Hi,

so here is an updated version of the MBIM patch (this time as one
single patch).

This is what has changed since the first version:

- renamed it from 'mbim' to 'umbim'
        I tried 'ubm' as proposed by Theo but that felt weird. Esp.
        when changing the prefixes of macros whose names were
        derived from the MBIM standard.

        We could still name the network interfaces 'ubm' while
        keeping 'umbim' as the driver's name. A little bit
        confusing though.

- removed the 'devinfo' option from ifconfig and also compressed the
        printed information onto fewer lines.

        Here's an example of the new format:

        umbim0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1430
                index 5 priority 0
                roaming disabled registration home network
                state up cell-class HSPA rssi -85dBm speed 5.5Mps up 40.2Mps 
down
                SIM initialized PIN valid (9 attempts left)
                subscriber-id 26201264 ICC-id 8949020000 provider T-Mobile D
                device EM8805 IMEI xxxxxxxxx firmware SWI9X15C_05.05
                phone# +49xxxxxxxxx APN internet.t-mobile
                dns 10.74.210.210 10.74.210.211
                status: active
                inet 10.75.178.41 --> 10.75.178.42 netmask 0xfffffffc

- the driver no longer messes around with the routing table.

- the driver no longer messes around with the in_ifaddr structures.
        Instead it calls in_ioctl() to change the network address.

        Note that this patch includes a smaller patch by mpi@ that
        splits in_control() into two functions, one of them
        being in_ioctl(). I included his patch for convenience
        so that this MBIM patch can be applied on its own and doesn't
        require any prerequisites.

- I removed all the VID/PID entries. Although the code for matching
        devices by VID/PID is still there, the table is currently
        empty and the driver will only match MBIM devices based
        on Class/SubClass.

        If anyone observes a umbim device that is permanently
        attaching and detaching, it might be worth a try to add
        its VID/PID to umbim_devs[].


mpi@ requested to change the watchdog to do a stop and init of the
interface in order to perform a reset. This is still missing as it
is too complicated right now. Changing the interface from down to up
or vice versa is done via a state machine. That makes it complicated
to kick off a transition going from up to down and then up again.

Thanks for all the feedback.

Gerhard


Index: sbin/ifconfig/ifconfig.8
===================================================================
RCS file: /cvs/src/sbin/ifconfig/ifconfig.8,v
retrieving revision 1.267
diff -u -p -u -p -r1.267 ifconfig.8
--- sbin/ifconfig/ifconfig.8    6 Apr 2016 10:07:14 -0000       1.267
+++ sbin/ifconfig/ifconfig.8    1 Jun 2016 14:32:18 -0000
@@ -519,6 +519,8 @@ tunnel
 .Xr vxlan 4 )
 .It
 .Xr vlan 4
+.It
+.Xr umbim 4
 .El
 .\" BRIDGE
 .Sh BRIDGE
@@ -1645,6 +1647,67 @@ will be assigned 802.1Q tag 5.
 Disassociate from the parent interface.
 This breaks the link between the vlan interface and its parent,
 clears its vlan tag, flags, and link address, and shuts the interface down.
+.El
+.\" UMBIM
+.Sh UMBIM
+.nr nS 1
+.Bk -words
+.Nm ifconfig
+.Ar umbim-interface
+.Op Cm pin Ar pin
+.Op Cm chgpin Ar oldpin Ar newpin
+.Op Cm puk Ar puk Ar newpin
+.Op Oo Fl Oc Ns Cm apn Ar apn
+.Op Oo Fl Oc Ns Cm class Ar class,class,...
+.Op Oo Fl Oc Ns Cm roaming
+.Ek
+.nr nS 0
+.Pp
+The following options are available for an
+.Xr umbim 4
+interface:
+.Bl -tag -width Ds
+.It Cm pin Ar pin
+Enter the PIN required to unlock the SIM card. Most SIM cards will not
+allow to establish a network association without providing a PIN.
+.It Cm chgpin Ar oldpin Ar newpin
+Permanently changes the PIN of the SIM card from the current value
+.Ar oldpin
+to
+.Ar newpin .
+.It Cm puk Ar puk Ar newpin
+Sets the PIN of the SIM card to
+.Ar newpin
+using the PUK
+.Ar puk
+to validate the request.
+.It Cm apn Ar apn
+Set the "Access Point Name" required by your network provider.
+.It Fl apn
+Clear the current "Access Point Name" value.
+.It Cm class
+List all available cell classes.
+.It Cm class Ar class,class,...
+Set the preferred cell classes. Apart from those listed by
+.Nm Cm class
+the following aliases can be used:
+.Ar 4G,
+.Ar 3G,
+and
+.Ar 2G.
+.It Fl class
+Clear any cell class preferences.
+.It Cm roaming
+Enable data roaming.
+.It Fl roaming
+Disable data roaming.
+.It Cm up
+As soon as the interface is marked as "up", the
+.Xr umbim 4
+device will try to establish a data connection with the service provider.
+.It Cm down
+Marking the interface as "down" will terminate any existing data connection
+and deregister with the service provider.
 .El
 .Sh EXAMPLES
 Assign the
Index: sbin/ifconfig/ifconfig.c
===================================================================
RCS file: /cvs/src/sbin/ifconfig/ifconfig.c,v
retrieving revision 1.322
diff -u -p -u -p -r1.322 ifconfig.c
--- sbin/ifconfig/ifconfig.c    3 May 2016 17:52:33 -0000       1.322
+++ sbin/ifconfig/ifconfig.c    1 Jun 2016 14:32:18 -0000
@@ -107,6 +107,8 @@
 #include <ifaddrs.h>
 
 #include "brconfig.h"
+#include <dev/usb/umbim.h>
+#include <dev/usb/if_umbim.h>
 
 #define MINIMUM(a, b)  (((a) < (b)) ? (a) : (b))
 #define MAXIMUM(a, b)  (((a) > (b)) ? (a) : (b))
@@ -145,6 +147,7 @@ int showmediaflag;
 int    showcapsflag;
 int    shownet80211chans;
 int    shownet80211nodes;
+int    showclasses;
 
 void   notealias(const char *, int);
 void   setifaddr(const char *, int);
@@ -275,6 +278,18 @@ void       unsetifdesc(const char *, int);
 void   printifhwfeatures(const char *, int);
 void   setpair(const char *, int);
 void   unsetpair(const char *, int);
+void   umbim_status(void);
+void   umbim_printclasses(char *, int);
+int    umbim_parse_classes(const char *);
+void   umbim_setpin(const char *, int);
+void   umbim_chgpin(const char *, const char *);
+void   umbim_puk(const char *, const char *);
+void   umbim_pinop(int, int, const char *, const char *);
+void   umbim_apn(const char *, int);
+void   umbim_setclass(const char *, int);
+void   umbim_roaming(const char *, int);
+void   utf16_to_char(uint16_t *, int, char *, size_t);
+int    char_to_utf16(const char *, uint16_t *, size_t);
 #else
 void   setignore(const char *, int);
 #endif
@@ -486,6 +501,15 @@ const struct       cmd {
        { "-descr",     1,              0,              unsetifdesc },
        { "wol",        IFXF_WOL,       0,              setifxflags },
        { "-wol",       -IFXF_WOL,      0,              setifxflags },
+       { "pin",        NEXTARG,        0,              umbim_setpin },
+       { "chgpin",     NEXTARG2,       0,              NULL, umbim_chgpin },
+       { "puk",        NEXTARG2,       0,              NULL, umbim_puk },
+       { "apn",        NEXTARG,        0,              umbim_apn },
+       { "-apn",       -1,             0,              umbim_apn },
+       { "class",      NEXTARG0,       0,              umbim_setclass },
+       { "-class",     -1,             0,              umbim_setclass },
+       { "roaming",    1,              0,              umbim_roaming },
+       { "-roaming",   0,              0,              umbim_roaming },
        { "patch",      NEXTARG,        0,              setpair },
        { "-patch",     1,              0,              unsetpair },
 #else /* SMALL */
@@ -2942,6 +2966,7 @@ status(int link, struct sockaddr_dl *sdl
        mpe_status();
        mpw_status();
        pflow_status();
+       umbim_status();
 #endif
        trunk_status();
        getifgroups();
@@ -4875,6 +4900,403 @@ setifpriority(const char *id, int param)
        if (ioctl(s, SIOCSIFPRIORITY, (caddr_t)&ifr) < 0)
                warn("SIOCSIFPRIORITY");
 }
+
+
+const struct umbim_valdescr umbim_regstate[] = UMBIM_REGSTATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_dataclass[] = UMBIM_DATACLASS_DESCRIPTIONS;
+const struct umbim_valdescr umbim_simstate[] = UMBIM_SIMSTATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_istate[] = UMBIM_INTERNAL_STATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_pktstate[] = UMBIM_PKTSRV_STATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_actstate[] = 
UMBIM_ACTIVATION_STATE_DESCRIPTIONS;
+
+const struct umbim_valdescr umbim_classalias[] = {
+       { UMBIM_DATACLASS_GPRS | UMBIM_DATACLASS_EDGE, "2g" },
+       { UMBIM_DATACLASS_UMTS | UMBIM_DATACLASS_HSDPA | UMBIM_DATACLASS_HSUPA,
+           "3g" },
+       { UMBIM_DATACLASS_LTE, "4g" },
+       { 0, NULL }
+};
+
+int
+umbim_descr2val(const struct umbim_valdescr *vdp, char *str)
+{
+       while (vdp->descr != NULL) {
+               if (!strcasecmp(vdp->descr, str))
+                       return vdp->val;
+               vdp++;
+       }
+       return 0;
+}
+
+void
+umbim_status(void)
+{
+       struct umbim_info mi;
+       char     provider[UMBIM_PROVIDERNAME_MAXLEN+1];
+       char     roamingtxt[UMBIM_ROAMINGTEXT_MAXLEN+1];
+       char     devid[UMBIM_DEVID_MAXLEN+1];
+       char     fwinfo[UMBIM_FWINFO_MAXLEN+1];
+       char     hwinfo[UMBIM_HWINFO_MAXLEN+1];
+       char     sid[UMBIM_SUBSCRIBERID_MAXLEN+1];
+       char     iccid[UMBIM_ICCID_MAXLEN+1];
+       char     apn[UMBIM_APN_MAXLEN+1];
+       char     pn[UMBIM_PHONENR_MAXLEN+1];
+       int      i, n;
+
+       memset((char *)&mi, 0, sizeof(mi));
+       ifr.ifr_data = (caddr_t)&mi;
+       if (ioctl(s, SIOCGUMBIMINFO, (caddr_t)&ifr) == -1)
+               return;
+
+       if (mi.nwerror) {
+               /* 3GPP 24.008 Cause Code */
+               printf("\terror: ");
+               switch (mi.nwerror) {
+               case 2:
+                       printf("SIM not activated");
+                       break;
+               case 4:
+                       printf("Roaming not supported");
+                       break;
+               case 6:
+                       printf("SIM reported stolen");
+                       break;
+               case 7:
+                       printf("No GPRS subscription");
+                       break;
+               case 8:
+                       printf("GPRS and non-GPRS services not allowed");
+                       break;
+               case 11:
+                       printf("Subscription expired");
+                       break;
+               case 12:
+                       printf("Subscription does not cover current location");
+                       break;
+               case 13:
+                       printf("No roaming in this location");
+                       break;
+               case 14:
+                       printf("GPRS not supported");
+                       break;
+               case 15:
+                       printf("No subscription for the service");
+                       break;
+               case 17:
+                       printf("Registration failed");
+                       break;
+               case 22:
+                       printf("Network congestion");
+                       break;
+               default:
+                       printf("Error code %d", mi.nwerror);
+                       break;
+               }
+               printf("\n");
+       }
+
+       printf("\troaming %s registration %s",
+           mi.enable_roaming ? "enabled" : "disabled",
+           umbim_val2descr(umbim_regstate, mi.regstate));
+       utf16_to_char(mi.roamingtxt, UMBIM_ROAMINGTEXT_MAXLEN,
+           roamingtxt, sizeof (roamingtxt));
+       if (roamingtxt[0])
+               printf(" [%s]", roamingtxt);
+       printf("\n");
+
+       if (showclasses)
+               umbim_printclasses("available classes", mi.supportedclasses);
+       printf("\tstate %s cell-class %s",
+           umbim_val2descr(umbim_istate, mi.state),
+           umbim_val2descr(umbim_dataclass, mi.highestclass));
+       if (mi.rssi != UMBIM_VALUE_UNKNOWN && mi.rssi != 0)
+               printf(" rssi %ddBm", mi.rssi);
+       if (mi.uplink_speed != 0 || mi.downlink_speed != 0) {
+               char s[2][FMT_SCALED_STRSIZE];
+               if (fmt_scaled(mi.uplink_speed, s[0]) != 0)
+                       snprintf(s[0], sizeof (s[0]), "%llu", mi.uplink_speed);
+               if (fmt_scaled(mi.downlink_speed, s[1]) != 0)
+                       snprintf(s[1], sizeof (s[1]), "%llu", 
mi.downlink_speed);
+               printf(" speed %sps up %sps down", s[0], s[1]);
+       }
+       printf("\n");
+
+       printf("\tSIM %s PIN ", umbim_val2descr(umbim_simstate, mi.sim_state));
+       switch (mi.pin_state) {
+       case UMBIM_PIN_REQUIRED:
+               printf("required");
+               break;
+       case UMBIM_PIN_UNLOCKED:
+               printf("valid");
+               break;
+       case UMBIM_PUK_REQUIRED:
+               printf("locked (PUK required)");
+               break;
+       default:
+               printf("unkown state (%d)", mi.pin_state);
+               break;
+       }
+       if (mi.pin_attempts_left != UMBIM_VALUE_UNKNOWN)
+               printf(" (%d attempts left)", mi.pin_attempts_left);
+       printf("\n");
+
+       utf16_to_char(mi.sid, UMBIM_SUBSCRIBERID_MAXLEN, sid, sizeof (sid));
+       utf16_to_char(mi.iccid, UMBIM_ICCID_MAXLEN, iccid, sizeof (iccid));
+       utf16_to_char(mi.provider, UMBIM_PROVIDERNAME_MAXLEN,
+           provider, sizeof (provider));
+       if (sid[0] || iccid[0] || provider[0]) {
+               printf("\t");
+               n = 0;
+               if (sid[0])
+                       printf("%ssubscriber-id %s", n++ ? " " : "", sid);
+               if (iccid[0])
+                       printf("%sICC-id %s", n++ ? " " : "", iccid);
+               if (provider[0])
+                       printf("%sprovider %s", n ? " " : "", provider);
+               printf("\n");
+       }
+
+       utf16_to_char(mi.hwinfo, UMBIM_HWINFO_MAXLEN, hwinfo, sizeof (hwinfo));
+       utf16_to_char(mi.devid, UMBIM_DEVID_MAXLEN, devid, sizeof (devid));
+       utf16_to_char(mi.fwinfo, UMBIM_FWINFO_MAXLEN, fwinfo, sizeof (fwinfo));
+       if (hwinfo[0] || devid[0] || fwinfo[0]) {
+               printf("\t");
+               n = 0;
+               if (hwinfo[0])
+                       printf("%sdevice %s", n++ ? " " : "", hwinfo);
+               if (devid[0]) {
+                       printf("%s", n++ ? " " : "");
+                       switch (mi.cellclass) {
+                       case UMBIM_CELLCLASS_GSM:
+                               printf("IMEI");
+                               break;
+                       case UMBIM_CELLCLASS_CDMA:
+                               n = strlen(devid);
+                               if (n == 8 || n == 11) {
+                                       printf("ESN");
+                                       break;
+                               } else if (n == 14 || n == 18) {
+                                       printf("MEID");
+                                       break;
+                               }
+                               /*FALLTHROUGH*/
+                       default:
+                               printf("ID");
+                               break;
+                       }
+                       printf(" %s", devid);
+               }
+               if (fwinfo[0])
+                       printf("%sfirmware %s", n++ ? " " : "", fwinfo);
+               printf("\n");
+       }
+
+       utf16_to_char(mi.pn, UMBIM_PHONENR_MAXLEN, pn, sizeof (pn));
+       utf16_to_char(mi.apn, UMBIM_APN_MAXLEN, apn, sizeof (apn));
+       if (pn[0] || apn[0]) {
+               printf("\t");
+               n = 0;
+               if (pn[0])
+                       printf("%sphone# +%s", n++ ? " " : "", pn);
+               if (apn[0])
+                       printf("%sAPN %s", n++ ? " " : "", apn);
+               printf("\n");
+       }
+
+       for (i = 0, n = 0; i < UMBIM_MAX_DNSSRV; i++) {
+               if (mi.ipv4dns[i] == INADDR_ANY)
+                       break;
+               printf("%s %s", n++ ? "" : "\tdns",
+                   inet_ntoa(*(struct in_addr *)&mi.ipv4dns[i]));
+       }
+       if (n)
+               printf("\n");
+}
+
+void
+umbim_printclasses(char *tag, int c)
+{
+       int      i;
+       char    *sep = "";
+
+       printf("\t%s: ", tag);
+       i = 0;
+       while (umbim_dataclass[i].descr) {
+               if (umbim_dataclass[i].val & c) {
+                       printf("%s%s", sep, umbim_dataclass[i].descr);
+                       sep = ",";
+               }
+               i++;
+       }
+       printf("\n");
+}
+
+int
+umbim_parse_classes(const char *spec)
+{
+       char    *optlist, *str;
+       int      c = 0, v;
+
+       if ((optlist = strdup(spec)) == NULL)
+               err(1, "strdup");
+       str = strtok(optlist, ",");
+       while (str != NULL) {
+               if ((v = umbim_descr2val(umbim_dataclass, str)) != 0 ||
+                   (v = umbim_descr2val(umbim_classalias, str)) != 0)
+                       c |= v;
+               str = strtok(NULL, ",");
+       }
+       free(optlist);
+       return c;
+}
+
+void
+umbim_setpin(const char *pin, int d)
+{
+       umbim_pinop(UMBIM_PIN_OP_ENTER, 0, pin, NULL);
+}
+
+void
+umbim_chgpin(const char *pin, const char *newpin)
+{
+       umbim_pinop(UMBIM_PIN_OP_CHANGE, 0, pin, newpin);
+}
+
+void
+umbim_puk(const char *pin, const char *newpin)
+{
+       umbim_pinop(UMBIM_PIN_OP_ENTER, 1, pin, newpin);
+}
+
+void
+umbim_pinop(int op, int is_puk, const char *pin, const char *newpin)
+{
+       struct umbim_parameter mp;
+
+       memset(&mp, 0, sizeof (mp));
+       ifr.ifr_data = (caddr_t)&mp;
+       if (ioctl(s, SIOCGUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCGUMBIMPARAM");
+
+       mp.op = op;
+       mp.is_puk = is_puk;
+       if ((mp.pinlen = char_to_utf16(pin, (uint16_t *)mp.pin,
+           sizeof (mp.pin))) == -1)
+               errx(1, "PIN too long");
+
+       if (newpin) {
+               if ((mp.newpinlen = char_to_utf16(newpin, (uint16_t *)mp.newpin,
+                   sizeof (mp.newpin))) == -1)
+               errx(1, "new PIN too long");
+       }
+
+       if (ioctl(s, SIOCSUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCSUMBIMPARAM");
+}
+
+void
+umbim_apn(const char *apn, int d)
+{
+       struct umbim_parameter mp;
+
+       memset(&mp, 0, sizeof (mp));
+       ifr.ifr_data = (caddr_t)&mp;
+       if (ioctl(s, SIOCGUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCGUMBIMPARAM");
+
+       if (d != 0)
+               memset(mp.apn, 0, sizeof (mp.apn));
+       else if ((mp.apnlen = char_to_utf16(apn, mp.apn,
+           sizeof (mp.apn))) == -1)
+               errx(1, "APN too long");
+
+       if (ioctl(s, SIOCSUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCSUMBIMPARAM");
+}
+
+void
+umbim_setclass(const char *val, int d)
+{
+       struct umbim_parameter mp;
+
+       if (val == NULL) {
+               if (showclasses)
+                       usage(1);
+               showclasses = 1;
+               return;
+       }
+
+       memset(&mp, 0, sizeof (mp));
+       ifr.ifr_data = (caddr_t)&mp;
+       if (ioctl(s, SIOCGUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCGUMBIMPARAM");
+       if (d != -1)
+               mp.preferredclasses = umbim_parse_classes(val);
+       else
+               mp.preferredclasses = UMBIM_DATACLASS_NONE;
+       if (ioctl(s, SIOCSUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCSUMBIMPARAM");
+}
+
+void
+umbim_roaming(const char *val, int d)
+{
+       struct umbim_parameter mp;
+
+       memset(&mp, 0, sizeof (mp));
+       ifr.ifr_data = (caddr_t)&mp;
+       if (ioctl(s, SIOCGUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCGUMBIMPARAM");
+       mp.roaming = d;
+       if (ioctl(s, SIOCSUMBIMPARAM, (caddr_t)&ifr) == -1)
+               err(1, "SIOCSUMBIMPARAM");
+}
+
+void
+utf16_to_char(uint16_t *in, int inlen, char *out, size_t outlen)
+{
+       uint16_t c;
+
+       while (outlen > 0) {
+               c = inlen > 0 ? letoh16(*in) : 0;
+               if (c == 0 || --outlen == 0) {
+                       /* always NUL terminate result */
+done:
+                       *out = '\0';
+                       break;
+               }
+               *out++ = isascii(c) ? (char)c : '?';
+               in++;
+               inlen -= sizeof (*in);
+       }
+}
+
+int
+char_to_utf16(const char *in, uint16_t *out, size_t outlen)
+{
+       int      n = 0;
+       uint16_t c;
+
+       for (;;) {
+               c = *in++;
+
+               if (c == '\0') {
+                       /*
+                        * NUL termination is not required, but zero out the
+                        * residual buffer
+                        */
+                       memset(out, 0, outlen);
+                       return n;
+               }
+               if (outlen < sizeof (*out))
+                       return -1;
+
+               *out++ = htole16(c);
+               n += sizeof (*out);
+               outlen -= sizeof (*out);
+       }
+}
+
 #endif
 
 #define SIN(x) ((struct sockaddr_in *) &(x))
Index: share/man/man4/Makefile
===================================================================
RCS file: /cvs/src/share/man/man4/Makefile,v
retrieving revision 1.621
diff -u -p -u -p -r1.621 Makefile
--- share/man/man4/Makefile     11 May 2016 21:52:49 -0000      1.621
+++ share/man/man4/Makefile     1 Jun 2016 14:32:18 -0000
@@ -33,9 +33,9 @@ MAN=  aac.4 ac97.4 acphy.4 \
        ix.4 ixgb.4 jmb.4 jme.4 jmphy.4 \
        kate.4 km.4 ksyms.4 kue.4 lc.4 lge.4 lii.4 lisa.4 lm.4 \
        lmenv.4 lmn.4 lmtemp.4 lo.4 lpt.4 lxtphy.4 luphy.4 \
-       maestro.4 mainbus.4 malo.4 maxds.4 maxtmp.4 mbg.4 midi.4 mii.4 mfi.4 \
-       mfii.4 mlphy.4 moscom.4 mos.4 mpe.4 mpath.4 mpi.4 mpii.4 mpu.4 msk.4 \
-       mpw.4 msts.4 mtd.4 mtdphy.4 multicast.4 mtio.4 myx.4 \
+       maestro.4 mainbus.4 malo.4 maxds.4 maxtmp.4 mbg.4 midi.4 mii.4 \
+       mfi.4 mfii.4 mlphy.4 moscom.4 mos.4 mpe.4 mpath.4 mpi.4 mpii.4 mpu.4 \
+       msk.4 mpw.4 msts.4 mtd.4 mtdphy.4 multicast.4 mtio.4 myx.4 \
        ne.4 neo.4 nep.4 netintro.4 nfe.4 nge.4 nmea.4 \
        nsclpcsio.4 nsgphy.4 nsphy.4 nsphyter.4 null.4 nviic.4 nvme.4 nvt.4 \
        oce.4 ohci.4 options.4 onewire.4 oosiop.4 osiop.4 otus.4 \
@@ -60,8 +60,8 @@ MAN=  aac.4 ac97.4 acphy.4 \
        ucom.4 uchcom.4 ucycom.4 uslhcom.4 udav.4 udcf.4 udl.4 udp.4 udsbr.4 \
        uftdi.4 ugen.4 ugl.4 ugold.4 uguru.4 uhci.4 uhid.4 uhidev.4 uipaq.4 \
        uk.4 ukbd.4 \
-       ukphy.4 ulpt.4 umass.4 umbg.4 umcs.4 umct.4 umidi.4 umodem.4 ums.4 \
-       umsm.4 unix.4 uonerng.4 uow.4 uoaklux.4 uoakrh.4 uoakv.4 upd.4 \
+       ukphy.4 ulpt.4 umass.4 umbg.4 umbim.4 umcs.4 umct.4 umidi.4 umodem.4 \
+       ums.4 umsm.4 unix.4 uonerng.4 uow.4 uoaklux.4 uoakrh.4 uoakv.4 upd.4 \
        upgt.4 upl.4 uplcom.4 ural.4 url.4 urlphy.4 \
        urndis.4 urtw.4 urtwn.4 usb.4  usbf.4 uscom.4 uslcom.4 usps.4 \
        uthum.4 uticom.4 utpms.4 utwitch.4 utrh.4 uts.4 uvideo.4 uvisor.4 \
Index: share/man/man4/umbim.4
===================================================================
RCS file: share/man/man4/umbim.4
diff -N share/man/man4/umbim.4
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ share/man/man4/umbim.4      1 Jun 2016 14:32:18 -0000
@@ -0,0 +1,95 @@
+.\" Copyright (c) 2016 genua mbH
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\"    - Redistributions of source code must retain the above copyright
+.\"      notice, this list of conditions and the following disclaimer.
+.\"    - Redistributions in binary form must reproduce the above
+.\"      copyright notice, this list of conditions and the following
+.\"      disclaimer in the documentation and/or other materials provided
+.\"      with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.\" $OpenBSD$
+.\"
+.Dd $Mdocdate$
+.Dt UBM 4
+.Os
+.Sh NAME
+.Nm ubm
+.Nd USB Mobile Broadband Interface Model (MBIM)
+.Sh SYNOPSIS
+.Cd "ubm*  at uhub?"
+.Sh DESCRIPTION
+The
+.Nm
+driver provides support for USB MBIM devices. Those devices allow to
+establish connections via celluar networks such as GPRS, UMTS, LTE, etc.
+.Pp
+The
+.Nm
+device appears as a regular point-to-point network interface,
+transporting raw IP frames.
+.Pp
+Required configuration parameters like PIN and APN have to be set
+via
+.Xr ifconfig 8 .
+Once the SIM card has has been unlocked with the correct PIN, it
+will remain in this state until the device is power-cycled.
+In case the device is connected to an "always-on" USB port,
+it is possible to connect to a provider without entering the
+PIN again even afer a reboot of the system.
+.Pp
+If a default gateway route is configured for the
+.Nm
+network interface, the driver will modify the destination IP address
+dynamically, according to the information sent by the network provider.
+.Sh HARDWARE
+The following devices are known to be supported by the
+.Nm
+driver:
+.Pp
+.Bl -tag -width Ds -offset indent -compact
+.It Tn Sierra Wireless MC8305
+.It Tn Sierra Wireless EM8805
+.El
+.Pp
+There are probably a lot more devices that also work flawlessly.
+If some devices fail to provide a confirming MBIM implementation,
+their vendor and product IDs should be added to the driver's blacklist
+manually.  Since most device offer multiple interfaces, blacklisted ones
+will probably be attached by some other driver, e.g.
+.Xr umsm 4 .
+.Sh SEE ALSO
+.Xr intro 4 ,
+.Xr netintro 4 ,
+.Xr usb 4 ,
+.Xr hostname.if 5 ,
+.Xr ifconfig 8
+.Xr route 8
+.Rs
+.%T "Universal Serial Bus Communications Class Subclass Specification for 
Mobile Broadband Interface Model"
+.%U http://www.usb.org/developers/docs/devclass_docs/MBIM10Errata1_073013.zip
+.Re
+.Sh CAVEATS
+The
+.Nm
+driver currently does not support IPv6 addresses.
+.Pp
+Roaming can be prevented by the driver. This feature hasn't been tested.
+Please don't kill me in case your phone bills rack up sky high.
Index: share/man/man4/usb.4
===================================================================
RCS file: /cvs/src/share/man/man4/usb.4,v
retrieving revision 1.174
diff -u -p -u -p -r1.174 usb.4
--- share/man/man4/usb.4        24 May 2016 05:47:16 -0000      1.174
+++ share/man/man4/usb.4        1 Jun 2016 14:32:18 -0000
@@ -277,6 +277,11 @@ USBRH temperature and humidity sensor
 .It Xr utwitch 4
 YUREX USB twitch/jiggle of knee sensor
 .El
+.Ss WAN network devices
+.Bl -tag -width 12n -offset ind -compact
+.It Xr umbim 4
+USB Mobile Broadband Interface Model device
+.El
 .Ss Miscellaneous devices
 .Bl -tag -width 12n -offset ind -compact
 .It Xr ualea 4
Index: sys/arch/amd64/conf/GENERIC
===================================================================
RCS file: /cvs/src/sys/arch/amd64/conf/GENERIC,v
retrieving revision 1.419
diff -u -p -u -p -r1.419 GENERIC
--- sys/arch/amd64/conf/GENERIC 1 Jun 2016 09:48:20 -0000       1.419
+++ sys/arch/amd64/conf/GENERIC 1 Jun 2016 14:32:19 -0000
@@ -279,6 +279,7 @@ urtw*       at uhub?                # Realtek 8187
 rsu*   at uhub?                # Realtek RTL8188SU/RTL8191SU/RTL8192SU
 urtwn* at uhub?                # Realtek RTL8188CU/RTL8192CU
 udcf*  at uhub?                # Gude Expert mouseCLOCK
+umbim* at uhub?                # Mobile Broadband Interface Model
 uthum* at uhidev?              # TEMPerHUM sensor
 ugold* at uhidev?              # gold TEMPer sensor
 utrh*  at uhidev?              # USBRH sensor
Index: sys/arch/i386/conf/GENERIC
===================================================================
RCS file: /cvs/src/sys/arch/i386/conf/GENERIC,v
retrieving revision 1.815
diff -u -p -u -p -r1.815 GENERIC
--- sys/arch/i386/conf/GENERIC  1 Jun 2016 11:39:59 -0000       1.815
+++ sys/arch/i386/conf/GENERIC  1 Jun 2016 14:32:19 -0000
@@ -314,6 +314,7 @@ rsu*        at uhub?                # Realtek 
RTL8188SU/RTL81
 urtwn* at uhub?                # Realtek RTL8188CU/RTL8192CU
 udcf*  at uhub?                # Gude Expert mouseCLOCK
 umbg*  at uhub?                # Meinberg Funkuhren USB5131
+umbim* at uhub?                # Mobile Broadband Interface Model
 uthum* at uhidev?              # TEMPerHUM sensor
 ugold* at uhidev?              # gold TEMPer sensor
 utrh*  at uhidev?              # USBRH sensor
Index: sys/dev/usb/files.usb
===================================================================
RCS file: /cvs/src/sys/dev/usb/files.usb,v
retrieving revision 1.127
diff -u -p -u -p -r1.127 files.usb
--- sys/dev/usb/files.usb       1 Jun 2016 09:48:20 -0000       1.127
+++ sys/dev/usb/files.usb       1 Jun 2016 14:32:19 -0000
@@ -402,6 +402,11 @@ device     otus: ether, ifnet, ifmedia, wlan
 attach otus at uhub
 file   dev/usb/if_otus.c               otus
 
+# Mobile Broadband Interface Model
+device umbim: ifnet, ifmedia
+attach umbim at uhub
+file   dev/usb/if_umbim.c              umbim
+
 # USB logical device
 device usbf {}
 attach usbf at usbdev
Index: sys/dev/usb/if_umbim.c
===================================================================
RCS file: sys/dev/usb/if_umbim.c
diff -N sys/dev/usb/if_umbim.c
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ sys/dev/usb/if_umbim.c      1 Jun 2016 14:32:19 -0000
@@ -0,0 +1,2441 @@
+/*     $OpenBSD$ */
+
+/*
+ * Copyright (c) 2016 genua mbH
+ * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Mobile Broadband Interface Model
+ * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
+ */
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/device.h>
+#include <sys/socket.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/mbuf.h>
+#include <sys/time.h>
+#include <sys/timeout.h>
+#include <sys/kernel.h>
+#include <sys/syslog.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+#include <net/if.h>
+#include <net/netisr.h>
+#include <net/if_arp.h>
+#include <net/if_var.h>
+#include <net/if_types.h>
+#include <net/route.h>
+
+#include <netinet/in.h>
+#include <netinet/in_var.h>
+#include <netinet/ip.h>
+
+#include <machine/bus.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+#include <dev/usb/usbdivar.h>
+#include <dev/usb/usbdi_util.h>
+#include <dev/usb/usbdevs.h>
+#include <dev/usb/usbcdc.h>
+
+#include <dev/usb/umbim.h>
+#include <dev/usb/if_umbim.h>
+
+#ifdef UMBIM_DEBUG
+#define DPRINTF(x...)                                                  \
+               do { if (umbim_debug) log(LOG_DEBUG, x); } while (0)
+
+#define DPRINTFN(n, x...)                                              \
+               do { if (umbim_debug >= (n)) log(LOG_DEBUG, x); } while (0)
+
+#define DDUMPN(n, b, l)                                                        
\
+               do {                                                    \
+                       if (umbim_debug >= (n))                         \
+                               umbim_dump((b), (l));                   \
+               } while (0)
+
+int     umbim_debug = 0;
+char   *umbim_uuid2str(uint8_t [UMBIM_UUID_LEN]);
+void    umbim_dump(void *, int);
+
+#else
+#define DPRINTF(x...)          do { } while (0)
+#define DPRINTFN(n, x...)      do { } while (0)
+#define DDUMPN(n, b, l)                do { } while (0)
+#endif
+
+#define DEVNAM(sc)             (((struct umbim_softc *)(sc))->sc_dev.dv_xname)
+
+/*
+ * State change timeout
+ */
+#define UMBIM_STATE_CHANGE_TIMEOUT     30
+
+/*
+ * State change flags
+ */
+#define UMBIM_NS_DONT_DROP     0x0001  /* do not drop below current state */
+#define UMBIM_NS_DONT_RAISE    0x0002  /* do not raise below current state */
+
+/*
+ * Diagnostic macros
+ */
+const struct umbim_valdescr umbim_regstates[] = UMBIM_REGSTATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_dataclasses[] = UMBIM_DATACLASS_DESCRIPTIONS;
+const struct umbim_valdescr umbim_simstate[] = UMBIM_SIMSTATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_messages[] = UMBIM_MESSAGES_DESCRIPTIONS;
+const struct umbim_valdescr umbim_status[] = UMBIM_STATUS_DESCRIPTIONS;
+const struct umbim_valdescr umbim_cids[] = UMBIM_CID_DESCRIPTIONS;
+const struct umbim_valdescr umbim_pktstate[] = UMBIM_PKTSRV_STATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_actstate[] = 
UMBIM_ACTIVATION_STATE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_error[] = UMBIM_ERROR_DESCRIPTIONS;
+const struct umbim_valdescr umbim_pintype[] = UMBIM_PINTYPE_DESCRIPTIONS;
+const struct umbim_valdescr umbim_istate[] = UMBIM_INTERNAL_STATE_DESCRIPTIONS;
+
+#define umbim_regstate(c)      umbim_val2descr(umbim_regstates, (c))
+#define umbim_dataclass(c)     umbim_val2descr(umbim_dataclasses, (c))
+#define umbim_simstate(s)      umbim_val2descr(umbim_simstate, (s))
+#define        umbim_request2str(m)    umbim_val2descr(umbim_messages, (m))
+#define        umbim_status2str(s)     umbim_val2descr(umbim_status, (s))
+#define        umbim_cid2str(c)        umbim_val2descr(umbim_cids, (c))
+#define        umbim_packet_state(s)   umbim_val2descr(umbim_pktstate, (s))
+#define        umbim_activation(s)     umbim_val2descr(umbim_actstate, (s))
+#define        umbim_error2str(e)      umbim_val2descr(umbim_error, (e))
+#define        umbim_pin_type(t)       umbim_val2descr(umbim_pintype, (t))
+#define        umbim_istate(s)         umbim_val2descr(umbim_istate, (s))
+
+/*
+ * Saved original interface address
+ * See "struct in_ifaddr".
+ */
+struct umbim_ifaddr {
+       struct sockaddr_in       addr;
+       struct sockaddr_in       dst;
+       struct sockaddr_in       netmask;
+};
+
+int             umbim_match(struct device *, void *, void *);
+void            umbim_attach(struct device *, struct device *, void *);
+int             umbim_detach(struct device *, int);
+int             umbim_alloc_xfers(struct umbim_softc *);
+void            umbim_free_xfers(struct umbim_softc *);
+int             umbim_alloc_bulkpipes(struct umbim_softc *);
+void            umbim_close_bulkpipes(struct umbim_softc *);
+int             umbim_ioctl(struct ifnet *, u_long, caddr_t);
+int             umbim_output(struct ifnet *, struct mbuf *, struct sockaddr *,
+                   struct rtentry *);
+int             umbim_input(struct ifnet *, struct mbuf *, void *);
+void            umbim_start(struct ifnet *);
+void            umbim_watchdog(struct ifnet *);
+void            umbim_statechg_timeout(void *);
+
+void            umbim_newstate(struct umbim_softc *, enum umbim_state, int);
+void            umbim_state_task(void *);
+void            umbim_up(struct umbim_softc *);
+void            umbim_down(struct umbim_softc *, int);
+void            umbim_linkstate(struct umbim_softc *, int);
+int             umbim_get_ipv4addr(struct ifnet *, struct umbim_ifaddr *);
+void            umbim_set_ipv4addr(struct ifnet *, struct umbim_ifaddr *,
+                   char *);
+void            umbim_restore_ipv4addr(struct umbim_softc *);
+
+void            umbim_get_response_task(void *);
+
+void            umbim_decode_response(struct umbim_softc *, void *, int);
+void            umbim_handle_indicate_status_msg(struct umbim_softc *, void *,
+                   int);
+void            umbim_handle_opendone_msg(struct umbim_softc *, void *, int);
+void            umbim_handle_closedone_msg(struct umbim_softc *, void *, int);
+int             umbim_decode_register_state(struct umbim_softc *, void *, int);
+int             umbim_decode_devices_caps(struct umbim_softc *, void *, int);
+int             umbim_decode_subscriber_status(struct umbim_softc *, void *,
+                   int);
+int             umbim_decode_radio_state(struct umbim_softc *, void *, int);
+int             umbim_decode_pin(struct umbim_softc *, void *, int);
+int             umbim_decode_packet_service(struct umbim_softc *, void *, int);
+int             umbim_decode_signal_state(struct umbim_softc *, void *, int);
+int             umbim_decode_connect_info(struct umbim_softc *, void *, int);
+int             umbim_decode_ip_configuration(struct umbim_softc *, void *, 
int);
+void            umbim_rx(struct umbim_softc *);
+void            umbim_rxeof(struct usbd_xfer *, void *, usbd_status);
+int             umbim_encap(struct umbim_softc *, struct mbuf *);
+void            umbim_txeof(struct usbd_xfer *, void *, usbd_status);
+void            umbim_decap(struct umbim_softc *, struct usbd_xfer *);
+
+usbd_status     umbim_send_encap_command(struct umbim_softc *, void *, int);
+int             umbim_get_encap_response(struct umbim_softc *, void *, int *);
+void            umbim_ctrl_msg(struct umbim_softc *, uint32_t, void *, int);
+
+void            umbim_open(struct umbim_softc *);
+void            umbim_close(struct umbim_softc *);
+
+int             umbim_setpin(struct umbim_softc *, int, int, void *, int,
+                   void *, int);
+void            umbim_setdataclass(struct umbim_softc *);
+void            umbim_radio(struct umbim_softc *, int);
+void            umbim_packet_service(struct umbim_softc *, int);
+void            umbim_connect(struct umbim_softc *);
+void            umbim_disconnect(struct umbim_softc *);
+void            umbim_send_connect(struct umbim_softc *, int);
+
+void            umbim_qry_ipconfig(struct umbim_softc *);
+void            umbim_cmd(struct umbim_softc *, int, int, void *, int);
+void            umbim_command_done(struct umbim_softc *, void *, int);
+void            umbim_decode_cid(struct umbim_softc *, uint32_t, void *, int);
+
+void            umbim_intr(struct usbd_xfer *, void *, usbd_status);
+
+char           *umbim_ntop(struct sockaddr *);
+
+int             umbim_xfer_tout = USBD_DEFAULT_TIMEOUT;
+
+uint8_t                 umbim_uuid_basic_connect[] = UMBIM_UUID_BASIC_CONNECT;
+uint8_t                 umbim_uuid_context_internet[] = 
UMBIM_UUID_CONTEXT_INTERNET;
+uint32_t        umbim_session_id = 0;
+
+struct cfdriver umbim_cd = {
+       NULL, "umbim", DV_DULL
+};
+
+const struct cfattach umbim_ca = {
+       sizeof (struct umbim_softc),
+       umbim_match,
+       umbim_attach,
+       umbim_detach,
+       NULL,
+};
+
+/*
+ * Some devices are picky about too frequent control messages.
+ * Query device state not more often than every 0.5 secs.
+ */
+struct timeval umbim_update_rate = { 0, 500000 };
+int umbim_delay = 4000;
+
+/*
+ * Normally, MBIM devices are detected by their interface class and subclass.
+ * But for some models that have multiple configurations, it is better to
+ * match by vendor and product id so that we can select the desired
+ * configuration ourselves.
+ *
+ * OTOH, some devices identifiy themself als an MBIM device but fail to speak
+ * the MBIM protocol.
+ */
+struct umbim_products {
+       struct usb_devno         dev;
+       int                      confno;
+};
+const struct umbim_products umbim_devs[] = {
+       /*
+        * Add devices here to force them to attach as umbim.
+        * Format: { { VID, PID }, CONFIGNO }
+        */
+};
+
+#define umbim_lookup(vid, pid)         \
+       ((const struct umbim_products *)usb_lookup(umbim_devs, vid, pid))
+
+int
+umbim_match(struct device *parent, void *match, void *aux)
+{
+       struct usb_attach_arg *uaa = aux;
+       usb_interface_descriptor_t *id;
+
+       if (umbim_lookup(uaa->vendor, uaa->product) != NULL)
+               return UMATCH_VENDOR_PRODUCT;
+       if (!uaa->iface)
+               return UMATCH_NONE;
+       if (!uaa->iface ||
+           (id = usbd_get_interface_descriptor(uaa->iface)) == NULL)
+               return UMATCH_NONE;
+       if (id->bInterfaceClass != UICLASS_CDC ||
+           id->bInterfaceSubClass !=
+           UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL ||
+           id->bNumEndpoints != 1)
+               return UMATCH_NONE;
+
+       return UMATCH_DEVCLASS_DEVSUBCLASS;
+}
+
+void
+umbim_attach(struct device *parent, struct device *self, void *aux)
+{
+       struct umbim_softc *sc = (struct umbim_softc *)self;
+       struct usb_attach_arg *uaa = aux;
+       usbd_status status;
+       struct usbd_desc_iter iter;
+       const usb_descriptor_t *desc;
+       int      v;
+       struct umbim_descriptor *md;
+       int      i;
+       struct usbd_interface *ctrl_iface = NULL;
+       int      ctrl_ep;
+       uint8_t  data_ifaceno;
+       usb_interface_descriptor_t *id;
+       usb_config_descriptor_t *cd;
+       usb_endpoint_descriptor_t *ed;
+       int      altnum;
+       int      s;
+       struct ifnet *ifp;
+       int      hard_mtu;
+
+       sc->sc_udev = uaa->device;
+
+       if (uaa->configno < 0) {
+               uaa->configno = umbim_lookup(uaa->vendor, uaa->product)->confno;
+               DPRINTF("%s: switching to config #%d\n", DEVNAM(sc),
+                   uaa->configno);
+               status = usbd_set_config_no(sc->sc_udev, uaa->configno, 1);
+               if (status) {
+                       printf("%s: failed to switch to config #%d: %s\n",
+                           DEVNAM(sc), uaa->configno, usbd_errstr(status));
+                       goto fail;
+               }
+       }
+
+       sc->sc_ver_maj = sc->sc_ver_min = -1;
+       usbd_desc_iter_init(sc->sc_udev, &iter);
+       hard_mtu = UMBIM_MAXSEGSZ_MINVAL;
+       while ((desc = usbd_desc_iter_next(&iter))) {
+               if (desc->bDescriptorType != UDESC_CS_INTERFACE)
+                       continue;
+               switch (desc->bDescriptorSubtype) {
+               case UDESCSUB_UMBIM:
+                       md = (struct umbim_descriptor *)desc;
+                       v = UGETW(md->bcdMBIMVersion);
+                       sc->sc_ver_maj = UMBIM_VER_MAJOR(v);
+                       sc->sc_ver_min = UMBIM_VER_MINOR(v);
+                       sc->sc_ctrl_len = UGETW(md->wMaxControlMessage);
+                       /* Never trust a USB device! Could try to exploit us */
+                       if (sc->sc_ctrl_len < UMBIM_CTRLMSG_MINLEN ||
+                           sc->sc_ctrl_len > UMBIM_CTRLMSG_MAXLEN) {
+                               printf("%s: control message len %d out of "
+                                   "bounds [%d .. %d]\n", DEVNAM(sc),
+                                   sc->sc_ctrl_len, UMBIM_CTRLMSG_MINLEN,
+                                   UMBIM_CTRLMSG_MAXLEN);
+                               /* cont. anyway */
+                       }
+                       sc->sc_maxpktlen = UGETW(md->wMaxSegmentSize);
+                       if (sc->sc_maxpktlen < UMBIM_MAXSEGSZ_MINVAL) {
+                               printf("%s: ignoring invalid segment size %d\n",
+                                   DEVNAM(sc), sc->sc_maxpktlen);
+                               /* cont. anyway */
+                               sc->sc_maxpktlen = 8 * 1024;
+                       }
+                       hard_mtu = sc->sc_maxpktlen;
+                       DPRINTFN(2, "%s: ctrl_len=%d, maxpktlen=%d, cap=0x%x\n",
+                           DEVNAM(sc), sc->sc_ctrl_len, sc->sc_maxpktlen,
+                           md->bmNetworkCapabilities);
+                       break;
+               default:
+                       break;
+               }
+       }
+       cd = usbd_get_config_descriptor(sc->sc_udev);
+       if (sc->sc_ver_maj < 0) {
+               printf("%s: missing MBIM descriptor\n", DEVNAM(sc));
+               goto fail;
+       }
+
+       for (i = 0; i < sc->sc_udev->cdesc->bNumInterface; i++) {
+               if (usbd_iface_claimed(sc->sc_udev, i))
+                       continue;
+               id = usbd_get_interface_descriptor(&sc->sc_udev->ifaces[i]);
+               if (id == NULL)
+                       continue;
+               if (id->bInterfaceClass == UICLASS_CDC &&
+                   id->bInterfaceSubClass ==
+                   UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL) {
+                       ctrl_iface = &sc->sc_udev->ifaces[i];
+                       sc->sc_ctrl_ifaceno = id->bInterfaceNumber;
+                       usbd_claim_iface(sc->sc_udev, i);
+               } else if (id->bInterfaceClass == UICLASS_CDC_DATA &&
+                   id->bInterfaceSubClass == UISUBCLASS_DATA &&
+                   id->bInterfaceProtocol == UIPROTO_DATA_MBIM) {
+                       sc->sc_data_iface = &sc->sc_udev->ifaces[i];
+                       data_ifaceno = id->bInterfaceNumber;
+                       usbd_claim_iface(sc->sc_udev, i);
+               }
+       }
+       if (ctrl_iface == NULL) {
+               printf("%s: no control interface found\n", DEVNAM(sc));
+               goto fail;
+       }
+       if (sc->sc_data_iface == NULL) {
+               printf("%s: no data interface found\n", DEVNAM(sc));
+               goto fail;
+       }
+
+       id = usbd_get_interface_descriptor(ctrl_iface);
+       ctrl_ep = -1;
+       for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) {
+               ed = usbd_interface2endpoint_descriptor(ctrl_iface, i);
+               if (ed == NULL)
+                       break;
+               if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT &&
+                   UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN)
+                       ctrl_ep = ed->bEndpointAddress;
+       }
+       if (ctrl_ep == -1) {
+               printf("%s: missing interrupt endpoint\n", DEVNAM(sc));
+               goto fail;
+       }
+
+       id = usbd_get_interface_descriptor(sc->sc_data_iface);
+       altnum = usbd_get_no_alts(cd, id->bInterfaceNumber);
+       if (UMBIM_INTERFACE_ALTSETTING >= altnum) {
+               printf("%s: mussing alt setting %d for interface #%d\n",
+                   DEVNAM(sc), UMBIM_INTERFACE_ALTSETTING, data_ifaceno);
+               goto fail;
+       }
+       sc->sc_rx_ep = sc->sc_tx_ep = -1;
+       if ((status = usbd_set_interface(sc->sc_data_iface,
+           UMBIM_INTERFACE_ALTSETTING))) {
+               printf("%s: select alt setting %d for interface #%d "
+                   "failed: %s\n", DEVNAM(sc), UMBIM_INTERFACE_ALTSETTING,
+                   data_ifaceno, usbd_errstr(status));
+               goto fail;
+       }
+       id = usbd_get_interface_descriptor(sc->sc_data_iface);
+       for (i = 0; i < id->bNumEndpoints; i++) {
+               if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface,
+                   i)) == NULL)
+                       break;
+               if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
+                   UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN)
+                       sc->sc_rx_ep = ed->bEndpointAddress;
+               else if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
+                   UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT)
+                       sc->sc_tx_ep = ed->bEndpointAddress;
+       }
+       if (sc->sc_rx_ep == -1 || sc->sc_tx_ep == -1) {
+               printf("%s: missing bulk endpoints\n", DEVNAM(sc));
+               goto fail;
+       }
+
+       DPRINTFN(2, "%s: ctrl-ifno#%d: ep-ctrl=%d, data-ifno#%d: ep-rx=%d, "
+           "ep-tx=%d\n", DEVNAM(sc), sc->sc_ctrl_ifaceno,
+           UE_GET_ADDR(ctrl_ep), data_ifaceno,
+           UE_GET_ADDR(sc->sc_rx_ep), UE_GET_ADDR(sc->sc_tx_ep));
+
+       usb_init_task(&sc->sc_umbim_task, umbim_state_task, sc,
+           USB_TASK_TYPE_GENERIC);
+       usb_init_task(&sc->sc_get_response_task, umbim_get_response_task, sc,
+           USB_TASK_TYPE_GENERIC);
+       timeout_set(&sc->sc_statechg_timer, umbim_statechg_timeout, sc);
+
+       if (usbd_open_pipe_intr(ctrl_iface, ctrl_ep, USBD_SHORT_XFER_OK,
+           &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof (sc->sc_intr_msg),
+           umbim_intr, USBD_DEFAULT_INTERVAL)) {
+               printf("%s: failed to open control pipe\n", DEVNAM(sc));
+               goto fail;
+       }
+       sc->sc_resp_buf = malloc(sc->sc_ctrl_len, M_USBDEV, M_NOWAIT);
+       if (sc->sc_resp_buf == NULL) {
+               printf("%s: allocation of resp buffer failed\n", DEVNAM(sc));
+               goto fail;
+       }
+       sc->sc_ctrl_msg = malloc(sc->sc_ctrl_len, M_USBDEV, M_NOWAIT);
+       if (sc->sc_ctrl_msg == NULL) {
+               printf("%s: allocation of ctrl msg buffer failed\n",
+                   DEVNAM(sc));
+               goto fail;
+       }
+
+       sc->sc_info.regstate = UMBIM_REGSTATE_UNKNOWN;
+       sc->sc_info.pin_attempts_left = UMBIM_VALUE_UNKNOWN;
+       sc->sc_info.rssi = UMBIM_VALUE_UNKNOWN;
+       sc->sc_info.ber = UMBIM_VALUE_UNKNOWN;
+
+       s = splnet();
+       ifp = GET_IFP(sc);
+       ifp->if_flags = IFF_SIMPLEX | IFF_MULTICAST | IFF_POINTOPOINT;
+       ifp->if_ioctl = umbim_ioctl;
+       ifp->if_start = umbim_start;
+
+       ifp->if_watchdog = umbim_watchdog;
+       strlcpy(ifp->if_xname, DEVNAM(sc), IFNAMSIZ);
+       ifp->if_link_state = LINK_STATE_DOWN;
+
+       ifp->if_type = IFT_MBIM;
+       ifp->if_addrlen = 0;
+       ifp->if_hdrlen = sizeof (struct ncm_header16) +
+           sizeof (struct ncm_pointer16);
+       ifp->if_mtu = 1500;             /* use a common default */
+       ifp->if_hardmtu = hard_mtu;
+       ifp->if_output = umbim_output;
+       if_attach(ifp);
+       if_ih_insert(ifp, umbim_input, NULL);
+       if_alloc_sadl(ifp);
+       ifp->if_softc = sc;
+#if NBPFILTER > 0
+       bpfattach(&ifp->if_bpf, ifp, DLT_RAW, 0);
+#endif
+       /*
+        * Open the device now so that we are able to query device information.
+        * XXX maybe close when done?
+        */
+       umbim_open(sc);
+       splx(s);
+
+       printf("%s: vers %d.%d\n", DEVNAM(sc), sc->sc_ver_maj, sc->sc_ver_min);
+       return;
+
+fail:
+       usbd_deactivate(sc->sc_udev);
+       return;
+}
+
+int
+umbim_detach(struct device *self, int flags)
+{
+       struct umbim_softc *sc = (struct umbim_softc *)self;
+       struct ifnet *ifp = GET_IFP(sc);
+       int      s;
+
+       s = splnet();
+       if (ifp->if_flags & IFF_RUNNING)
+               umbim_down(sc, 1);
+       umbim_close(sc);
+
+       usb_rem_wait_task(sc->sc_udev, &sc->sc_get_response_task);
+       if (timeout_initialized(&sc->sc_statechg_timer))
+               timeout_del(&sc->sc_statechg_timer);
+       sc->sc_nresp = 0;
+       usb_rem_wait_task(sc->sc_udev, &sc->sc_umbim_task);
+       if (sc->sc_ctrl_pipe) {
+               usbd_close_pipe(sc->sc_ctrl_pipe);
+               sc->sc_ctrl_pipe = NULL;
+       }
+       if (sc->sc_ctrl_msg) {
+               free(sc->sc_ctrl_msg, M_USBDEV, sc->sc_ctrl_len);
+               sc->sc_ctrl_msg = NULL;
+       }
+       if (sc->sc_resp_buf) {
+               free(sc->sc_resp_buf, M_USBDEV, sc->sc_ctrl_len);
+               sc->sc_resp_buf = NULL;
+       }
+       if (sc->sc_saved_ifaddr != NULL &&
+           sc->sc_saved_ifaddr != UMBIM_IFADDR_NONE)
+               free(sc->sc_saved_ifaddr, M_USBDEV,
+                   sizeof (struct umbim_ifaddr));
+       sc->sc_saved_ifaddr = NULL;
+
+       if (ifp->if_softc != NULL) {
+               if_ih_remove(ifp, umbim_input, NULL);
+               if_detach(ifp);
+       }
+
+       splx(s);
+       return 0;
+}
+
+int
+umbim_alloc_xfers(struct umbim_softc *sc)
+{
+       if (!sc->sc_rx_xfer) {
+               if ((sc->sc_rx_xfer = usbd_alloc_xfer(sc->sc_udev)) != NULL)
+                       sc->sc_rx_buf = usbd_alloc_buffer(sc->sc_rx_xfer,
+                           sc->sc_maxpktlen + UMBIM_HDR32_LEN);
+       }
+       if (!sc->sc_tx_xfer) {
+               if ((sc->sc_tx_xfer = usbd_alloc_xfer(sc->sc_udev)) != NULL)
+                       sc->sc_tx_buf = usbd_alloc_buffer(sc->sc_tx_xfer,
+                           sc->sc_maxpktlen + UMBIM_HDR16_LEN);
+       }
+       return (sc->sc_rx_buf && sc->sc_tx_buf) ? 1 : 0;
+}
+
+void
+umbim_free_xfers(struct umbim_softc *sc)
+{
+       if (sc->sc_rx_xfer) {
+               /* implicit usbd_free_buffer() */
+               usbd_free_xfer(sc->sc_rx_xfer);
+               sc->sc_rx_xfer = NULL;
+               sc->sc_rx_buf = NULL;
+       }
+       if (sc->sc_tx_xfer) {
+               usbd_free_xfer(sc->sc_tx_xfer);
+               sc->sc_tx_xfer = NULL;
+               sc->sc_tx_buf = NULL;
+       }
+       if (sc->sc_tx_m) {
+               m_freem(sc->sc_tx_m);
+               sc->sc_tx_m = NULL;
+       }
+}
+
+int
+umbim_alloc_bulkpipes(struct umbim_softc *sc)
+{
+       struct ifnet *ifp = GET_IFP(sc);
+
+       if (!(ifp->if_flags & IFF_RUNNING)) {
+               if (usbd_open_pipe(sc->sc_data_iface, sc->sc_rx_ep,
+                   USBD_EXCLUSIVE_USE, &sc->sc_rx_pipe))
+                       return 0;
+               if (usbd_open_pipe(sc->sc_data_iface, sc->sc_tx_ep,
+                   USBD_EXCLUSIVE_USE, &sc->sc_tx_pipe))
+                       return 0;
+
+               ifp->if_flags |= IFF_RUNNING;
+               ifp->if_flags &= ~IFF_OACTIVE;
+               umbim_rx(sc);
+       }
+       return 1;
+}
+
+void
+umbim_close_bulkpipes(struct umbim_softc *sc)
+{
+       struct ifnet *ifp = GET_IFP(sc);
+
+       ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+       ifp->if_timer = 0;
+       if (sc->sc_rx_pipe) {
+               usbd_close_pipe(sc->sc_rx_pipe);
+               sc->sc_rx_pipe = NULL;
+       }
+       if (sc->sc_tx_pipe) {
+               usbd_close_pipe(sc->sc_tx_pipe);
+               sc->sc_tx_pipe = NULL;
+       }
+}
+
+int
+umbim_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+       struct proc *p = curproc;
+       struct umbim_softc *sc = ifp->if_softc;
+       struct ifreq *ifr = (struct ifreq *)data;
+       int      s, error = 0;
+       struct umbim_parameter mp;
+
+       if (usbd_is_dying(sc->sc_udev))
+               return EIO;
+
+       s = splnet();
+       switch (cmd) {
+       case SIOCSIFADDR:
+               sc->sc_if.if_rtrequest = p2p_rtrequest;
+               break;
+       case SIOCSIFFLAGS:
+               usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
+               break;
+       case SIOCGUMBIMINFO:
+               error = copyout(&sc->sc_info, ifr->ifr_data,
+                   sizeof (sc->sc_info));
+               break;
+       case SIOCSUMBIMPARAM:
+               if ((error = suser(p, 0)) != 0)
+                       break;
+               if ((error = copyin(ifr->ifr_data, &mp, sizeof (mp))) != 0)
+                       break;
+
+               if ((error = umbim_setpin(sc, mp.op, mp.is_puk,
+                   mp.pin, mp.pinlen, mp.newpin, mp.newpinlen)) != 0)
+                       break;
+
+               if (mp.apnlen < 0 || mp.apnlen > sizeof (sc->sc_info.apn)) {
+                       error = EINVAL;
+                       break;
+               }
+               sc->sc_roaming = mp.roaming ? 1 : 0;
+               memset(sc->sc_info.apn, 0, sizeof (sc->sc_info.apn));
+               memcpy(sc->sc_info.apn, mp.apn, mp.apnlen);
+               sc->sc_info.apnlen = mp.apnlen;
+               sc->sc_info.preferredclasses = mp.preferredclasses;
+               umbim_setdataclass(sc);
+               break;
+       case SIOCGUMBIMPARAM:
+               memset(&mp, 0, sizeof (mp));
+               memcpy(mp.apn, sc->sc_info.apn, sc->sc_info.apnlen);
+               mp.apnlen = sc->sc_info.apnlen;
+               mp.roaming = sc->sc_roaming;
+               mp.preferredclasses = sc->sc_info.preferredclasses;
+               error = copyout(&mp, ifr->ifr_data, sizeof (mp));
+               break;
+       case SIOCSIFMTU:
+               /* Does this include the NCM headers and tail? */
+               if (ifr->ifr_mtu > ifp->if_hardmtu) {
+                       error = EINVAL;
+                       break;
+               }
+               ifp->if_mtu = ifr->ifr_mtu;
+               break;
+       case SIOCGIFMTU:
+               ifr->ifr_mtu = ifp->if_mtu;
+               break;
+       case SIOCGIFHARDMTU:
+               ifr->ifr_hardmtu = ifp->if_hardmtu;
+               break;
+       case SIOCAIFADDR:
+       case SIOCSIFDSTADDR:
+       case SIOCADDMULTI:
+       case SIOCDELMULTI:
+               break;
+       default:
+               error = ENOTTY;
+               break;
+       }
+       splx(s);
+       return error;
+}
+
+int
+umbim_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
+    struct rtentry *rtp)
+{
+       struct umbim_softc *sc = ifp->if_softc;
+
+       if (usbd_is_dying(sc->sc_udev) || !(ifp->if_flags & IFF_RUNNING)) {
+               m_freem(m);
+               return ENETDOWN;
+       }
+       return if_enqueue(ifp, m);
+}
+
+int
+umbim_input(struct ifnet *ifp, struct mbuf *m, void *cookie)
+{
+       struct niqueue *inq;
+       uint8_t ipv;
+
+       if (((ifp->if_flags & IFF_UP) == 0) || (m->m_flags & M_FILDROP) != 0) {
+               m_freem(m);
+               return 1;
+       }
+       if (m->m_pkthdr.len < sizeof (struct ip)) {
+               ifp->if_ierrors++;
+               DPRINTFN(4, "%s: dropping short packet (len %d)\n", __func__,
+                   m->m_pkthdr.len);
+               m_freem(m);
+               return 1;
+       }
+       m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
+       m_copydata(m, 0, sizeof (ipv), &ipv);
+       ipv >>= 4;
+
+       ifp->if_ibytes += m->m_pkthdr.len;
+       switch (ipv) {
+       case 4:
+               inq = &ipintrq;
+               break;
+       case 6:
+               inq = &ip6intrq;
+               break;
+       default:
+               ifp->if_ierrors++;
+               DPRINTFN(4, "%s: dropping packet with bad IP version (%d)\n",
+                   __func__, ipv);
+               m_freem(m);
+               return 1;
+       }
+       niq_enqueue(inq, m);
+       return 1;
+}
+
+void
+umbim_start(struct ifnet *ifp)
+{
+       struct umbim_softc *sc = ifp->if_softc;
+       struct mbuf *m_head = NULL;
+
+       if (usbd_is_dying(sc->sc_udev) ||
+           !(ifp->if_flags & IFF_RUNNING) ||
+           (ifp->if_flags & IFF_OACTIVE))
+               return;
+
+       m_head = ifq_deq_begin(&ifp->if_snd);
+       if (m_head == NULL)
+               return;
+
+       if (!umbim_encap(sc, m_head)) {
+               ifq_deq_rollback(&ifp->if_snd, m_head);
+               ifp->if_flags |= IFF_OACTIVE;
+               return;
+       }
+       ifq_deq_commit(&ifp->if_snd, m_head);
+
+#if NBPFILTER > 0
+       if (ifp->if_bpf)
+               bpf_mtap(ifp->if_bpf, m_head, BPF_DIRECTION_OUT);
+#endif
+
+       ifp->if_flags |= IFF_OACTIVE;
+       ifp->if_timer = (2 * umbim_xfer_tout) / 1000;
+}
+
+void
+umbim_watchdog(struct ifnet *ifp)
+{
+       struct umbim_softc *sc = ifp->if_softc;
+
+       if (usbd_is_dying(sc->sc_udev))
+               return;
+
+       ifp->if_oerrors++;
+       log(LOG_WARNING, "%s: watchdog timeout\n", DEVNAM(sc));
+       /* XXX FIXME: re-initialize device */
+       return;
+}
+
+void
+umbim_statechg_timeout(void *arg)
+{
+       struct umbim_softc *sc = arg;
+
+       log(LOG_INFO, "%s: state change time out\n",DEVNAM(sc));
+       usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
+}
+
+void
+umbim_newstate(struct umbim_softc *sc, enum umbim_state newstate, int flags)
+{
+       if (newstate == sc->sc_state)
+               return;
+       if (((flags & UMBIM_NS_DONT_DROP) && newstate < sc->sc_state) ||
+           ((flags & UMBIM_NS_DONT_RAISE) && newstate > sc->sc_state))
+               return;
+       log(LOG_DEBUG, "%s: state going %s from '%s' to '%s'\n", DEVNAM(sc),
+           newstate > sc->sc_state ? "up" : "down",
+           umbim_istate(sc->sc_state), umbim_istate(newstate));
+       sc->sc_state = newstate;
+       usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
+}
+
+void
+umbim_state_task(void *arg)
+{
+       struct umbim_softc *sc = arg;
+       struct ifnet *ifp = GET_IFP(sc);
+
+       int      s;
+
+       s = splnet();
+       if (ifp->if_flags & IFF_UP)
+               umbim_up(sc);
+       else
+               umbim_down(sc, 0);
+       umbim_linkstate(sc,
+           sc->sc_state == UMBIM_S_UP ? LINK_STATE_UP : LINK_STATE_DOWN);
+       splx(s);
+}
+
+
+void
+umbim_up(struct umbim_softc *sc)
+{
+       struct ifnet *ifp = GET_IFP(sc);
+
+       splassert(IPL_NET);
+
+       switch (sc->sc_state) {
+       case UMBIM_S_DOWN:
+               DPRINTF("%s: init: opening ...\n", DEVNAM(sc));
+               umbim_open(sc);
+               break;
+       case UMBIM_S_OPEN:
+               DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc));
+               umbim_radio(sc, 1);
+               break;
+       case UMBIM_S_RADIO:
+               DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc));
+               umbim_cmd(sc, UMBIM_CID_SUBSCRIBER_READY_STATUS,
+                   UMBIM_CMDOP_QRY, NULL, 0);
+               break;
+       case UMBIM_S_SIMREADY:
+               DPRINTF("%s: init: attaching ...\n", DEVNAM(sc));
+               umbim_packet_service(sc, 1);
+               break;
+       case UMBIM_S_ATTACHED:
+               sc->sc_tx_seq = 0;
+               if (!umbim_alloc_xfers(sc)) {
+                       umbim_free_xfers(sc);
+                       log(LOG_ERR, "%s: allocation of xfers failed\n",
+                           DEVNAM(sc));
+                       break;
+               }
+               DPRINTF("%s: init: connecting ...\n", DEVNAM(sc));
+               umbim_connect(sc);
+               break;
+       case UMBIM_S_CONNECTED:
+               DPRINTF("%s: init: getting IP config ...\n", DEVNAM(sc));
+               umbim_qry_ipconfig(sc);
+               break;
+       case UMBIM_S_UP:
+               DPRINTF("%s: init: reached state UP\n", DEVNAM(sc));
+               if (!umbim_alloc_bulkpipes(sc)) {
+                       log(LOG_ERR, "%s: opening bulk pipes failed\n",
+                           DEVNAM(sc));
+                       ifp->if_flags &= ~IFF_UP;
+                       umbim_down(sc, 1);
+               }
+               break;
+       }
+       if (sc->sc_state < UMBIM_S_UP)
+               timeout_add_sec(&sc->sc_statechg_timer,
+                   UMBIM_STATE_CHANGE_TIMEOUT);
+       else
+               timeout_del(&sc->sc_statechg_timer);
+       return;
+}
+
+void
+umbim_down(struct umbim_softc *sc, int force)
+{
+       splassert(IPL_NET);
+
+       umbim_close_bulkpipes(sc);
+       if (sc->sc_state < UMBIM_S_CONNECTED)
+               umbim_free_xfers(sc);
+
+       switch (sc->sc_state) {
+       case UMBIM_S_UP:
+       case UMBIM_S_CONNECTED:
+               DPRINTF("%s: stop: disconnecting ...\n", DEVNAM(sc));
+               umbim_disconnect(sc);
+               if (!force)
+                       break;
+               /*FALLTHROUGH*/
+       case UMBIM_S_ATTACHED:
+               DPRINTF("%s: stop: detaching ...\n", DEVNAM(sc));
+               umbim_packet_service(sc, 0);
+               if (!force)
+                       break;
+               /*FALLTHROUGH*/
+       case UMBIM_S_SIMREADY:
+       case UMBIM_S_RADIO:
+               DPRINTF("%s: stop: turning radio off ...\n", DEVNAM(sc));
+               umbim_radio(sc, 0);
+               if (!force)
+                       break;
+               /*FALLTHROUGH*/
+       case UMBIM_S_OPEN:
+       case UMBIM_S_DOWN:
+               /* Do not close the device */
+               DPRINTF("%s: stop: reached state DOWN\n", DEVNAM(sc));
+               break;
+       }
+       if (force)
+               sc->sc_state = UMBIM_S_OPEN;
+
+       if (sc->sc_state > UMBIM_S_OPEN)
+               timeout_add_sec(&sc->sc_statechg_timer,
+                   UMBIM_STATE_CHANGE_TIMEOUT);
+       else
+               timeout_del(&sc->sc_statechg_timer);
+}
+
+void
+umbim_linkstate(struct umbim_softc *sc, int state)
+{
+       struct ifnet *ifp = GET_IFP(sc);
+       int      s;
+
+       s = splnet();
+       if (ifp->if_link_state != state) {
+               log(LOG_INFO, "%s: link state changed from %s to %s\n",
+                   DEVNAM(sc),
+                   LINK_STATE_IS_UP(ifp->if_link_state) ? "up" : "down",
+                   LINK_STATE_IS_UP(state) ? "up" : "down");
+               ifp->if_link_state = state;
+               if_link_state_change(ifp);
+               if (!LINK_STATE_IS_UP(state)) {
+                       memset(sc->sc_info.ipv4dns, 0,
+                           sizeof (sc->sc_info.ipv4dns));
+                       umbim_restore_ipv4addr(sc);
+               }
+       }
+       splx(s);
+}
+
+int
+umbim_get_ipv4addr(struct ifnet *ifp, struct umbim_ifaddr *uif)
+{
+       int     error;
+       struct ifreq ifr;
+
+       memset(uif, 0, sizeof (*uif));
+       if ((error = in_ioctl(SIOCGIFADDR, (caddr_t)&ifr, ifp, 1)) != 0)
+               return error;
+       memcpy(&uif->addr, &ifr.ifr_addr, sizeof (uif->addr));
+
+       if ((error = in_ioctl(SIOCGIFDSTADDR, (caddr_t)&ifr, ifp, 1)) != 0)
+               return error;
+       memcpy(&uif->dst, &ifr.ifr_dstaddr, sizeof (uif->dst));
+
+       if ((error = in_ioctl(SIOCGIFNETMASK, (caddr_t)&ifr, ifp, 1)) != 0)
+               return error;
+       memcpy(&uif->netmask, &ifr.ifr_addr, sizeof (uif->netmask));
+       return 0;
+}
+
+void
+umbim_set_ipv4addr(struct ifnet *ifp, struct umbim_ifaddr *uif, char *op)
+{
+       struct ifreq ifr;
+       int      error;
+
+       splassert(IPL_NET);
+
+       if (uif == NULL)
+               return;
+       log(LOG_INFO, "%s: %s IPv4 addr %s, mask %s, gateway %s\n",
+           DEVNAM(ifp->if_softc), op,
+           umbim_ntop((struct sockaddr *)&uif->addr),
+           umbim_ntop((struct sockaddr *)&uif->netmask),
+           umbim_ntop((struct sockaddr *)&uif->dst));
+
+       memset(&ifr, 0, sizeof (ifr));
+       memcpy(&ifr.ifr_addr, &uif->addr, sizeof (ifr.ifr_addr));
+       if ((error = in_ioctl(SIOCSIFADDR, (caddr_t)&ifr, ifp, 1)) != 0)
+               log(LOG_ERR, "%s: unable to set IPv4 address, error %d\n",
+                   DEVNAM(ifp->if_softc), error);
+
+       memset(&ifr, 0, sizeof (ifr));
+       memcpy(&ifr.ifr_dstaddr, &uif->dst, sizeof (ifr.ifr_dstaddr));
+       if ((error = in_ioctl(SIOCSIFDSTADDR, (caddr_t)&ifr, ifp, 1)) != 0)
+               log(LOG_ERR, "%s: unable to set IPv4 gateway, error %d\n",
+                   DEVNAM(ifp->if_softc), error);
+
+       memset(&ifr, 0, sizeof (ifr));
+       memcpy(&ifr.ifr_addr, &uif->netmask, sizeof (ifr.ifr_addr));
+       if ((error = in_ioctl(SIOCSIFNETMASK, (caddr_t)&ifr, ifp, 1)) != 0)
+               log(LOG_ERR, "%s: unable to set IPv4 netmask, error %d\n",
+                   DEVNAM(ifp->if_softc), error);
+}
+
+void
+umbim_restore_ipv4addr(struct umbim_softc *sc)
+{
+       struct ifnet *ifp = GET_IFP(sc);
+
+       splassert(IPL_NET);
+       if (sc->sc_saved_ifaddr == UMBIM_IFADDR_NONE) {
+               /*
+                * Purge any existing addresses
+                */
+               struct umbim_ifaddr uif;
+               struct in_aliasreq ifra;
+
+               if (umbim_get_ipv4addr(ifp, &uif) == 0 &&
+                   uif.addr.sin_addr.s_addr != INADDR_ANY) {
+                       log(LOG_DEBUG, "%s: purge IPv4 addr %s\n", DEVNAM(sc),
+                           umbim_ntop((struct sockaddr *)&uif.addr));
+                       memset(&ifra, 0, sizeof (ifra));
+                       memcpy(&ifra.ifra_addr, &uif.addr,
+                           sizeof (ifra.ifra_addr));
+                       in_ioctl(SIOCDIFADDR, (caddr_t)&ifra, ifp, 1);
+               }
+       } else if (sc->sc_saved_ifaddr != NULL) {
+               umbim_set_ipv4addr(ifp, sc->sc_saved_ifaddr, "restore");
+               free(sc->sc_saved_ifaddr, M_USBDEV,
+                   sizeof (struct umbim_ifaddr));
+       }
+       sc->sc_saved_ifaddr = NULL;
+}
+
+void
+umbim_get_response_task(void *arg)
+{
+       struct umbim_softc *sc = arg;
+       int      len;
+       int      s;
+
+       /*
+        * Function is required to send on RESPONSE_AVAILABLE notification for
+        * each encapsulated response that is to be processed by the host.
+        * But of course, we can receive multiple notifications before the
+        * response task is run.
+        */
+       s = splusb();
+       while (sc->sc_nresp > 0) {
+               --sc->sc_nresp;
+               len = sc->sc_ctrl_len;
+               if (umbim_get_encap_response(sc, sc->sc_resp_buf, &len))
+                       umbim_decode_response(sc, sc->sc_resp_buf, len);
+       }
+       splx(s);
+}
+
+void
+umbim_decode_response(struct umbim_softc *sc, void *response, int len)
+{
+       struct umbim_msghdr *hdr = response;
+       struct umbim_fragmented_msg_hdr *fraghdr;
+       uint32_t type;
+       uint32_t tid;
+
+       DPRINTFN(3, "%s: got response: len %d\n", DEVNAM(sc), len);
+       DDUMPN(4, response, len);
+
+       if (len < sizeof (*hdr) || letoh32(hdr->len) != len) {
+               /*
+                * We should probably cancel a transaction, but since the
+                * message is too short, we cannot decode the transaction
+                * id (tid) and hence don't know, whom to cancel. Must wait
+                * for the timeout.
+                */
+               DPRINTF("%s: received short response (len %d)\n",
+                   DEVNAM(sc), len);
+               return;
+       }
+
+       /*
+        * XXX FIXME: if message is fragmented, store it until last frag
+        *      is received and then re-assemble all fragments.
+        */
+       type = letoh32(hdr->type);
+       tid = letoh32(hdr->tid);
+       switch (type) {
+       case UMBIM_INDICATE_STATUS_MSG:
+       case UMBIM_COMMAND_DONE:
+               fraghdr = response;
+               if (letoh32(fraghdr->frag.nfrag) != 1) {
+                       DPRINTF("%s: discarding fragmented messages\n",
+                           DEVNAM(sc));
+                       return;
+               }
+               break;
+       default:
+               break;
+       }
+
+       DPRINTF("%s: <- rcv %s (tid %u)\n", DEVNAM(sc), umbim_request2str(type),
+           tid);
+       switch (type) {
+       case UMBIM_FUNCTION_ERROR_MSG:
+       case UMBIM_HOST_ERROR_MSG:
+       {
+               struct umbim_f2h_hosterr *e;
+               int      err;
+
+               if (len >= sizeof (*e)) {
+                       e = response;
+                       err = letoh32(e->err);
+
+                       DPRINTF("%s: %s message, error %s (tid %u)\n",
+                           DEVNAM(sc), umbim_request2str(type),
+                           umbim_error2str(err), tid);
+                       if (err == UMBIM_ERROR_NOT_OPENED)
+                               umbim_newstate(sc, UMBIM_S_DOWN, 0);
+               }
+               break;
+       }
+       case UMBIM_INDICATE_STATUS_MSG:
+               umbim_handle_indicate_status_msg(sc, response, len);
+               break;
+       case UMBIM_OPEN_DONE:
+               umbim_handle_opendone_msg(sc, response, len);
+               break;
+       case UMBIM_CLOSE_DONE:
+               umbim_handle_closedone_msg(sc, response, len);
+               break;
+       case UMBIM_COMMAND_DONE:
+               umbim_command_done(sc, response, len);
+               break;
+       default:
+               DPRINTF("%s: discard messsage %s\n", DEVNAM(sc),
+                   umbim_request2str(type));
+               break;
+       }
+}
+
+void
+umbim_handle_indicate_status_msg(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_f2h_indicate_status *m = data;
+       uint32_t infolen;
+       uint32_t cid;
+
+       if (len < sizeof (*m)) {
+               DPRINTF("%s: discard short %s messsage\n", DEVNAM(sc),
+                   umbim_request2str(letoh32(m->hdr.type)));
+               return;
+       }
+       if (memcmp(m->devid, umbim_uuid_basic_connect, sizeof (m->devid))) {
+               DPRINTF("%s: discard %s messsage for other UUID '%s'\n",
+                   DEVNAM(sc), umbim_request2str(letoh32(m->hdr.type)),
+                   umbim_uuid2str(m->devid));
+               return;
+       }
+       infolen = letoh32(m->infolen);
+       if (len < sizeof (*m) + infolen) {
+               DPRINTF("%s: discard truncated %s messsage (want %d, got %d)\n",
+                   DEVNAM(sc), umbim_request2str(letoh32(m->hdr.type)),
+                   (int)sizeof (*m) + infolen, len);
+               return;
+       }
+
+       cid = letoh32(m->cid);
+       DPRINTF("%s: indicate %s status\n", DEVNAM(sc), umbim_cid2str(cid));
+       umbim_decode_cid(sc, cid, m->info, infolen);
+}
+
+void
+umbim_handle_opendone_msg(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_f2h_openclosedone *resp = data;
+       uint32_t status;
+
+       status = letoh32(resp->status);
+       if (status == UMBIM_STATUS_SUCCESS) {
+               if (sc->sc_maxsessions == 0) {
+                       umbim_cmd(sc, UMBIM_CID_DEVICE_CAPS, UMBIM_CMDOP_QRY,
+                           NULL, 0);
+                       umbim_cmd(sc, UMBIM_CID_PIN, UMBIM_CMDOP_QRY, NULL, 0);
+                       umbim_cmd(sc, UMBIM_CID_REGISTER_STATE, UMBIM_CMDOP_QRY,
+                           NULL, 0);
+               }
+               umbim_newstate(sc, UMBIM_S_OPEN, UMBIM_NS_DONT_DROP);
+       } else
+               log(LOG_ERR, "%s: open error: %s\n", DEVNAM(sc),
+                   umbim_status2str(status));
+       return;
+}
+
+void
+umbim_handle_closedone_msg(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_f2h_openclosedone *resp = data;
+       uint32_t status;
+
+       status = letoh32(resp->status);
+       if (status == UMBIM_STATUS_SUCCESS)
+               umbim_newstate(sc, UMBIM_S_DOWN, 0);
+       else
+               DPRINTF("%s: close error: %s\n", DEVNAM(sc),
+                   umbim_status2str(status));
+       return;
+}
+
+static inline void
+umbim_getinfobuf(void *in, int inlen, uint32_t offs, uint32_t sz,
+    void *out, size_t outlen)
+{
+       offs = letoh32(offs);
+       sz = letoh32(sz);
+       if (inlen >= offs + sz) {
+               memset(out, 0, outlen);
+               memcpy(out, in + offs, MIN(sz, outlen));
+       }
+}
+
+static inline int
+umbim_padding(void *data, int len, size_t sz)
+{
+       char    *p = data;
+       int      np = 0;
+
+       while (len < sz && (len % 4) != 0) {
+               *p++ = '\0';
+               len++;
+               np++;
+       }
+       return np;
+}
+
+static inline int
+umbim_addstr(void *buf, size_t bufsz, int *offs, void *str, int slen,
+    uint32_t *offsmember, uint32_t *sizemember)
+{
+       if (*offs + slen > bufsz)
+               return 0;
+
+       *sizemember = htole32((uint32_t)slen);
+       if (slen && str) {
+               *offsmember = htole32((uint32_t)*offs);
+               memcpy(buf + *offs, str, slen);
+               *offs += slen;
+               *offs += umbim_padding(buf, *offs, bufsz);
+       } else
+               *offsmember = htole32(0);
+       return 1;
+}
+
+int
+umbim_decode_register_state(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_registration_state_info *rs = data;
+
+       if (len < sizeof (*rs))
+               return 0;
+       sc->sc_info.nwerror = letoh32(rs->nwerror);
+       sc->sc_info.regstate = letoh32(rs->regstate);
+       sc->sc_info.regmode = letoh32(rs->regmode);
+       sc->sc_info.cellclass = letoh32(rs->curcellclass);
+
+       /* XXX should we remember the provider_id? */
+       umbim_getinfobuf(data, len, rs->provname_offs, rs->provname_size,
+           sc->sc_info.provider, sizeof (sc->sc_info.provider));
+       umbim_getinfobuf(data, len, rs->roamingtxt_offs, rs->roamingtxt_size,
+           sc->sc_info.roamingtxt, sizeof (sc->sc_info.roamingtxt));
+
+       DPRINTFN(2, "%s: %s, availclass 0x%x, class 0x%x, regmode %d\n",
+           DEVNAM(sc), umbim_regstate(sc->sc_info.regstate),
+           letoh32(rs->availclasses), sc->sc_info.cellclass,
+           sc->sc_info.regmode);
+
+       if (sc->sc_info.regstate == UMBIM_REGSTATE_ROAMING &&
+           !sc->sc_roaming &&
+           sc->sc_info.activation == UMBIM_ACTIVATION_STATE_ACTIVATED) {
+               log(LOG_INFO, "%s: disconnecting from roaming network\n",
+                   DEVNAM(sc));
+               umbim_newstate(sc, UMBIM_S_ATTACHED, UMBIM_NS_DONT_RAISE);
+       }
+       return 1;
+}
+
+int
+umbim_decode_devices_caps(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_device_caps *dc = data;
+
+       if (len < sizeof (*dc))
+               return 0;
+       sc->sc_maxsessions = letoh32(dc->max_sessions);
+       sc->sc_info.supportedclasses = letoh32(dc->dataclass);
+       umbim_getinfobuf(data, len, dc->devid_offs, dc->devid_size,
+           sc->sc_info.devid, sizeof (sc->sc_info.devid));
+       umbim_getinfobuf(data, len, dc->fwinfo_offs, dc->fwinfo_size,
+           sc->sc_info.fwinfo, sizeof (sc->sc_info.fwinfo));
+       umbim_getinfobuf(data, len, dc->hwinfo_offs, dc->hwinfo_size,
+           sc->sc_info.hwinfo, sizeof (sc->sc_info.hwinfo));
+       DPRINTFN(2, "%s: max sessions %d, supported classes 0x%x\n",
+           DEVNAM(sc), sc->sc_maxsessions, sc->sc_info.supportedclasses);
+       return 1;
+}
+
+int
+umbim_decode_subscriber_status(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_subscriber_ready_info *si = data;
+       int     npn;
+
+       if (len < sizeof (*si))
+               return 0;
+       sc->sc_info.sim_state = letoh32(si->ready);
+
+       umbim_getinfobuf(data, len, si->sid_offs, si->sid_size,
+           sc->sc_info.sid, sizeof (sc->sc_info.sid));
+       umbim_getinfobuf(data, len, si->icc_offs, si->icc_size,
+           sc->sc_info.iccid, sizeof (sc->sc_info.iccid));
+
+       npn = letoh32(si->no_pn);
+       if (npn > 0)
+               umbim_getinfobuf(data, len, si->pn[0].offs, si->pn[0].size,
+                   sc->sc_info.pn, sizeof (sc->sc_info.pn));
+       else
+               memset(sc->sc_info.pn, 0, sizeof (sc->sc_info.pn));
+
+       if (sc->sc_info.sim_state == UMBIM_SIMSTATE_LOCKED)
+               sc->sc_info.pin_state = UMBIM_PUK_REQUIRED;
+       log(LOG_INFO, "%s: SIM %s\n", DEVNAM(sc),
+           umbim_simstate(sc->sc_info.sim_state));
+       if (sc->sc_info.sim_state == UMBIM_SIMSTATE_INITIALIZED)
+               umbim_newstate(sc, UMBIM_S_SIMREADY, UMBIM_NS_DONT_DROP);
+       return 1;
+}
+
+int
+umbim_decode_radio_state(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_radio_state_info *rs = data;
+
+       if (len < sizeof (*rs))
+               return 0;
+
+       sc->sc_info.hw_radio_on =
+           (letoh32(rs->hw_state) == UMBIM_RADIO_STATE_ON) ? 1 : 0;
+       sc->sc_info.sw_radio_on =
+           (letoh32(rs->sw_state) == UMBIM_RADIO_STATE_ON) ? 1 : 0;
+       if (!sc->sc_info.hw_radio_on) {
+               log(LOG_INFO, "%s: radio is off by rfkill switch\n",
+                   DEVNAM(sc));
+               /*
+                * XXX do we need a time to poll the state of the rfkill switch
+                *      or will the device send an unsolicited notification
+                *      in case the state changes?
+                */
+               umbim_newstate(sc, UMBIM_S_OPEN, 0);
+       } else if (!sc->sc_info.sw_radio_on) {
+               log(LOG_INFO, "%s: radio is off\n", DEVNAM(sc));
+               umbim_newstate(sc, UMBIM_S_OPEN, 0);
+       } else
+               umbim_newstate(sc, UMBIM_S_RADIO, UMBIM_NS_DONT_DROP);
+       return 1;
+}
+
+int
+umbim_decode_pin(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_pin_info *pi = data;
+       uint32_t        attempts_left;
+
+       if (len < sizeof (*pi))
+               return 0;
+
+       attempts_left = letoh32(pi->remaining_attempts);
+       if (attempts_left != 0xffffffff)
+               sc->sc_info.pin_attempts_left = attempts_left;
+
+       switch (letoh32(pi->state)) {
+       case UMBIM_PIN_STATE_UNLOCKED:
+               sc->sc_info.pin_state = UMBIM_PIN_UNLOCKED;
+               break;
+       case UMBIM_PIN_STATE_LOCKED:
+               switch (letoh32(pi->type)) {
+               case UMBIM_PIN_TYPE_PIN1:
+                       sc->sc_info.pin_state = UMBIM_PIN_REQUIRED;
+                       break;
+               case UMBIM_PIN_TYPE_PUK1:
+                       sc->sc_info.pin_state = UMBIM_PUK_REQUIRED;
+                       break;
+               case UMBIM_PIN_TYPE_PIN2:
+               case UMBIM_PIN_TYPE_PUK2:
+                       /* Assume that PIN1 was accepted */
+                       sc->sc_info.pin_state = UMBIM_PIN_UNLOCKED;
+                       break;
+               }
+               break;
+       }
+       log(LOG_INFO, "%s: %s state %s (%d attempts left)\n",
+           DEVNAM(sc), umbim_pin_type(letoh32(pi->type)),
+           (letoh32(pi->state) == UMBIM_PIN_STATE_UNLOCKED) ?
+               "unlocked" : "locked",
+           letoh32(pi->remaining_attempts));
+
+       /*
+        * In case the PIN was set after IFF_UP, retrigger the state machine
+        */
+       usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
+       return 1;
+}
+
+int
+umbim_decode_packet_service(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_packet_service_info *psi = data;
+       int      state, highestclass;
+       uint64_t up_speed, down_speed;
+       struct ifnet *ifp = GET_IFP(sc);
+
+       if (len < sizeof (*psi))
+               return 0;
+
+       sc->sc_info.nwerror = letoh32(psi->nwerror);
+       state = letoh32(psi->state);
+       highestclass = letoh32(psi->highest_dataclass);
+       up_speed = letoh64(psi->uplink_speed);
+       down_speed = letoh64(psi->downlink_speed);
+       if (sc->sc_info.packetstate  != state ||
+           sc->sc_info.uplink_speed != up_speed ||
+           sc->sc_info.downlink_speed != down_speed) {
+               log(LOG_INFO, "%s: packet service ", DEVNAM(sc));
+               if (sc->sc_info.packetstate  != state)
+                       addlog("changed from %s to ",
+                           umbim_packet_state(sc->sc_info.packetstate));
+               addlog("%s, class %s, speed: %llu up / %llu down\n",
+                   umbim_packet_state(state), umbim_dataclass(highestclass),
+                   up_speed, down_speed);
+       }
+       sc->sc_info.packetstate = state;
+       sc->sc_info.highestclass = highestclass;
+       sc->sc_info.uplink_speed = up_speed;
+       sc->sc_info.downlink_speed = down_speed;
+
+       if (sc->sc_info.regmode == UMBIM_REGMODE_AUTOMATIC) {
+               /*
+                * For devices using automatic registration mode, just proceed,
+                * once registration has completed.
+                */
+               if (ifp->if_flags & IFF_UP) {
+                       switch (sc->sc_info.regstate) {
+                       case UMBIM_REGSTATE_HOME:
+                       case UMBIM_REGSTATE_ROAMING:
+                       case UMBIM_REGSTATE_PARTNER:
+                               umbim_newstate(sc, UMBIM_S_ATTACHED,
+                                   UMBIM_NS_DONT_DROP);
+                               break;
+                       default:
+                               break;
+                       }
+               } else
+                       umbim_newstate(sc, UMBIM_S_SIMREADY,
+                           UMBIM_NS_DONT_RAISE);
+       } else switch (sc->sc_info.packetstate) {
+       case UMBIM_PKTSERVICE_STATE_ATTACHED:
+               umbim_newstate(sc, UMBIM_S_ATTACHED, UMBIM_NS_DONT_DROP);
+               break;
+       case UMBIM_PKTSERVICE_STATE_DETACHED:
+               umbim_newstate(sc, UMBIM_S_SIMREADY, UMBIM_NS_DONT_RAISE);
+               break;
+       }
+       return 1;
+}
+
+int
+umbim_decode_signal_state(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_signal_state *ss = data;
+       int      rssi;
+
+       if (len < sizeof (*ss))
+               return 0;
+
+       if (letoh32(ss->rssi) == 99)
+               rssi = UMBIM_VALUE_UNKNOWN;
+       else {
+               rssi = -113 + 2 * letoh32(ss->rssi);
+               if (sc->sc_info.rssi != rssi &&
+                   sc->sc_state >= UMBIM_S_CONNECTED)
+                       log(LOG_INFO, "%s: rssi %d dBm\n", DEVNAM(sc), rssi);
+       }
+       sc->sc_info.rssi = rssi;
+       sc->sc_info.ber = letoh32(ss->err_rate);
+       if (sc->sc_info.ber == -99)
+               sc->sc_info.ber = UMBIM_VALUE_UNKNOWN;
+       return 1;
+}
+
+int
+umbim_decode_connect_info(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_connect_info *ci = data;
+       int      act;
+
+       if (len < sizeof (*ci))
+               return 0;
+
+       if (letoh32(ci->sessionid) != umbim_session_id) {
+               DPRINTF("%s: discard connection info for session %u\n",
+                   DEVNAM(sc), letoh32(ci->sessionid));
+               return 1;
+       }
+       if (memcmp(ci->context, umbim_uuid_context_internet,
+           sizeof (ci->context))) {
+               DPRINTF("%s: discard connection info for other context\n",
+                   DEVNAM(sc));
+               return 1;
+       }
+       act = letoh32(ci->activation);
+       if (sc->sc_info.activation != act) {
+               log(LOG_INFO, "%s: connection %s\n", DEVNAM(sc),
+                   umbim_activation(act));
+               if (letoh32(ci->iptype) != UMBIM_CONTEXT_IPTYPE_DEFAULT &&
+                   letoh32(ci->iptype) != UMBIM_CONTEXT_IPTYPE_IPV4)
+                       log(LOG_DEBUG, "%s: got iptype %d connection\n",
+                           DEVNAM(sc), letoh32(ci->iptype));
+
+               sc->sc_info.activation = act;
+               sc->sc_info.nwerror = letoh32(ci->nwerror);
+
+               if (sc->sc_info.activation == UMBIM_ACTIVATION_STATE_ACTIVATED)
+                       umbim_newstate(sc, UMBIM_S_CONNECTED,
+                           UMBIM_NS_DONT_DROP);
+               else if (sc->sc_info.activation ==
+                   UMBIM_ACTIVATION_STATE_DEACTIVATED)
+                       umbim_newstate(sc, UMBIM_S_ATTACHED, 0);
+               /* else: other states are purely transitional */
+       }
+       return 1;
+}
+
+int
+umbim_decode_ip_configuration(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_cid_ip_configuration_info *ic = data;
+       struct ifnet *ifp = GET_IFP(sc);
+       int      s;
+       uint32_t avail;
+       uint32_t val;
+       int      n, i;
+       int      off;
+       struct umbim_cid_ipv4_element ipv4elem;
+       struct umbim_ifaddr uif;
+       int      newifaddr = 0;
+       int      ifaddr_changed = 0;
+       int      state = -1;
+
+       if (len < sizeof (*ic))
+               return 0;
+       if (letoh32(ic->sessionid) != umbim_session_id) {
+               DPRINTF("%s: ignore IP configration for session id %d\n",
+                   DEVNAM(sc), letoh32(ic->sessionid));
+               return 0;
+       }
+       s = splnet();
+
+       /*
+        * IPv4 configuation
+        */
+       avail = letoh32(ic->ipv4_available);
+       if (avail & UMBIM_IPCONF_HAS_ADDRINFO) {
+               n = letoh32(ic->ipv4_naddr);
+               off = letoh32(ic->ipv4_addroffs);
+
+               if (n == 0 || off + sizeof (ipv4elem) > len)
+                       goto done;
+
+               /* Only pick the first one */
+               memcpy(&ipv4elem, data + off, sizeof (ipv4elem));
+               ipv4elem.addr = letoh32(ipv4elem.addr);
+               ipv4elem.prefixlen = letoh32(ipv4elem.prefixlen);
+
+               umbim_get_ipv4addr(ifp, &uif);
+               if (sc->sc_saved_ifaddr == NULL) {
+                       if (uif.addr.sin_addr.s_addr == INADDR_ANY &&
+                           uif.dst.sin_addr.s_addr == INADDR_ANY) {
+                               newifaddr = 1;
+                               /* No original addr */
+                               sc->sc_saved_ifaddr = UMBIM_IFADDR_NONE;
+                       } else {
+                               sc->sc_saved_ifaddr = malloc(sizeof (uif),
+                                   M_USBDEV, M_WAITOK | M_ZERO);
+                               memcpy(sc->sc_saved_ifaddr, &uif, sizeof (uif));
+                       }
+                       newifaddr = 1;
+               } else if (ipv4elem.addr != uif.addr.sin_addr.s_addr)
+                       ifaddr_changed = 1;
+               state = UMBIM_S_UP;
+       }
+       if (newifaddr || ifaddr_changed) {
+               memset(&uif, 0, sizeof (uif));
+               uif.addr.sin_family = AF_INET;
+               uif.addr.sin_len = sizeof(uif.addr);
+               uif.addr.sin_addr.s_addr = ipv4elem.addr;
+               uif.dst.sin_family = AF_INET;
+               uif.dst.sin_len = sizeof(uif.dst);
+               if (avail & UMBIM_IPCONF_HAS_GWINFO) {
+                       off = letoh32(ic->ipv4_gwoffs);
+                       uif.dst.sin_addr.s_addr =
+                           letoh32(*((uint32_t *)(data + off)));
+               } else if (newifaddr)
+                       uif.dst.sin_addr.s_addr = INADDR_BROADCAST;
+               uif.netmask.sin_family = AF_INET;
+               uif.netmask.sin_len = sizeof(uif.netmask);
+               in_len2mask(&uif.netmask.sin_addr, ipv4elem.prefixlen);
+               umbim_set_ipv4addr(ifp, &uif, newifaddr ? "new" : "change");
+       }
+
+       memset(sc->sc_info.ipv4dns, 0, sizeof (sc->sc_info.ipv4dns));
+       if (avail & UMBIM_IPCONF_HAS_DNSINFO) {
+               n = letoh32(ic->ipv4_ndnssrv);
+               off = letoh32(ic->ipv4_dnssrvoffs);
+               i = 0;
+               while (n-- > 0) {
+                       if (off + sizeof (uint32_t) > len)
+                               break;
+                       val = letoh32(*((uint32_t *)(data + off)));
+                       if (i < UMBIM_MAX_DNSSRV)
+                               sc->sc_info.ipv4dns[i++] = val;
+                       off += sizeof (uint32_t);
+               }
+       }
+
+       if ((avail & UMBIM_IPCONF_HAS_MTUINFO)) {
+               val = letoh32(ic->ipv4_mtu);
+               if (ifp->if_hardmtu != val && val <= sc->sc_maxpktlen) {
+                       ifp->if_hardmtu = val;
+                       if (ifp->if_mtu > val)
+                               ifp->if_mtu = val;
+                       log(LOG_INFO, "%s: MTU is %d\n", DEVNAM(sc), val);
+               }
+       }
+
+       avail = letoh32(ic->ipv6_available);
+       if (avail & UMBIM_IPCONF_HAS_ADDRINFO) {
+               /* XXX FIXME: IPv6 configuation missing */
+               log(LOG_INFO, "%s: ignoring IPv6 configuration\n", DEVNAM(sc));
+       }
+       if (state != -1)
+               umbim_newstate(sc, state, 0);
+
+done:
+       splx(s);
+       return 1;
+}
+
+void
+umbim_rx(struct umbim_softc *sc)
+{
+       usbd_setup_xfer(sc->sc_rx_xfer, sc->sc_rx_pipe, sc, sc->sc_rx_buf,
+           sc->sc_maxpktlen, USBD_SHORT_XFER_OK | USBD_NO_COPY,
+           USBD_NO_TIMEOUT, umbim_rxeof);
+       usbd_transfer(sc->sc_rx_xfer);
+}
+
+void
+umbim_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
+{
+       struct umbim_softc *sc = priv;
+       struct ifnet *ifp = GET_IFP(sc);
+
+       if (usbd_is_dying(sc->sc_udev) || !(ifp->if_flags & IFF_RUNNING))
+               return;
+
+       if (status != USBD_NORMAL_COMPLETION) {
+               if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
+                       return;
+               DPRINTF("%s: rx error: %s\n", DEVNAM(sc), usbd_errstr(status));
+               if (status == USBD_STALLED)
+                       usbd_clear_endpoint_stall_async(sc->sc_rx_pipe);
+               if (++sc->sc_rx_nerr > 100) {
+                       log(LOG_ERR, "%s: too many rx errors, disabling\n",
+                           DEVNAM(sc));
+                       usbd_deactivate(sc->sc_udev);
+               }
+       } else {
+               sc->sc_rx_nerr = 0;
+               umbim_decap(sc, xfer);
+       }
+
+       umbim_rx(sc);
+       return;
+}
+
+int
+umbim_encap(struct umbim_softc *sc, struct mbuf *m)
+{
+       struct ncm_header16 *hdr;
+       struct ncm_pointer16 *ptr;
+       usbd_status  err;
+       int      len;
+
+       KASSERT(sc->sc_tx_m == NULL);
+
+       hdr = sc->sc_tx_buf;
+       ptr = (struct ncm_pointer16 *)(hdr + 1);
+
+       USETDW(hdr->dwSignature, NCM_HDR16_SIG);
+       USETW(hdr->wHeaderLength, sizeof (*hdr));
+       USETW(hdr->wSequence, sc->sc_tx_seq);
+       sc->sc_tx_seq++;
+       USETW(hdr->wNdpIndex, sizeof (*hdr));
+
+       len = m->m_pkthdr.len;
+       USETDW(ptr->dwSignature, UMBIM_NCM_NTH16_SIG(umbim_session_id));
+       USETW(ptr->wLength, sizeof (*ptr));
+       USETW(ptr->wNextNdpIndex, 0);
+       USETW(ptr->dgram[0].wDatagramIndex, UMBIM_HDR16_LEN);
+       USETW(ptr->dgram[0].wDatagramLen, len);
+       USETW(ptr->dgram[1].wDatagramIndex, 0);
+       USETW(ptr->dgram[1].wDatagramLen, 0);
+
+       m_copydata(m, 0, len, (caddr_t)(ptr + 1));
+       sc->sc_tx_m = m;
+       len += UMBIM_HDR16_LEN;
+       USETW(hdr->wBlockLength, len);
+
+       DPRINTFN(3, "%s: encap %d bytes\n", DEVNAM(sc), len);
+       DDUMPN(5, sc->sc_tx_buf, len);
+       usbd_setup_xfer(sc->sc_tx_xfer, sc->sc_tx_pipe, sc, sc->sc_tx_buf, len,
+           USBD_FORCE_SHORT_XFER | USBD_NO_COPY, umbim_xfer_tout, umbim_txeof);
+       err = usbd_transfer(sc->sc_tx_xfer);
+       if (err != USBD_IN_PROGRESS) {
+               DPRINTF("%s: start tx error: %s\n", DEVNAM(sc),
+                   usbd_errstr(err));
+               return 0;
+       }
+       return 1;
+}
+
+void
+umbim_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
+{
+       struct umbim_softc *sc = priv;
+       struct ifnet *ifp = GET_IFP(sc);
+       int      s;
+
+       s = splnet();
+       ifp->if_flags &= ~IFF_OACTIVE;
+       ifp->if_timer = 0;
+
+       m_freem(sc->sc_tx_m);
+       sc->sc_tx_m = NULL;
+
+       if (status != USBD_NORMAL_COMPLETION) {
+               if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) {
+                       ifp->if_oerrors++;
+                       DPRINTF("%s: tx error: %s\n", DEVNAM(sc),
+                           usbd_errstr(status));
+                       if (status == USBD_STALLED)
+                               usbd_clear_endpoint_stall_async(sc->sc_tx_pipe);
+               }
+       } else {
+               ifp->if_opackets++;
+               if (IFQ_IS_EMPTY(&ifp->if_snd) == 0)
+                       umbim_start(ifp);
+       }
+
+       splx(s);
+}
+
+void
+umbim_decap(struct umbim_softc *sc, struct usbd_xfer *xfer)
+{
+       struct ifnet *ifp = GET_IFP(sc);
+       int      s;
+       void    *buf;
+       uint32_t len;
+       char    *dp;
+       struct ncm_header16 *hdr16;
+       struct ncm_header32 *hdr32;
+       struct ncm_pointer16 *ptr16;
+       struct ncm_pointer16_dgram *dgram16;
+       struct ncm_pointer32_dgram *dgram32;
+       uint32_t hsig, psig;
+       int      hlen, blen;
+       int      ptrlen, ptroff, dgentryoff;
+       uint32_t doff, dlen;
+       struct mbuf_list ml = MBUF_LIST_INITIALIZER();
+       struct mbuf *m;
+
+       usbd_get_xfer_status(xfer, NULL, &buf, &len, NULL);
+       DPRINTFN(4, "%s: recv %d bytes\n", DEVNAM(sc), len);
+       DDUMPN(5, buf, len);
+       s = splnet();
+       if (len < sizeof (*hdr16))
+               goto toosmall;
+       if (len > sc->sc_maxpktlen) {
+               DPRINTF("%s: packet too large (%d)\n", DEVNAM(sc), len);
+               goto fail;
+       }
+
+       hdr16 = (struct ncm_header16 *)buf;
+       hsig = UGETDW(hdr16->dwSignature);
+       hlen = UGETW(hdr16->wHeaderLength);
+       switch (hsig) {
+       case NCM_HDR16_SIG:
+               blen = UGETW(hdr16->wBlockLength);
+               if (hlen != sizeof (*hdr16)) {
+                       DPRINTF("%s: bad header len %d for NTH16 (exp %zu)\n",
+                           DEVNAM(sc), hlen, sizeof (*hdr16));
+                       goto fail;
+               }
+               break;
+       case NCM_HDR32_SIG:
+               hdr32 = (struct ncm_header32 *)hdr16;
+               blen = UGETDW(hdr32->dwBlockLength);
+               if (hlen != sizeof (*hdr32)) {
+                       DPRINTF("%s: bad header len %d for NTH32 (exp %zu)\n",
+                           DEVNAM(sc), hlen, sizeof (*hdr32));
+                       goto fail;
+               }
+               break;
+       default:
+               DPRINTF("%s: unsupported NCM header signature (0x%08x)\n",
+                   DEVNAM(sc), hsig);
+               goto fail;
+       }
+       if (len < hlen)
+               goto toosmall;
+       if (len < blen) {
+               DPRINTF("%s: bad NTB len (%d) for %d bytes of data\n",
+                   DEVNAM(sc), blen, len);
+               goto fail;
+       }
+
+       ptroff = hlen;
+       ptr16 = (struct ncm_pointer16 *)(buf + ptroff);
+       psig = UGETDW(ptr16->dwSignature);
+       ptrlen = UGETW(ptr16->wLength);
+       if (len < ptrlen + ptroff)
+               goto toosmall;
+       if (!UMBIM_NCM_NTH16_ISISG(psig) && !UMBIM_NCM_NTH32_ISISG(psig)) {
+               DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n",
+                   DEVNAM(sc), psig);
+               goto fail;
+       }
+
+       switch (hsig) {
+       case NCM_HDR16_SIG:
+               dgentryoff = offsetof(struct ncm_pointer16, dgram);
+               break;
+       case NCM_HDR32_SIG:
+               dgentryoff = offsetof(struct ncm_pointer32, dgram);
+               break;
+       default:
+               goto fail;
+       }
+
+       while (dgentryoff < ptrlen) {
+               switch (hsig) {
+               case NCM_HDR16_SIG:
+                       if (ptroff + dgentryoff < sizeof (*dgram16))
+                               goto done;
+                       dgram16 = (struct ncm_pointer16_dgram *)
+                           (buf + ptroff + dgentryoff);
+                       dgentryoff += sizeof (*dgram16);
+                       dlen = UGETW(dgram16->wDatagramLen);
+                       doff = UGETW(dgram16->wDatagramIndex);
+                       break;
+               case NCM_HDR32_SIG:
+                       if (ptroff + dgentryoff < sizeof (*dgram32))
+                               goto done;
+                       dgram32 = (struct ncm_pointer32_dgram *)
+                           (buf + ptroff + dgentryoff);
+                       dgentryoff += sizeof (*dgram32);
+                       dlen = UGETDW(dgram32->dwDatagramLen);
+                       doff = UGETDW(dgram32->dwDatagramIndex);
+                       break;
+               default:
+                       ifp->if_ierrors++;
+                       goto done;
+               }
+
+               /* Terminating zero entry */
+               if (dlen == 0 && doff == 0)
+                       break;
+               if (len < dlen + doff) {
+                       /* Skip giant datagram but continue processing */
+                       DPRINTF("%s: datagram too large (%d @ off %d)\n",
+                           DEVNAM(sc), dlen, doff);
+                       continue;
+               }
+
+               dp = buf + doff;
+               DPRINTFN(3, "%s: decap %d bytes\n", DEVNAM(sc), dlen);
+               m = m_devget(dp, dlen, 0);
+               if (m == NULL) {
+                       ifp->if_iqdrops++;
+                       continue;
+               }
+
+               ml_enqueue(&ml, m);
+       }
+done:
+       if_input(ifp, &ml);
+       splx(s);
+       return;
+toosmall:
+       DPRINTF("%s: packet too small (%d)\n", DEVNAM(sc), len);
+fail:
+       ifp->if_ierrors++;
+       splx(s);
+}
+
+usbd_status
+umbim_send_encap_command(struct umbim_softc *sc, void *data, int len)
+{
+       struct usbd_xfer *xfer;
+       usb_device_request_t req;
+       char *buf;
+
+       if (len > sc->sc_ctrl_len)
+               return USBD_INVAL;
+
+       if ((xfer = usbd_alloc_xfer(sc->sc_udev)) == NULL)
+               return USBD_NOMEM;
+       if ((buf = usbd_alloc_buffer(xfer, len)) == NULL) {
+               usbd_free_xfer(xfer);
+               return USBD_NOMEM;
+       }
+       memcpy(buf, data, len);
+
+       /* XXX FIXME: if (total len > sc->sc_ctrl_len) => must fragment */
+       req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
+       req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
+       USETW(req.wValue, 0);
+       USETW(req.wIndex, sc->sc_ctrl_ifaceno);
+       USETW(req.wLength, len);
+       DELAY(umbim_delay);
+       return usbd_request_async(xfer, &req, NULL, NULL);
+}
+
+int
+umbim_get_encap_response(struct umbim_softc *sc, void *buf, int *len)
+{
+       usb_device_request_t req;
+       usbd_status err;
+
+       req.bmRequestType = UT_READ_CLASS_INTERFACE;
+       req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
+       USETW(req.wValue, 0);
+       USETW(req.wIndex, sc->sc_ctrl_ifaceno);
+       USETW(req.wLength, *len);
+       /* XXX FIXME: re-assemble fragments */
+
+       DELAY(umbim_delay);
+       err = usbd_do_request_flags(sc->sc_udev, &req, buf, USBD_SHORT_XFER_OK,
+           len, umbim_xfer_tout);
+       if (err == USBD_NORMAL_COMPLETION)
+               return 1;
+       DPRINTF("%s: ctrl recv: %s\n", DEVNAM(sc), usbd_errstr(err));
+       return 0;
+}
+
+void
+umbim_ctrl_msg(struct umbim_softc *sc, uint32_t req, void *data, int len)
+{
+       uint32_t tid;
+       struct umbim_msghdr *hdr = data;
+       usbd_status err;
+       int      s;
+
+       assertwaitok();
+       if (usbd_is_dying(sc->sc_udev))
+               return;
+       if (len < sizeof (*hdr))
+               return;
+       tid = ++sc->sc_tid;
+
+       hdr->type = htole32(req);
+       hdr->len = htole32(len);
+       hdr->tid = htole32(tid);
+
+#ifdef UMBIM_DEBUG
+       if (umbim_debug) {
+               const char *op, *str;
+               if (req == UMBIM_COMMAND_MSG) {
+                       struct umbim_h2f_cmd *c = data;
+                       if (letoh32(c->op) == UMBIM_CMDOP_SET)
+                               op = "set";
+                       else
+                               op = "qry";
+                       str = umbim_cid2str(letoh32(c->cid));
+               } else {
+                       op = "snd";
+                       str = umbim_request2str(req);
+               }
+               DPRINTF("%s: -> %s %s (tid %u)\n", DEVNAM(sc), op, str, tid);
+       }
+#endif
+       s = splusb();
+       err = umbim_send_encap_command(sc, data, len);
+       splx(s);
+       if (err != USBD_NORMAL_COMPLETION) {
+               log(LOG_ERR, "%s: send %s msg (tid %u) failed: %s\n",
+                   DEVNAM(sc), umbim_request2str(req), tid, usbd_errstr(err));
+
+               /* will affect other transactions, too */
+               usbd_abort_pipe(sc->sc_udev->default_pipe);
+       } else {
+               DPRINTFN(2, "%s: sent %s (tid %u)\n", DEVNAM(sc),
+                   umbim_request2str(req), tid);
+               DDUMPN(3, data, len);
+       }
+       return;
+}
+
+void
+umbim_open(struct umbim_softc *sc)
+{
+       struct umbim_h2f_openmsg msg;
+
+       memset(&msg, 0, sizeof (msg));
+       msg.maxlen = htole32(sc->sc_ctrl_len);
+       umbim_ctrl_msg(sc, UMBIM_OPEN_MSG, &msg, sizeof (msg));
+       return;
+}
+
+void
+umbim_close(struct umbim_softc *sc)
+{
+       struct umbim_h2f_closemsg msg;
+
+       memset(&msg, 0, sizeof (msg));
+       umbim_ctrl_msg(sc, UMBIM_CLOSE_MSG, &msg, sizeof (msg));
+}
+
+int
+umbim_setpin(struct umbim_softc *sc, int op, int is_puk, void *pin, int pinlen,
+    void *newpin, int newpinlen)
+{
+       struct umbim_cid_pin cp;
+       int      off;
+
+       if (pinlen == 0)
+               return 0;
+       if (pinlen < 0 || pinlen > UMBIM_PIN_MAXLEN ||
+           newpinlen < 0 || newpinlen > UMBIM_PIN_MAXLEN ||
+           op < 0 || op > UMBIM_PIN_OP_CHANGE ||
+           (is_puk && op != UMBIM_PIN_OP_ENTER))
+               return EINVAL;
+
+       memset(&cp, 0, sizeof (cp));
+       cp.type = htole32(is_puk ? UMBIM_PIN_TYPE_PUK1 : UMBIM_PIN_TYPE_PIN1);
+
+       off = offsetof(struct umbim_cid_pin, data);
+       if (!umbim_addstr(&cp, sizeof (cp), &off, pin, pinlen,
+           &cp.pin_offs, &cp.pin_size))
+               return EINVAL;
+
+       cp.op  = htole32(op);
+       if (newpinlen) {
+               if (!umbim_addstr(&cp, sizeof (cp), &off, newpin, newpinlen,
+                   &cp.newpin_offs, &cp.newpin_size))
+                       return EINVAL;
+       } else {
+               if ((op == UMBIM_PIN_OP_CHANGE) || is_puk)
+                       return EINVAL;
+               if (!umbim_addstr(&cp, sizeof (cp), &off, NULL, 0,
+                   &cp.newpin_offs, &cp.newpin_size))
+                       return EINVAL;
+       }
+       umbim_cmd(sc, UMBIM_CID_PIN, UMBIM_CMDOP_SET, &cp, off);
+       return 0;
+}
+
+void
+umbim_setdataclass(struct umbim_softc *sc)
+{
+       struct umbim_cid_registration_state rs;
+       uint32_t         classes;
+
+       if (sc->sc_info.supportedclasses == UMBIM_DATACLASS_NONE)
+               return;
+
+       memset(&rs, 0, sizeof (rs));
+       rs.regaction = htole32(UMBIM_REGACTION_AUTOMATIC);
+       classes = sc->sc_info.supportedclasses;
+       if (sc->sc_info.preferredclasses != UMBIM_DATACLASS_NONE)
+               classes &= sc->sc_info.preferredclasses;
+       rs.data_class = htole32(classes);
+       umbim_cmd(sc, UMBIM_CID_REGISTER_STATE, UMBIM_CMDOP_SET, &rs,
+           sizeof (rs));
+}
+
+void
+umbim_radio(struct umbim_softc *sc, int on)
+{
+       struct umbim_cid_radio_state s;
+
+       DPRINTF("%s: set radio %s\n", DEVNAM(sc), on ? "on" : "off");
+       memset(&s, 0, sizeof (s));
+       s.state = htole32(on ? UMBIM_RADIO_STATE_ON : UMBIM_RADIO_STATE_OFF);
+       umbim_cmd(sc, UMBIM_CID_RADIO_STATE, UMBIM_CMDOP_SET, &s, sizeof (s));
+}
+
+void
+umbim_packet_service(struct umbim_softc *sc, int attach)
+{
+       struct umbim_cid_packet_service s;
+
+       DPRINTF("%s: %s packet service\n", DEVNAM(sc),
+           attach ? "attach" : "detach");
+       memset(&s, 0, sizeof (s));
+       s.action = htole32(attach ?
+           UMBIM_PKTSERVICE_ACTION_ATTACH : UMBIM_PKTSERVICE_ACTION_DETACH);
+       umbim_cmd(sc, UMBIM_CID_PACKET_SERVICE, UMBIM_CMDOP_SET, &s, sizeof 
(s));
+}
+
+void
+umbim_connect(struct umbim_softc *sc)
+{
+       if (sc->sc_info.regstate == UMBIM_REGSTATE_ROAMING && !sc->sc_roaming) {
+               log(LOG_INFO, "%s: connection disabled in roaming network\n",
+                   DEVNAM(sc));
+               return;
+       }
+       log(LOG_DEBUG, "%s: connecting ...\n", DEVNAM(sc));
+       umbim_send_connect(sc, UMBIM_CONNECT_ACTIVATE);
+}
+
+void
+umbim_disconnect(struct umbim_softc *sc)
+{
+       log(LOG_DEBUG, "%s: disconnecting ...\n", DEVNAM(sc));
+       umbim_send_connect(sc, UMBIM_CONNECT_DEACTIVATE);
+}
+
+void
+umbim_send_connect(struct umbim_softc *sc, int command)
+{
+       struct umbim_cid_connect *c;
+       int      off;
+
+       /* Too large or the stack */
+       c = malloc(sizeof (*c), M_USBDEV, M_WAIT|M_ZERO);
+       c->sessionid = htole32(umbim_session_id);
+       c->command = htole32(command);
+       off = offsetof(struct umbim_cid_connect, data);
+       if (!umbim_addstr(c, sizeof (*c), &off, sc->sc_info.apn,
+           sc->sc_info.apnlen, &c->access_offs, &c->access_size))
+               goto done;
+       /* XXX FIXME: support user name and passphrase */
+       c->user_offs = htole32(0);
+       c->user_size = htole32(0);
+       c->passwd_offs = htole32(0);
+       c->passwd_size = htole32(0);
+       c->authprot = htole32(UMBIM_AUTHPROT_NONE);
+       c->compression = htole32(UMBIM_COMPRESSION_NONE);
+       c->iptype = htole32(UMBIM_CONTEXT_IPTYPE_IPV4);
+       memcpy(c->context, umbim_uuid_context_internet, sizeof (c->context));
+       umbim_cmd(sc, UMBIM_CID_CONNECT, UMBIM_CMDOP_SET, c, off);
+done:
+       free(c, M_USBDEV, sizeof (*c));
+       return;
+}
+
+void
+umbim_qry_ipconfig(struct umbim_softc *sc)
+{
+       struct umbim_cid_ip_configuration_info ipc;
+
+       memset(&ipc, 0, sizeof (ipc));
+       ipc.sessionid = htole32(umbim_session_id);
+       umbim_cmd(sc, UMBIM_CID_IP_CONFIGURATION, UMBIM_CMDOP_QRY,
+           &ipc, sizeof (ipc));
+}
+
+void
+umbim_cmd(struct umbim_softc *sc, int cid, int op, void *data, int len)
+{
+       struct umbim_h2f_cmd *cmd;
+       int     totlen;
+
+       /* XXX FIXME support sending fragments */
+       if (sizeof (*cmd) + len > sc->sc_ctrl_len) {
+               DPRINTF("%s: set %s msg too long: cannot send\n",
+                   DEVNAM(sc), umbim_cid2str(cid));
+               return;
+       }
+       cmd = sc->sc_ctrl_msg;
+       memset(cmd, 0, sizeof (*cmd));
+       cmd->frag.nfrag = htole32(1);
+       memcpy(cmd->devid, umbim_uuid_basic_connect, sizeof (cmd->devid));
+       cmd->cid = htole32(cid);
+       cmd->op = htole32(op);
+       cmd->infolen = htole32(len);
+       totlen = sizeof (*cmd);
+       if (len > 0) {
+               memcpy(cmd + 1, data, len);
+               totlen += len;
+       }
+       umbim_ctrl_msg(sc, UMBIM_COMMAND_MSG, cmd, totlen);
+}
+
+void
+umbim_command_done(struct umbim_softc *sc, void *data, int len)
+{
+       struct umbim_f2h_cmddone *cmd = data;
+       uint32_t status;
+       uint32_t cid;
+       uint32_t infolen;
+
+       if (len < sizeof (*cmd)) {
+               DPRINTF("%s: discard short %s messsage\n", DEVNAM(sc),
+                   umbim_request2str(letoh32(cmd->hdr.type)));
+               return;
+       }
+       cid = letoh32(cmd->cid);
+       if (memcmp(cmd->devid, umbim_uuid_basic_connect, sizeof (cmd->devid))) {
+               DPRINTF("%s: discard %s messsage for other UUID '%s'\n",
+                   DEVNAM(sc), umbim_request2str(letoh32(cmd->hdr.type)),
+                   umbim_uuid2str(cmd->devid));
+               return;
+       }
+
+       status = letoh32(cmd->status);
+       switch (status) {
+       case UMBIM_STATUS_SUCCESS:
+               break;
+       case UMBIM_STATUS_NOT_INITIALIZED:
+               log(LOG_ERR, "%s: SIM not initialized (PIN missing)\n",
+                   DEVNAM(sc));
+               return;
+       case UMBIM_STATUS_PIN_REQUIRED:
+               sc->sc_info.pin_state = UMBIM_PIN_REQUIRED;
+               /*FALLTHROUGH*/
+       default:
+               log(LOG_ERR, "%s: set/qry %s failed: %s\n", DEVNAM(sc),
+                   umbim_cid2str(cid), umbim_status2str(status));
+               return;
+       }
+
+       infolen = letoh32(cmd->infolen);
+       if (len < sizeof (*cmd) + infolen) {
+               DPRINTF("%s: discard truncated %s messsage (want %d, got %d)\n",
+                   DEVNAM(sc), umbim_cid2str(cid),
+                   (int)sizeof (*cmd) + infolen, len);
+               return;
+       }
+       DPRINTFN(2, "%s: set/qry %s done\n", DEVNAM(sc), umbim_cid2str(cid));
+       umbim_decode_cid(sc, cid, cmd->info, infolen);
+}
+
+void
+umbim_decode_cid(struct umbim_softc *sc, uint32_t cid, void *data, int len)
+{
+       int      ok = 1;
+
+       switch (cid) {
+       case UMBIM_CID_DEVICE_CAPS:
+               ok = umbim_decode_devices_caps(sc, data, len);
+               break;
+       case UMBIM_CID_SUBSCRIBER_READY_STATUS:
+               ok = umbim_decode_subscriber_status(sc, data, len);
+               break;
+       case UMBIM_CID_RADIO_STATE:
+               ok = umbim_decode_radio_state(sc, data, len);
+               break;
+       case UMBIM_CID_PIN:
+               ok = umbim_decode_pin(sc, data, len);
+               break;
+       case UMBIM_CID_REGISTER_STATE:
+               ok = umbim_decode_register_state(sc, data, len);
+               break;
+       case UMBIM_CID_PACKET_SERVICE:
+               ok = umbim_decode_packet_service(sc, data, len);
+               break;
+       case UMBIM_CID_SIGNAL_STATE:
+               ok = umbim_decode_signal_state(sc, data, len);
+               break;
+       case UMBIM_CID_CONNECT:
+               ok = umbim_decode_connect_info(sc, data, len);
+               break;
+       case UMBIM_CID_IP_CONFIGURATION:
+               ok = umbim_decode_ip_configuration(sc, data, len);
+               break;
+       default:
+               /*
+                * Note: the above list is incomplete and only contains
+                *      mandatory CIDs from the BASIC_CONNECT set.
+                *      So alternate values are not unusual.
+                */
+               DPRINTFN(4, "%s: ignore %s\n", DEVNAM(sc), umbim_cid2str(cid));
+               break;
+       }
+       if (!ok)
+               DPRINTF("%s: discard %s with bad info length %d\n",
+                   DEVNAM(sc), umbim_cid2str(cid), len);
+       return;
+}
+
+void
+umbim_intr(struct usbd_xfer *xfer, void *priv, usbd_status status)
+{
+       struct umbim_softc *sc = priv;
+       int      total_len;
+
+       if (status != USBD_NORMAL_COMPLETION) {
+               DPRINTF("%s: notification error: %s\n", DEVNAM(sc),
+                   usbd_errstr(status));
+               if (status == USBD_STALLED)
+                       usbd_clear_endpoint_stall_async(sc->sc_ctrl_pipe);
+               return;
+       }
+       usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL);
+       if (total_len < UCDC_NOTIFICATION_LENGTH) {
+               DPRINTF("%s: short notification (%d<%d)\n", DEVNAM(sc),
+                   total_len, UCDC_NOTIFICATION_LENGTH);
+                   return;
+       }
+       if (sc->sc_intr_msg.bmRequestType != UCDC_NOTIFICATION) {
+               DPRINTF("%s: unexpected notification (type=0x%02x)\n",
+                   DEVNAM(sc), sc->sc_intr_msg.bmRequestType);
+               return;
+       }
+
+       switch (sc->sc_intr_msg.bNotification) {
+       case UCDC_N_NETWORK_CONNECTION:
+               log(LOG_DEBUG, "%s: network %sconnected\n", DEVNAM(sc),
+                   UGETW(sc->sc_intr_msg.wValue) ? "" : "dis");
+               break;
+       case UCDC_N_RESPONSE_AVAILABLE:
+               DPRINTFN(2, "%s: umbim_intr: response available\n", DEVNAM(sc));
+               ++sc->sc_nresp;
+               usb_add_task(sc->sc_udev, &sc->sc_get_response_task);
+               break;
+       case UCDC_N_CONNECTION_SPEED_CHANGE:
+               DPRINTFN(2, "%s: umbim_intr: connection speed changed\n",
+                   DEVNAM(sc));
+               break;
+       default:
+               DPRINTF("%s: unexpected notifiation (0x%02x)\n",
+                   DEVNAM(sc), sc->sc_intr_msg.bNotification);
+               break;
+       }
+}
+
+/*
+ * Diagnostic routines
+ */
+char *
+umbim_ntop(struct sockaddr *sa)
+{
+#define NUMBUFS                4
+       static char astr[NUMBUFS][INET_ADDRSTRLEN];
+       static unsigned nbuf = 0;
+       char    *s;
+
+       s = astr[nbuf++];
+       if (nbuf >= NUMBUFS)
+               nbuf = 0;
+
+       switch (sa->sa_family) {
+       case AF_INET:
+       default:
+               inet_ntop(AF_INET, &satosin(sa)->sin_addr, s, sizeof (astr[0]));
+               break;
+       case AF_INET6:
+               inet_ntop(AF_INET6, &satosin6(sa)->sin6_addr, s,
+                   sizeof (astr[0]));
+               break;
+       }
+       return s;
+}
+
+#ifdef UMBIM_DEBUG
+char *
+umbim_uuid2str(uint8_t uuid[UMBIM_UUID_LEN])
+{
+       static char uuidstr[2 * UMBIM_UUID_LEN + 5];
+
+#define UUID_BFMT      "%02X"
+#define UUID_SEP       "-"
+       snprintf(uuidstr, sizeof (uuidstr),
+           UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_SEP
+           UUID_BFMT UUID_BFMT UUID_SEP
+           UUID_BFMT UUID_BFMT UUID_SEP
+           UUID_BFMT UUID_BFMT UUID_SEP
+           UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT,
+           uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5],
+           uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11],
+           uuid[12], uuid[13], uuid[14], uuid[15]);
+       return uuidstr;
+}
+
+void
+umbim_dump(void *buf, int len)
+{
+       int      i = 0;
+       uint8_t *c = buf;
+
+       if (len == 0)
+               return;
+       while (i < len) {
+               if ((i % 16) == 0) {
+                       if (i > 0)
+                               addlog("\n");
+                       log(LOG_DEBUG, "%4d:  ", i);
+               }
+               addlog(" %02x", *c);
+               c++;
+               i++;
+       }
+       addlog("\n");
+}
+#endif /* UMBIM_DEBUG */
Index: sys/dev/usb/if_umbim.h
===================================================================
RCS file: sys/dev/usb/if_umbim.h
diff -N sys/dev/usb/if_umbim.h
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ sys/dev/usb/if_umbim.h      1 Jun 2016 14:32:19 -0000
@@ -0,0 +1,375 @@
+/*     $OpenBSD$ */
+
+/*
+ * Copyright (c) 2016 genua mbH
+ * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Mobile Broadband Interface Model
+ * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
+ */
+
+struct umbim_valdescr {
+       int      val;
+       char    *descr;
+};
+
+static const char *
+umbim_val2descr(const struct umbim_valdescr *vdp, int val)
+{
+       static char sval[32];
+
+       while (vdp->descr != NULL) {
+               if (vdp->val == val)
+                       return vdp->descr;
+               vdp++;
+       }
+       snprintf(sval, sizeof (sval), "#%d", val);
+       return sval;
+}
+
+#define UMBIM_REGSTATE_DESCRIPTIONS {                          \
+       { UMBIM_REGSTATE_UNKNOWN,       "unknown" },            \
+       { UMBIM_REGSTATE_DEREGISTERED,  "not registered" },     \
+       { UMBIM_REGSTATE_SEARCHING,     "searching" },          \
+       { UMBIM_REGSTATE_HOME,          "home network" },       \
+       { UMBIM_REGSTATE_ROAMING,       "roaming network" },    \
+       { UMBIM_REGSTATE_PARTNER,       "partner network" },    \
+       { UMBIM_REGSTATE_DENIED,        "access denied" },      \
+       { 0, NULL } }
+
+#define UMBIM_DATACLASS_DESCRIPTIONS {                                 \
+       { UMBIM_DATACLASS_NONE,                         "none" },       \
+       { UMBIM_DATACLASS_GPRS,                         "GPRS" },       \
+       { UMBIM_DATACLASS_EDGE,                         "EDGE" },       \
+       { UMBIM_DATACLASS_UMTS,                         "UMTS" },       \
+       { UMBIM_DATACLASS_HSDPA,                        "HSDPA" },      \
+       { UMBIM_DATACLASS_HSUPA,                        "HSUPA" },      \
+       { UMBIM_DATACLASS_HSDPA|UMBIM_DATACLASS_HSUPA,  "HSPA" },       \
+       { UMBIM_DATACLASS_LTE,                          "LTE" },        \
+       { UMBIM_DATACLASS_1XRTT,                        "CDMA2000" },   \
+       { UMBIM_DATACLASS_1XEVDO,                       "CDMA2000" },   \
+       { UMBIM_DATACLASS_1XEVDO_REV_A,                 "CDMA2000" },   \
+       { UMBIM_DATACLASS_1XEVDV,                       "CDMA2000" },   \
+       { UMBIM_DATACLASS_3XRTT,                        "CDMA2000" },   \
+       { UMBIM_DATACLASS_1XEVDO_REV_B,                 "CDMA2000" },   \
+       { UMBIM_DATACLASS_UMB,                          "CDMA2000" },   \
+       { UMBIM_DATACLASS_CUSTOM,                       "custom" },     \
+       { 0, NULL } }
+
+#define UMBIM_1TO1_DESCRIPTION(m)      { (m), #m }
+#define UMBIM_MESSAGES_DESCRIPTIONS {                          \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_OPEN_MSG),                 \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CLOSE_MSG),                \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_COMMAND_MSG),              \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_HOST_ERROR_MSG),           \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_OPEN_DONE),                \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CLOSE_DONE),               \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_COMMAND_DONE),             \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_FUNCTION_ERROR_MSG),       \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_INDICATE_STATUS_MSG),      \
+       { 0, NULL } }
+
+#define UMBIM_STATUS_DESCRIPTION(m)    { UMBIM_STATUS_ ## m, #m }
+#define UMBIM_STATUS_DESCRIPTIONS {                                    \
+       UMBIM_STATUS_DESCRIPTION(SUCCESS),                              \
+       UMBIM_STATUS_DESCRIPTION(BUSY),                                 \
+       UMBIM_STATUS_DESCRIPTION(FAILURE),                              \
+       UMBIM_STATUS_DESCRIPTION(SIM_NOT_INSERTED),                     \
+       UMBIM_STATUS_DESCRIPTION(BAD_SIM),                              \
+       UMBIM_STATUS_DESCRIPTION(PIN_REQUIRED),                         \
+       UMBIM_STATUS_DESCRIPTION(PIN_DISABLED),                         \
+       UMBIM_STATUS_DESCRIPTION(NOT_REGISTERED),                       \
+       UMBIM_STATUS_DESCRIPTION(PROVIDERS_NOT_FOUND),                  \
+       UMBIM_STATUS_DESCRIPTION(NO_DEVICE_SUPPORT),                    \
+       UMBIM_STATUS_DESCRIPTION(PROVIDER_NOT_VISIBLE),                 \
+       UMBIM_STATUS_DESCRIPTION(DATA_CLASS_NOT_AVAILABLE),             \
+       UMBIM_STATUS_DESCRIPTION(PACKET_SERVICE_DETACHED),              \
+       UMBIM_STATUS_DESCRIPTION(MAX_ACTIVATED_CONTEXTS),               \
+       UMBIM_STATUS_DESCRIPTION(NOT_INITIALIZED),                      \
+       UMBIM_STATUS_DESCRIPTION(VOICE_CALL_IN_PROGRESS),               \
+       UMBIM_STATUS_DESCRIPTION(CONTEXT_NOT_ACTIVATED),                \
+       UMBIM_STATUS_DESCRIPTION(SERVICE_NOT_ACTIVATED),                \
+       UMBIM_STATUS_DESCRIPTION(INVALID_ACCESS_STRING),                \
+       UMBIM_STATUS_DESCRIPTION(INVALID_USER_NAME_PWD),                \
+       UMBIM_STATUS_DESCRIPTION(RADIO_POWER_OFF),                      \
+       UMBIM_STATUS_DESCRIPTION(INVALID_PARAMETERS),                   \
+       UMBIM_STATUS_DESCRIPTION(READ_FAILURE),                         \
+       UMBIM_STATUS_DESCRIPTION(WRITE_FAILURE),                        \
+       UMBIM_STATUS_DESCRIPTION(NO_PHONEBOOK),                         \
+       UMBIM_STATUS_DESCRIPTION(PARAMETER_TOO_LONG),                   \
+       UMBIM_STATUS_DESCRIPTION(STK_BUSY),                             \
+       UMBIM_STATUS_DESCRIPTION(OPERATION_NOT_ALLOWED),                \
+       UMBIM_STATUS_DESCRIPTION(MEMORY_FAILURE),                       \
+       UMBIM_STATUS_DESCRIPTION(INVALID_MEMORY_INDEX),                 \
+       UMBIM_STATUS_DESCRIPTION(MEMORY_FULL),                          \
+       UMBIM_STATUS_DESCRIPTION(FILTER_NOT_SUPPORTED),                 \
+       UMBIM_STATUS_DESCRIPTION(DSS_INSTANCE_LIMIT),                   \
+       UMBIM_STATUS_DESCRIPTION(INVALID_DEVICE_SERVICE_OPERATION),     \
+       UMBIM_STATUS_DESCRIPTION(AUTH_INCORRECT_AUTN),                  \
+       UMBIM_STATUS_DESCRIPTION(AUTH_SYNC_FAILURE),                    \
+       UMBIM_STATUS_DESCRIPTION(AUTH_AMF_NOT_SET),                     \
+       UMBIM_STATUS_DESCRIPTION(CONTEXT_NOT_SUPPORTED),                \
+       UMBIM_STATUS_DESCRIPTION(SMS_UNKNOWN_SMSC_ADDRESS),             \
+       UMBIM_STATUS_DESCRIPTION(SMS_NETWORK_TIMEOUT),                  \
+       UMBIM_STATUS_DESCRIPTION(SMS_LANG_NOT_SUPPORTED),               \
+       UMBIM_STATUS_DESCRIPTION(SMS_ENCODING_NOT_SUPPORTED),           \
+       UMBIM_STATUS_DESCRIPTION(SMS_FORMAT_NOT_SUPPORTED),             \
+       { 0, NULL } }
+
+#define UMBIM_ERROR_DESCRIPTION(m)     { UMBIM_ERROR_ ## m, #m }
+#define UMBIM_ERROR_DESCRIPTIONS {                                     \
+       UMBIM_ERROR_DESCRIPTION(TIMEOUT_FRAGMENT),                      \
+       UMBIM_ERROR_DESCRIPTION(FRAGMENT_OUT_OF_SEQUENCE),              \
+       UMBIM_ERROR_DESCRIPTION(LENGTH_MISMATCH),                       \
+       UMBIM_ERROR_DESCRIPTION(DUPLICATED_TID),                        \
+       UMBIM_ERROR_DESCRIPTION(NOT_OPENED),                            \
+       UMBIM_ERROR_DESCRIPTION(UNKNOWN),                               \
+       UMBIM_ERROR_DESCRIPTION(CANCEL),                                \
+       UMBIM_ERROR_DESCRIPTION(MAX_TRANSFER),                          \
+       { 0, NULL } }
+
+#define UMBIM_CID_DESCRIPTIONS {                                               
\
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_DEVICE_CAPS),                  \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_SUBSCRIBER_READY_STATUS),      \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_RADIO_STATE),                  \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PIN),                          \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PIN_LIST),                     \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_HOME_PROVIDER),                \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PREFERRED_PROVIDERS),          \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_VISIBLE_PROVIDERS),            \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_REGISTER_STATE),               \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PACKET_SERVICE),               \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_SIGNAL_STATE),                 \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_CONNECT),                      \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PROVISIONED_CONTEXTS),         \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_SERVICE_ACTIVATION),           \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_IP_CONFIGURATION),             \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_DEVICE_SERVICES),              \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST),\
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PACKET_STATISTICS),            \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_NETWORK_IDLE_HINT),            \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_EMERGENCY_MODE),               \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_IP_PACKET_FILTERS),            \
+       UMBIM_1TO1_DESCRIPTION(UMBIM_CID_MULTICARRIER_PROVIDERS),       \
+       { 0, NULL } }
+
+#define UMBIM_SIMSTATE_DESCRIPTIONS {                                  \
+       { UMBIM_SIMSTATE_NOTINITIALIZED, "not initialized" },           \
+       { UMBIM_SIMSTATE_INITIALIZED, "initialized" },                  \
+       { UMBIM_SIMSTATE_NOTINSERTED, "not inserted" },                 \
+       { UMBIM_SIMSTATE_BADSIM, "bad type" },                          \
+       { UMBIM_SIMSTATE_FAILURE, "failed" },                           \
+       { UMBIM_SIMSTATE_NOTACTIVATED, "not activated" },               \
+       { UMBIM_SIMSTATE_LOCKED, "locked" },                            \
+       { 0, NULL } }
+
+#define UMBIM_PINTYPE_DESCRIPTIONS {                                   \
+       { UMBIM_PIN_TYPE_NONE, "none" },                                \
+       { UMBIM_PIN_TYPE_CUSTOM, "custom" },                            \
+       { UMBIM_PIN_TYPE_PIN1, "PIN1" },                                \
+       { UMBIM_PIN_TYPE_PIN2, "PIN2" },                                \
+       { UMBIM_PIN_TYPE_DEV_SIM_PIN, "device PIN" },                   \
+       { UMBIM_PIN_TYPE_DEV_FIRST_SIM_PIN, "device 1st PIN" },         \
+       { UMBIM_PIN_TYPE_NETWORK_PIN, "network PIN" },                  \
+       { UMBIM_PIN_TYPE_NETWORK_SUBSET_PIN, "network subset PIN" },    \
+       { UMBIM_PIN_TYPE_SERVICE_PROVIDER_PIN, "provider PIN" },        \
+       { UMBIM_PIN_TYPE_CORPORATE_PIN, "corporate PIN" },              \
+       { UMBIM_PIN_TYPE_SUBSIDY_LOCK, "subsidy lock" },                \
+       { UMBIM_PIN_TYPE_PUK1, "PUK" },                                 \
+       { UMBIM_PIN_TYPE_PUK2, "PUK2" },                                \
+       { UMBIM_PIN_TYPE_DEV_FIRST_SIM_PUK, "device 1st PUK" },         \
+       { UMBIM_PIN_TYPE_NETWORK_PUK, "network PUK" },                  \
+       { UMBIM_PIN_TYPE_NETWORK_SUBSET_PUK, "network subset PUK" },    \
+       { UMBIM_PIN_TYPE_SERVICE_PROVIDER_PUK, "provider PUK" },        \
+       { UMBIM_PIN_TYPE_CORPORATE_PUK, "corporate PUK" },              \
+       { 0, NULL } }
+
+#define UMBIM_PKTSRV_STATE_DESCRIPTIONS {                              \
+       { UMBIM_PKTSERVICE_STATE_UNKNOWN, "unknown" },                  \
+       { UMBIM_PKTSERVICE_STATE_ATTACHING, "attaching" },              \
+       { UMBIM_PKTSERVICE_STATE_ATTACHED, "attached" },                \
+       { UMBIM_PKTSERVICE_STATE_DETACHING, "detaching" },              \
+       { UMBIM_PKTSERVICE_STATE_DETACHED, "detached" },                \
+       { 0, NULL } }
+
+#define UMBIM_ACTIVATION_STATE_DESCRIPTIONS {                          \
+       { UMBIM_ACTIVATION_STATE_UNKNOWN, "unknown" },                  \
+       { UMBIM_ACTIVATION_STATE_ACTIVATED, "activated" },              \
+       { UMBIM_ACTIVATION_STATE_ACTIVATING, "activating" },            \
+       { UMBIM_ACTIVATION_STATE_DEACTIVATED, "deactivated" },          \
+       { UMBIM_ACTIVATION_STATE_DEACTIVATING, "deactivating" },        \
+       { 0, NULL } }
+
+/*
+ * Driver internal state
+ */
+enum umbim_state {
+       UMBIM_S_DOWN = 0,       /* interface down */
+       UMBIM_S_OPEN,           /* UMBIM device has been opened */
+       UMBIM_S_RADIO,          /* radio is on */
+       UMBIM_S_SIMREADY,       /* SIM is ready */
+       UMBIM_S_ATTACHED,       /* packet service is attached */
+       UMBIM_S_CONNECTED,      /* connected to provider */
+       UMBIM_S_UP,             /* have IP configuration */
+};
+
+#define UMBIM_INTERNAL_STATE_DESCRIPTIONS {    \
+       { UMBIM_S_DOWN, "down" },               \
+       { UMBIM_S_OPEN, "open" },               \
+       { UMBIM_S_RADIO, "radio on" },          \
+       { UMBIM_S_SIMREADY, "SIM is ready" },   \
+       { UMBIM_S_ATTACHED, "attached" },       \
+       { UMBIM_S_CONNECTED, "connected" },     \
+       { UMBIM_S_UP, "up" },                   \
+       { 0, NULL } }
+
+/*
+ * UMBIM parameters (SIOC[GS]UMBIMPARAM ioctls)
+ */
+struct umbim_parameter {
+       int                     op;
+       int                     is_puk;
+       char                    pin[UMBIM_PIN_MAXLEN];
+       int                     pinlen;
+
+       char                    newpin[UMBIM_PIN_MAXLEN];
+       int                     newpinlen;
+
+#define UMBIM_APN_MAXLEN               100
+       uint16_t                apn[UMBIM_APN_MAXLEN];
+       int                     apnlen;
+
+       int                     roaming;
+       uint32_t                preferredclasses;
+};
+
+/*
+ * UMBIM device status info (SIOCGUMBIMINFO ioctl)
+ */
+struct umbim_info {
+       enum umbim_state        state;
+       int                     enable_roaming;
+#define UMBIM_PIN_REQUIRED     0
+#define UMBIM_PIN_UNLOCKED     1
+#define UMBIM_PUK_REQUIRED     2
+       int                     pin_state;
+       int                     pin_attempts_left;
+       int                     activation;
+       int                     sim_state;
+       int                     regstate;
+       int                     regmode;
+       int                     nwerror;
+       int                     packetstate;
+       uint32_t                supportedclasses; /* what the hw supports */
+       uint32_t                preferredclasses; /* what the user prefers */
+       uint32_t                highestclass;   /* what the network offers */
+       uint32_t                cellclass;
+#define UMBIM_PROVIDERNAME_MAXLEN      20
+       uint16_t                provider[UMBIM_PROVIDERNAME_MAXLEN];
+#define UMBIM_PHONENR_MAXLEN           22
+       uint16_t                pn[UMBIM_PHONENR_MAXLEN];
+#define UMBIM_SUBSCRIBERID_MAXLEN      15
+       uint16_t                sid[UMBIM_SUBSCRIBERID_MAXLEN];
+#define UMBIM_ICCID_MAXLEN             20
+       uint16_t                iccid[UMBIM_ICCID_MAXLEN];
+#define UMBIM_ROAMINGTEXT_MAXLEN       63
+       uint16_t                roamingtxt[UMBIM_ROAMINGTEXT_MAXLEN];
+
+#define UMBIM_DEVID_MAXLEN             18
+       uint16_t                devid[UMBIM_DEVID_MAXLEN];
+#define UMBIM_FWINFO_MAXLEN            30
+       uint16_t                fwinfo[UMBIM_FWINFO_MAXLEN];
+#define UMBIM_HWINFO_MAXLEN            30
+       uint16_t                hwinfo[UMBIM_HWINFO_MAXLEN];
+
+       uint16_t                apn[UMBIM_APN_MAXLEN];
+       int                     apnlen;
+
+#define UMBIM_VALUE_UNKNOWN    -999
+       int                     rssi;
+#define UMBIM_BER_EXCELLENT    0
+#define UMBIM_BER_VERYGOOD     1
+#define UMBIM_BER_GOOD         2
+#define UMBIM_BER_OK           3
+#define UMBIM_BER_MEDIUM       4
+#define UMBIM_BER_BAD          5
+#define UMBIM_BER_VERYBAD      6
+#define UMBIM_BER_EXTREMELYBAD 7
+       int                     ber;
+
+       int                     hw_radio_on;
+       int                     sw_radio_on;
+
+       uint64_t                uplink_speed;
+       uint64_t                downlink_speed;
+
+#define UMBIM_MAX_DNSSRV               2
+       u_int32_t               ipv4dns[UMBIM_MAX_DNSSRV];
+};
+
+#ifdef _KERNEL
+/*
+ * UMBIM device
+ */
+struct umbim_softc {
+       struct device            sc_dev;
+       struct ifnet             sc_if;
+#define GET_IFP(sc)    (&(sc)->sc_if)
+       struct usbd_device      *sc_udev;
+
+       int                      sc_ver_maj;
+       int                      sc_ver_min;
+       int                      sc_ctrl_len;
+       int                      sc_maxpktlen;
+       int                      sc_maxsessions;
+
+       struct usb_task          sc_umbim_task;
+       struct usb_task          sc_get_response_task;
+       int                      sc_nresp;
+       struct timeout           sc_statechg_timer;
+
+       uint8_t                  sc_ctrl_ifaceno;
+       struct usbd_pipe        *sc_ctrl_pipe;
+       struct usb_cdc_notification sc_intr_msg;
+       struct usbd_interface   *sc_data_iface;
+
+       void                    *sc_resp_buf;
+       void                    *sc_ctrl_msg;
+
+       int                      sc_rx_ep;
+       struct usbd_xfer        *sc_rx_xfer;
+       void                    *sc_rx_buf;
+       struct usbd_pipe        *sc_rx_pipe;
+       unsigned                 sc_rx_nerr;
+
+       int                      sc_tx_ep;
+       struct usbd_xfer        *sc_tx_xfer;
+       void                    *sc_tx_buf;
+       struct usbd_pipe        *sc_tx_pipe;
+       struct mbuf             *sc_tx_m;
+       uint32_t                 sc_tx_seq;
+
+       uint32_t                 sc_tid;
+
+#define UMBIM_IFADDR_NONE      ((void *)-1)
+       void                    *sc_saved_ifaddr;
+
+#define sc_state               sc_info.state
+#define sc_roaming             sc_info.enable_roaming
+       struct umbim_info        sc_info;
+};
+#endif /* _KERNEL */
Index: sys/dev/usb/uhub.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/uhub.c,v
retrieving revision 1.88
diff -u -p -u -p -r1.88 uhub.c
--- sys/dev/usb/uhub.c  29 Nov 2015 16:30:48 -0000      1.88
+++ sys/dev/usb/uhub.c  1 Jun 2016 14:32:19 -0000
@@ -523,7 +523,9 @@ uhub_port_connect(struct uhub_softc *sc,
 {
        struct usbd_port *up = &sc->sc_hub->hub->ports[port-1];
        int speed;
+       int retry = 1;
 
+again:
        /* We have a connect status change, handle it. */
        usbd_clear_port_feature(sc->sc_hub, port, UHF_C_PORT_CONNECTION);
 
@@ -613,6 +615,11 @@ uhub_port_connect(struct uhub_softc *sc,
                 * some other serious problem.  Since we cannot leave
                 * at 0 we have to disable the port instead.
                 */
+               if (retry--) {
+                       printf("%s: port %d: retrying\n", DEVNAME(sc), port);
+                       goto again;
+               }
+
                printf("%s: device problem, disabling port %d\n", DEVNAME(sc),
                    port);
                usbd_clear_port_feature(sc->sc_hub, port, UHF_PORT_ENABLE);
Index: sys/dev/usb/umbim.h
===================================================================
RCS file: sys/dev/usb/umbim.h
diff -N sys/dev/usb/umbim.h
--- /dev/null   1 Jan 1970 00:00:00 -0000
+++ sys/dev/usb/umbim.h 1 Jun 2016 14:32:19 -0000
@@ -0,0 +1,670 @@
+/*     $OpenBSD$ */
+
+/*
+ * Copyright (c) 2016 genua mbH
+ * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Mobile Broadband Interface Model
+ * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
+ */
+#ifndef _UMBIM_H_
+#define _UMBIM_H_
+
+#define UDESCSUB_UMBIM                 27
+#define UMBIM_INTERFACE_ALTSETTING     1
+
+#define UMBIM_RESET_FUNCTION           0x05
+
+/*
+ * Registration state (UMBIM_REGISTER_STATE)
+ */
+#define UMBIM_REGSTATE_UNKNOWN                 0
+#define UMBIM_REGSTATE_DEREGISTERED            1
+#define UMBIM_REGSTATE_SEARCHING               2
+#define UMBIM_REGSTATE_HOME                    3
+#define UMBIM_REGSTATE_ROAMING                 4
+#define UMBIM_REGSTATE_PARTNER                 5
+#define UMBIM_REGSTATE_DENIED                  6
+
+/*
+ * Data classes mask (UMBIM_DATA_CLASS)
+ */
+#define UMBIM_DATACLASS_NONE                   0x00000000
+#define UMBIM_DATACLASS_GPRS                   0x00000001
+#define UMBIM_DATACLASS_EDGE                   0x00000002
+#define UMBIM_DATACLASS_UMTS                   0x00000004
+#define UMBIM_DATACLASS_HSDPA                  0x00000008
+#define UMBIM_DATACLASS_HSUPA                  0x00000010
+#define UMBIM_DATACLASS_LTE                    0x00000020
+#define UMBIM_DATACLASS_1XRTT                  0x00010000
+#define UMBIM_DATACLASS_1XEVDO                 0x00020000
+#define UMBIM_DATACLASS_1XEVDO_REV_A           0x00040000
+#define UMBIM_DATACLASS_1XEVDV                 0x00080000
+#define UMBIM_DATACLASS_3XRTT                  0x00100000
+#define UMBIM_DATACLASS_1XEVDO_REV_B           0x00200000
+#define UMBIM_DATACLASS_UMB                    0x00400000
+#define UMBIM_DATACLASS_CUSTOM                 0x80000000
+
+/*
+ * Cell classes mask (UMBIM_CELLULAR_CLASS)
+ */
+#define UMBIM_CELLCLASS_GSM                    0x00000001
+#define UMBIM_CELLCLASS_CDMA                   0x00000002
+
+/*
+ * UUIDs
+ */
+#define UMBIM_UUID_LEN         16
+
+#define UMBIM_UUID_BASIC_CONNECT {                             \
+               0xa2, 0x89, 0xcc, 0x33, 0xbc, 0xbb, 0x8b, 0x4f, \
+               0xb6, 0xb0, 0x13, 0x3e, 0xc2, 0xaa, 0xe6, 0xdf  \
+       }
+
+#define UMBIM_UUID_CONTEXT_INTERNET {                          \
+               0x7e, 0x5e, 0x2a, 0x7e, 0x4e, 0x6f, 0x72, 0x72, \
+               0x73, 0x6b, 0x65, 0x6e, 0x7e, 0x5e, 0x2a, 0x7e  \
+       }
+
+#define UMBIM_UUID_CONTEXT_VPN {                               \
+               0x9b, 0x9f, 0x7b, 0xbe, 0x89, 0x52, 0x44, 0xb7, \
+               0x83, 0xac, 0xca, 0x41, 0x31, 0x8d, 0xf7, 0xa0  \
+       }
+
+#define UMBIM_CTRLMSG_MINLEN           64
+#define UMBIM_CTRLMSG_MAXLEN           (4 * 1204)
+
+#define UMBIM_MAXSEGSZ_MINVAL          (2 * 1024)
+
+/*
+ * Control messages (host to function)
+ */
+#define UMBIM_OPEN_MSG                 1U
+#define UMBIM_CLOSE_MSG                        2U
+#define UMBIM_COMMAND_MSG              3U
+#define UMBIM_HOST_ERROR_MSG           4U
+
+/*
+ * Control messages (function to host)
+ */
+#define UMBIM_OPEN_DONE                        0x80000001U
+#define UMBIM_CLOSE_DONE               0x80000002U
+#define UMBIM_COMMAND_DONE             0x80000003U
+#define UMBIM_FUNCTION_ERROR_MSG       0x80000004U
+#define UMBIM_INDICATE_STATUS_MSG      0x80000007U
+
+/*
+ * Generic status codes
+ */
+#define UMBIM_STATUS_SUCCESS                   0
+#define UMBIM_STATUS_BUSY                      1
+#define UMBIM_STATUS_FAILURE                   2
+#define UMBIM_STATUS_SIM_NOT_INSERTED          3
+#define UMBIM_STATUS_BAD_SIM                   4
+#define UMBIM_STATUS_PIN_REQUIRED              5
+#define UMBIM_STATUS_PIN_DISABLED              6
+#define UMBIM_STATUS_NOT_REGISTERED            7
+#define UMBIM_STATUS_PROVIDERS_NOT_FOUND       8
+#define UMBIM_STATUS_NO_DEVICE_SUPPORT         9
+#define UMBIM_STATUS_PROVIDER_NOT_VISIBLE      10
+#define UMBIM_STATUS_DATA_CLASS_NOT_AVAILABLE  11
+#define UMBIM_STATUS_PACKET_SERVICE_DETACHED   12
+#define UMBIM_STATUS_MAX_ACTIVATED_CONTEXTS    13
+#define UMBIM_STATUS_NOT_INITIALIZED           14
+#define UMBIM_STATUS_VOICE_CALL_IN_PROGRESS    15
+#define UMBIM_STATUS_CONTEXT_NOT_ACTIVATED     16
+#define UMBIM_STATUS_SERVICE_NOT_ACTIVATED     17
+#define UMBIM_STATUS_INVALID_ACCESS_STRING     18
+#define UMBIM_STATUS_INVALID_USER_NAME_PWD     19
+#define UMBIM_STATUS_RADIO_POWER_OFF           20
+#define UMBIM_STATUS_INVALID_PARAMETERS                21
+#define UMBIM_STATUS_READ_FAILURE              22
+#define UMBIM_STATUS_WRITE_FAILURE             23
+#define UMBIM_STATUS_NO_PHONEBOOK              25
+#define UMBIM_STATUS_PARAMETER_TOO_LONG                26
+#define UMBIM_STATUS_STK_BUSY                  27
+#define UMBIM_STATUS_OPERATION_NOT_ALLOWED     28
+#define UMBIM_STATUS_MEMORY_FAILURE            29
+#define UMBIM_STATUS_INVALID_MEMORY_INDEX      30
+#define UMBIM_STATUS_MEMORY_FULL               31
+#define UMBIM_STATUS_FILTER_NOT_SUPPORTED      32
+#define UMBIM_STATUS_DSS_INSTANCE_LIMIT                33
+#define UMBIM_STATUS_INVALID_DEVICE_SERVICE_OPERATION  34
+#define UMBIM_STATUS_AUTH_INCORRECT_AUTN       35
+#define UMBIM_STATUS_AUTH_SYNC_FAILURE         36
+#define UMBIM_STATUS_AUTH_AMF_NOT_SET          37
+#define UMBIM_STATUS_CONTEXT_NOT_SUPPORTED     38
+#define UMBIM_STATUS_SMS_UNKNOWN_SMSC_ADDRESS  100
+#define UMBIM_STATUS_SMS_NETWORK_TIMEOUT       101
+#define UMBIM_STATUS_SMS_LANG_NOT_SUPPORTED    102
+#define UMBIM_STATUS_SMS_ENCODING_NOT_SUPPORTED        103
+#define UMBIM_STATUS_SMS_FORMAT_NOT_SUPPORTED  104
+
+/*
+ * Message formats
+ */
+struct umbim_msghdr {
+       /* Msg header */
+       uint32_t        type;           /* message type */
+       uint32_t        len;            /* message length */
+       uint32_t        tid;            /* transaction id */
+} __packed;
+
+struct umbim_fraghdr {
+       uint32_t        nfrag;          /* total # of fragments */
+       uint32_t        currfrag;       /* current fragment */
+} __packed;
+
+struct umbim_fragmented_msg_hdr {
+       struct umbim_msghdr     hdr;
+       struct umbim_fraghdr    frag;
+} __packed;
+
+struct umbim_h2f_openmsg {
+       struct umbim_msghdr     hdr;
+       uint32_t                maxlen;
+} __packed;
+
+struct umbim_h2f_closemsg {
+       struct umbim_msghdr     hdr;
+} __packed;
+
+struct umbim_h2f_cmd {
+       struct umbim_msghdr     hdr;
+       struct umbim_fraghdr    frag;
+       uint8_t                 devid[UMBIM_UUID_LEN];
+       uint32_t                cid;            /* command id */
+#define UMBIM_CMDOP_QRY                0
+#define UMBIM_CMDOP_SET                1
+       uint32_t                op;
+       uint32_t                infolen;
+       uint8_t                 info[];
+} __packed;
+
+struct umbim_f2h_indicate_status {
+       struct umbim_msghdr     hdr;
+       struct umbim_fraghdr    frag;
+       uint8_t                 devid[UMBIM_UUID_LEN];
+       uint32_t                cid;            /* command id */
+       uint32_t                infolen;
+       uint8_t                 info[];
+} __packed;
+
+struct umbim_f2h_hosterr {
+       struct umbim_msghdr     hdr;
+
+#define UMBIM_ERROR_TIMEOUT_FRAGMENT           1
+#define UMBIM_ERROR_FRAGMENT_OUT_OF_SEQUENCE   2
+#define UMBIM_ERROR_LENGTH_MISMATCH            3
+#define UMBIM_ERROR_DUPLICATED_TID             4
+#define UMBIM_ERROR_NOT_OPENED                 5
+#define UMBIM_ERROR_UNKNOWN                    6
+#define UMBIM_ERROR_CANCEL                     7
+#define UMBIM_ERROR_MAX_TRANSFER               8
+       uint32_t                err;
+} __packed;
+
+struct umbim_f2h_openclosedone {
+       struct umbim_msghdr     hdr;
+       int32_t                 status;
+} __packed;
+
+struct umbim_f2h_cmddone {
+       struct umbim_msghdr     hdr;
+       struct umbim_fraghdr    frag;
+       uint8_t                 devid[UMBIM_UUID_LEN];
+       uint32_t                cid;            /* command id */
+       int32_t                 status;
+       uint32_t                infolen;
+       uint8_t                 info[];
+} __packed;
+
+/*
+ * Messages and commands for UMBIM_UUID_BASIC_CONNECT
+ */
+#define UMBIM_CID_DEVICE_CAPS                          1
+#define UMBIM_CID_SUBSCRIBER_READY_STATUS              2
+#define UMBIM_CID_RADIO_STATE                          3
+#define UMBIM_CID_PIN                                  4
+#define UMBIM_CID_PIN_LIST                             5
+#define UMBIM_CID_HOME_PROVIDER                                6
+#define UMBIM_CID_PREFERRED_PROVIDERS                  7
+#define UMBIM_CID_VISIBLE_PROVIDERS                    8
+#define UMBIM_CID_REGISTER_STATE                       9
+#define UMBIM_CID_PACKET_SERVICE                       10
+#define UMBIM_CID_SIGNAL_STATE                         11
+#define UMBIM_CID_CONNECT                              12
+#define UMBIM_CID_PROVISIONED_CONTEXTS                 13
+#define UMBIM_CID_SERVICE_ACTIVATION                   14
+#define UMBIM_CID_IP_CONFIGURATION                     15
+#define UMBIM_CID_DEVICE_SERVICES                      16
+#define UMBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST                19
+#define UMBIM_CID_PACKET_STATISTICS                    20
+#define UMBIM_CID_NETWORK_IDLE_HINT                    21
+#define UMBIM_CID_EMERGENCY_MODE                       22
+#define UMBIM_CID_IP_PACKET_FILTERS                    23
+#define UMBIM_CID_MULTICARRIER_PROVIDERS               24
+
+struct umbim_cid_subscriber_ready_info {
+#define UMBIM_SIMSTATE_NOTINITIALIZED          0
+#define UMBIM_SIMSTATE_INITIALIZED             1
+#define UMBIM_SIMSTATE_NOTINSERTED             2
+#define UMBIM_SIMSTATE_BADSIM                  3
+#define UMBIM_SIMSTATE_FAILURE                 4
+#define UMBIM_SIMSTATE_NOTACTIVATED            5
+#define UMBIM_SIMSTATE_LOCKED                  6
+       uint32_t        ready;
+
+       uint32_t        sid_offs;
+       uint32_t        sid_size;
+
+       uint32_t        icc_offs;
+       uint32_t        icc_size;
+
+#define UMBIM_SIMUNIQEID_NONE                  0
+#define UMBIM_SIMUNIQEID_PROTECT               1
+       uint32_t        info;
+
+       uint32_t        no_pn;
+       struct {
+               uint32_t        offs;
+               uint32_t        size;
+       }
+                       pn[];
+} __packed;
+
+struct umbim_cid_radio_state {
+#define UMBIM_RADIO_STATE_OFF                  0
+#define UMBIM_RADIO_STATE_ON                   1
+       uint32_t        state;
+} __packed;
+
+struct umbim_cid_radio_state_info {
+       uint32_t        hw_state;
+       uint32_t        sw_state;
+} __packed;
+
+struct umbim_cid_pin {
+#define UMBIM_PIN_TYPE_NONE                    0
+#define UMBIM_PIN_TYPE_CUSTOM                  1
+#define UMBIM_PIN_TYPE_PIN1                    2
+#define UMBIM_PIN_TYPE_PIN2                    3
+#define UMBIM_PIN_TYPE_DEV_SIM_PIN             4
+#define UMBIM_PIN_TYPE_DEV_FIRST_SIM_PIN       5
+#define UMBIM_PIN_TYPE_NETWORK_PIN             6
+#define UMBIM_PIN_TYPE_NETWORK_SUBSET_PIN      7
+#define UMBIM_PIN_TYPE_SERVICE_PROVIDER_PIN    8
+#define UMBIM_PIN_TYPE_CORPORATE_PIN           9
+#define UMBIM_PIN_TYPE_SUBSIDY_LOCK            10
+#define UMBIM_PIN_TYPE_PUK1                    11
+#define UMBIM_PIN_TYPE_PUK2                    12
+#define UMBIM_PIN_TYPE_DEV_FIRST_SIM_PUK       13
+#define UMBIM_PIN_TYPE_NETWORK_PUK             14
+#define UMBIM_PIN_TYPE_NETWORK_SUBSET_PUK      15
+#define UMBIM_PIN_TYPE_SERVICE_PROVIDER_PUK    16
+#define UMBIM_PIN_TYPE_CORPORATE_PUK           17
+       uint32_t        type;
+
+#define UMBIM_PIN_OP_ENTER                     0
+#define UMBIM_PIN_OP_ENABLE                    1
+#define UMBIM_PIN_OP_DISABLE                   2
+#define UMBIM_PIN_OP_CHANGE                    3
+       uint32_t        op;
+       uint32_t        pin_offs;
+       uint32_t        pin_size;
+       uint32_t        newpin_offs;
+       uint32_t        newpin_size;
+#define UMBIM_PIN_MAXLEN       32
+       uint8_t         data[2 * UMBIM_PIN_MAXLEN];
+} __packed;
+
+struct umbim_cid_pin_info {
+       uint32_t        type;
+
+#define UMBIM_PIN_STATE_UNLOCKED               0
+#define UMBIM_PIN_STATE_LOCKED                 1
+       uint32_t        state;
+       uint32_t        remaining_attempts;
+} __packed;
+
+struct umbim_cid_pin_list_info {
+       struct umbim_pin_desc {
+
+#define UMBIM_PINMODE_NOTSUPPORTED             0
+#define UMBIM_PINMODE_ENABLED                  1
+#define UMBIM_PINMODE_DISABLED                 2
+               uint32_t        mode;
+
+#define UMBIM_PINFORMAT_UNKNOWN                        0
+#define UMBIM_PINFORMAT_NUMERIC                        1
+#define UMBIM_PINFORMAT_ALPHANUMERIC           2
+               uint32_t        format;
+
+               uint32_t        minlen;
+               uint32_t        maxlen;
+       }
+               pin1,
+               pin2,
+               dev_sim_pin,
+               first_dev_sim_pin,
+               net_pin,
+               net_sub_pin,
+               svp_pin,
+               corp_pin,
+               subsidy_lock,
+               custom;
+} __packed;
+
+struct umbim_cid_device_caps {
+#define UMBIM_DEVTYPE_UNKNOWN                  0
+#define UMBIM_DEVTYPE_EMBEDDED                 1
+#define UMBIM_DEVTYPE_REMOVABLE                        2
+#define UMBIM_DEVTYPE_REMOTE                   3
+       uint32_t        devtype;
+
+       uint32_t        cellclass;      /* values: UMBIM_CELLULAR_CLASS */
+       uint32_t        voiceclass;
+       uint32_t        simclass;
+       uint32_t        dataclass;      /* values: UMBIM_DATA_CLASS */
+       uint32_t        smscaps;
+       uint32_t        cntrlcaps;
+       uint32_t        max_sessions;
+
+       uint32_t        custdataclass_offs;
+       uint32_t        custdataclass_size;
+
+       uint32_t        devid_offs;
+       uint32_t        devid_size;
+
+       uint32_t        fwinfo_offs;
+       uint32_t        fwinfo_size;
+
+       uint32_t        hwinfo_offs;
+       uint32_t        hwinfo_size;
+
+       uint32_t        data[];
+} __packed;
+
+struct umbim_cid_registration_state {
+       uint32_t        provid_offs;
+       uint32_t        provid_size;
+
+#define UMBIM_REGACTION_AUTOMATIC              0
+#define UMBIM_REGACTION_MANUAL                 1
+       uint32_t        regaction;
+       uint32_t        data_class;
+
+       uint32_t        data[];
+} __packed;
+
+struct umbim_cid_registration_state_info {
+       uint32_t        nwerror;
+
+       uint32_t        regstate;       /* values: UMBIM_REGISTER_STATE */
+
+#define UMBIM_REGMODE_UNKNOWN                  0
+#define UMBIM_REGMODE_AUTOMATIC                        1
+#define UMBIM_REGMODE_MANUAL                   2
+       uint32_t        regmode;
+
+       uint32_t        availclasses;   /* values: UMBIM_DATA_CLASS */
+       uint32_t        curcellclass;   /* values: UMBIM_CELLULAR_CLASS */
+
+       uint32_t        provid_offs;
+       uint32_t        provid_size;
+
+       uint32_t        provname_offs;
+       uint32_t        provname_size;
+
+       uint32_t        roamingtxt_offs;
+       uint32_t        roamingtxt_size;
+
+#define UMBIM_REGFLAGS_NONE                    0
+#define UMBIM_REGFLAGS_MANUAL_NOT_AVAILABLE    1
+#define UMBIM_REGFLAGS_PACKETSERVICE_AUTOATTACH        2
+       uint32_t        regflag;
+
+       uint32_t        data[];
+} __packed;
+
+struct umbim_cid_packet_service {
+#define UMBIM_PKTSERVICE_ACTION_ATTACH         0
+#define UMBIM_PKTSERVICE_ACTION_DETACH         1
+       uint32_t        action;
+} __packed;
+
+struct umbim_cid_packet_service_info {
+       uint32_t        nwerror;
+
+#define UMBIM_PKTSERVICE_STATE_UNKNOWN         0
+#define UMBIM_PKTSERVICE_STATE_ATTACHING       1
+#define UMBIM_PKTSERVICE_STATE_ATTACHED                2
+#define UMBIM_PKTSERVICE_STATE_DETACHING       3
+#define UMBIM_PKTSERVICE_STATE_DETACHED                4
+       uint32_t        state;
+
+       uint32_t        highest_dataclass;
+       uint64_t        uplink_speed;
+       uint64_t        downlink_speed;
+} __packed;
+
+struct umbim_cid_signal_state {
+       uint32_t        rssi;
+       uint32_t        err_rate;
+       uint32_t        ss_intvl;
+       uint32_t        rssi_thr;
+       uint32_t        err_thr;
+} __packed;
+
+struct umbim_cid_connect {
+       uint32_t        sessionid;
+
+#define UMBIM_CONNECT_DEACTIVATE       0
+#define UMBIM_CONNECT_ACTIVATE         1
+       uint32_t        command;
+
+#define UMBIM_ACCESS_MAXLEN            200
+       uint32_t        access_offs;
+       uint32_t        access_size;
+
+#define UMBIM_USER_MAXLEN              510
+       uint32_t        user_offs;
+       uint32_t        user_size;
+
+#define UMBIM_PASSWD_MAXLEN            510
+       uint32_t        passwd_offs;
+       uint32_t        passwd_size;
+
+#define UMBIM_COMPRESSION_NONE         0
+#define UMBIM_COMPRESSION_ENABLE       1
+       uint32_t        compression;
+
+#define UMBIM_AUTHPROT_NONE            0
+#define UMBIM_AUTHPROT_PAP             1
+#define UMBIM_AUTHPROT_CHAP            2
+#define UMBIM_AUTHPROT_MSCHAP          3
+       uint32_t        authprot;
+
+#define UMBIM_CONTEXT_IPTYPE_DEFAULT   0
+#define UMBIM_CONTEXT_IPTYPE_IPV4      1
+#define UMBIM_CONTEXT_IPTYPE_IPV6      2
+#define UMBIM_CONTEXT_IPTYPE_IPV4V6    3
+#define UMBIM_CONTEXT_IPTYPE_IPV4ANDV6 4
+       uint32_t        iptype;
+
+       uint8_t         context[UMBIM_UUID_LEN];
+
+       uint8_t         data[UMBIM_ACCESS_MAXLEN + UMBIM_USER_MAXLEN +
+                            UMBIM_PASSWD_MAXLEN];
+
+} __packed;
+
+struct umbim_cid_connect_info {
+       uint32_t        sessionid;
+
+#define UMBIM_ACTIVATION_STATE_UNKNOWN         0
+#define UMBIM_ACTIVATION_STATE_ACTIVATED       1
+#define UMBIM_ACTIVATION_STATE_ACTIVATING      2
+#define UMBIM_ACTIVATION_STATE_DEACTIVATED     3
+#define UMBIM_ACTIVATION_STATE_DEACTIVATING    4
+       uint32_t        activation;
+
+       uint32_t        voice;
+       uint32_t        iptype;
+       uint8_t         context[UMBIM_UUID_LEN];
+       uint32_t        nwerror;
+} __packed;
+
+struct umbim_cid_ipv4_element {
+       uint32_t        prefixlen;
+       uint32_t        addr;
+} __packed;
+
+struct umbim_cid_ipv6_element {
+       uint32_t        prefixlen;
+       uint8_t         addr[16];
+} __packed;
+
+struct umbim_cid_ip_configuration_info {
+       uint32_t        sessionid;
+
+#define UMBIM_IPCONF_HAS_ADDRINFO      0x0001
+#define UMBIM_IPCONF_HAS_GWINFO                0x0002
+#define UMBIM_IPCONF_HAS_DNSINFO       0x0004
+#define UMBIM_IPCONF_HAS_MTUINFO       0x0008
+       uint32_t        ipv4_available;
+       uint32_t        ipv6_available;
+
+       uint32_t        ipv4_naddr;
+       uint32_t        ipv4_addroffs;
+       uint32_t        ipv6_naddr;
+       uint32_t        ipv6_addroffs;
+
+       uint32_t        ipv4_gwoffs;
+       uint32_t        ipv6_gwoffs;
+
+       uint32_t        ipv4_ndnssrv;
+       uint32_t        ipv4_dnssrvoffs;
+       uint32_t        ipv6_ndnssrv;
+       uint32_t        ipv6_dnssrvoffs;
+
+       uint32_t        ipv4_mtu;
+       uint32_t        ipv6_mtu;
+
+       uint32_t        data[];
+} __packed;
+
+struct umbim_cid_packet_statistics_info {
+       uint32_t        in_discards;
+       uint32_t        in_errors;
+       uint64_t        in_octets;
+       uint64_t        in_packets;
+       uint64_t        out_octets;
+       uint64_t        out_packets;
+       uint32_t        out_errors;
+       uint32_t        out_discards;
+} __packed;
+
+
+#ifdef _KERNEL
+
+struct umbim_descriptor {
+       uByte   bLength;
+       uByte   bDescriptorType;
+       uByte   bDescriptorSubtype;
+#define UMBIM_VER_MAJOR(v)     (((v) >> 8) & 0x0f)
+#define UMBIM_VER_MINOR(v)     ((v) & 0x0f)
+       uWord   bcdMBIMVersion;
+       uWord   wMaxControlMessage;
+       uByte   bNumberFilters;
+       uByte   bMaxFilterSize;
+       uWord   wMaxSegmentSize;
+       uByte   bmNetworkCapabilities;
+} __packed;
+
+/*
+ * NCM Encoding
+ */
+#define UMBIM_HDR16_LEN                \
+       (sizeof (struct ncm_header16) + sizeof (struct ncm_pointer16))
+#define UMBIM_HDR32_LEN                \
+       (sizeof (struct ncm_header32) + sizeof (struct ncm_pointer32))
+
+struct ncm_header16 {
+#define NCM_HDR16_SIG          0x484d434e
+       uDWord  dwSignature;
+       uWord   wHeaderLength;
+       uWord   wSequence;
+       uWord   wBlockLength;
+       uWord   wNdpIndex;
+} __packed;
+
+struct ncm_header32 {
+#define NCM_HDR32_SIG          0x686d636e
+       uDWord  dwSignature;
+       uWord   wHeaderLength;
+       uWord   wSequence;
+       uDWord  dwBlockLength;
+       uDWord  dwNdpIndex;
+} __packed;
+
+
+#define UMBIM_NCM_NTH_SIDSHIFT 24
+#define UMBIM_NCM_NTH_GETSID(s)        (((s) > UMBIM_NCM_NTH_SIDSHIFT) & 0xff)
+
+struct ncm_pointer16_dgram {
+       uWord   wDatagramIndex;
+       uWord   wDatagramLen;
+} __packed;
+
+struct ncm_pointer16 {
+#define UMBIM_NCM_NTH16_IPS     0x00535049
+#define UMBIM_NCM_NTH16_ISISG(s) (((s) & 0x00ffffff) == UMBIM_NCM_NTH16_IPS)
+#define UMBIM_NCM_NTH16_SIG(s) \
+               ((((s) & 0xff) << UMBIM_NCM_NTH_SIDSHIFT) | UMBIM_NCM_NTH16_IPS)
+       uDWord  dwSignature;
+       uWord   wLength;
+       uWord   wNextNdpIndex;
+
+       /* Minimum is two datagrams, but can be more */
+       struct ncm_pointer16_dgram dgram[2];
+} __packed;
+
+struct ncm_pointer32_dgram {
+       uDWord  dwDatagramIndex;
+       uDWord  dwDatagramLen;
+} __packed;
+
+struct ncm_pointer32 {
+#define UMBIM_NCM_NTH32_IPS    0x00737069
+#define UMBIM_NCM_NTH32_ISISG(s)       \
+               (((s) & 0x00ffffff) == UMBIM_NCM_NTH32_IPS)
+#define UMBIM_NCM_NTH32_SIG(s)         \
+               ((((s) & 0xff) << UMBIM_NCM_NTH_SIDSHIFT) | UMBIM_NCM_NTH32_IPS)
+       uDWord  dwSignature;
+       uWord   wLength;
+       uWord   wReserved6;
+       uDWord  dwNextNdpIndex;
+       uDWord  dwReserved12;
+
+       /* Minimum is two datagrams, but can be more */
+       struct ncm_pointer32_dgram dgram[2];
+} __packed;
+
+#endif /* _KERNEL */
+
+#endif /* _UMBIM_H_ */
Index: sys/dev/usb/usb.h
===================================================================
RCS file: /cvs/src/sys/dev/usb/usb.h,v
retrieving revision 1.55
diff -u -p -u -p -r1.55 usb.h
--- sys/dev/usb/usb.h   24 May 2016 05:35:01 -0000      1.55
+++ sys/dev/usb/usb.h   1 Jun 2016 14:32:19 -0000
@@ -508,6 +508,7 @@ typedef struct usb_port_status usb_port_
 #define         UISUBCLASS_ETHERNET_NETWORKING_CONTROL_MODEL 6
 #define         UISUBCLASS_ATM_NETWORKING_CONTROL_MODEL 7
 #define         UISUBCLASS_MOBILE_DIRECT_LINE_MODEL    10
+#define         UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL 14
 #define   UIPROTO_CDC_AT                       1
 
 #define UICLASS_HID            0x03
@@ -545,6 +546,7 @@ typedef struct usb_port_status usb_port_
 
 #define UICLASS_CDC_DATA       0x0a
 #define  UISUBCLASS_DATA               0
+#define   UIPROTO_DATA_MBIM            0x02    /* MBIM */
 #define   UIPROTO_DATA_ISDNBRI         0x30    /* Physical iface */
 #define   UIPROTO_DATA_HDLC            0x31    /* HDLC */
 #define   UIPROTO_DATA_TRANSPARENT     0x32    /* Transparent */
Index: sys/net/if_types.h
===================================================================
RCS file: /cvs/src/sys/net/if_types.h,v
retrieving revision 1.20
diff -u -p -u -p -r1.20 if_types.h
--- sys/net/if_types.h  7 Mar 2016 19:33:26 -0000       1.20
+++ sys/net/if_types.h  1 Jun 2016 14:32:19 -0000
@@ -268,5 +268,6 @@
 #define        IFT_CARP        0xf7            /* Common Address Redundancy 
Protocol */
 #define IFT_BLUETOOTH  0xf8            /* Bluetooth */
 #define IFT_PFLOW      0xf9            /* pflow */
+#define IFT_MBIM       0xfa            /* Mobile Broadband Interface Model */
 
 #endif /* _NET_IF_TYPES_H_ */
Index: sys/netinet/in.c
===================================================================
RCS file: /cvs/src/sys/netinet/in.c,v
retrieving revision 1.127
diff -u -p -u -p -r1.127 in.c
--- sys/netinet/in.c    18 Apr 2016 06:43:51 -0000      1.127
+++ sys/netinet/in.c    1 Jun 2016 14:32:19 -0000
@@ -83,9 +83,7 @@
 
 
 void in_socktrim(struct sockaddr_in *);
-void in_len2mask(struct in_addr *, int);
-int in_lifaddr_ioctl(struct socket *, u_long, caddr_t,
-       struct ifnet *);
+int in_lifaddr_ioctl(u_long, caddr_t, struct ifnet *, int);
 
 void in_purgeaddr(struct ifaddr *);
 int in_addhost(struct in_ifaddr *, struct sockaddr_in *);
@@ -172,14 +170,11 @@ in_len2mask(struct in_addr *mask, int le
 int
 in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp)
 {
-       struct ifreq *ifr = (struct ifreq *)data;
-       struct ifaddr *ifa;
-       struct in_ifaddr *ia = NULL;
-       struct in_aliasreq *ifra = (struct in_aliasreq *)data;
-       struct sockaddr_in oldaddr;
-       int error;
-       int newifaddr;
-       int s;
+       int privileged;
+
+       privileged = 0;
+       if ((so->so_state & SS_PRIV) != 0)
+               privileged++;
 
        switch (cmd) {
 #ifdef MROUTING
@@ -189,18 +184,33 @@ in_control(struct socket *so, u_long cmd
 #endif /* MROUTING */
        case SIOCALIFADDR:
        case SIOCDLIFADDR:
-               if ((so->so_state & SS_PRIV) == 0)
+               if (!privileged)
                        return (EPERM);
                /* FALLTHROUGH */
        case SIOCGLIFADDR:
                if (ifp == NULL)
                        return (EINVAL);
-               return in_lifaddr_ioctl(so, cmd, data, ifp);
+               return in_lifaddr_ioctl(cmd, data, ifp, privileged);
        default:
                if (ifp == NULL)
                        return (EOPNOTSUPP);
        }
 
+       return (in_ioctl(cmd, data, ifp, privileged));
+}
+
+int
+in_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
+{
+       struct ifreq *ifr = (struct ifreq *)data;
+       struct ifaddr *ifa;
+       struct in_ifaddr *ia = NULL;
+       struct in_aliasreq *ifra = (struct in_aliasreq *)data;
+       struct sockaddr_in oldaddr;
+       int error;
+       int newifaddr;
+       int s;
+
        TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
                if (ifa->ifa_addr->sa_family == AF_INET) {
                        ia = ifatoia(ifa);
@@ -225,7 +235,7 @@ in_control(struct socket *so, u_long cmd
                        return (EADDRNOTAVAIL);
                /* FALLTHROUGH */
        case SIOCSIFADDR:
-               if ((so->so_state & SS_PRIV) == 0)
+               if (!privileged)
                        return (EPERM);
 
                if (ia == NULL) {
@@ -250,7 +260,7 @@ in_control(struct socket *so, u_long cmd
        case SIOCSIFNETMASK:
        case SIOCSIFDSTADDR:
        case SIOCSIFBRDADDR:
-               if ((so->so_state & SS_PRIV) == 0)
+               if (!privileged)
                        return (EPERM);
                /* FALLTHROUGH */
 
@@ -410,8 +420,7 @@ in_control(struct socket *so, u_long cmd
  *     other values may be returned from in_ioctl()
  */
 int
-in_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data,
-    struct ifnet *ifp)
+in_lifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
 {
        struct if_laddrreq *iflr = (struct if_laddrreq *)data;
        struct ifaddr *ifa;
@@ -481,7 +490,7 @@ in_lifaddr_ioctl(struct socket *so, u_lo
                ifra.ifra_mask.sin_len = sizeof(struct sockaddr_in);
                in_len2mask(&ifra.ifra_mask.sin_addr, iflr->prefixlen);
 
-               return in_control(so, SIOCAIFADDR, (caddr_t)&ifra, ifp);
+               return in_ioctl(SIOCAIFADDR, (caddr_t)&ifra, ifp, privileged);
            }
        case SIOCGLIFADDR:
        case SIOCDLIFADDR:
@@ -566,7 +575,8 @@ in_lifaddr_ioctl(struct socket *so, u_lo
                        memcpy(&ifra.ifra_dstaddr, &ia->ia_sockmask,
                            ia->ia_sockmask.sin_len);
 
-                       return in_control(so, SIOCDIFADDR, (caddr_t)&ifra, ifp);
+                       return in_ioctl(SIOCDIFADDR, (caddr_t)&ifra, ifp,
+                           privileged);
                }
            }
        }
Index: sys/netinet/in.h
===================================================================
RCS file: /cvs/src/sys/netinet/in.h,v
retrieving revision 1.115
diff -u -p -u -p -r1.115 in.h
--- sys/netinet/in.h    20 Oct 2015 20:22:42 -0000      1.115
+++ sys/netinet/in.h    1 Jun 2016 14:32:19 -0000
@@ -791,6 +791,7 @@ extern         struct in_addr zeroin_addr;
 
 struct mbuf;
 
+void      in_purgeaddr(struct ifaddr *);
 int       in_broadcast(struct in_addr, u_int);
 int       in_canforward(struct in_addr);
 int       in_cksum(struct mbuf *, int);
@@ -798,6 +799,7 @@ int    in4_cksum(struct mbuf *, u_int8_t
 void      in_proto_cksum_out(struct mbuf *, struct ifnet *);
 void      in_ifdetach(struct ifnet *);
 int       in_mask2len(struct in_addr *);
+void      in_len2mask(struct in_addr *, int);
 
 char     *inet_ntoa(struct in_addr);
 int       inet_nat64(int, const void *, void *, const void *, u_int8_t);
Index: sys/netinet/in_var.h
===================================================================
RCS file: /cvs/src/sys/netinet/in_var.h,v
retrieving revision 1.38
diff -u -p -u -p -r1.38 in_var.h
--- sys/netinet/in_var.h        21 Jan 2016 11:23:48 -0000      1.38
+++ sys/netinet/in_var.h        1 Jun 2016 14:32:19 -0000
@@ -157,6 +157,7 @@ void        in_delmulti(struct in_multi *);
 int    in_hasmulti(struct in_addr *, struct ifnet *);
 void   in_ifscrub(struct ifnet *, struct in_ifaddr *);
 int    in_control(struct socket *, u_long, caddr_t, struct ifnet *);
+int    in_ioctl(u_long, caddr_t, struct ifnet *, int);
 void   in_prefixlen2mask(struct in_addr *, int);
 #endif
 
Index: sys/netinet6/in6.c
===================================================================
RCS file: /cvs/src/sys/netinet6/in6.c,v
retrieving revision 1.186
diff -u -p -u -p -r1.186 in6.c
--- sys/netinet6/in6.c  3 Mar 2016 12:57:15 -0000       1.186
+++ sys/netinet6/in6.c  1 Jun 2016 14:32:19 -0000
@@ -118,7 +118,8 @@ const struct in6_addr in6mask64 = IN6MAS
 const struct in6_addr in6mask96 = IN6MASK96;
 const struct in6_addr in6mask128 = IN6MASK128;
 
-int in6_lifaddr_ioctl(struct socket *, u_long, caddr_t, struct ifnet *);
+int in6_lifaddr_ioctl(u_long, caddr_t, struct ifnet *, int);
+int in6_ioctl(u_long, caddr_t, struct ifnet *, int);
 int in6_ifinit(struct ifnet *, struct in6_ifaddr *, int);
 void in6_unlink_ifa(struct in6_ifaddr *, struct ifnet *);
 
@@ -165,11 +166,7 @@ in6_mask2len(struct in6_addr *mask, u_ch
 int
 in6_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp)
 {
-       struct  in6_ifreq *ifr = (struct in6_ifreq *)data;
-       struct  in6_ifaddr *ia6 = NULL;
-       struct  in6_aliasreq *ifra = (struct in6_aliasreq *)data;
-       struct sockaddr_in6 *sa6;
-       int s, privileged;
+       int privileged;
 
        privileged = 0;
        if ((so->so_state & SS_PRIV) != 0)
@@ -183,6 +180,18 @@ in6_control(struct socket *so, u_long cm
        }
 #endif
 
+       return (in6_ioctl(cmd, data, ifp, privileged));
+}
+
+int
+in6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
+{
+       struct  in6_ifreq *ifr = (struct in6_ifreq *)data;
+       struct  in6_ifaddr *ia6 = NULL;
+       struct  in6_aliasreq *ifra = (struct in6_aliasreq *)data;
+       struct sockaddr_in6 *sa6;
+       int s;
+
        if (ifp == NULL)
                return (EOPNOTSUPP);
 
@@ -206,7 +215,7 @@ in6_control(struct socket *so, u_long cm
                        return (EPERM);
                /* FALLTHROUGH */
        case SIOCGLIFADDR:
-               return in6_lifaddr_ioctl(so, cmd, data, ifp);
+               return in6_lifaddr_ioctl(cmd, data, ifp, privileged);
        }
 
        /*
@@ -939,8 +948,7 @@ in6_unlink_ifa(struct in6_ifaddr *ia6, s
  * address encoding scheme. (see figure on page 8)
  */
 int
-in6_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data,
-    struct ifnet *ifp)
+in6_lifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
 {
        struct if_laddrreq *iflr = (struct if_laddrreq *)data;
        struct ifaddr *ifa;
@@ -1047,7 +1055,8 @@ in6_lifaddr_ioctl(struct socket *so, u_l
                in6_prefixlen2mask(&ifra.ifra_prefixmask.sin6_addr, prefixlen);
 
                ifra.ifra_flags = iflr->flags & ~IFLR_PREFIX;
-               return in6_control(so, SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp);
+               return in6_ioctl(SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp,
+                   privileged);
            }
        case SIOCGLIFADDR:
        case SIOCDLIFADDR:
@@ -1142,8 +1151,8 @@ in6_lifaddr_ioctl(struct socket *so, u_l
                            ia6->ia_prefixmask.sin6_len);
 
                        ifra.ifra_flags = ia6->ia6_flags;
-                       return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
-                           ifp);
+                       return in6_ioctl(SIOCDIFADDR_IN6, (caddr_t)&ifra, ifp,
+                           privileged);
                }
            }
        }
Index: sys/netinet6/in6_var.h
===================================================================
RCS file: /cvs/src/sys/netinet6/in6_var.h,v
retrieving revision 1.62
diff -u -p -u -p -r1.62 in6_var.h
--- sys/netinet6/in6_var.h      3 Mar 2016 12:57:15 -0000       1.62
+++ sys/netinet6/in6_var.h      1 Jun 2016 14:32:19 -0000
@@ -394,6 +394,7 @@ int in6_hasmulti(struct in6_addr *, stru
 struct in6_multi_mship *in6_joingroup(struct ifnet *, struct in6_addr *, int 
*);
 int    in6_leavegroup(struct in6_multi_mship *);
 int    in6_control(struct socket *, u_long, caddr_t, struct ifnet *);
+int    in6_ioctl(u_long, caddr_t, struct ifnet *, int);
 int    in6_update_ifa(struct ifnet *, struct in6_aliasreq *,
        struct in6_ifaddr *);
 void   in6_purgeaddr(struct ifaddr *);
Index: sys/sys/sockio.h
===================================================================
RCS file: /cvs/src/sys/sys/sockio.h,v
retrieving revision 1.64
diff -u -p -u -p -r1.64 sockio.h
--- sys/sys/sockio.h    31 May 2016 22:35:02 -0000      1.64
+++ sys/sys/sockio.h    1 Jun 2016 14:32:19 -0000
@@ -202,6 +202,10 @@
 #define SIOCGIFPARENT  _IOWR('i', 179, struct if_parent) /* get parent if */
 #define SIOCDIFPARENT  _IOW('i', 180, struct ifreq)    /* del parent if */
 
+#define        SIOCGUMBIMINFO  _IOWR('i', 190, struct ifreq)   /* get UMBIM 
info */
+#define        SIOCSUMBIMPARAM  _IOW('i', 191, struct ifreq)   /* set UMBIM 
param */
+#define        SIOCGUMBIMPARAM _IOWR('i', 192, struct ifreq)   /* get UMBIM 
param */
+
 #define        SIOCSVH         _IOWR('i', 245, struct ifreq)   /* set carp 
param */
 #define        SIOCGVH         _IOWR('i', 246, struct ifreq)   /* get carp 
param */
 


Reply via email to