diff --git a/hw/usb/desc.c b/hw/usb/desc.c
index f133ddb..ab48691 100644
--- a/hw/usb/desc.c
+++ b/hw/usb/desc.c
@@ -759,7 +759,7 @@
          * We return the same value that a configured device would return if
          * it used the first configuration.
          */
-        if (config->bmAttributes & 0x40) {
+        if (config->bmAttributes & USB_CFG_ATT_SELFPOWER) {
             data[0] |= 1 << USB_DEVICE_SELF_POWERED;
         }
         if (dev->remote_wakeup) {
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index c5420eb..bfebfe9 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -224,7 +224,7 @@
             .bNumInterfaces        = 2,
             .bConfigurationValue   = DEV_CONFIG_VALUE,
             .iConfiguration        = STRING_CONFIG,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .bMaxPower             = 0x32,
             .nif = ARRAY_SIZE(desc_iface),
             .ifs = desc_iface,
diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index 7f292b1..a9661d2 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -229,7 +229,7 @@
         {
             .bNumInterfaces        = 2,
             .bConfigurationValue   = 1,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .bMaxPower             = 0,
             .nif = ARRAY_SIZE(desc_iface_bluetooth),
             .ifs = desc_iface_bluetooth,
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 2966066..f36e617 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -202,7 +202,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_MOUSE,
-            .bmAttributes          = 0xa0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_WAKEUP,
             .bMaxPower             = 50,
             .nif = 1,
             .ifs = &desc_iface_mouse,
@@ -219,7 +219,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_TABLET,
-            .bmAttributes          = 0xa0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_WAKEUP,
             .bMaxPower             = 50,
             .nif = 1,
             .ifs = &desc_iface_tablet,
@@ -236,7 +236,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_TABLET,
-            .bmAttributes          = 0xa0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_WAKEUP,
             .bMaxPower             = 50,
             .nif = 1,
             .ifs = &desc_iface_tablet2,
@@ -253,7 +253,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_KEYBOARD,
-            .bmAttributes          = 0xa0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_WAKEUP,
             .bMaxPower             = 50,
             .nif = 1,
             .ifs = &desc_iface_keyboard,
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 58647b4..bc03531 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -119,7 +119,8 @@
         {
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
-            .bmAttributes          = 0xe0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER |
+                                     USB_CFG_ATT_WAKEUP,
             .nif = 1,
             .ifs = &desc_iface_hub,
         },
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index f0c2536..518d536 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -266,7 +266,7 @@
             .bNumInterfaces        = 2,
             .bConfigurationValue   = DEV_RNDIS_CONFIG_VALUE,
             .iConfiguration        = STRING_RNDIS,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .bMaxPower             = 0x32,
             .nif = ARRAY_SIZE(desc_iface_rndis),
             .ifs = desc_iface_rndis,
@@ -274,7 +274,7 @@
             .bNumInterfaces        = 2,
             .bConfigurationValue   = DEV_CONFIG_VALUE,
             .iConfiguration        = STRING_CDC,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .bMaxPower             = 0x32,
             .nif = ARRAY_SIZE(desc_iface_cdc),
             .ifs = desc_iface_cdc,
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 0b150d4..d360614 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -144,7 +144,7 @@
         {
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
-            .bmAttributes          = 0x80,
+            .bmAttributes          = USB_CFG_ATT_ONE,
             .bMaxPower             = 50,
             .nif = 1,
             .ifs = &desc_iface0,
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 8c7a61e..470e69f 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -463,7 +463,8 @@
         {
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
-            .bmAttributes          = 0xe0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER |
+                                     USB_CFG_ATT_WAKEUP,
             .bMaxPower             = 50,
             .nif = 1,
             .ifs = &desc_iface0,
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index c434c56..2852669 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -117,7 +117,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_FULL,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .nif = 1,
             .ifs = &desc_iface_full,
         },
@@ -152,7 +152,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_HIGH,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .nif = 1,
             .ifs = &desc_iface_high,
         },
@@ -189,7 +189,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_SUPER,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .nif = 1,
             .ifs = &desc_iface_super,
         },
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 997b715..9832385 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -286,7 +286,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_HIGH,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .nif = 1,
             .ifs = &desc_iface_high,
         },
@@ -302,7 +302,7 @@
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
             .iConfiguration        = STR_CONFIG_SUPER,
-            .bmAttributes          = 0xc0,
+            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
             .nif = 1,
             .ifs = &desc_iface_super,
         },
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index 1b09235..1b73fd0 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -107,7 +107,7 @@
         {
             .bNumInterfaces        = 1,
             .bConfigurationValue   = 1,
-            .bmAttributes          = 0x80,
+            .bmAttributes          = USB_CFG_ATT_ONE,
             .bMaxPower             = 40,
             .nif = 1,
             .ifs = &desc_iface_wacom,
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index ad814b5..0820244 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -252,9 +252,11 @@
                               uint32_t td_addr, bool queuing)
 {
     UHCIAsync *first = QTAILQ_FIRST(&queue->asyncs);
+    uint32_t queue_token_addr = (queue->token >> 8) & 0x7f;
 
     return queue->qh_addr == qh_addr &&
            queue->token == uhci_queue_token(td) &&
+           queue_token_addr == queue->ep->dev->addr &&
            (queuing || !(td->ctrl & TD_CTRL_ACTIVE) || first == NULL ||
             first->td_addr == td_addr);
 }
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 0fa814e..ef3177a 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -807,7 +807,7 @@
 static void xhci_die(XHCIState *xhci)
 {
     xhci->usbsts |= USBSTS_HCE;
-    fprintf(stderr, "xhci: asserted controller error\n");
+    DPRINTF("xhci: asserted controller error\n");
 }
 
 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
@@ -854,8 +854,8 @@
     erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
     if (erdp < intr->er_start ||
         erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
-        fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
-        fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
+        DPRINTF("xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
+        DPRINTF("xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
                 v, intr->er_start, intr->er_size);
         xhci_die(xhci);
         return;
@@ -923,7 +923,7 @@
     if (intr->er_full) {
         DPRINTF("xhci_event(): ER full, queueing\n");
         if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
-            fprintf(stderr, "xhci: event queue full, dropping event!\n");
+            DPRINTF("xhci: event queue full, dropping event!\n");
             return;
         }
         intr->ev_buffer[intr->ev_buffer_put++] = *event;
@@ -936,8 +936,8 @@
     erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
     if (erdp < intr->er_start ||
         erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
-        fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
-        fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
+        DPRINTF("xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
+        DPRINTF("xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
                 v, intr->er_start, intr->er_size);
         xhci_die(xhci);
         return;
@@ -954,7 +954,7 @@
 #endif
         intr->er_full = 1;
         if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
-            fprintf(stderr, "xhci: event queue full, dropping event!\n");
+            DPRINTF("xhci: event queue full, dropping event!\n");
             return;
         }
         intr->ev_buffer[intr->ev_buffer_put++] = *event;
@@ -1072,7 +1072,7 @@
     }
     /* cache the (sole) event ring segment location */
     if (intr->erstsz != 1) {
-        fprintf(stderr, "xhci: invalid value for ERSTSZ: %d\n", intr->erstsz);
+        DPRINTF("xhci: invalid value for ERSTSZ: %d\n", intr->erstsz);
         xhci_die(xhci);
         return;
     }
@@ -1082,7 +1082,7 @@
     le32_to_cpus(&seg.addr_high);
     le32_to_cpus(&seg.size);
     if (seg.size < 16 || seg.size > 4096) {
-        fprintf(stderr, "xhci: invalid value for segment size: %d\n", seg.size);
+        DPRINTF("xhci: invalid value for segment size: %d\n", seg.size);
         xhci_die(xhci);
         return;
     }
@@ -1248,7 +1248,7 @@
 
     r = usb_device_alloc_streams(eps[0]->dev, eps, nr_eps, req_nr_streams);
     if (r != 0) {
-        fprintf(stderr, "xhci: alloc streams failed\n");
+        DPRINTF("xhci: alloc streams failed\n");
         return CC_RESOURCE_ERROR;
     }
 
@@ -1532,7 +1532,7 @@
     assert(slotid >= 1 && slotid <= xhci->numslots);
 
     if (epid < 1 || epid > 31) {
-        fprintf(stderr, "xhci: bad ep %d\n", epid);
+        DPRINTF("xhci: bad ep %d\n", epid);
         return CC_TRB_ERROR;
     }
 
@@ -1544,7 +1544,7 @@
     }
 
     if (xhci_ep_nuke_xfers(xhci, slotid, epid, CC_STOPPED) > 0) {
-        fprintf(stderr, "xhci: FIXME: endpoint stopped w/ xfers running, "
+        DPRINTF("xhci: FIXME: endpoint stopped w/ xfers running, "
                 "data might be lost\n");
     }
 
@@ -1569,7 +1569,7 @@
     assert(slotid >= 1 && slotid <= xhci->numslots);
 
     if (epid < 1 || epid > 31) {
-        fprintf(stderr, "xhci: bad ep %d\n", epid);
+        DPRINTF("xhci: bad ep %d\n", epid);
         return CC_TRB_ERROR;
     }
 
@@ -1583,13 +1583,13 @@
     epctx = slot->eps[epid-1];
 
     if (epctx->state != EP_HALTED) {
-        fprintf(stderr, "xhci: reset EP while EP %d not halted (%d)\n",
+        DPRINTF("xhci: reset EP while EP %d not halted (%d)\n",
                 epid, epctx->state);
         return CC_CONTEXT_STATE_ERROR;
     }
 
     if (xhci_ep_nuke_xfers(xhci, slotid, epid, 0) > 0) {
-        fprintf(stderr, "xhci: FIXME: endpoint reset w/ xfers running, "
+        DPRINTF("xhci: FIXME: endpoint reset w/ xfers running, "
                 "data might be lost\n");
     }
 
@@ -1626,7 +1626,7 @@
     assert(slotid >= 1 && slotid <= xhci->numslots);
 
     if (epid < 1 || epid > 31) {
-        fprintf(stderr, "xhci: bad ep %d\n", epid);
+        DPRINTF("xhci: bad ep %d\n", epid);
         return CC_TRB_ERROR;
     }
 
@@ -1643,7 +1643,7 @@
     epctx = slot->eps[epid-1];
 
     if (epctx->state != EP_STOPPED) {
-        fprintf(stderr, "xhci: set EP dequeue pointer while EP %d not stopped\n", epid);
+        DPRINTF("xhci: set EP dequeue pointer while EP %d not stopped\n", epid);
         return CC_CONTEXT_STATE_ERROR;
     }
 
@@ -1685,7 +1685,7 @@
         switch (TRB_TYPE(*trb)) {
         case TR_DATA:
             if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) {
-                fprintf(stderr, "xhci: data direction mismatch for TR_DATA\n");
+                DPRINTF("xhci: data direction mismatch for TR_DATA\n");
                 goto err;
             }
             /* fallthrough */
@@ -1695,7 +1695,7 @@
             chunk = trb->status & 0x1ffff;
             if (trb->control & TRB_TR_IDT) {
                 if (chunk > 8 || in_xfer) {
-                    fprintf(stderr, "xhci: invalid immediate data TRB\n");
+                    DPRINTF("xhci: invalid immediate data TRB\n");
                     goto err;
                 }
                 qemu_sglist_add(&xfer->sgl, trb->addr, chunk);
@@ -1824,7 +1824,7 @@
     } else {
         ep = xhci_epid_to_usbep(xhci, xfer->slotid, xfer->epid);
         if (!ep) {
-            fprintf(stderr, "xhci: slot %d has no device\n",
+            DPRINTF("xhci: slot %d has no device\n",
                     xfer->slotid);
             return -1;
         }
@@ -1887,7 +1887,7 @@
         xhci_stall_ep(xfer);
         break;
     default:
-        fprintf(stderr, "%s: FIXME: status = %d\n", __func__,
+        DPRINTF("%s: FIXME: status = %d\n", __func__,
                 xfer->packet.status);
         FIXME("unhandled USB_RET_*");
     }
@@ -1911,21 +1911,21 @@
 
     /* do some sanity checks */
     if (TRB_TYPE(*trb_setup) != TR_SETUP) {
-        fprintf(stderr, "xhci: ep0 first TD not SETUP: %d\n",
+        DPRINTF("xhci: ep0 first TD not SETUP: %d\n",
                 TRB_TYPE(*trb_setup));
         return -1;
     }
     if (TRB_TYPE(*trb_status) != TR_STATUS) {
-        fprintf(stderr, "xhci: ep0 last TD not STATUS: %d\n",
+        DPRINTF("xhci: ep0 last TD not STATUS: %d\n",
                 TRB_TYPE(*trb_status));
         return -1;
     }
     if (!(trb_setup->control & TRB_TR_IDT)) {
-        fprintf(stderr, "xhci: Setup TRB doesn't have IDT set\n");
+        DPRINTF("xhci: Setup TRB doesn't have IDT set\n");
         return -1;
     }
     if ((trb_setup->status & 0x1ffff) != 8) {
-        fprintf(stderr, "xhci: Setup TRB has bad length (%d)\n",
+        DPRINTF("xhci: Setup TRB has bad length (%d)\n",
                 (trb_setup->status & 0x1ffff));
         return -1;
     }
@@ -1974,10 +1974,10 @@
             xfer->mfindex_kick = asap;
         }
     } else {
-        xfer->mfindex_kick = (xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT)
-            & TRB_TR_FRAMEID_MASK;
+        xfer->mfindex_kick = ((xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT)
+                              & TRB_TR_FRAMEID_MASK) << 3;
         xfer->mfindex_kick |= mfindex & ~0x3fff;
-        if (xfer->mfindex_kick < mfindex) {
+        if (xfer->mfindex_kick + 0x100 < mfindex) {
             xfer->mfindex_kick += 0x4000;
         }
     }
@@ -2038,9 +2038,7 @@
         }
         break;
     default:
-        fprintf(stderr, "xhci: unknown or unhandled EP "
-                "(type %d, in %d, ep %02x)\n",
-                epctx->type, xfer->in_xfer, xfer->epid);
+        trace_usb_xhci_unimplemented("endpoint type", epctx->type);
         return -1;
     }
 
@@ -2078,12 +2076,12 @@
     assert(epid >= 1 && epid <= 31);
 
     if (!xhci->slots[slotid-1].enabled) {
-        fprintf(stderr, "xhci: xhci_kick_ep for disabled slot %d\n", slotid);
+        DPRINTF("xhci: xhci_kick_ep for disabled slot %d\n", slotid);
         return;
     }
     epctx = xhci->slots[slotid-1].eps[epid-1];
     if (!epctx) {
-        fprintf(stderr, "xhci: xhci_kick_ep for disabled endpoint %d,%d\n",
+        DPRINTF("xhci: xhci_kick_ep for disabled endpoint %d,%d\n",
                 epid, slotid);
         return;
     }
@@ -2188,14 +2186,14 @@
                 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
                 ep = xfer->packet.ep;
             } else {
-                fprintf(stderr, "xhci: error firing CTL transfer\n");
+                DPRINTF("xhci: error firing CTL transfer\n");
             }
         } else {
             if (xhci_fire_transfer(xhci, xfer, epctx) >= 0) {
                 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
             } else {
                 if (!xfer->timed_xfer) {
-                    fprintf(stderr, "xhci: error firing data transfer\n");
+                    DPRINTF("xhci: error firing data transfer\n");
                 }
             }
         }
@@ -2298,7 +2296,7 @@
     xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
 
     if (ictl_ctx[0] != 0x0 || ictl_ctx[1] != 0x3) {
-        fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
+        DPRINTF("xhci: invalid input context control %08x %08x\n",
                 ictl_ctx[0], ictl_ctx[1]);
         return CC_TRB_ERROR;
     }
@@ -2314,14 +2312,14 @@
 
     uport = xhci_lookup_uport(xhci, slot_ctx);
     if (uport == NULL) {
-        fprintf(stderr, "xhci: port not found\n");
+        DPRINTF("xhci: port not found\n");
         return CC_TRB_ERROR;
     }
     trace_usb_xhci_slot_address(slotid, uport->path);
 
     dev = uport->dev;
     if (!dev || !dev->attached) {
-        fprintf(stderr, "xhci: port %s not connected\n", uport->path);
+        DPRINTF("xhci: port %s not connected\n", uport->path);
         return CC_USB_TRANSACTION_ERROR;
     }
 
@@ -2330,7 +2328,7 @@
             continue;
         }
         if (xhci->slots[i].uport == uport) {
-            fprintf(stderr, "xhci: port %s already assigned to slot %d\n",
+            DPRINTF("xhci: port %s already assigned to slot %d\n",
                     uport->path, i+1);
             return CC_TRB_ERROR;
         }
@@ -2414,7 +2412,7 @@
     xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
 
     if ((ictl_ctx[0] & 0x3) != 0x0 || (ictl_ctx[1] & 0x3) != 0x1) {
-        fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
+        DPRINTF("xhci: invalid input context control %08x %08x\n",
                 ictl_ctx[0], ictl_ctx[1]);
         return CC_TRB_ERROR;
     }
@@ -2423,7 +2421,7 @@
     xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
 
     if (SLOT_STATE(slot_ctx[3]) < SLOT_ADDRESSED) {
-        fprintf(stderr, "xhci: invalid slot state %08x\n", slot_ctx[3]);
+        DPRINTF("xhci: invalid slot state %08x\n", slot_ctx[3]);
         return CC_CONTEXT_STATE_ERROR;
     }
 
@@ -2496,7 +2494,7 @@
     xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
 
     if (ictl_ctx[0] != 0x0 || ictl_ctx[1] & ~0x3) {
-        fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
+        DPRINTF("xhci: invalid input context control %08x %08x\n",
                 ictl_ctx[0], ictl_ctx[1]);
         return CC_TRB_ERROR;
     }
@@ -2575,11 +2573,11 @@
     unsigned int slotid;
     slotid = (trb->control >> TRB_CR_SLOTID_SHIFT) & TRB_CR_SLOTID_MASK;
     if (slotid < 1 || slotid > xhci->numslots) {
-        fprintf(stderr, "xhci: bad slot id %d\n", slotid);
+        DPRINTF("xhci: bad slot id %d\n", slotid);
         event->ccode = CC_TRB_ERROR;
         return 0;
     } else if (!xhci->slots[slotid-1].enabled) {
-        fprintf(stderr, "xhci: slot id %d not enabled\n", slotid);
+        DPRINTF("xhci: slot id %d not enabled\n", slotid);
         event->ccode = CC_SLOT_NOT_ENABLED_ERROR;
         return 0;
     }
@@ -2695,7 +2693,7 @@
                 }
             }
             if (i >= xhci->numslots) {
-                fprintf(stderr, "xhci: no device slots available\n");
+                DPRINTF("xhci: no device slots available\n");
                 event.ccode = CC_NO_SLOTS_ERROR;
             } else {
                 slotid = i+1;
@@ -2887,7 +2885,7 @@
 
     trace_usb_xhci_reset();
     if (!(xhci->usbsts & USBSTS_HCH)) {
-        fprintf(stderr, "xhci: reset while running!\n");
+        DPRINTF("xhci: reset while running!\n");
     }
 
     xhci->usbcmd = 0;
@@ -3065,7 +3063,7 @@
                 /* windows does this for some reason, don't spam stderr */
                 break;
             default:
-                fprintf(stderr, "%s: ignore pls write (old %d, new %d)\n",
+                DPRINTF("%s: ignore pls write (old %d, new %d)\n",
                         __func__, old_pls, new_pls);
                 break;
             }
@@ -3316,7 +3314,7 @@
     trace_usb_xhci_doorbell_write(reg, val);
 
     if (!xhci_running(xhci)) {
-        fprintf(stderr, "xhci: wrote doorbell while xHC stopped or paused\n");
+        DPRINTF("xhci: wrote doorbell while xHC stopped or paused\n");
         return;
     }
 
@@ -3326,16 +3324,16 @@
         if (val == 0) {
             xhci_process_commands(xhci);
         } else {
-            fprintf(stderr, "xhci: bad doorbell 0 write: 0x%x\n",
+            DPRINTF("xhci: bad doorbell 0 write: 0x%x\n",
                     (uint32_t)val);
         }
     } else {
         epid = val & 0xff;
         streamid = (val >> 16) & 0xffff;
         if (reg > xhci->numslots) {
-            fprintf(stderr, "xhci: bad doorbell %d\n", (int)reg);
+            DPRINTF("xhci: bad doorbell %d\n", (int)reg);
         } else if (epid > 31) {
-            fprintf(stderr, "xhci: bad doorbell %d write: 0x%x\n",
+            DPRINTF("xhci: bad doorbell %d write: 0x%x\n",
                     (int)reg, (uint32_t)val);
         } else {
             xhci_kick_ep(xhci, reg, epid, streamid);
@@ -3636,7 +3634,7 @@
         slot->uport = xhci_lookup_uport(xhci, slot_ctx);
         assert(slot->uport && slot->uport->dev);
 
-        for (epid = 1; epid <= 32; epid++) {
+        for (epid = 1; epid <= 31; epid++) {
             pctx = slot->ctx + 32 * epid;
             xhci_dma_read_u32s(xhci, pctx, ep_ctx, sizeof(ep_ctx));
             state = ep_ctx[0] & EP_STATE_MASK;
diff --git a/include/hw/usb.h b/include/hw/usb.h
index 3ef7af7..1919bdc 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -157,6 +157,11 @@
 #define USB_DEV_CAP_USB2_EXT            0x02
 #define USB_DEV_CAP_SUPERSPEED          0x03
 
+#define USB_CFG_ATT_ONE              (1 << 7) /* should always be set */
+#define USB_CFG_ATT_SELFPOWER        (1 << 6)
+#define USB_CFG_ATT_WAKEUP           (1 << 5)
+#define USB_CFG_ATT_BATTERY          (1 << 4)
+
 #define USB_ENDPOINT_XFER_CONTROL	0
 #define USB_ENDPOINT_XFER_ISOC		1
 #define USB_ENDPOINT_XFER_BULK		2