USB_RAW_IOCTL_EP_SET_HALT:
+               ret = raw_ioctl_ep_set_clear_halt_wedge(
+                                       dev, value, true, true);
+               break;
+       case USB_RAW_IOCTL_EP_CLEAR_HALT:
+               ret = raw_ioctl_ep_set_clear_halt_wedge(
+                                       dev, value, false, true);
+               break;
+       case USB_RAW_IOCTL_EP_SET_WEDGE:
+               ret = raw_ioctl_ep_set_clear_halt_wedge(
+                                       dev, value, true, false);
+               break;
        default:
                ret = -EINVAL;
        }