[PATCH v1 0/7] tests/qtest: Extend USB host controller transfer coverage

[PATCH v1 0/7] tests/qtest: Extend USB host controller transfer coverage

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

Peter's discussion of isochronous endpoint mismatches highlighted the
lack of tests as a concern for moving the checks into the USB core [1].
This series adds transfer tests motivated by that discussion, without
changing controller or USB core code.

The tests cover EHCI control transfers and isochronous IN/OUT requests
to EP0, UHCI interrupt retries and isochronous completion on NAK, and
successful UHCI/xHCI isochronous OUT transfers to USB audio. The audio
tests configure the device and enable its streaming interface through
EP0 before submitting a packet.

These cases exercise both rejection/retry behavior and successful
isochronous transfers. EHCI isochronous success and USB_RET_ASYNC
completion remain outside the coverage of this series.

Suggestions for other transfer paths to cover in follow-up patches
are welcome.

[1] https://lore.kernel.org/qemu-devel/CAFEAcA8jcNzVT9QuFfog4GZRWt8ZpysKbOy9R-SxmtTrAZ67JQ@mail.gmail.com/

Junjie Cao (7):
  tests/qtest/usb-hcd-ehci: Test a control transfer
  tests/qtest/usb-hcd-ehci: Cover isochronous IN to EP0
  tests/qtest/usb-hcd-ehci: Cover isochronous OUT to EP0
  tests/qtest/usb-hcd-uhci: Test interrupt NAK retries
  tests/qtest/usb-hcd-uhci: Test isochronous NAK completion
  tests/qtest/usb-hcd-uhci: Test a successful isochronous transfer
  tests/qtest/usb-hcd-xhci: Test a successful isochronous transfer

 tests/qtest/usb-hcd-ehci-test.c | 208 +++++++++++++++++++++++++++++
 tests/qtest/usb-hcd-uhci-test.c | 229 ++++++++++++++++++++++++++++++++
 tests/qtest/usb-hcd-xhci-test.c |  95 ++++++++++++-
 3 files changed, 526 insertions(+), 6 deletions(-)


base-commit: ed698be7700160c74d24ef7830adccd2a28d840a
-- 
2.43.0

[PATCH v1 1/7] tests/qtest/usb-hcd-ehci: Test a control transfer

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

The EHCI tests currently cover port state and hotplug. Drive a
GET_DESCRIPTOR request through the asynchronous schedule and check its
data and completion status. This provides a working control transfer
for the endpoint mismatch tests that follow.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-ehci-test.c | 142 ++++++++++++++++++++++++++++++++
 1 file changed, 142 insertions(+)

diff --git a/tests/qtest/usb-hcd-ehci-test.c b/tests/qtest/usb-hcd-ehci-test.c
index 87e37cdd7c..1a8019dab4 100644
--- a/tests/qtest/usb-hcd-ehci-test.c
+++ b/tests/qtest/usb-hcd-ehci-test.c
@@ -9,6 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "libqtest-single.h"
+#include "libqos/libqos-pc.h"
 #include "libqos/pci-pc.h"
 #include "hw/usb/uhci-regs.h"
 #include "hw/usb/ehci-regs.h"
@@ -20,6 +21,144 @@ static struct qhc uhci2;
 static struct qhc uhci3;
 static struct qhc ehci1;
 
+/* Guest descriptor fields from EHCI sections 3.3, 3.5 and 3.6. */
+#define EHCI_LINK_TERMINATE     1
+#define EHCI_LINK_QH            2
+#define EHCI_QTD_ACTIVE         (1 << 7)
+#define EHCI_QTD_IOC            (1 << 15)
+#define EHCI_QTD_DATA1          (1U << 31)
+#define EHCI_QTD_PID_OUT        0
+#define EHCI_QTD_PID_IN         1
+#define EHCI_QTD_PID_SETUP      2
+#define EHCI_FRAME_NS           1000000
+
+typedef struct EHCITransferTest {
+    QOSState *qs;
+    struct qhc hc;
+    uint32_t opbase;
+    uint64_t mem;
+    uint64_t qh;
+    uint64_t qtd;
+    uint64_t data;
+} EHCITransferTest;
+
+static uint32_t ehci_readl(EHCITransferTest *t, unsigned int reg)
+{
+    return qpci_io_readl(t->hc.dev, t->hc.bar, t->opbase + reg);
+}
+
+static void ehci_writel(EHCITransferTest *t, unsigned int reg, uint32_t value)
+{
+    qpci_io_writel(t->hc.dev, t->hc.bar, t->opbase + reg, value);
+}
+
+static void ehci_stop_schedules(EHCITransferTest *t)
+{
+    unsigned int i;
+
+    ehci_writel(t, USBCMD, USBCMD_RUNSTOP);
+    for (i = 0; i < 10; i++) {
+        qtest_clock_step(t->qs->qts, EHCI_FRAME_NS);
+        if (!(ehci_readl(t, USBSTS) & (USBSTS_ASS | USBSTS_PSS))) {
+            break;
+        }
+    }
+    g_assert_cmpuint(i, <, 10);
+    g_assert_cmphex(ehci_readl(t, USBSTS) & USBSTS_HSE, ==, 0);
+}
+
+static void ehci_transfer_init(EHCITransferTest *t)
+{
+    t->qs = qtest_pc_boot("-machine q35,pit=off -nodefaults "
+                          "-device ich9-usb-ehci1,id=ehci,addr=1d.7 "
+                          "-device usb-kbd,bus=ehci.0,port=1,usb_version=2");
+    qusb_pci_init_one(t->qs->pcibus, &t->hc, QPCI_DEVFN(0x1d, 7), 0);
+    t->opbase = qpci_io_readb(t->hc.dev, t->hc.bar, CAPLENGTH);
+    t->mem = guest_alloc(&t->qs->alloc, 0x2000);
+    t->qh = t->mem;
+    t->qtd = t->mem + 0x100;
+    t->data = t->mem + 0x1000;
+    qtest_memset(t->qs->qts, t->mem, 0, 0x2000);
+
+    ehci_writel(t, USBCMD, USBCMD_HCRESET);
+    ehci_writel(t, CONFIGFLAG, 1);
+    /* PORTSC1 follows CONFIGFLAG. */
+    ehci_writel(t, CONFIGFLAG + 4, PORTSC_PPOWER | PORTSC_PRESET);
+    qtest_clock_step(t->qs->qts, 50 * EHCI_FRAME_NS);
+    ehci_writel(t, CONFIGFLAG + 4, PORTSC_PPOWER);
+    g_assert_cmphex(ehci_readl(t, CONFIGFLAG + 4) &
+                    (PORTSC_CONNECT | PORTSC_PED), ==,
+                    PORTSC_CONNECT | PORTSC_PED);
+    ehci_writel(t, USBSTS, USBSTS_RO_MASK);
+}
+
+static void ehci_control_packet(EHCITransferTest *t, unsigned int pid,
+                                unsigned int len)
+{
+    QTestState *qts = t->qs->qts;
+    uint32_t token;
+    unsigned int i;
+
+    qtest_memset(qts, t->qh, 0, 96);
+    qtest_memset(qts, t->qtd, 0, 64);
+    qtest_writel(qts, t->qh, t->qh | EHCI_LINK_QH);
+    /* EP0, high speed, qTD data toggle, reclamation head, 64-byte packets. */
+    qtest_writel(qts, t->qh + 4, (2 << 12) | (1 << 14) | (1 << 15) |
+                                (64 << 16));
+    qtest_writel(qts, t->qh + 8, 1 << 30);
+    qtest_writel(qts, t->qh + 16, t->qtd);
+    qtest_writel(qts, t->qh + 20, EHCI_LINK_TERMINATE);
+    qtest_writel(qts, t->qtd, EHCI_LINK_TERMINATE);
+    qtest_writel(qts, t->qtd + 4, EHCI_LINK_TERMINATE);
+    token = EHCI_QTD_ACTIVE | EHCI_QTD_IOC | (3 << 10) |
+            (pid << 8) | (len << 16);
+    if (pid != EHCI_QTD_PID_SETUP) {
+        token |= EHCI_QTD_DATA1;
+    }
+    qtest_writel(qts, t->qtd + 8, token);
+    qtest_writel(qts, t->qtd + 12, t->data);
+    ehci_writel(t, USBSTS, USBSTS_RO_MASK);
+    ehci_writel(t, ASYNCLISTADDR, t->qh);
+    ehci_writel(t, USBCMD, USBCMD_RUNSTOP | USBCMD_ASE);
+    for (i = 0; i < 10; i++) {
+        qtest_clock_step(qts, EHCI_FRAME_NS);
+        token = qtest_readl(qts, t->qtd + 8);
+        if (!(token & EHCI_QTD_ACTIVE)) {
+            break;
+        }
+    }
+    g_assert_cmpuint(i, <, 10);
+    g_assert_cmphex(token & 0xff, ==, 0);
+    g_assert_cmpuint((token >> 16) & 0x7fff, ==, 0);
+    g_assert_cmphex(ehci_readl(t, USBSTS) &
+                    (USBSTS_INT | USBSTS_ERRINT | USBSTS_HSE), ==, USBSTS_INT);
+    ehci_stop_schedules(t);
+}
+
+static void test_ehci_control(void)
+{
+    const uint8_t setup[] = { 0x80, 6, 0, 1, 0, 0, 18, 0 };
+    EHCITransferTest t;
+    uint8_t descriptor[18];
+
+    ehci_transfer_init(&t);
+    qtest_memwrite(t.qs->qts, t.data, setup, sizeof(setup));
+    ehci_control_packet(&t, EHCI_QTD_PID_SETUP, sizeof(setup));
+    qtest_memset(t.qs->qts, t.data, 0xa5, sizeof(descriptor));
+    ehci_control_packet(&t, EHCI_QTD_PID_IN, sizeof(descriptor));
+    qtest_memread(t.qs->qts, t.data, descriptor, sizeof(descriptor));
+    g_assert_cmpuint(descriptor[0], ==, sizeof(descriptor));
+    g_assert_cmpuint(descriptor[1], ==, 1);
+    g_assert_cmpuint(descriptor[7], ==, 64);
+    g_assert_cmpuint(descriptor[17], ==, 1);
+    ehci_control_packet(&t, EHCI_QTD_PID_OUT, 0);
+
+    qpci_iounmap(t.hc.dev, t.hc.bar);
+    uhci_deinit(&t.hc);
+    guest_free(&t.qs->alloc, t.mem);
+    qtest_shutdown(t.qs);
+}
+
 /* helpers */
 
 #if 0
@@ -160,6 +299,9 @@ int main(int argc, char **argv)
     qtest_add_func("/ehci/pci/uhci-port-2", pci_uhci_port_2);
     qtest_add_func("/ehci/pci/ehci-port-2", pci_ehci_port_2);
     qtest_add_func("/ehci/pci/ehci-port-3-hotplug", pci_ehci_port_hotplug);
+    if (qtest_has_device("usb-kbd")) {
+        qtest_add_func("/ehci/pci/control", test_ehci_control);
+    }
 
     qtest_start("-machine q35 -device ich9-usb-ehci1,bus=pcie.0,addr=1d.7,"
                 "multifunction=on,id=ich9-ehci-1 "
-- 
2.43.0

[PATCH v1 2/7] tests/qtest/usb-hcd-ehci: Cover isochronous IN to EP0

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

Start a control request, then submit an isochronous IN transaction to
EP0. The iTD must complete without reading data, and the pending
control request must still return the full descriptor through qTDs.

Removing the endpoint type check in ehci_process_itd() makes the iTD
consume the descriptor and fails the test.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-ehci-test.c | 75 ++++++++++++++++++++++++++++++---
 1 file changed, 68 insertions(+), 7 deletions(-)

diff --git a/tests/qtest/usb-hcd-ehci-test.c b/tests/qtest/usb-hcd-ehci-test.c
index 1a8019dab4..66070ee5c1 100644
--- a/tests/qtest/usb-hcd-ehci-test.c
+++ b/tests/qtest/usb-hcd-ehci-test.c
@@ -30,8 +30,16 @@ static struct qhc ehci1;
 #define EHCI_QTD_PID_OUT        0
 #define EHCI_QTD_PID_IN         1
 #define EHCI_QTD_PID_SETUP      2
+#define EHCI_ITD_ACTIVE         (1U << 31)
+#define EHCI_ITD_IOC            (1 << 15)
+#define EHCI_ITD_IN             (1 << 11)
 #define EHCI_FRAME_NS           1000000
 
+enum EHCIControlScenario {
+    EHCI_CONTROL_ONLY,
+    EHCI_ISO_IN_TO_CONTROL,
+};
+
 typedef struct EHCITransferTest {
     QOSState *qs;
     struct qhc hc;
@@ -39,7 +47,9 @@ typedef struct EHCITransferTest {
     uint64_t mem;
     uint64_t qh;
     uint64_t qtd;
+    uint64_t itd;
     uint64_t data;
+    uint64_t isodata;
 } EHCITransferTest;
 
 static uint32_t ehci_readl(EHCITransferTest *t, unsigned int reg)
@@ -74,11 +84,13 @@ static void ehci_transfer_init(EHCITransferTest *t)
                           "-device usb-kbd,bus=ehci.0,port=1,usb_version=2");
     qusb_pci_init_one(t->qs->pcibus, &t->hc, QPCI_DEVFN(0x1d, 7), 0);
     t->opbase = qpci_io_readb(t->hc.dev, t->hc.bar, CAPLENGTH);
-    t->mem = guest_alloc(&t->qs->alloc, 0x2000);
-    t->qh = t->mem;
-    t->qtd = t->mem + 0x100;
-    t->data = t->mem + 0x1000;
-    qtest_memset(t->qs->qts, t->mem, 0, 0x2000);
+    t->mem = guest_alloc(&t->qs->alloc, 0x4000);
+    t->qh = t->mem + 0x1000;
+    t->qtd = t->mem + 0x1100;
+    t->itd = t->mem + 0x1200;
+    t->data = t->mem + 0x2000;
+    t->isodata = t->mem + 0x3000;
+    qtest_memset(t->qs->qts, t->mem, 0, 0x4000);
 
     ehci_writel(t, USBCMD, USBCMD_HCRESET);
     ehci_writel(t, CONFIGFLAG, 1);
@@ -135,15 +147,59 @@ static void ehci_control_packet(EHCITransferTest *t, unsigned int pid,
     ehci_stop_schedules(t);
 }
 
-static void test_ehci_control(void)
+static void ehci_iso_to_control(EHCITransferTest *t)
+{
+    QTestState *qts = t->qs->qts;
+    uint8_t buffer[18];
+    uint32_t transaction;
+    unsigned int i;
+
+    qtest_memset(qts, t->isodata, 0xa5, sizeof(buffer));
+    qtest_writel(qts, t->itd, EHCI_LINK_TERMINATE);
+    qtest_writel(qts, t->itd + 4, EHCI_ITD_ACTIVE | EHCI_ITD_IOC |
+                                  (sizeof(buffer) << 16));
+    qtest_writel(qts, t->itd + 36, t->isodata); /* Address 0, endpoint 0. */
+    qtest_writel(qts, t->itd + 40, 64 | EHCI_ITD_IN);
+    qtest_writel(qts, t->itd + 44, 1); /* One transaction per microframe. */
+    for (i = 0; i < 1024; i++) {
+        qtest_writel(qts, t->mem + 4 * i, t->itd);
+    }
+    ehci_writel(t, USBSTS, USBSTS_RO_MASK);
+    ehci_writel(t, PERIODICLISTBASE, t->mem);
+    ehci_writel(t, USBCMD, USBCMD_RUNSTOP | USBCMD_PSE);
+    for (i = 0; i < 10; i++) {
+        qtest_clock_step(qts, EHCI_FRAME_NS);
+        transaction = qtest_readl(qts, t->itd + 4);
+        if (!(transaction & EHCI_ITD_ACTIVE)) {
+            break;
+        }
+    }
+    g_assert_cmpuint(i, <, 10);
+    /* A non-iso endpoint must not transfer data or receive the packet. */
+    g_assert_cmphex(transaction, ==, EHCI_ITD_IOC);
+    qtest_memread(qts, t->isodata, buffer, sizeof(buffer));
+    for (i = 0; i < sizeof(buffer); i++) {
+        g_assert_cmphex(buffer[i], ==, 0xa5);
+    }
+    g_assert_cmphex(ehci_readl(t, USBSTS) &
+                    (USBSTS_INT | USBSTS_ERRINT | USBSTS_HSE), ==, USBSTS_INT);
+    ehci_stop_schedules(t);
+}
+
+static void test_ehci_control(gconstpointer opaque)
 {
     const uint8_t setup[] = { 0x80, 6, 0, 1, 0, 0, 18, 0 };
+    unsigned int scenario = GPOINTER_TO_UINT(opaque);
     EHCITransferTest t;
     uint8_t descriptor[18];
 
     ehci_transfer_init(&t);
     qtest_memwrite(t.qs->qts, t.data, setup, sizeof(setup));
     ehci_control_packet(&t, EHCI_QTD_PID_SETUP, sizeof(setup));
+    if (scenario != EHCI_CONTROL_ONLY) {
+        ehci_iso_to_control(&t);
+    }
+    /* The invalid iTD must leave the pending control transfer intact. */
     qtest_memset(t.qs->qts, t.data, 0xa5, sizeof(descriptor));
     ehci_control_packet(&t, EHCI_QTD_PID_IN, sizeof(descriptor));
     qtest_memread(t.qs->qts, t.data, descriptor, sizeof(descriptor));
@@ -300,7 +356,12 @@ int main(int argc, char **argv)
     qtest_add_func("/ehci/pci/ehci-port-2", pci_ehci_port_2);
     qtest_add_func("/ehci/pci/ehci-port-3-hotplug", pci_ehci_port_hotplug);
     if (qtest_has_device("usb-kbd")) {
-        qtest_add_func("/ehci/pci/control", test_ehci_control);
+        qtest_add_data_func("/ehci/pci/control",
+                            GUINT_TO_POINTER(EHCI_CONTROL_ONLY),
+                            test_ehci_control);
+        qtest_add_data_func("/ehci/pci/iso-in-to-control",
+                            GUINT_TO_POINTER(EHCI_ISO_IN_TO_CONTROL),
+                            test_ehci_control);
     }
 
     qtest_start("-machine q35 -device ich9-usb-ehci1,bus=pcie.0,addr=1d.7,"
-- 
2.43.0

[PATCH v1 3/7] tests/qtest/usb-hcd-ehci: Cover isochronous OUT to EP0

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

An isochronous OUT transaction sent to EP0 must leave a pending
control read intact. Extend the IN mismatch test to cover this
direction as well.

Without the endpoint type check, the unexpected OUT packet changes
the control state and the following valid IN qTD halts.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-ehci-test.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/usb-hcd-ehci-test.c b/tests/qtest/usb-hcd-ehci-test.c
index 66070ee5c1..6097d470fb 100644
--- a/tests/qtest/usb-hcd-ehci-test.c
+++ b/tests/qtest/usb-hcd-ehci-test.c
@@ -38,6 +38,7 @@ static struct qhc ehci1;
 enum EHCIControlScenario {
     EHCI_CONTROL_ONLY,
     EHCI_ISO_IN_TO_CONTROL,
+    EHCI_ISO_OUT_TO_CONTROL,
 };
 
 typedef struct EHCITransferTest {
@@ -147,7 +148,7 @@ static void ehci_control_packet(EHCITransferTest *t, unsigned int pid,
     ehci_stop_schedules(t);
 }
 
-static void ehci_iso_to_control(EHCITransferTest *t)
+static void ehci_iso_to_control(EHCITransferTest *t, bool in)
 {
     QTestState *qts = t->qs->qts;
     uint8_t buffer[18];
@@ -159,7 +160,7 @@ static void ehci_iso_to_control(EHCITransferTest *t)
     qtest_writel(qts, t->itd + 4, EHCI_ITD_ACTIVE | EHCI_ITD_IOC |
                                   (sizeof(buffer) << 16));
     qtest_writel(qts, t->itd + 36, t->isodata); /* Address 0, endpoint 0. */
-    qtest_writel(qts, t->itd + 40, 64 | EHCI_ITD_IN);
+    qtest_writel(qts, t->itd + 40, 64 | (in ? EHCI_ITD_IN : 0));
     qtest_writel(qts, t->itd + 44, 1); /* One transaction per microframe. */
     for (i = 0; i < 1024; i++) {
         qtest_writel(qts, t->mem + 4 * i, t->itd);
@@ -176,7 +177,8 @@ static void ehci_iso_to_control(EHCITransferTest *t)
     }
     g_assert_cmpuint(i, <, 10);
     /* A non-iso endpoint must not transfer data or receive the packet. */
-    g_assert_cmphex(transaction, ==, EHCI_ITD_IOC);
+    g_assert_cmphex(transaction, ==, EHCI_ITD_IOC |
+                    (in ? 0 : sizeof(buffer) << 16));
     qtest_memread(qts, t->isodata, buffer, sizeof(buffer));
     for (i = 0; i < sizeof(buffer); i++) {
         g_assert_cmphex(buffer[i], ==, 0xa5);
@@ -197,7 +199,7 @@ static void test_ehci_control(gconstpointer opaque)
     qtest_memwrite(t.qs->qts, t.data, setup, sizeof(setup));
     ehci_control_packet(&t, EHCI_QTD_PID_SETUP, sizeof(setup));
     if (scenario != EHCI_CONTROL_ONLY) {
-        ehci_iso_to_control(&t);
+        ehci_iso_to_control(&t, scenario == EHCI_ISO_IN_TO_CONTROL);
     }
     /* The invalid iTD must leave the pending control transfer intact. */
     qtest_memset(t.qs->qts, t.data, 0xa5, sizeof(descriptor));
@@ -362,6 +364,9 @@ int main(int argc, char **argv)
         qtest_add_data_func("/ehci/pci/iso-in-to-control",
                             GUINT_TO_POINTER(EHCI_ISO_IN_TO_CONTROL),
                             test_ehci_control);
+        qtest_add_data_func("/ehci/pci/iso-out-to-control",
+                            GUINT_TO_POINTER(EHCI_ISO_OUT_TO_CONTROL),
+                            test_ehci_control);
     }
 
     qtest_start("-machine q35 -device ich9-usb-ehci1,bus=pcie.0,addr=1d.7,"
-- 
2.43.0

[PATCH v1 4/7] tests/qtest/usb-hcd-uhci: Test interrupt NAK retries

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

An idle interrupt endpoint must leave its TD active on NAK. Once
data arrives, completion must clear the NAK bit left by earlier
attempts.

Configure a USB keyboard through EP0, check that an IN TD stays
pending over several frames, then inject a key and verify the report,
completion status and QH advancement. Keeping NAK set on completion
fails this test.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-uhci-test.c | 161 ++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)

diff --git a/tests/qtest/usb-hcd-uhci-test.c b/tests/qtest/usb-hcd-uhci-test.c
index 4446555f08..5c2b6cef7c 100644
--- a/tests/qtest/usb-hcd-uhci-test.c
+++ b/tests/qtest/usb-hcd-uhci-test.c
@@ -8,6 +8,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bswap.h"
 #include "libqtest-single.h"
 #include "libqos/libqos.h"
 #include "libqos/usb.h"
@@ -17,6 +18,163 @@
 
 static QOSState *qs;
 
+#define UHCI_FRAME_NS 1000000
+#define UHCI_PID_SETUP 0x2d
+#define UHCI_PID_IN    0x69
+#define UHCI_LINK_END  1
+#define UHCI_LINK_QH   2
+
+typedef struct UHCITransferTest {
+    QOSState *qs;
+    struct qhc hc;
+    uint64_t mem;
+    uint64_t qh;
+    uint64_t td;
+    uint64_t data;
+} UHCITransferTest;
+
+static uint32_t uhci_mem_readl(UHCITransferTest *t, uint64_t addr)
+{
+    uint32_t value;
+
+    qtest_memread(t->qs->qts, addr, &value, sizeof(value));
+    return le32_to_cpu(value);
+}
+
+static void uhci_mem_writel(UHCITransferTest *t, uint64_t addr, uint32_t value)
+{
+    value = cpu_to_le32(value);
+    qtest_memwrite(t->qs->qts, addr, &value, sizeof(value));
+}
+
+static void uhci_writew(UHCITransferTest *t, unsigned int reg, uint16_t value)
+{
+    qpci_io_writew(t->hc.dev, t->hc.bar, reg, value);
+}
+
+static uint32_t uhci_step(UHCITransferTest *t)
+{
+    uint16_t status;
+
+    qtest_clock_step(t->qs->qts, UHCI_FRAME_NS);
+    status = qpci_io_readw(t->hc.dev, t->hc.bar, UHCI_USBSTS);
+    g_assert_cmphex(status & (UHCI_STS_HSERR | UHCI_STS_HCPERR |
+                              UHCI_STS_USBERR), ==, 0);
+    return uhci_mem_readl(t, t->td + 4);
+}
+
+static void uhci_submit(UHCITransferTest *t, unsigned int pid, unsigned int ep,
+                        unsigned int len, bool data1)
+{
+    unsigned int i;
+    uint32_t ctrl = TD_CTRL_ACTIVE | TD_CTRL_IOC | 0x7ff |
+                    (3 << TD_CTRL_ERROR_SHIFT);
+
+    uhci_writew(t, UHCI_USBCMD, 0);
+    uhci_mem_writel(t, t->td, UHCI_LINK_END);
+    uhci_mem_writel(t, t->td + 4, ctrl);
+    uhci_mem_writel(t, t->td + 8, pid | (ep << 15) | (data1 << 19) |
+                                (((len - 1) & 0x7ff) << 21));
+    uhci_mem_writel(t, t->td + 12, t->data);
+    uhci_mem_writel(t, t->qh, UHCI_LINK_END);
+    uhci_mem_writel(t, t->qh + 4, t->td);
+    for (i = 0; i < 1024; i++) {
+        uhci_mem_writel(t, t->mem + 4 * i, t->qh | UHCI_LINK_QH);
+    }
+    uhci_writew(t, UHCI_USBSTS, UHCI_STS_USBINT | UHCI_STS_USBERR);
+    uhci_writew(t, UHCI_USBCMD, UHCI_CMD_RS);
+}
+
+static void uhci_expect_complete(UHCITransferTest *t, unsigned int len)
+{
+    uint32_t ctrl;
+    unsigned int i;
+
+    for (i = 0; i < 10; i++) {
+        ctrl = uhci_step(t);
+        if (!(ctrl & TD_CTRL_ACTIVE)) {
+            break;
+        }
+    }
+    g_assert_cmpuint(i, <, 10);
+    g_assert_cmphex(ctrl & (TD_CTRL_ACTIVE | TD_CTRL_STALL | TD_CTRL_BABBLE |
+                            TD_CTRL_NAK | TD_CTRL_TIMEOUT), ==, 0);
+    g_assert_cmpuint((ctrl + 1) & 0x7ff, ==, len);
+    g_assert_cmphex(uhci_mem_readl(t, t->qh + 4), ==, UHCI_LINK_END);
+    uhci_writew(t, UHCI_USBCMD, 0);
+}
+
+static void uhci_transfer_init(UHCITransferTest *t)
+{
+    const char *cmd = "-nodefaults -global pci-host-bridge.bypass-iommu=on "
+                      "-device piix3-usb-uhci,id=uhci,addr=1d.0 "
+                      "-device usb-kbd,bus=uhci.0,port=1";
+    const uint8_t setup[] = { 0, 9, 1, 0, 0, 0, 0, 0 };
+
+    if (!strcmp(qtest_get_arch(), "ppc64")) {
+        t->qs = qtest_spapr_boot("%s", cmd);
+    } else {
+        t->qs = qtest_pc_boot("-machine pc,pit=off %s", cmd);
+    }
+    qusb_pci_init_one(t->qs->pcibus, &t->hc, QPCI_DEVFN(0x1d, 0), 4);
+    t->mem = guest_alloc(&t->qs->alloc, 0x3000);
+    t->qh = t->mem + 0x1000;
+    t->td = t->mem + 0x1100;
+    t->data = t->mem + 0x2000;
+    qtest_memset(t->qs->qts, t->mem, 0, 0x3000);
+    uhci_writew(t, UHCI_USBCMD, UHCI_CMD_HCRESET);
+    uhci_writew(t, UHCI_USBPORTSC1, UHCI_PORT_RESET);
+    qtest_clock_step(t->qs->qts, 50 * UHCI_FRAME_NS);
+    uhci_writew(t, UHCI_USBPORTSC1, UHCI_PORT_EN);
+    g_assert_cmphex(qpci_io_readw(t->hc.dev, t->hc.bar, UHCI_USBPORTSC1) &
+                    (UHCI_PORT_CCS | UHCI_PORT_EN), ==,
+                    UHCI_PORT_CCS | UHCI_PORT_EN);
+    qpci_io_writel(t->hc.dev, t->hc.bar, UHCI_USBFLBASEADD, t->mem);
+
+    /* Configure the keyboard's interrupt endpoint through EP0 first. */
+    qtest_memwrite(t->qs->qts, t->data, setup, sizeof(setup));
+    uhci_submit(t, UHCI_PID_SETUP, 0, sizeof(setup), false);
+    uhci_expect_complete(t, sizeof(setup));
+    uhci_submit(t, UHCI_PID_IN, 0, 0, true);
+    uhci_expect_complete(t, 0);
+}
+
+static void test_uhci_nak(void)
+{
+    const uint8_t expected[] = { 0, 0, 4, 0, 0, 0, 0, 0 };
+    UHCITransferTest t;
+    uint8_t report[sizeof(expected)];
+    uint32_t ctrl;
+    unsigned int i;
+
+    uhci_transfer_init(&t);
+    qtest_memset(t.qs->qts, t.data, 0xa5, sizeof(report));
+    uhci_submit(&t, UHCI_PID_IN, 1, sizeof(report), false);
+    for (i = 0; i < 3; i++) {
+        ctrl = uhci_step(&t);
+        g_assert_cmphex(ctrl & (TD_CTRL_ACTIVE | TD_CTRL_NAK), ==,
+                        TD_CTRL_NAK | TD_CTRL_ACTIVE);
+        g_assert_cmpuint((ctrl + 1) & 0x7ff, ==, 0);
+    }
+    qtest_memread(t.qs->qts, t.data, report, sizeof(report));
+    for (i = 0; i < sizeof(report); i++) {
+        g_assert_cmphex(report[i], ==, 0xa5);
+    }
+
+    qtest_qmp_assert_success(t.qs->qts,
+        "{'execute': 'input-send-event', 'arguments': {'events': ["
+        "{'type': 'key', 'data': {'down': true, "
+        "'key': {'type': 'qcode', 'data': 'a'}}}]}}");
+    uhci_expect_complete(&t, sizeof(report));
+    qtest_memread(t.qs->qts, t.data, report, sizeof(report));
+    g_assert_cmpmem(report, sizeof(report), expected, sizeof(expected));
+
+    qpci_iounmap(t.hc.dev, t.hc.bar);
+    uhci_deinit(&t.hc);
+    guest_free(&t.qs->alloc, t.mem);
+    qtest_shutdown(t.qs);
+}
+
 static void test_port(int port)
 {
     struct qhc uhci;
@@ -72,6 +230,9 @@ int main(int argc, char **argv)
     if (qtest_has_device("usb-storage")) {
         qtest_add_func("/uhci/pci/hotplug/usb-storage", test_usb_storage_hotplug);
     }
+    if (qtest_has_device("usb-kbd")) {
+        qtest_add_func("/uhci/pci/intr-nak", test_uhci_nak);
+    }
 
     if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
         qs = qtest_pc_boot("%s", cmd);
-- 
2.43.0

[PATCH v1 5/7] tests/qtest/usb-hcd-uhci: Test isochronous NAK completion

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

A TD marked isochronous must become inactive on NAK. Send such a TD
to the keyboard's interrupt endpoint, then inject a key and check
that the inactive TD does not consume it. A new ordinary TD must
still return that report.

Removing the isochronous ACTIVE-bit clearing in uhci_complete_td()
fails this test.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-uhci-test.c | 38 ++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/tests/qtest/usb-hcd-uhci-test.c b/tests/qtest/usb-hcd-uhci-test.c
index 5c2b6cef7c..bad279e9a2 100644
--- a/tests/qtest/usb-hcd-uhci-test.c
+++ b/tests/qtest/usb-hcd-uhci-test.c
@@ -64,13 +64,17 @@ static uint32_t uhci_step(UHCITransferTest *t)
 }
 
 static void uhci_submit(UHCITransferTest *t, unsigned int pid, unsigned int ep,
-                        unsigned int len, bool data1)
+                        unsigned int len, bool data1, bool iso)
 {
     unsigned int i;
-    uint32_t ctrl = TD_CTRL_ACTIVE | TD_CTRL_IOC | 0x7ff |
-                    (3 << TD_CTRL_ERROR_SHIFT);
+    uint32_t ctrl = TD_CTRL_ACTIVE | TD_CTRL_IOC | 0x7ff;
 
     uhci_writew(t, UHCI_USBCMD, 0);
+    if (iso) {
+        ctrl |= TD_CTRL_IOS;
+    } else {
+        ctrl |= 3 << TD_CTRL_ERROR_SHIFT;
+    }
     uhci_mem_writel(t, t->td, UHCI_LINK_END);
     uhci_mem_writel(t, t->td + 4, ctrl);
     uhci_mem_writel(t, t->td + 8, pid | (ep << 15) | (data1 << 19) |
@@ -79,7 +83,8 @@ static void uhci_submit(UHCITransferTest *t, unsigned int pid, unsigned int ep,
     uhci_mem_writel(t, t->qh, UHCI_LINK_END);
     uhci_mem_writel(t, t->qh + 4, t->td);
     for (i = 0; i < 1024; i++) {
-        uhci_mem_writel(t, t->mem + 4 * i, t->qh | UHCI_LINK_QH);
+        uhci_mem_writel(t, t->mem + 4 * i,
+                        iso ? t->td : t->qh | UHCI_LINK_QH);
     }
     uhci_writew(t, UHCI_USBSTS, UHCI_STS_USBINT | UHCI_STS_USBERR);
     uhci_writew(t, UHCI_USBCMD, UHCI_CMD_RS);
@@ -133,15 +138,16 @@ static void uhci_transfer_init(UHCITransferTest *t)
 
     /* Configure the keyboard's interrupt endpoint through EP0 first. */
     qtest_memwrite(t->qs->qts, t->data, setup, sizeof(setup));
-    uhci_submit(t, UHCI_PID_SETUP, 0, sizeof(setup), false);
+    uhci_submit(t, UHCI_PID_SETUP, 0, sizeof(setup), false, false);
     uhci_expect_complete(t, sizeof(setup));
-    uhci_submit(t, UHCI_PID_IN, 0, 0, true);
+    uhci_submit(t, UHCI_PID_IN, 0, 0, true, false);
     uhci_expect_complete(t, 0);
 }
 
-static void test_uhci_nak(void)
+static void test_uhci_nak(gconstpointer opaque)
 {
     const uint8_t expected[] = { 0, 0, 4, 0, 0, 0, 0, 0 };
+    const bool iso = GPOINTER_TO_UINT(opaque);
     UHCITransferTest t;
     uint8_t report[sizeof(expected)];
     uint32_t ctrl;
@@ -149,11 +155,11 @@ static void test_uhci_nak(void)
 
     uhci_transfer_init(&t);
     qtest_memset(t.qs->qts, t.data, 0xa5, sizeof(report));
-    uhci_submit(&t, UHCI_PID_IN, 1, sizeof(report), false);
+    uhci_submit(&t, UHCI_PID_IN, 1, sizeof(report), false, iso);
     for (i = 0; i < 3; i++) {
         ctrl = uhci_step(&t);
         g_assert_cmphex(ctrl & (TD_CTRL_ACTIVE | TD_CTRL_NAK), ==,
-                        TD_CTRL_NAK | TD_CTRL_ACTIVE);
+                        TD_CTRL_NAK | (iso ? 0 : TD_CTRL_ACTIVE));
         g_assert_cmpuint((ctrl + 1) & 0x7ff, ==, 0);
     }
     qtest_memread(t.qs->qts, t.data, report, sizeof(report));
@@ -165,6 +171,15 @@ static void test_uhci_nak(void)
         "{'execute': 'input-send-event', 'arguments': {'events': ["
         "{'type': 'key', 'data': {'down': true, "
         "'key': {'type': 'qcode', 'data': 'a'}}}]}}");
+    if (iso) {
+        /* An inactive isochronous TD must not consume the new report. */
+        g_assert_cmphex(uhci_step(&t), ==, ctrl);
+        qtest_memread(t.qs->qts, t.data, report, sizeof(report));
+        for (i = 0; i < sizeof(report); i++) {
+            g_assert_cmphex(report[i], ==, 0xa5);
+        }
+        uhci_submit(&t, UHCI_PID_IN, 1, sizeof(report), false, false);
+    }
     uhci_expect_complete(&t, sizeof(report));
     qtest_memread(t.qs->qts, t.data, report, sizeof(report));
     g_assert_cmpmem(report, sizeof(report), expected, sizeof(expected));
@@ -231,7 +246,10 @@ int main(int argc, char **argv)
         qtest_add_func("/uhci/pci/hotplug/usb-storage", test_usb_storage_hotplug);
     }
     if (qtest_has_device("usb-kbd")) {
-        qtest_add_func("/uhci/pci/intr-nak", test_uhci_nak);
+        qtest_add_data_func("/uhci/pci/intr-nak", GUINT_TO_POINTER(false),
+                            test_uhci_nak);
+        qtest_add_data_func("/uhci/pci/iso-nak", GUINT_TO_POINTER(true),
+                            test_uhci_nak);
     }
 
     if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
-- 
2.43.0

[PATCH v1 6/7] tests/qtest/usb-hcd-uhci: Test a successful isochronous transfer

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

The isochronous NAK test exercises a TD sent to an interrupt endpoint.
Add a successful transfer to an isochronous endpoint as a positive
case for changes to endpoint type checks.

Configure a USB audio device and enable its streaming interface
through EP0 before submitting an OUT packet. Check that the TD
completes without errors and reports the full packet length.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-uhci-test.c | 74 +++++++++++++++++++++++++++------
 1 file changed, 62 insertions(+), 12 deletions(-)

diff --git a/tests/qtest/usb-hcd-uhci-test.c b/tests/qtest/usb-hcd-uhci-test.c
index bad279e9a2..28d38bcc7c 100644
--- a/tests/qtest/usb-hcd-uhci-test.c
+++ b/tests/qtest/usb-hcd-uhci-test.c
@@ -21,6 +21,7 @@ static QOSState *qs;
 #define UHCI_FRAME_NS 1000000
 #define UHCI_PID_SETUP 0x2d
 #define UHCI_PID_IN    0x69
+#define UHCI_PID_OUT   0xe1
 #define UHCI_LINK_END  1
 #define UHCI_LINK_QH   2
 
@@ -109,17 +110,27 @@ static void uhci_expect_complete(UHCITransferTest *t, unsigned int len)
     uhci_writew(t, UHCI_USBCMD, 0);
 }
 
-static void uhci_transfer_init(UHCITransferTest *t)
+static void uhci_control_no_data(UHCITransferTest *t,
+                                 const uint8_t setup[8])
+{
+    qtest_memwrite(t->qs->qts, t->data, setup, 8);
+    uhci_submit(t, UHCI_PID_SETUP, 0, 8, false, false);
+    uhci_expect_complete(t, 8);
+    uhci_submit(t, UHCI_PID_IN, 0, 0, true, false);
+    uhci_expect_complete(t, 0);
+}
+
+static void uhci_transfer_init(UHCITransferTest *t, const char *usb_device)
 {
     const char *cmd = "-nodefaults -global pci-host-bridge.bypass-iommu=on "
-                      "-device piix3-usb-uhci,id=uhci,addr=1d.0 "
-                      "-device usb-kbd,bus=uhci.0,port=1";
+                      "-device piix3-usb-uhci,id=uhci,addr=1d.0";
     const uint8_t setup[] = { 0, 9, 1, 0, 0, 0, 0, 0 };
 
     if (!strcmp(qtest_get_arch(), "ppc64")) {
-        t->qs = qtest_spapr_boot("%s", cmd);
+        t->qs = qtest_spapr_boot("%s %s", cmd, usb_device);
     } else {
-        t->qs = qtest_pc_boot("-machine pc,pit=off %s", cmd);
+        t->qs = qtest_pc_boot("-machine pc,pit=off %s %s", cmd,
+                              usb_device);
     }
     qusb_pci_init_one(t->qs->pcibus, &t->hc, QPCI_DEVFN(0x1d, 0), 4);
     t->mem = guest_alloc(&t->qs->alloc, 0x3000);
@@ -136,12 +147,8 @@ static void uhci_transfer_init(UHCITransferTest *t)
                     UHCI_PORT_CCS | UHCI_PORT_EN);
     qpci_io_writel(t->hc.dev, t->hc.bar, UHCI_USBFLBASEADD, t->mem);
 
-    /* Configure the keyboard's interrupt endpoint through EP0 first. */
-    qtest_memwrite(t->qs->qts, t->data, setup, sizeof(setup));
-    uhci_submit(t, UHCI_PID_SETUP, 0, sizeof(setup), false, false);
-    uhci_expect_complete(t, sizeof(setup));
-    uhci_submit(t, UHCI_PID_IN, 0, 0, true, false);
-    uhci_expect_complete(t, 0);
+    /* Configure the device through EP0 before using a non-default endpoint. */
+    uhci_control_no_data(t, setup);
 }
 
 static void test_uhci_nak(gconstpointer opaque)
@@ -153,7 +160,7 @@ static void test_uhci_nak(gconstpointer opaque)
     uint32_t ctrl;
     unsigned int i;
 
-    uhci_transfer_init(&t);
+    uhci_transfer_init(&t, "-device usb-kbd,bus=uhci.0,port=1");
     qtest_memset(t.qs->qts, t.data, 0xa5, sizeof(report));
     uhci_submit(&t, UHCI_PID_IN, 1, sizeof(report), false, iso);
     for (i = 0; i < 3; i++) {
@@ -190,6 +197,48 @@ static void test_uhci_nak(gconstpointer opaque)
     qtest_shutdown(t.qs);
 }
 
+static void test_uhci_iso_audio_out(void)
+{
+    const uint8_t set_interface[] = { 1, 11, 1, 0, 1, 0, 0, 0 };
+    const unsigned int packet_size = 192;
+    UHCITransferTest t;
+    uint32_t ctrl;
+    unsigned int i;
+
+    if (!qtest_has_device("usb-audio")) {
+        g_test_skip("usb-audio is not available");
+        return;
+    }
+
+    uhci_transfer_init(&t, "-audiodev none,id=snd0 "
+                           "-device usb-audio,audiodev=snd0,"
+                           "bus=uhci.0,port=1");
+    /* Interface 1, alternate setting 1 enables the stereo OUT endpoint. */
+    uhci_control_no_data(&t, set_interface);
+
+    /* Full-speed audio altsetting 1 advertises OUT endpoint 1, 192 bytes. */
+    qtest_memset(t.qs->qts, t.data, 0x5a, packet_size);
+    uhci_submit(&t, UHCI_PID_OUT, 1, packet_size, false, true);
+    for (i = 0; i < 10; i++) {
+        ctrl = uhci_step(&t);
+        if (!(ctrl & TD_CTRL_ACTIVE)) {
+            break;
+        }
+    }
+    g_assert_cmpuint(i, <, 10);
+    g_assert_cmphex(ctrl & (TD_CTRL_ACTIVE | TD_CTRL_STALL | TD_CTRL_BABBLE |
+                            TD_CTRL_NAK | TD_CTRL_TIMEOUT), ==, 0);
+    g_assert_cmpuint((ctrl + 1) & 0x7ff, ==, packet_size);
+    g_assert_cmphex(qpci_io_readw(t.hc.dev, t.hc.bar, UHCI_USBSTS) &
+                    UHCI_STS_USBINT, ==, UHCI_STS_USBINT);
+    uhci_writew(&t, UHCI_USBCMD, 0);
+
+    qpci_iounmap(t.hc.dev, t.hc.bar);
+    uhci_deinit(&t.hc);
+    guest_free(&t.qs->alloc, t.mem);
+    qtest_shutdown(t.qs);
+}
+
 static void test_port(int port)
 {
     struct qhc uhci;
@@ -251,6 +300,7 @@ int main(int argc, char **argv)
         qtest_add_data_func("/uhci/pci/iso-nak", GUINT_TO_POINTER(true),
                             test_uhci_nak);
     }
+    qtest_add_func("/uhci/pci/iso-audio-out", test_uhci_iso_audio_out);
 
     if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
         qs = qtest_pc_boot("%s", cmd);
-- 
2.43.0

[PATCH v1 7/7] tests/qtest/usb-hcd-xhci: Test a successful isochronous transfer

[Junjie Cao]

From: Junjie Cao <junjie.cao@intel.com>

The MFINDEX test leaves the audio streaming interface disabled and
checks scheduling with a transfer that stalls. Add a successful
isochronous transfer so changes to endpoint checks are also tested
with a configured device.

Enable the audio streaming interface through EP0, then check the OUT
transfer event for success, zero residual length and the expected
slot, endpoint and TRB pointer.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
 tests/qtest/usb-hcd-xhci-test.c | 95 ++++++++++++++++++++++++++++++---
 1 file changed, 89 insertions(+), 6 deletions(-)

diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
index 2e173af750..c14c19988e 100644
--- a/tests/qtest/usb-hcd-xhci-test.c
+++ b/tests/qtest/usb-hcd-xhci-test.c
@@ -42,13 +42,18 @@
 
 #define TRB_C                   (1 << 0)
 #define TRB_TR_IOC              (1 << 5)
+#define TRB_TR_IDT              (1 << 6)
+#define TRB_TR_DIR              (1 << 16)
 #define TRB_TR_SIA              (1U << 31)
 #define TRB_TYPE(t)             ((t) << 10)
 #define TRB_GET_TYPE(control)   (((control) >> 10) & 0x3f)
 #define TRB_GET_CCODE(status)   ((status) >> 24)
 #define TRB_GET_SLOT(control)   ((control) >> 24)
+#define TRB_GET_EPID(control)   (((control) >> 16) & 0x1f)
 
 #define TR_ISOCH                5
+#define TR_SETUP                2
+#define TR_STATUS               4
 #define CR_ENABLE_SLOT          9
 #define CR_ADDRESS_DEVICE       11
 #define CR_CONFIGURE_ENDPOINT   12
@@ -69,8 +74,8 @@ typedef struct XHCITest {
     QPCIBus *bus;
     struct qhc hc;
     uint32_t oper, runtime, doorbell;
-    uint64_t cmd_ring, event_ring, input_ctx;
-    unsigned int cmd_idx, event_idx;
+    uint64_t cmd_ring, event_ring, input_ctx, ep0_ring;
+    unsigned int cmd_idx, event_idx, ep0_idx;
     unsigned int port, slot;
 } XHCITest;
 
@@ -204,7 +209,8 @@ static void xhci_write_trb(XHCITest *x, uint64_t addr, uint64_t parameter,
 }
 
 /* Fetch the next event if there is one. Does not advance the clock. */
-static bool xhci_next_event(XHCITest *x, uint32_t *status, uint32_t *control)
+static bool xhci_next_event_full(XHCITest *x, uint64_t *parameter,
+                                 uint32_t *status, uint32_t *control)
 {
     uint64_t addr = x->event_ring + 16 * x->event_idx;
     uint32_t c = qtest_readl(x->qts, addr + 12);
@@ -212,6 +218,9 @@ static bool xhci_next_event(XHCITest *x, uint32_t *status, uint32_t *control)
     if (!(c & TRB_C)) {
         return false;
     }
+    if (parameter) {
+        *parameter = qtest_readq(x->qts, addr);
+    }
     if (status) {
         *status = qtest_readl(x->qts, addr + 8);
     }
@@ -224,6 +233,11 @@ static bool xhci_next_event(XHCITest *x, uint32_t *status, uint32_t *control)
     return true;
 }
 
+static bool xhci_next_event(XHCITest *x, uint32_t *status, uint32_t *control)
+{
+    return xhci_next_event_full(x, NULL, status, control);
+}
+
 static unsigned int xhci_command(XHCITest *x, uint64_t parameter,
                                  uint32_t control)
 {
@@ -246,7 +260,7 @@ static unsigned int xhci_command(XHCITest *x, uint64_t parameter,
  */
 static void xhci_test_start(XHCITest *x, const char *usb_device)
 {
-    uint64_t dcbaa, erst, ep0_ring;
+    uint64_t dcbaa, erst;
     unsigned int maxports;
 
     memset(x, 0, sizeof(*x));
@@ -302,14 +316,39 @@ static void xhci_test_start(XHCITest *x, const char *usb_device)
     qtest_writel(x->qts, x->input_ctx + 0x20, 1 << 27);
     qtest_writel(x->qts, x->input_ctx + 0x24, (x->port + 1) << 16);
     /* ep0 context */
-    ep0_ring = xhci_alloc_page(x);
+    x->ep0_ring = xhci_alloc_page(x);
     qtest_writel(x->qts, x->input_ctx + 0x44,
                  (64 << 16) | (EP_TYPE_CONTROL << 3));
-    qtest_writeq(x->qts, x->input_ctx + 0x48, ep0_ring | 1);
+    qtest_writeq(x->qts, x->input_ctx + 0x48, x->ep0_ring | 1);
     xhci_command(x, x->input_ctx,
                  TRB_TYPE(CR_ADDRESS_DEVICE) | (x->slot << 24));
 }
 
+static void xhci_control_no_data(XHCITest *x, const uint8_t setup[8])
+{
+    uint64_t setup_packet = 0, parameter;
+    uint32_t status, control;
+    unsigned int i;
+
+    for (i = 0; i < 8; i++) {
+        setup_packet |= (uint64_t)setup[i] << (i * 8);
+    }
+    xhci_write_trb(x, x->ep0_ring + 16 * x->ep0_idx++, setup_packet, 8,
+                   TRB_TYPE(TR_SETUP) | TRB_TR_IDT | TRB_C);
+    xhci_write_trb(x, x->ep0_ring + 16 * x->ep0_idx++, 0, 0,
+                   TRB_TYPE(TR_STATUS) | TRB_TR_DIR | TRB_TR_IOC | TRB_C);
+    xhci_writel(x, x->doorbell + 4 * x->slot, 1);
+
+    g_assert_true(xhci_next_event_full(x, &parameter, &status, &control));
+    g_assert_cmpuint(TRB_GET_TYPE(control), ==, ER_TRANSFER);
+    g_assert_cmpuint(TRB_GET_CCODE(status), ==, CC_SUCCESS);
+    g_assert_cmpuint(status & 0xffffff, ==, 0);
+    g_assert_cmpuint(TRB_GET_SLOT(control), ==, x->slot);
+    g_assert_cmpuint(TRB_GET_EPID(control), ==, 1);
+    g_assert_cmphex(parameter, ==,
+                    x->ep0_ring + 16 * (x->ep0_idx - 1));
+}
+
 /* Returns the address of the transfer ring. */
 static uint64_t xhci_configure_ep(XHCITest *x, unsigned int epid,
                                   unsigned int type, unsigned int interval,
@@ -423,6 +462,48 @@ static void test_xhci_isoch_ep_type_mismatch(void)
     xhci_test_end(&x);
 }
 
+static void test_xhci_isoch_audio_out(void)
+{
+    const uint8_t set_configuration[] = { 0, 9, 1, 0, 0, 0, 0, 0 };
+    const uint8_t set_interface[] = { 1, 11, 1, 0, 1, 0, 0, 0 };
+    const unsigned int packet_size = 192;
+    const unsigned int interval = 3; /* bInterval 1: one full-speed frame. */
+    XHCITest x;
+    uint32_t status, control;
+    uint64_t parameter, ring, data;
+
+    if (!xhci_test_supported("usb-audio")) {
+        return;
+    }
+
+    xhci_test_start(&x, "-audiodev none,id=snd0 "
+                        "-device usb-audio,audiodev=snd0");
+    xhci_control_no_data(&x, set_configuration);
+    xhci_control_no_data(&x, set_interface);
+
+    ring = xhci_configure_ep(&x, 2, EP_TYPE_ISOCH_OUT, interval,
+                             packet_size);
+    data = xhci_alloc_page(&x);
+    qtest_memset(x.qts, data, 0x5a, packet_size);
+    xhci_write_trb(&x, ring, data, packet_size,
+                   TRB_TYPE(TR_ISOCH) | TRB_TR_SIA | TRB_TR_IOC | TRB_C);
+    xhci_writel(&x, x.doorbell + 4 * x.slot, 2);
+    g_assert_false(xhci_next_event(&x, NULL, NULL));
+
+    qtest_clock_step(x.qts, (1ULL << interval) * XHCI_MICROFRAME_NS);
+    g_assert_true(xhci_next_event_full(&x, &parameter, &status, &control));
+    g_assert_cmpuint(TRB_GET_TYPE(control), ==, ER_TRANSFER);
+    g_assert_cmpuint(TRB_GET_CCODE(status), ==, CC_SUCCESS);
+    g_assert_cmpuint(status & 0xffffff, ==, 0);
+    g_assert_cmpuint(TRB_GET_SLOT(control), ==, x.slot);
+    g_assert_cmpuint(TRB_GET_EPID(control), ==, 2);
+    g_assert_cmphex(parameter, ==, ring);
+    g_assert_cmphex(xhci_readl(&x, x.oper + XHCI_USBSTS) &
+                    (USBSTS_HCH | USBSTS_HCE), ==, 0);
+
+    xhci_test_end(&x);
+}
+
 int main(int argc, char **argv)
 {
     int ret;
@@ -441,6 +522,8 @@ int main(int argc, char **argv)
                    test_xhci_isoch_mfindex_32bit);
     qtest_add_func("/xhci/pci/isoch/ep-type-mismatch",
                    test_xhci_isoch_ep_type_mismatch);
+    qtest_add_func("/xhci/pci/isoch/audio-out",
+                   test_xhci_isoch_audio_out);
 
     qtest_start("-device nec-usb-xhci,id=xhci"
                 " -drive id=drive0,if=none,file=null-co://,"
-- 
2.43.0