On 01/06/16(Wed) 17:20, Gerhard Roth wrote:
> [...] 
> Thanks for all the feedback.

More comments inline.

> Index: sbin/ifconfig/ifconfig.c
> ===================================================================
> RCS file: /cvs/src/sbin/ifconfig/ifconfig.c,v
> retrieving revision 1.322
> diff -u -p -u -p -r1.322 ifconfig.c
> --- sbin/ifconfig/ifconfig.c  3 May 2016 17:52:33 -0000       1.322
> +++ sbin/ifconfig/ifconfig.c  1 Jun 2016 14:32:18 -0000
> @@ -107,6 +107,8 @@
>  #include <ifaddrs.h>
>  
>  #include "brconfig.h"
> +#include <dev/usb/umbim.h>
> +#include <dev/usb/if_umbim.h>

Does USB mobile broadband interfaces share a spec with non-USB devices?
In other words would it make sense to move (some of) the defines in net/
rather than usb/?

In any case these two include lines should be before the standard ones
and under #ifndef SMALL.

>  
>  #define MINIMUM(a, b)        (((a) < (b)) ? (a) : (b))
>  #define MAXIMUM(a, b)        (((a) > (b)) ? (a) : (b))
> @@ -145,6 +147,7 @@ int       showmediaflag;
>  int  showcapsflag;
>  int  shownet80211chans;
>  int  shownet80211nodes;
> +int  showclasses;
>  
>  void notealias(const char *, int);
>  void setifaddr(const char *, int);
> @@ -275,6 +278,18 @@ void     unsetifdesc(const char *, int);
>  void printifhwfeatures(const char *, int);
>  void setpair(const char *, int);
>  void unsetpair(const char *, int);
> +void umbim_status(void);
> +void umbim_printclasses(char *, int);
> +int  umbim_parse_classes(const char *);
> +void umbim_setpin(const char *, int);
> +void umbim_chgpin(const char *, const char *);
> +void umbim_puk(const char *, const char *);
> +void umbim_pinop(int, int, const char *, const char *);
> +void umbim_apn(const char *, int);
> +void umbim_setclass(const char *, int);
> +void umbim_roaming(const char *, int);
> +void utf16_to_char(uint16_t *, int, char *, size_t);
> +int  char_to_utf16(const char *, uint16_t *, size_t);
>  #else
>  void setignore(const char *, int);
>  #endif
> @@ -486,6 +501,15 @@ const struct     cmd {
>       { "-descr",     1,              0,              unsetifdesc },
>       { "wol",        IFXF_WOL,       0,              setifxflags },
>       { "-wol",       -IFXF_WOL,      0,              setifxflags },
> +     { "pin",        NEXTARG,        0,              umbim_setpin },
> +     { "chgpin",     NEXTARG2,       0,              NULL, umbim_chgpin },
> +     { "puk",        NEXTARG2,       0,              NULL, umbim_puk },
> +     { "apn",        NEXTARG,        0,              umbim_apn },
> +     { "-apn",       -1,             0,              umbim_apn },
> +     { "class",      NEXTARG0,       0,              umbim_setclass },
> +     { "-class",     -1,             0,              umbim_setclass },
> +     { "roaming",    1,              0,              umbim_roaming },
> +     { "-roaming",   0,              0,              umbim_roaming },
>       { "patch",      NEXTARG,        0,              setpair },
>       { "-patch",     1,              0,              unsetpair },
>  #else /* SMALL */
> @@ -2942,6 +2966,7 @@ status(int link, struct sockaddr_dl *sdl
>       mpe_status();
>       mpw_status();
>       pflow_status();
> +     umbim_status();
>  #endif
>       trunk_status();
>       getifgroups();
> @@ -4875,6 +4900,403 @@ setifpriority(const char *id, int param)
>       if (ioctl(s, SIOCSIFPRIORITY, (caddr_t)&ifr) < 0)
>               warn("SIOCSIFPRIORITY");
>  }
> +
> +
> +const struct umbim_valdescr umbim_regstate[] = UMBIM_REGSTATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_dataclass[] = UMBIM_DATACLASS_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_simstate[] = UMBIM_SIMSTATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_istate[] = 
> UMBIM_INTERNAL_STATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_pktstate[] = 
> UMBIM_PKTSRV_STATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_actstate[] = 
> UMBIM_ACTIVATION_STATE_DESCRIPTIONS;

These lines do not fit in 80 char, if the driver rename is not enough
please cut them! ;)

> Index: share/man/man4/umbim.4
> ===================================================================
> RCS file: share/man/man4/umbim.4
> diff -N share/man/man4/umbim.4
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ share/man/man4/umbim.4    1 Jun 2016 14:32:18 -0000
> @@ -0,0 +1,95 @@
> +.\" Copyright (c) 2016 genua mbH
> +.\" All rights reserved.
> +.\"
> +.\" Redistribution and use in source and binary forms, with or without
> +.\" modification, are permitted provided that the following conditions
> +.\" are met:
> +.\"
> +.\"    - Redistributions of source code must retain the above copyright
> +.\"      notice, this list of conditions and the following disclaimer.
> +.\"    - Redistributions in binary form must reproduce the above
> +.\"      copyright notice, this list of conditions and the following
> +.\"      disclaimer in the documentation and/or other materials provided
> +.\"      with the distribution.
> +.\"
> +.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
> +.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
> +.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
> +.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
> +.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
> +.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
> +.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
> +.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
> +.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
> +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
> +.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
> +.\" POSSIBILITY OF SUCH DAMAGE.

Any reason for using a different license in documentation an code?

> +.Sh CAVEATS
> +The
> +.Nm
> +driver currently does not support IPv6 addresses.
> +.Pp
> +Roaming can be prevented by the driver. This feature hasn't been tested.
> +Please don't kill me in case your phone bills rack up sky high.

I wouldn't put the last sentence in this manual.  The license already
say that.

> Index: sys/dev/usb/if_umbim.c
> ===================================================================
> RCS file: sys/dev/usb/if_umbim.c
> diff -N sys/dev/usb/if_umbim.c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ sys/dev/usb/if_umbim.c    1 Jun 2016 14:32:19 -0000
> @@ -0,0 +1,2441 @@
> +/*   $OpenBSD$ */
> +
> +/*
> + * Copyright (c) 2016 genua mbH
> + * All rights reserved.
> + *
> + * Permission to use, copy, modify, and distribute this software for any
> + * purpose with or without fee is hereby granted, provided that the above
> + * copyright notice and this permission notice appear in all copies.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
> + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
> + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
> + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
> + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> + */
> +
> +/*
> + * Mobile Broadband Interface Model
> + * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
> + */
> +#include "bpfilter.h"
> +
> +#include <sys/param.h>
> +#include <sys/device.h>
> +#include <sys/socket.h>
> +#include <sys/systm.h>
> +#include <sys/malloc.h>
> +#include <sys/mbuf.h>
> +#include <sys/time.h>
> +#include <sys/timeout.h>
> +#include <sys/kernel.h>
> +#include <sys/syslog.h>
> +
> +#if NBPFILTER > 0
> +#include <net/bpf.h>
> +#endif
> +#include <net/if.h>
> +#include <net/netisr.h>
> +#include <net/if_arp.h>
> +#include <net/if_var.h>
> +#include <net/if_types.h>
> +#include <net/route.h>
> +
> +#include <netinet/in.h>
> +#include <netinet/in_var.h>
> +#include <netinet/ip.h>

> +
> +#include <machine/bus.h>
> +
> +#include <dev/usb/usb.h>
> +#include <dev/usb/usbdi.h>
> +#include <dev/usb/usbdivar.h>
> +#include <dev/usb/usbdi_util.h>
> +#include <dev/usb/usbdevs.h>
> +#include <dev/usb/usbcdc.h>
> +
> +#include <dev/usb/umbim.h>
> +#include <dev/usb/if_umbim.h>

Please remove unused headers.  You have many of them.


> +/*
> + * State change timeout
> + */
> +#define UMBIM_STATE_CHANGE_TIMEOUT   30
> +
> +/*
> + * State change flags
> + */
> +#define UMBIM_NS_DONT_DROP   0x0001  /* do not drop below current state */
> +#define UMBIM_NS_DONT_RAISE  0x0002  /* do not raise below current state */
> +
> +/*
> + * Diagnostic macros
> + */
> +const struct umbim_valdescr umbim_regstates[] = UMBIM_REGSTATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_dataclasses[] = 
> UMBIM_DATACLASS_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_simstate[] = UMBIM_SIMSTATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_messages[] = UMBIM_MESSAGES_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_status[] = UMBIM_STATUS_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_cids[] = UMBIM_CID_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_pktstate[] = 
> UMBIM_PKTSRV_STATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_actstate[] = 
> UMBIM_ACTIVATION_STATE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_error[] = UMBIM_ERROR_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_pintype[] = UMBIM_PINTYPE_DESCRIPTIONS;
> +const struct umbim_valdescr umbim_istate[] = 
> UMBIM_INTERNAL_STATE_DESCRIPTIONS;
> +
> +#define umbim_regstate(c)    umbim_val2descr(umbim_regstates, (c))
> +#define umbim_dataclass(c)   umbim_val2descr(umbim_dataclasses, (c))
> +#define umbim_simstate(s)    umbim_val2descr(umbim_simstate, (s))
> +#define      umbim_request2str(m)    umbim_val2descr(umbim_messages, (m))
> +#define      umbim_status2str(s)     umbim_val2descr(umbim_status, (s))
> +#define      umbim_cid2str(c)        umbim_val2descr(umbim_cids, (c))
> +#define      umbim_packet_state(s)   umbim_val2descr(umbim_pktstate, (s))
> +#define      umbim_activation(s)     umbim_val2descr(umbim_actstate, (s))
> +#define      umbim_error2str(e)      umbim_val2descr(umbim_error, (e))
> +#define      umbim_pin_type(t)       umbim_val2descr(umbim_pintype, (t))
> +#define      umbim_istate(s)         umbim_val2descr(umbim_istate, (s))

Please do not mix "#define<tab>" and "#define<space>" in the same file.

> +/*
> + * Saved original interface address
> + * See "struct in_ifaddr".
> + */
> +struct umbim_ifaddr {
> +     struct sockaddr_in       addr;
> +     struct sockaddr_in       dst;
> +     struct sockaddr_in       netmask;
> +};

Sorry but this still need some improvement, see below.

> +/*
> + * Some devices are picky about too frequent control messages.
> + * Query device state not more often than every 0.5 secs.
> + */
> +struct timeval umbim_update_rate = { 0, 500000 };
                  ^^^^^^^^^^^^^^^^^
This variable seems unused.  What it is for?

> +int umbim_delay = 4000;

What is this supposed to be?

> +/*
> + * Normally, MBIM devices are detected by their interface class and subclass.
> + * But for some models that have multiple configurations, it is better to
> + * match by vendor and product id so that we can select the desired
> + * configuration ourselves.
> + *
> + * OTOH, some devices identifiy themself als an MBIM device but fail to speak
> + * the MBIM protocol.
> + */
> +struct umbim_products {
> +     struct usb_devno         dev;
> +     int                      confno;
> +};
> +const struct umbim_products umbim_devs[] = {
> +     /*
> +      * Add devices here to force them to attach as umbim.
> +      * Format: { { VID, PID }, CONFIGNO }
> +      */
> +};
> +
> +#define umbim_lookup(vid, pid)               \
> +     ((const struct umbim_products *)usb_lookup(umbim_devs, vid, pid))
> +
> +int
> +umbim_match(struct device *parent, void *match, void *aux)
> +{
> +     struct usb_attach_arg *uaa = aux;
> +     usb_interface_descriptor_t *id;
> +
> +     if (umbim_lookup(uaa->vendor, uaa->product) != NULL)
> +             return UMATCH_VENDOR_PRODUCT;
> +     if (!uaa->iface)
> +             return UMATCH_NONE;
> +     if (!uaa->iface ||
> +         (id = usbd_get_interface_descriptor(uaa->iface)) == NULL)
> +             return UMATCH_NONE;

No need to check twice for "uaa->iface".

> +     if (id->bInterfaceClass != UICLASS_CDC ||
> +         id->bInterfaceSubClass !=
> +         UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL ||
> +         id->bNumEndpoints != 1)
> +             return UMATCH_NONE;
> +
> +     return UMATCH_DEVCLASS_DEVSUBCLASS;
> +}
> +
> +void
> +umbim_attach(struct device *parent, struct device *self, void *aux)
> +{
> +     struct umbim_softc *sc = (struct umbim_softc *)self;
> +     struct usb_attach_arg *uaa = aux;
> +     usbd_status status;
> +     struct usbd_desc_iter iter;
> +     const usb_descriptor_t *desc;
> +     int      v;
> +     struct umbim_descriptor *md;
> +     int      i;
> +     struct usbd_interface *ctrl_iface = NULL;
> +     int      ctrl_ep;
> +     uint8_t  data_ifaceno;
> +     usb_interface_descriptor_t *id;
> +     usb_config_descriptor_t *cd;
> +     usb_endpoint_descriptor_t *ed;
> +     int      altnum;
> +     int      s;
> +     struct ifnet *ifp;
> +     int      hard_mtu;
> +
> +     sc->sc_udev = uaa->device;
> +
> +     if (uaa->configno < 0) {

Could you please add a comment explaining the weird behavior of your
device here?  The fact that the stack MUST not set a configuration other
than the one we want to use otherwise it detaches itself.  The logic of
the driver is hard to understand otherwise.

> +             uaa->configno = umbim_lookup(uaa->vendor, uaa->product)->confno;
> +             DPRINTF("%s: switching to config #%d\n", DEVNAM(sc),
> +                 uaa->configno);
> +             status = usbd_set_config_no(sc->sc_udev, uaa->configno, 1);
> +             if (status) {
> +                     printf("%s: failed to switch to config #%d: %s\n",
> +                         DEVNAM(sc), uaa->configno, usbd_errstr(status));
> +                     goto fail;
> +             }
> +     }
> +
> +     sc->sc_ver_maj = sc->sc_ver_min = -1;
> +     usbd_desc_iter_init(sc->sc_udev, &iter);
> +     hard_mtu = UMBIM_MAXSEGSZ_MINVAL;
> +     while ((desc = usbd_desc_iter_next(&iter))) {
> +             if (desc->bDescriptorType != UDESC_CS_INTERFACE)
> +                     continue;
> +             switch (desc->bDescriptorSubtype) {
> +             case UDESCSUB_UMBIM:
> +                     md = (struct umbim_descriptor *)desc;
> +                     v = UGETW(md->bcdMBIMVersion);
> +                     sc->sc_ver_maj = UMBIM_VER_MAJOR(v);
> +                     sc->sc_ver_min = UMBIM_VER_MINOR(v);
> +                     sc->sc_ctrl_len = UGETW(md->wMaxControlMessage);
> +                     /* Never trust a USB device! Could try to exploit us */

That's true for the whole stack ;)  Sadly we're missing *a lot* of
checks.

> +                     if (sc->sc_ctrl_len < UMBIM_CTRLMSG_MINLEN ||
> +                         sc->sc_ctrl_len > UMBIM_CTRLMSG_MAXLEN) {
> +                             printf("%s: control message len %d out of "
> +                                 "bounds [%d .. %d]\n", DEVNAM(sc),
> +                                 sc->sc_ctrl_len, UMBIM_CTRLMSG_MINLEN,
> +                                 UMBIM_CTRLMSG_MAXLEN);
> +                             /* cont. anyway */
> +                     }
> +                     sc->sc_maxpktlen = UGETW(md->wMaxSegmentSize);
> +                     if (sc->sc_maxpktlen < UMBIM_MAXSEGSZ_MINVAL) {
> +                             printf("%s: ignoring invalid segment size %d\n",
> +                                 DEVNAM(sc), sc->sc_maxpktlen);
> +                             /* cont. anyway */
> +                             sc->sc_maxpktlen = 8 * 1024;
> +                     }
> +                     hard_mtu = sc->sc_maxpktlen;
> +                     DPRINTFN(2, "%s: ctrl_len=%d, maxpktlen=%d, cap=0x%x\n",
> +                         DEVNAM(sc), sc->sc_ctrl_len, sc->sc_maxpktlen,
> +                         md->bmNetworkCapabilities);
> +                     break;
> +             default:
> +                     break;
> +             }
> +     }
> +     cd = usbd_get_config_descriptor(sc->sc_udev);

This is confusing, could you move that below?  Just before you use "cd".
This function does not generate any I/O anyway.

> +     if (sc->sc_ver_maj < 0) {
> +             printf("%s: missing MBIM descriptor\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +
> +     for (i = 0; i < sc->sc_udev->cdesc->bNumInterface; i++) {
> +             if (usbd_iface_claimed(sc->sc_udev, i))
> +                     continue;
> +             id = usbd_get_interface_descriptor(&sc->sc_udev->ifaces[i]);
> +             if (id == NULL)
> +                     continue;
> +             if (id->bInterfaceClass == UICLASS_CDC &&
> +                 id->bInterfaceSubClass ==
> +                 UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL) {
> +                     ctrl_iface = &sc->sc_udev->ifaces[i];
> +                     sc->sc_ctrl_ifaceno = id->bInterfaceNumber;
> +                     usbd_claim_iface(sc->sc_udev, i);
> +             } else if (id->bInterfaceClass == UICLASS_CDC_DATA &&
> +                 id->bInterfaceSubClass == UISUBCLASS_DATA &&
> +                 id->bInterfaceProtocol == UIPROTO_DATA_MBIM) {
> +                     sc->sc_data_iface = &sc->sc_udev->ifaces[i];
> +                     data_ifaceno = id->bInterfaceNumber;
> +                     usbd_claim_iface(sc->sc_udev, i);
> +             }
> +     }
> +     if (ctrl_iface == NULL) {
> +             printf("%s: no control interface found\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +     if (sc->sc_data_iface == NULL) {
> +             printf("%s: no data interface found\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +
> +     id = usbd_get_interface_descriptor(ctrl_iface);
> +     ctrl_ep = -1;
> +     for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) {
> +             ed = usbd_interface2endpoint_descriptor(ctrl_iface, i);
> +             if (ed == NULL)
> +                     break;
> +             if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT &&
> +                 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN)
> +                     ctrl_ep = ed->bEndpointAddress;
> +     }
> +     if (ctrl_ep == -1) {
> +             printf("%s: missing interrupt endpoint\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +
> +     id = usbd_get_interface_descriptor(sc->sc_data_iface);
> +     altnum = usbd_get_no_alts(cd, id->bInterfaceNumber);
> +     if (UMBIM_INTERFACE_ALTSETTING >= altnum) {
> +             printf("%s: mussing alt setting %d for interface #%d\n",
> +                 DEVNAM(sc), UMBIM_INTERFACE_ALTSETTING, data_ifaceno);
> +             goto fail;
> +     }
> +     sc->sc_rx_ep = sc->sc_tx_ep = -1;
> +     if ((status = usbd_set_interface(sc->sc_data_iface,
> +         UMBIM_INTERFACE_ALTSETTING))) {
> +             printf("%s: select alt setting %d for interface #%d "
> +                 "failed: %s\n", DEVNAM(sc), UMBIM_INTERFACE_ALTSETTING,
> +                 data_ifaceno, usbd_errstr(status));
> +             goto fail;
> +     }
> +     id = usbd_get_interface_descriptor(sc->sc_data_iface);
> +     for (i = 0; i < id->bNumEndpoints; i++) {
> +             if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface,
> +                 i)) == NULL)
> +                     break;
> +             if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
> +                 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN)
> +                     sc->sc_rx_ep = ed->bEndpointAddress;
> +             else if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
> +                 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT)
> +                     sc->sc_tx_ep = ed->bEndpointAddress;
> +     }
> +     if (sc->sc_rx_ep == -1 || sc->sc_tx_ep == -1) {
> +             printf("%s: missing bulk endpoints\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +
> +     DPRINTFN(2, "%s: ctrl-ifno#%d: ep-ctrl=%d, data-ifno#%d: ep-rx=%d, "
> +         "ep-tx=%d\n", DEVNAM(sc), sc->sc_ctrl_ifaceno,
> +         UE_GET_ADDR(ctrl_ep), data_ifaceno,
> +         UE_GET_ADDR(sc->sc_rx_ep), UE_GET_ADDR(sc->sc_tx_ep));
> +
> +     usb_init_task(&sc->sc_umbim_task, umbim_state_task, sc,
> +         USB_TASK_TYPE_GENERIC);
> +     usb_init_task(&sc->sc_get_response_task, umbim_get_response_task, sc,
> +         USB_TASK_TYPE_GENERIC);
> +     timeout_set(&sc->sc_statechg_timer, umbim_statechg_timeout, sc);
> +
> +     if (usbd_open_pipe_intr(ctrl_iface, ctrl_ep, USBD_SHORT_XFER_OK,
> +         &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof (sc->sc_intr_msg),
> +         umbim_intr, USBD_DEFAULT_INTERVAL)) {
> +             printf("%s: failed to open control pipe\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +     sc->sc_resp_buf = malloc(sc->sc_ctrl_len, M_USBDEV, M_NOWAIT);
> +     if (sc->sc_resp_buf == NULL) {
> +             printf("%s: allocation of resp buffer failed\n", DEVNAM(sc));
> +             goto fail;
> +     }
> +     sc->sc_ctrl_msg = malloc(sc->sc_ctrl_len, M_USBDEV, M_NOWAIT);
> +     if (sc->sc_ctrl_msg == NULL) {
> +             printf("%s: allocation of ctrl msg buffer failed\n",
> +                 DEVNAM(sc));
> +             goto fail;
> +     }
> +
> +     sc->sc_info.regstate = UMBIM_REGSTATE_UNKNOWN;
> +     sc->sc_info.pin_attempts_left = UMBIM_VALUE_UNKNOWN;
> +     sc->sc_info.rssi = UMBIM_VALUE_UNKNOWN;
> +     sc->sc_info.ber = UMBIM_VALUE_UNKNOWN;
> +
> +     s = splnet();
> +     ifp = GET_IFP(sc);
> +     ifp->if_flags = IFF_SIMPLEX | IFF_MULTICAST | IFF_POINTOPOINT;
> +     ifp->if_ioctl = umbim_ioctl;
> +     ifp->if_start = umbim_start;
> +
> +     ifp->if_watchdog = umbim_watchdog;
> +     strlcpy(ifp->if_xname, DEVNAM(sc), IFNAMSIZ);
> +     ifp->if_link_state = LINK_STATE_DOWN;
> +
> +     ifp->if_type = IFT_MBIM;
> +     ifp->if_addrlen = 0;
> +     ifp->if_hdrlen = sizeof (struct ncm_header16) +
> +         sizeof (struct ncm_pointer16);
> +     ifp->if_mtu = 1500;             /* use a common default */
> +     ifp->if_hardmtu = hard_mtu;
> +     ifp->if_output = umbim_output;
> +     if_attach(ifp);
> +     if_ih_insert(ifp, umbim_input, NULL);

If it non-USB MBI exist, I'd suggest to rename umbim_{input,output} and
all the generic functions to mbim_* :)

> +     if_alloc_sadl(ifp);
> +     ifp->if_softc = sc;
> +#if NBPFILTER > 0
> +     bpfattach(&ifp->if_bpf, ifp, DLT_RAW, 0);
> +#endif
> +     /*
> +      * Open the device now so that we are able to query device information.
> +      * XXX maybe close when done?
> +      */
> +     umbim_open(sc);

Is this really needed?  open/close are confusing names because their
generally used for openting/closing /dev/nodes.

> +     splx(s);
> +
> +     printf("%s: vers %d.%d\n", DEVNAM(sc), sc->sc_ver_maj, sc->sc_ver_min);
> +     return;
> +
> +fail:
> +     usbd_deactivate(sc->sc_udev);
> +     return;
> +}
> +
> +int
> +umbim_detach(struct device *self, int flags)
> +{
> +     struct umbim_softc *sc = (struct umbim_softc *)self;
> +     struct ifnet *ifp = GET_IFP(sc);
> +     int      s;
> +
> +     s = splnet();
> +     if (ifp->if_flags & IFF_RUNNING)
> +             umbim_down(sc, 1);
> +     umbim_close(sc);
> +
> +     usb_rem_wait_task(sc->sc_udev, &sc->sc_get_response_task);
> +     if (timeout_initialized(&sc->sc_statechg_timer))
> +             timeout_del(&sc->sc_statechg_timer);
> +     sc->sc_nresp = 0;
> +     usb_rem_wait_task(sc->sc_udev, &sc->sc_umbim_task);
> +     if (sc->sc_ctrl_pipe) {
> +             usbd_close_pipe(sc->sc_ctrl_pipe);
> +             sc->sc_ctrl_pipe = NULL;
> +     }
> +     if (sc->sc_ctrl_msg) {
> +             free(sc->sc_ctrl_msg, M_USBDEV, sc->sc_ctrl_len);
> +             sc->sc_ctrl_msg = NULL;
> +     }
> +     if (sc->sc_resp_buf) {
> +             free(sc->sc_resp_buf, M_USBDEV, sc->sc_ctrl_len);
> +             sc->sc_resp_buf = NULL;
> +     }
> +     if (sc->sc_saved_ifaddr != NULL &&
> +         sc->sc_saved_ifaddr != UMBIM_IFADDR_NONE)
> +             free(sc->sc_saved_ifaddr, M_USBDEV,
> +                 sizeof (struct umbim_ifaddr));
> +     sc->sc_saved_ifaddr = NULL;
> +
> +     if (ifp->if_softc != NULL) {
> +             if_ih_remove(ifp, umbim_input, NULL);
> +             if_detach(ifp);
> +     }
> +
> +     splx(s);
> +     return 0;
> +}
> +
> +int
> +umbim_alloc_xfers(struct umbim_softc *sc)
> +{
> +     if (!sc->sc_rx_xfer) {
> +             if ((sc->sc_rx_xfer = usbd_alloc_xfer(sc->sc_udev)) != NULL)
> +                     sc->sc_rx_buf = usbd_alloc_buffer(sc->sc_rx_xfer,
> +                         sc->sc_maxpktlen + UMBIM_HDR32_LEN);
> +     }
> +     if (!sc->sc_tx_xfer) {
> +             if ((sc->sc_tx_xfer = usbd_alloc_xfer(sc->sc_udev)) != NULL)
> +                     sc->sc_tx_buf = usbd_alloc_buffer(sc->sc_tx_xfer,
> +                         sc->sc_maxpktlen + UMBIM_HDR16_LEN);
> +     }
> +     return (sc->sc_rx_buf && sc->sc_tx_buf) ? 1 : 0;
> +}
> +
> +void
> +umbim_free_xfers(struct umbim_softc *sc)
> +{
> +     if (sc->sc_rx_xfer) {
> +             /* implicit usbd_free_buffer() */
> +             usbd_free_xfer(sc->sc_rx_xfer);
> +             sc->sc_rx_xfer = NULL;
> +             sc->sc_rx_buf = NULL;
> +     }
> +     if (sc->sc_tx_xfer) {
> +             usbd_free_xfer(sc->sc_tx_xfer);
> +             sc->sc_tx_xfer = NULL;
> +             sc->sc_tx_buf = NULL;
> +     }
> +     if (sc->sc_tx_m) {
> +             m_freem(sc->sc_tx_m);
> +             sc->sc_tx_m = NULL;
> +     }
> +}
> +
> +int
> +umbim_alloc_bulkpipes(struct umbim_softc *sc)
> +{
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     if (!(ifp->if_flags & IFF_RUNNING)) {
> +             if (usbd_open_pipe(sc->sc_data_iface, sc->sc_rx_ep,
> +                 USBD_EXCLUSIVE_USE, &sc->sc_rx_pipe))
> +                     return 0;
> +             if (usbd_open_pipe(sc->sc_data_iface, sc->sc_tx_ep,
> +                 USBD_EXCLUSIVE_USE, &sc->sc_tx_pipe))
> +                     return 0;
> +
> +             ifp->if_flags |= IFF_RUNNING;
> +             ifp->if_flags &= ~IFF_OACTIVE;

IFF_OACTIVE should no longer bet set/remove.  Use ifq_clr_oactive() if
that's really what you want.

> +             umbim_rx(sc);
> +     }
> +     return 1;
> +}
> +
> +void
> +umbim_close_bulkpipes(struct umbim_softc *sc)
> +{
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
> +     ifp->if_timer = 0;
> +     if (sc->sc_rx_pipe) {
> +             usbd_close_pipe(sc->sc_rx_pipe);
> +             sc->sc_rx_pipe = NULL;
> +     }
> +     if (sc->sc_tx_pipe) {
> +             usbd_close_pipe(sc->sc_tx_pipe);
> +             sc->sc_tx_pipe = NULL;
> +     }
> +}
> +
> +int
> +umbim_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
> +{
> +     struct proc *p = curproc;
> +     struct umbim_softc *sc = ifp->if_softc;
> +     struct ifreq *ifr = (struct ifreq *)data;
> +     int      s, error = 0;
> +     struct umbim_parameter mp;
> +
> +     if (usbd_is_dying(sc->sc_udev))
> +             return EIO;
> +
> +     s = splnet();
> +     switch (cmd) {
> +     case SIOCSIFADDR:
> +             sc->sc_if.if_rtrequest = p2p_rtrequest;

Could we share more code from this driver with other p2p interfaces?

> +             break;
> +     case SIOCSIFFLAGS:
> +             usb_add_task(sc->sc_udev, &sc->sc_umbim_task);

I guess you want to wait for the task to complete here.  You're not
respecting  the API by returning directly.  But why using a task?  To
serialize up/down operations?

> +             break;
> +     case SIOCGUMBIMINFO:
> +             error = copyout(&sc->sc_info, ifr->ifr_data,
> +                 sizeof (sc->sc_info));
> +             break;
> +     case SIOCSUMBIMPARAM:
> +             if ((error = suser(p, 0)) != 0)
> +                     break;
> +             if ((error = copyin(ifr->ifr_data, &mp, sizeof (mp))) != 0)
> +                     break;
> +
> +             if ((error = umbim_setpin(sc, mp.op, mp.is_puk,
> +                 mp.pin, mp.pinlen, mp.newpin, mp.newpinlen)) != 0)
> +                     break;
> +
> +             if (mp.apnlen < 0 || mp.apnlen > sizeof (sc->sc_info.apn)) {
> +                     error = EINVAL;
> +                     break;
> +             }
> +             sc->sc_roaming = mp.roaming ? 1 : 0;
> +             memset(sc->sc_info.apn, 0, sizeof (sc->sc_info.apn));
> +             memcpy(sc->sc_info.apn, mp.apn, mp.apnlen);
> +             sc->sc_info.apnlen = mp.apnlen;
> +             sc->sc_info.preferredclasses = mp.preferredclasses;
> +             umbim_setdataclass(sc);
> +             break;
> +     case SIOCGUMBIMPARAM:
> +             memset(&mp, 0, sizeof (mp));
> +             memcpy(mp.apn, sc->sc_info.apn, sc->sc_info.apnlen);
> +             mp.apnlen = sc->sc_info.apnlen;
> +             mp.roaming = sc->sc_roaming;
> +             mp.preferredclasses = sc->sc_info.preferredclasses;
> +             error = copyout(&mp, ifr->ifr_data, sizeof (mp));
> +             break;
> +     case SIOCSIFMTU:
> +             /* Does this include the NCM headers and tail? */

The reader will ask the same question.

> +             if (ifr->ifr_mtu > ifp->if_hardmtu) {
> +                     error = EINVAL;
> +                     break;
> +             }
> +             ifp->if_mtu = ifr->ifr_mtu;
> +             break;
> +     case SIOCGIFMTU:
> +             ifr->ifr_mtu = ifp->if_mtu;
> +             break;
> +     case SIOCGIFHARDMTU:
> +             ifr->ifr_hardmtu = ifp->if_hardmtu;
> +             break;
> +     case SIOCAIFADDR:

It is accepted that this ioctl(2) implicitly bring the interface up.

> +     case SIOCSIFDSTADDR:
> +     case SIOCADDMULTI:
> +     case SIOCDELMULTI:
> +             break;
> +     default:
> +             error = ENOTTY;
> +             break;
> +     }
> +     splx(s);
> +     return error;
> +}
> +
> +int
> +umbim_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
> +    struct rtentry *rtp)
> +{
> +     struct umbim_softc *sc = ifp->if_softc;
> +
> +     if (usbd_is_dying(sc->sc_udev) || !(ifp->if_flags & IFF_RUNNING)) {
> +             m_freem(m);
> +             return ENETDOWN;
> +     }

Please do not check for USB stuff here, that's a another layer.  The
IFF_RUNNING check should be (IFF_UP|IFF_RUNNING) != (IFF_UP|IFF_RUNNING).


What about routing domains?  Did you try your device in a rdomain != 0?

> +     return if_enqueue(ifp, m);
> +}
> +
> +int
> +umbim_input(struct ifnet *ifp, struct mbuf *m, void *cookie)
> +{
> +     struct niqueue *inq;
> +     uint8_t ipv;
> +
> +     if (((ifp->if_flags & IFF_UP) == 0) || (m->m_flags & M_FILDROP) != 0) {
> +             m_freem(m);
> +             return 1;
> +     }

Please remove the M_FILDROP, it doesn't exist anymore.

> +     if (m->m_pkthdr.len < sizeof (struct ip)) {
> +             ifp->if_ierrors++;
> +             DPRINTFN(4, "%s: dropping short packet (len %d)\n", __func__,
> +                 m->m_pkthdr.len);
> +             m_freem(m);
> +             return 1;
> +     }
> +     m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
> +     m_copydata(m, 0, sizeof (ipv), &ipv);
> +     ipv >>= 4;
> +
> +     ifp->if_ibytes += m->m_pkthdr.len;
> +     switch (ipv) {
> +     case 4:
> +             inq = &ipintrq;
> +             break;
> +     case 6:
> +             inq = &ip6intrq;
> +             break;
> +     default:
> +             ifp->if_ierrors++;
> +             DPRINTFN(4, "%s: dropping packet with bad IP version (%d)\n",
> +                 __func__, ipv);
> +             m_freem(m);
> +             return 1;
> +     }
> +     niq_enqueue(inq, m);
> +     return 1;
> +}
> +
> +void
> +umbim_start(struct ifnet *ifp)
> +{
> +     struct umbim_softc *sc = ifp->if_softc;
> +     struct mbuf *m_head = NULL;
> +
> +     if (usbd_is_dying(sc->sc_udev) ||
> +         !(ifp->if_flags & IFF_RUNNING) ||
> +         (ifp->if_flags & IFF_OACTIVE))
> +             return;

IFF_OACTIVE here again :)

> +
> +     m_head = ifq_deq_begin(&ifp->if_snd);
> +     if (m_head == NULL)
> +             return;
> +
> +     if (!umbim_encap(sc, m_head)) {
> +             ifq_deq_rollback(&ifp->if_snd, m_head);
> +             ifp->if_flags |= IFF_OACTIVE;
> +             return;
> +     }
> +     ifq_deq_commit(&ifp->if_snd, m_head);
> +
> +#if NBPFILTER > 0
> +     if (ifp->if_bpf)
> +             bpf_mtap(ifp->if_bpf, m_head, BPF_DIRECTION_OUT);
> +#endif
> +
> +     ifp->if_flags |= IFF_OACTIVE;
> +     ifp->if_timer = (2 * umbim_xfer_tout) / 1000;
> +}
> +
> +void
> +umbim_watchdog(struct ifnet *ifp)
> +{
> +     struct umbim_softc *sc = ifp->if_softc;
> +
> +     if (usbd_is_dying(sc->sc_udev))
> +             return;
> +
> +     ifp->if_oerrors++;
> +     log(LOG_WARNING, "%s: watchdog timeout\n", DEVNAM(sc));

I'm not sure drivers should start using log(9).  They all use printf(9)
for things that should not happen.

> +     /* XXX FIXME: re-initialize device */
> +     return;
> +}
> +
> +void
> +umbim_statechg_timeout(void *arg)
> +{
> +     struct umbim_softc *sc = arg;
> +
> +     log(LOG_INFO, "%s: state change time out\n",DEVNAM(sc));

Same here.

> +     usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
> +}
> +
> +void
> +umbim_newstate(struct umbim_softc *sc, enum umbim_state newstate, int flags)
> +{
> +     if (newstate == sc->sc_state)
> +             return;
> +     if (((flags & UMBIM_NS_DONT_DROP) && newstate < sc->sc_state) ||
> +         ((flags & UMBIM_NS_DONT_RAISE) && newstate > sc->sc_state))
> +             return;
> +     log(LOG_DEBUG, "%s: state going %s from '%s' to '%s'\n", DEVNAM(sc),
> +         newstate > sc->sc_state ? "up" : "down",
> +         umbim_istate(sc->sc_state), umbim_istate(newstate));

> +     usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
> +}
> +
> +void
> +umbim_state_task(void *arg)
> +{
> +     struct umbim_softc *sc = arg;
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     int      s;
> +
> +     s = splnet();
> +     if (ifp->if_flags & IFF_UP)
> +             umbim_up(sc);
> +     else
> +             umbim_down(sc, 0);
> +     umbim_linkstate(sc,
> +         sc->sc_state == UMBIM_S_UP ? LINK_STATE_UP : LINK_STATE_DOWN);

This function is used only here, right?  So no need for a function.

> +     splx(s);
> +}
> +
> +
> +void
> +umbim_up(struct umbim_softc *sc)
> +{
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     splassert(IPL_NET);
> +
> +     switch (sc->sc_state) {
> +     case UMBIM_S_DOWN:
> +             DPRINTF("%s: init: opening ...\n", DEVNAM(sc));
> +             umbim_open(sc);
> +             break;
> +     case UMBIM_S_OPEN:
> +             DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc));
> +             umbim_radio(sc, 1);
> +             break;
> +     case UMBIM_S_RADIO:
> +             DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc));
> +             umbim_cmd(sc, UMBIM_CID_SUBSCRIBER_READY_STATUS,
> +                 UMBIM_CMDOP_QRY, NULL, 0);
> +             break;
> +     case UMBIM_S_SIMREADY:
> +             DPRINTF("%s: init: attaching ...\n", DEVNAM(sc));
> +             umbim_packet_service(sc, 1);
> +             break;
> +     case UMBIM_S_ATTACHED:
> +             sc->sc_tx_seq = 0;
> +             if (!umbim_alloc_xfers(sc)) {
> +                     umbim_free_xfers(sc);
> +                     log(LOG_ERR, "%s: allocation of xfers failed\n",
> +                         DEVNAM(sc));
> +                     break;
> +             }
> +             DPRINTF("%s: init: connecting ...\n", DEVNAM(sc));
> +             umbim_connect(sc);
> +             break;
> +     case UMBIM_S_CONNECTED:
> +             DPRINTF("%s: init: getting IP config ...\n", DEVNAM(sc));
> +             umbim_qry_ipconfig(sc);
> +             break;
> +     case UMBIM_S_UP:
> +             DPRINTF("%s: init: reached state UP\n", DEVNAM(sc));
> +             if (!umbim_alloc_bulkpipes(sc)) {
> +                     log(LOG_ERR, "%s: opening bulk pipes failed\n",
> +                         DEVNAM(sc));
> +                     ifp->if_flags &= ~IFF_UP;
> +                     umbim_down(sc, 1);
> +             }
> +             break;
> +     }
> +     if (sc->sc_state < UMBIM_S_UP)
> +             timeout_add_sec(&sc->sc_statechg_timer,
> +                 UMBIM_STATE_CHANGE_TIMEOUT);
> +     else
> +             timeout_del(&sc->sc_statechg_timer);
> +     return;
> +}
> +
> +void
> +umbim_down(struct umbim_softc *sc, int force)
> +{
> +     splassert(IPL_NET);
> +
> +     umbim_close_bulkpipes(sc);
> +     if (sc->sc_state < UMBIM_S_CONNECTED)
> +             umbim_free_xfers(sc);
> +
> +     switch (sc->sc_state) {
> +     case UMBIM_S_UP:
> +     case UMBIM_S_CONNECTED:
> +             DPRINTF("%s: stop: disconnecting ...\n", DEVNAM(sc));
> +             umbim_disconnect(sc);
> +             if (!force)
> +                     break;
> +             /*FALLTHROUGH*/
> +     case UMBIM_S_ATTACHED:
> +             DPRINTF("%s: stop: detaching ...\n", DEVNAM(sc));
> +             umbim_packet_service(sc, 0);
> +             if (!force)
> +                     break;
> +             /*FALLTHROUGH*/
> +     case UMBIM_S_SIMREADY:
> +     case UMBIM_S_RADIO:
> +             DPRINTF("%s: stop: turning radio off ...\n", DEVNAM(sc));
> +             umbim_radio(sc, 0);
> +             if (!force)
> +                     break;
> +             /*FALLTHROUGH*/
> +     case UMBIM_S_OPEN:
> +     case UMBIM_S_DOWN:
> +             /* Do not close the device */
> +             DPRINTF("%s: stop: reached state DOWN\n", DEVNAM(sc));
> +             break;
> +     }
> +     if (force)
> +             sc->sc_state = UMBIM_S_OPEN;
> +
> +     if (sc->sc_state > UMBIM_S_OPEN)
> +             timeout_add_sec(&sc->sc_statechg_timer,
> +                 UMBIM_STATE_CHANGE_TIMEOUT);
> +     else
> +             timeout_del(&sc->sc_statechg_timer);
> +}
> +
> +void
> +umbim_linkstate(struct umbim_softc *sc, int state)
> +{
> +     struct ifnet *ifp = GET_IFP(sc);
> +     int      s;
> +
> +     s = splnet();
> +     if (ifp->if_link_state != state) {
> +             log(LOG_INFO, "%s: link state changed from %s to %s\n",
> +                 DEVNAM(sc),
> +                 LINK_STATE_IS_UP(ifp->if_link_state) ? "up" : "down",
> +                 LINK_STATE_IS_UP(state) ? "up" : "down");
> +             ifp->if_link_state = state;
> +             if_link_state_change(ifp);
> +             if (!LINK_STATE_IS_UP(state)) {
> +                     memset(sc->sc_info.ipv4dns, 0,
> +                         sizeof (sc->sc_info.ipv4dns));
> +                     umbim_restore_ipv4addr(sc);

Why do you need to change the address based on the link state?

Anyway you current code is racy because if_link_state_change() is
asynchronous.

> +             }
> +     }
> +     splx(s);
> +}
> +
> +int
> +umbim_get_ipv4addr(struct ifnet *ifp, struct umbim_ifaddr *uif)
> +{
> +     int     error;
> +     struct ifreq ifr;
> +
> +     memset(uif, 0, sizeof (*uif));
> +     if ((error = in_ioctl(SIOCGIFADDR, (caddr_t)&ifr, ifp, 1)) != 0)
> +             return error;
> +     memcpy(&uif->addr, &ifr.ifr_addr, sizeof (uif->addr));
> +
> +     if ((error = in_ioctl(SIOCGIFDSTADDR, (caddr_t)&ifr, ifp, 1)) != 0)
> +             return error;
> +     memcpy(&uif->dst, &ifr.ifr_dstaddr, sizeof (uif->dst));
> +
> +     if ((error = in_ioctl(SIOCGIFNETMASK, (caddr_t)&ifr, ifp, 1)) != 0)
> +             return error;
> +     memcpy(&uif->netmask, &ifr.ifr_addr, sizeof (uif->netmask));
> +     return 0;
> +}
> +
> +void
> +umbim_set_ipv4addr(struct ifnet *ifp, struct umbim_ifaddr *uif, char *op)
> +{
> +     struct ifreq ifr;
> +     int      error;
> +
> +     splassert(IPL_NET);
> +
> +     if (uif == NULL)
> +             return;
> +     log(LOG_INFO, "%s: %s IPv4 addr %s, mask %s, gateway %s\n",
> +         DEVNAM(ifp->if_softc), op,
> +         umbim_ntop((struct sockaddr *)&uif->addr),
> +         umbim_ntop((struct sockaddr *)&uif->netmask),
> +         umbim_ntop((struct sockaddr *)&uif->dst));
> +
> +     memset(&ifr, 0, sizeof (ifr));
> +     memcpy(&ifr.ifr_addr, &uif->addr, sizeof (ifr.ifr_addr));
> +     if ((error = in_ioctl(SIOCSIFADDR, (caddr_t)&ifr, ifp, 1)) != 0)
> +             log(LOG_ERR, "%s: unable to set IPv4 address, error %d\n",
> +                 DEVNAM(ifp->if_softc), error);

These ioctl(2) are deprecated and should not be used.  That's
why I motioned SIOCAIFADDR in my previous email.

> +
> +     memset(&ifr, 0, sizeof (ifr));
> +     memcpy(&ifr.ifr_dstaddr, &uif->dst, sizeof (ifr.ifr_dstaddr));
> +     if ((error = in_ioctl(SIOCSIFDSTADDR, (caddr_t)&ifr, ifp, 1)) != 0)
> +             log(LOG_ERR, "%s: unable to set IPv4 gateway, error %d\n",
> +                 DEVNAM(ifp->if_softc), error);
> +
> +     memset(&ifr, 0, sizeof (ifr));
> +     memcpy(&ifr.ifr_addr, &uif->netmask, sizeof (ifr.ifr_addr));
> +     if ((error = in_ioctl(SIOCSIFNETMASK, (caddr_t)&ifr, ifp, 1)) != 0)
> +             log(LOG_ERR, "%s: unable to set IPv4 netmask, error %d\n",
> +                 DEVNAM(ifp->if_softc), error);

Please return an error instead of using log(9) for error reporting.

> +}
> +
> +void
> +umbim_restore_ipv4addr(struct umbim_softc *sc)
> +{
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     splassert(IPL_NET);
> +     if (sc->sc_saved_ifaddr == UMBIM_IFADDR_NONE) {
> +             /*
> +              * Purge any existing addresses
> +              */
> +             struct umbim_ifaddr uif;
> +             struct in_aliasreq ifra;
> +
> +             if (umbim_get_ipv4addr(ifp, &uif) == 0 &&
> +                 uif.addr.sin_addr.s_addr != INADDR_ANY) {
> +                     log(LOG_DEBUG, "%s: purge IPv4 addr %s\n", DEVNAM(sc),
> +                         umbim_ntop((struct sockaddr *)&uif.addr));
> +                     memset(&ifra, 0, sizeof (ifra));
> +                     memcpy(&ifra.ifra_addr, &uif.addr,
> +                         sizeof (ifra.ifra_addr));
> +                     in_ioctl(SIOCDIFADDR, (caddr_t)&ifra, ifp, 1);
> +             }
> +     } else if (sc->sc_saved_ifaddr != NULL) {
> +             umbim_set_ipv4addr(ifp, sc->sc_saved_ifaddr, "restore");
> +             free(sc->sc_saved_ifaddr, M_USBDEV,
> +                 sizeof (struct umbim_ifaddr));
> +     }
> +     sc->sc_saved_ifaddr = NULL;
> +}
> +
> +void
> +umbim_get_response_task(void *arg)
> +{
> +     struct umbim_softc *sc = arg;
> +     int      len;
> +     int      s;
> +
> +     /*
> +      * Function is required to send on RESPONSE_AVAILABLE notification for
> +      * each encapsulated response that is to be processed by the host.
> +      * But of course, we can receive multiple notifications before the
> +      * response task is run.
> +      */
> +     s = splusb();
> +     while (sc->sc_nresp > 0) {
> +             --sc->sc_nresp;
> +             len = sc->sc_ctrl_len;
> +             if (umbim_get_encap_response(sc, sc->sc_resp_buf, &len))
> +                     umbim_decode_response(sc, sc->sc_resp_buf, len);
> +     }
> +     splx(s);
> +}
> +
> +void
> +umbim_decode_response(struct umbim_softc *sc, void *response, int len)
> +{
> +     struct umbim_msghdr *hdr = response;
> +     struct umbim_fragmented_msg_hdr *fraghdr;
> +     uint32_t type;
> +     uint32_t tid;
> +
> +     DPRINTFN(3, "%s: got response: len %d\n", DEVNAM(sc), len);
> +     DDUMPN(4, response, len);
> +
> +     if (len < sizeof (*hdr) || letoh32(hdr->len) != len) {
> +             /*
> +              * We should probably cancel a transaction, but since the
> +              * message is too short, we cannot decode the transaction
> +              * id (tid) and hence don't know, whom to cancel. Must wait
> +              * for the timeout.
> +              */
> +             DPRINTF("%s: received short response (len %d)\n",
> +                 DEVNAM(sc), len);
> +             return;
> +     }
> +
> +     /*
> +      * XXX FIXME: if message is fragmented, store it until last frag
> +      *      is received and then re-assemble all fragments.
> +      */
> +     type = letoh32(hdr->type);
> +     tid = letoh32(hdr->tid);
> +     switch (type) {
> +     case UMBIM_INDICATE_STATUS_MSG:
> +     case UMBIM_COMMAND_DONE:
> +             fraghdr = response;
> +             if (letoh32(fraghdr->frag.nfrag) != 1) {
> +                     DPRINTF("%s: discarding fragmented messages\n",
> +                         DEVNAM(sc));
> +                     return;
> +             }
> +             break;
> +     default:
> +             break;
> +     }
> +
> +     DPRINTF("%s: <- rcv %s (tid %u)\n", DEVNAM(sc), umbim_request2str(type),
> +         tid);
> +     switch (type) {
> +     case UMBIM_FUNCTION_ERROR_MSG:
> +     case UMBIM_HOST_ERROR_MSG:
> +     {
> +             struct umbim_f2h_hosterr *e;
> +             int      err;
> +
> +             if (len >= sizeof (*e)) {
> +                     e = response;
> +                     err = letoh32(e->err);
> +
> +                     DPRINTF("%s: %s message, error %s (tid %u)\n",
> +                         DEVNAM(sc), umbim_request2str(type),
> +                         umbim_error2str(err), tid);
> +                     if (err == UMBIM_ERROR_NOT_OPENED)
> +                             umbim_newstate(sc, UMBIM_S_DOWN, 0);
> +             }
> +             break;
> +     }
> +     case UMBIM_INDICATE_STATUS_MSG:
> +             umbim_handle_indicate_status_msg(sc, response, len);
> +             break;
> +     case UMBIM_OPEN_DONE:
> +             umbim_handle_opendone_msg(sc, response, len);
> +             break;
> +     case UMBIM_CLOSE_DONE:
> +             umbim_handle_closedone_msg(sc, response, len);
> +             break;
> +     case UMBIM_COMMAND_DONE:
> +             umbim_command_done(sc, response, len);
> +             break;
> +     default:
> +             DPRINTF("%s: discard messsage %s\n", DEVNAM(sc),
> +                 umbim_request2str(type));
> +             break;
> +     }
> +}
> +
> +void
> +umbim_handle_indicate_status_msg(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_f2h_indicate_status *m = data;
> +     uint32_t infolen;
> +     uint32_t cid;
> +
> +     if (len < sizeof (*m)) {
> +             DPRINTF("%s: discard short %s messsage\n", DEVNAM(sc),
> +                 umbim_request2str(letoh32(m->hdr.type)));
> +             return;
> +     }
> +     if (memcmp(m->devid, umbim_uuid_basic_connect, sizeof (m->devid))) {
> +             DPRINTF("%s: discard %s messsage for other UUID '%s'\n",
> +                 DEVNAM(sc), umbim_request2str(letoh32(m->hdr.type)),
> +                 umbim_uuid2str(m->devid));
> +             return;
> +     }
> +     infolen = letoh32(m->infolen);
> +     if (len < sizeof (*m) + infolen) {
> +             DPRINTF("%s: discard truncated %s messsage (want %d, got %d)\n",
> +                 DEVNAM(sc), umbim_request2str(letoh32(m->hdr.type)),
> +                 (int)sizeof (*m) + infolen, len);
> +             return;
> +     }
> +
> +     cid = letoh32(m->cid);
> +     DPRINTF("%s: indicate %s status\n", DEVNAM(sc), umbim_cid2str(cid));
> +     umbim_decode_cid(sc, cid, m->info, infolen);
> +}
> +
> +void
> +umbim_handle_opendone_msg(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_f2h_openclosedone *resp = data;
> +     uint32_t status;
> +
> +     status = letoh32(resp->status);
> +     if (status == UMBIM_STATUS_SUCCESS) {
> +             if (sc->sc_maxsessions == 0) {
> +                     umbim_cmd(sc, UMBIM_CID_DEVICE_CAPS, UMBIM_CMDOP_QRY,
> +                         NULL, 0);
> +                     umbim_cmd(sc, UMBIM_CID_PIN, UMBIM_CMDOP_QRY, NULL, 0);
> +                     umbim_cmd(sc, UMBIM_CID_REGISTER_STATE, UMBIM_CMDOP_QRY,
> +                         NULL, 0);
> +             }
> +             umbim_newstate(sc, UMBIM_S_OPEN, UMBIM_NS_DONT_DROP);
> +     } else
> +             log(LOG_ERR, "%s: open error: %s\n", DEVNAM(sc),
> +                 umbim_status2str(status));
> +     return;
> +}
> +
> +void
> +umbim_handle_closedone_msg(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_f2h_openclosedone *resp = data;
> +     uint32_t status;
> +
> +     status = letoh32(resp->status);
> +     if (status == UMBIM_STATUS_SUCCESS)
> +             umbim_newstate(sc, UMBIM_S_DOWN, 0);
> +     else
> +             DPRINTF("%s: close error: %s\n", DEVNAM(sc),
> +                 umbim_status2str(status));
> +     return;
> +}
> +
> +static inline void
> +umbim_getinfobuf(void *in, int inlen, uint32_t offs, uint32_t sz,
> +    void *out, size_t outlen)
> +{
> +     offs = letoh32(offs);
> +     sz = letoh32(sz);
> +     if (inlen >= offs + sz) {
> +             memset(out, 0, outlen);
> +             memcpy(out, in + offs, MIN(sz, outlen));
> +     }
> +}
> +
> +static inline int
> +umbim_padding(void *data, int len, size_t sz)
> +{
> +     char    *p = data;
> +     int      np = 0;
> +
> +     while (len < sz && (len % 4) != 0) {
> +             *p++ = '\0';
> +             len++;
> +             np++;
> +     }
> +     return np;
> +}
> +
> +static inline int
> +umbim_addstr(void *buf, size_t bufsz, int *offs, void *str, int slen,
> +    uint32_t *offsmember, uint32_t *sizemember)
> +{
> +     if (*offs + slen > bufsz)
> +             return 0;
> +
> +     *sizemember = htole32((uint32_t)slen);
> +     if (slen && str) {
> +             *offsmember = htole32((uint32_t)*offs);
> +             memcpy(buf + *offs, str, slen);
> +             *offs += slen;
> +             *offs += umbim_padding(buf, *offs, bufsz);
> +     } else
> +             *offsmember = htole32(0);
> +     return 1;
> +}
> +
> +int
> +umbim_decode_register_state(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_registration_state_info *rs = data;
> +
> +     if (len < sizeof (*rs))
> +             return 0;
> +     sc->sc_info.nwerror = letoh32(rs->nwerror);
> +     sc->sc_info.regstate = letoh32(rs->regstate);
> +     sc->sc_info.regmode = letoh32(rs->regmode);
> +     sc->sc_info.cellclass = letoh32(rs->curcellclass);
> +
> +     /* XXX should we remember the provider_id? */
> +     umbim_getinfobuf(data, len, rs->provname_offs, rs->provname_size,
> +         sc->sc_info.provider, sizeof (sc->sc_info.provider));
> +     umbim_getinfobuf(data, len, rs->roamingtxt_offs, rs->roamingtxt_size,
> +         sc->sc_info.roamingtxt, sizeof (sc->sc_info.roamingtxt));
> +
> +     DPRINTFN(2, "%s: %s, availclass 0x%x, class 0x%x, regmode %d\n",
> +         DEVNAM(sc), umbim_regstate(sc->sc_info.regstate),
> +         letoh32(rs->availclasses), sc->sc_info.cellclass,
> +         sc->sc_info.regmode);
> +
> +     if (sc->sc_info.regstate == UMBIM_REGSTATE_ROAMING &&
> +         !sc->sc_roaming &&
> +         sc->sc_info.activation == UMBIM_ACTIVATION_STATE_ACTIVATED) {
> +             log(LOG_INFO, "%s: disconnecting from roaming network\n",
> +                 DEVNAM(sc));
> +             umbim_newstate(sc, UMBIM_S_ATTACHED, UMBIM_NS_DONT_RAISE);
> +     }
> +     return 1;
> +}
> +
> +int
> +umbim_decode_devices_caps(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_device_caps *dc = data;
> +
> +     if (len < sizeof (*dc))
> +             return 0;
> +     sc->sc_maxsessions = letoh32(dc->max_sessions);
> +     sc->sc_info.supportedclasses = letoh32(dc->dataclass);
> +     umbim_getinfobuf(data, len, dc->devid_offs, dc->devid_size,
> +         sc->sc_info.devid, sizeof (sc->sc_info.devid));
> +     umbim_getinfobuf(data, len, dc->fwinfo_offs, dc->fwinfo_size,
> +         sc->sc_info.fwinfo, sizeof (sc->sc_info.fwinfo));
> +     umbim_getinfobuf(data, len, dc->hwinfo_offs, dc->hwinfo_size,
> +         sc->sc_info.hwinfo, sizeof (sc->sc_info.hwinfo));
> +     DPRINTFN(2, "%s: max sessions %d, supported classes 0x%x\n",
> +         DEVNAM(sc), sc->sc_maxsessions, sc->sc_info.supportedclasses);
> +     return 1;
> +}
> +
> +int
> +umbim_decode_subscriber_status(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_subscriber_ready_info *si = data;
> +     int     npn;
> +
> +     if (len < sizeof (*si))
> +             return 0;
> +     sc->sc_info.sim_state = letoh32(si->ready);
> +
> +     umbim_getinfobuf(data, len, si->sid_offs, si->sid_size,
> +         sc->sc_info.sid, sizeof (sc->sc_info.sid));
> +     umbim_getinfobuf(data, len, si->icc_offs, si->icc_size,
> +         sc->sc_info.iccid, sizeof (sc->sc_info.iccid));
> +
> +     npn = letoh32(si->no_pn);
> +     if (npn > 0)
> +             umbim_getinfobuf(data, len, si->pn[0].offs, si->pn[0].size,
> +                 sc->sc_info.pn, sizeof (sc->sc_info.pn));
> +     else
> +             memset(sc->sc_info.pn, 0, sizeof (sc->sc_info.pn));
> +
> +     if (sc->sc_info.sim_state == UMBIM_SIMSTATE_LOCKED)
> +             sc->sc_info.pin_state = UMBIM_PUK_REQUIRED;
> +     log(LOG_INFO, "%s: SIM %s\n", DEVNAM(sc),
> +         umbim_simstate(sc->sc_info.sim_state));
> +     if (sc->sc_info.sim_state == UMBIM_SIMSTATE_INITIALIZED)
> +             umbim_newstate(sc, UMBIM_S_SIMREADY, UMBIM_NS_DONT_DROP);
> +     return 1;
> +}
> +
> +int
> +umbim_decode_radio_state(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_radio_state_info *rs = data;
> +
> +     if (len < sizeof (*rs))
> +             return 0;
> +
> +     sc->sc_info.hw_radio_on =
> +         (letoh32(rs->hw_state) == UMBIM_RADIO_STATE_ON) ? 1 : 0;
> +     sc->sc_info.sw_radio_on =
> +         (letoh32(rs->sw_state) == UMBIM_RADIO_STATE_ON) ? 1 : 0;
> +     if (!sc->sc_info.hw_radio_on) {
> +             log(LOG_INFO, "%s: radio is off by rfkill switch\n",
> +                 DEVNAM(sc));
> +             /*
> +              * XXX do we need a time to poll the state of the rfkill switch
> +              *      or will the device send an unsolicited notification
> +              *      in case the state changes?
> +              */
> +             umbim_newstate(sc, UMBIM_S_OPEN, 0);
> +     } else if (!sc->sc_info.sw_radio_on) {
> +             log(LOG_INFO, "%s: radio is off\n", DEVNAM(sc));
> +             umbim_newstate(sc, UMBIM_S_OPEN, 0);
> +     } else
> +             umbim_newstate(sc, UMBIM_S_RADIO, UMBIM_NS_DONT_DROP);
> +     return 1;
> +}
> +
> +int
> +umbim_decode_pin(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_pin_info *pi = data;
> +     uint32_t        attempts_left;
> +
> +     if (len < sizeof (*pi))
> +             return 0;
> +
> +     attempts_left = letoh32(pi->remaining_attempts);
> +     if (attempts_left != 0xffffffff)
> +             sc->sc_info.pin_attempts_left = attempts_left;
> +
> +     switch (letoh32(pi->state)) {
> +     case UMBIM_PIN_STATE_UNLOCKED:
> +             sc->sc_info.pin_state = UMBIM_PIN_UNLOCKED;
> +             break;
> +     case UMBIM_PIN_STATE_LOCKED:
> +             switch (letoh32(pi->type)) {
> +             case UMBIM_PIN_TYPE_PIN1:
> +                     sc->sc_info.pin_state = UMBIM_PIN_REQUIRED;
> +                     break;
> +             case UMBIM_PIN_TYPE_PUK1:
> +                     sc->sc_info.pin_state = UMBIM_PUK_REQUIRED;
> +                     break;
> +             case UMBIM_PIN_TYPE_PIN2:
> +             case UMBIM_PIN_TYPE_PUK2:
> +                     /* Assume that PIN1 was accepted */
> +                     sc->sc_info.pin_state = UMBIM_PIN_UNLOCKED;
> +                     break;
> +             }
> +             break;
> +     }
> +     log(LOG_INFO, "%s: %s state %s (%d attempts left)\n",
> +         DEVNAM(sc), umbim_pin_type(letoh32(pi->type)),
> +         (letoh32(pi->state) == UMBIM_PIN_STATE_UNLOCKED) ?
> +             "unlocked" : "locked",
> +         letoh32(pi->remaining_attempts));
> +
> +     /*
> +      * In case the PIN was set after IFF_UP, retrigger the state machine
> +      */
> +     usb_add_task(sc->sc_udev, &sc->sc_umbim_task);
> +     return 1;
> +}
> +
> +int
> +umbim_decode_packet_service(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_packet_service_info *psi = data;
> +     int      state, highestclass;
> +     uint64_t up_speed, down_speed;
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     if (len < sizeof (*psi))
> +             return 0;
> +
> +     sc->sc_info.nwerror = letoh32(psi->nwerror);
> +     state = letoh32(psi->state);
> +     highestclass = letoh32(psi->highest_dataclass);
> +     up_speed = letoh64(psi->uplink_speed);
> +     down_speed = letoh64(psi->downlink_speed);
> +     if (sc->sc_info.packetstate  != state ||
> +         sc->sc_info.uplink_speed != up_speed ||
> +         sc->sc_info.downlink_speed != down_speed) {
> +             log(LOG_INFO, "%s: packet service ", DEVNAM(sc));
> +             if (sc->sc_info.packetstate  != state)
> +                     addlog("changed from %s to ",
> +                         umbim_packet_state(sc->sc_info.packetstate));
> +             addlog("%s, class %s, speed: %llu up / %llu down\n",
> +                 umbim_packet_state(state), umbim_dataclass(highestclass),
> +                 up_speed, down_speed);
> +     }
> +     sc->sc_info.packetstate = state;
> +     sc->sc_info.highestclass = highestclass;
> +     sc->sc_info.uplink_speed = up_speed;
> +     sc->sc_info.downlink_speed = down_speed;
> +
> +     if (sc->sc_info.regmode == UMBIM_REGMODE_AUTOMATIC) {
> +             /*
> +              * For devices using automatic registration mode, just proceed,
> +              * once registration has completed.
> +              */
> +             if (ifp->if_flags & IFF_UP) {
> +                     switch (sc->sc_info.regstate) {
> +                     case UMBIM_REGSTATE_HOME:
> +                     case UMBIM_REGSTATE_ROAMING:
> +                     case UMBIM_REGSTATE_PARTNER:
> +                             umbim_newstate(sc, UMBIM_S_ATTACHED,
> +                                 UMBIM_NS_DONT_DROP);
> +                             break;
> +                     default:
> +                             break;
> +                     }
> +             } else
> +                     umbim_newstate(sc, UMBIM_S_SIMREADY,
> +                         UMBIM_NS_DONT_RAISE);
> +     } else switch (sc->sc_info.packetstate) {
> +     case UMBIM_PKTSERVICE_STATE_ATTACHED:
> +             umbim_newstate(sc, UMBIM_S_ATTACHED, UMBIM_NS_DONT_DROP);
> +             break;
> +     case UMBIM_PKTSERVICE_STATE_DETACHED:
> +             umbim_newstate(sc, UMBIM_S_SIMREADY, UMBIM_NS_DONT_RAISE);
> +             break;
> +     }
> +     return 1;
> +}
> +
> +int
> +umbim_decode_signal_state(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_signal_state *ss = data;
> +     int      rssi;
> +
> +     if (len < sizeof (*ss))
> +             return 0;
> +
> +     if (letoh32(ss->rssi) == 99)
> +             rssi = UMBIM_VALUE_UNKNOWN;
> +     else {
> +             rssi = -113 + 2 * letoh32(ss->rssi);
> +             if (sc->sc_info.rssi != rssi &&
> +                 sc->sc_state >= UMBIM_S_CONNECTED)
> +                     log(LOG_INFO, "%s: rssi %d dBm\n", DEVNAM(sc), rssi);
> +     }
> +     sc->sc_info.rssi = rssi;
> +     sc->sc_info.ber = letoh32(ss->err_rate);
> +     if (sc->sc_info.ber == -99)
> +             sc->sc_info.ber = UMBIM_VALUE_UNKNOWN;
> +     return 1;
> +}
> +
> +int
> +umbim_decode_connect_info(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_connect_info *ci = data;
> +     int      act;
> +
> +     if (len < sizeof (*ci))
> +             return 0;
> +
> +     if (letoh32(ci->sessionid) != umbim_session_id) {
> +             DPRINTF("%s: discard connection info for session %u\n",
> +                 DEVNAM(sc), letoh32(ci->sessionid));
> +             return 1;
> +     }
> +     if (memcmp(ci->context, umbim_uuid_context_internet,
> +         sizeof (ci->context))) {
> +             DPRINTF("%s: discard connection info for other context\n",
> +                 DEVNAM(sc));
> +             return 1;
> +     }
> +     act = letoh32(ci->activation);
> +     if (sc->sc_info.activation != act) {
> +             log(LOG_INFO, "%s: connection %s\n", DEVNAM(sc),
> +                 umbim_activation(act));
> +             if (letoh32(ci->iptype) != UMBIM_CONTEXT_IPTYPE_DEFAULT &&
> +                 letoh32(ci->iptype) != UMBIM_CONTEXT_IPTYPE_IPV4)
> +                     log(LOG_DEBUG, "%s: got iptype %d connection\n",
> +                         DEVNAM(sc), letoh32(ci->iptype));
> +
> +             sc->sc_info.activation = act;
> +             sc->sc_info.nwerror = letoh32(ci->nwerror);
> +
> +             if (sc->sc_info.activation == UMBIM_ACTIVATION_STATE_ACTIVATED)
> +                     umbim_newstate(sc, UMBIM_S_CONNECTED,
> +                         UMBIM_NS_DONT_DROP);
> +             else if (sc->sc_info.activation ==
> +                 UMBIM_ACTIVATION_STATE_DEACTIVATED)
> +                     umbim_newstate(sc, UMBIM_S_ATTACHED, 0);
> +             /* else: other states are purely transitional */
> +     }
> +     return 1;
> +}
> +
> +int
> +umbim_decode_ip_configuration(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_cid_ip_configuration_info *ic = data;
> +     struct ifnet *ifp = GET_IFP(sc);
> +     int      s;
> +     uint32_t avail;
> +     uint32_t val;
> +     int      n, i;
> +     int      off;
> +     struct umbim_cid_ipv4_element ipv4elem;
> +     struct umbim_ifaddr uif;
> +     int      newifaddr = 0;
> +     int      ifaddr_changed = 0;
> +     int      state = -1;
> +
> +     if (len < sizeof (*ic))
> +             return 0;
> +     if (letoh32(ic->sessionid) != umbim_session_id) {
> +             DPRINTF("%s: ignore IP configration for session id %d\n",
> +                 DEVNAM(sc), letoh32(ic->sessionid));
> +             return 0;
> +     }
> +     s = splnet();
> +
> +     /*
> +      * IPv4 configuation
> +      */
> +     avail = letoh32(ic->ipv4_available);
> +     if (avail & UMBIM_IPCONF_HAS_ADDRINFO) {
> +             n = letoh32(ic->ipv4_naddr);
> +             off = letoh32(ic->ipv4_addroffs);
> +
> +             if (n == 0 || off + sizeof (ipv4elem) > len)
> +                     goto done;
> +
> +             /* Only pick the first one */
> +             memcpy(&ipv4elem, data + off, sizeof (ipv4elem));
> +             ipv4elem.addr = letoh32(ipv4elem.addr);
> +             ipv4elem.prefixlen = letoh32(ipv4elem.prefixlen);
> +
> +             umbim_get_ipv4addr(ifp, &uif);
> +             if (sc->sc_saved_ifaddr == NULL) {
> +                     if (uif.addr.sin_addr.s_addr == INADDR_ANY &&
> +                         uif.dst.sin_addr.s_addr == INADDR_ANY) {
> +                             newifaddr = 1;
> +                             /* No original addr */
> +                             sc->sc_saved_ifaddr = UMBIM_IFADDR_NONE;
> +                     } else {
> +                             sc->sc_saved_ifaddr = malloc(sizeof (uif),
> +                                 M_USBDEV, M_WAITOK | M_ZERO);
> +                             memcpy(sc->sc_saved_ifaddr, &uif, sizeof (uif));
> +                     }
> +                     newifaddr = 1;
> +             } else if (ipv4elem.addr != uif.addr.sin_addr.s_addr)
> +                     ifaddr_changed = 1;
> +             state = UMBIM_S_UP;
> +     }
> +     if (newifaddr || ifaddr_changed) {
> +             memset(&uif, 0, sizeof (uif));
> +             uif.addr.sin_family = AF_INET;
> +             uif.addr.sin_len = sizeof(uif.addr);
> +             uif.addr.sin_addr.s_addr = ipv4elem.addr;
> +             uif.dst.sin_family = AF_INET;
> +             uif.dst.sin_len = sizeof(uif.dst);
> +             if (avail & UMBIM_IPCONF_HAS_GWINFO) {
> +                     off = letoh32(ic->ipv4_gwoffs);
> +                     uif.dst.sin_addr.s_addr =
> +                         letoh32(*((uint32_t *)(data + off)));
> +             } else if (newifaddr)
> +                     uif.dst.sin_addr.s_addr = INADDR_BROADCAST;
> +             uif.netmask.sin_family = AF_INET;
> +             uif.netmask.sin_len = sizeof(uif.netmask);
> +             in_len2mask(&uif.netmask.sin_addr, ipv4elem.prefixlen);
> +             umbim_set_ipv4addr(ifp, &uif, newifaddr ? "new" : "change");

I still fail to understand why you keep track of the previous address.

> +     }
> +
> +     memset(sc->sc_info.ipv4dns, 0, sizeof (sc->sc_info.ipv4dns));
> +     if (avail & UMBIM_IPCONF_HAS_DNSINFO) {
> +             n = letoh32(ic->ipv4_ndnssrv);
> +             off = letoh32(ic->ipv4_dnssrvoffs);
> +             i = 0;
> +             while (n-- > 0) {
> +                     if (off + sizeof (uint32_t) > len)
> +                             break;
> +                     val = letoh32(*((uint32_t *)(data + off)));
> +                     if (i < UMBIM_MAX_DNSSRV)
> +                             sc->sc_info.ipv4dns[i++] = val;
> +                     off += sizeof (uint32_t);
> +             }
> +     }
> +
> +     if ((avail & UMBIM_IPCONF_HAS_MTUINFO)) {
> +             val = letoh32(ic->ipv4_mtu);
> +             if (ifp->if_hardmtu != val && val <= sc->sc_maxpktlen) {
> +                     ifp->if_hardmtu = val;
> +                     if (ifp->if_mtu > val)
> +                             ifp->if_mtu = val;
> +                     log(LOG_INFO, "%s: MTU is %d\n", DEVNAM(sc), val);
> +             }

Could you move that to SIOCSIFMTU, this would already be ready when a
userland tool will parse the messages.

> +     }
> +
> +     avail = letoh32(ic->ipv6_available);
> +     if (avail & UMBIM_IPCONF_HAS_ADDRINFO) {
> +             /* XXX FIXME: IPv6 configuation missing */
> +             log(LOG_INFO, "%s: ignoring IPv6 configuration\n", DEVNAM(sc));
> +     }
> +     if (state != -1)
> +             umbim_newstate(sc, state, 0);
> +
> +done:
> +     splx(s);
> +     return 1;
> +}
> +
> +void
> +umbim_rx(struct umbim_softc *sc)
> +{
> +     usbd_setup_xfer(sc->sc_rx_xfer, sc->sc_rx_pipe, sc, sc->sc_rx_buf,
> +         sc->sc_maxpktlen, USBD_SHORT_XFER_OK | USBD_NO_COPY,
> +         USBD_NO_TIMEOUT, umbim_rxeof);
> +     usbd_transfer(sc->sc_rx_xfer);
> +}
> +
> +void
> +umbim_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
> +{
> +     struct umbim_softc *sc = priv;
> +     struct ifnet *ifp = GET_IFP(sc);
> +
> +     if (usbd_is_dying(sc->sc_udev) || !(ifp->if_flags & IFF_RUNNING))
> +             return;
> +
> +     if (status != USBD_NORMAL_COMPLETION) {
> +             if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
> +                     return;
> +             DPRINTF("%s: rx error: %s\n", DEVNAM(sc), usbd_errstr(status));
> +             if (status == USBD_STALLED)
> +                     usbd_clear_endpoint_stall_async(sc->sc_rx_pipe);
> +             if (++sc->sc_rx_nerr > 100) {
> +                     log(LOG_ERR, "%s: too many rx errors, disabling\n",
> +                         DEVNAM(sc));
> +                     usbd_deactivate(sc->sc_udev);
> +             }
> +     } else {
> +             sc->sc_rx_nerr = 0;
> +             umbim_decap(sc, xfer);
> +     }
> +
> +     umbim_rx(sc);
> +     return;
> +}
> +
> +int
> +umbim_encap(struct umbim_softc *sc, struct mbuf *m)
> +{
> +     struct ncm_header16 *hdr;
> +     struct ncm_pointer16 *ptr;
> +     usbd_status  err;
> +     int      len;
> +
> +     KASSERT(sc->sc_tx_m == NULL);
> +
> +     hdr = sc->sc_tx_buf;
> +     ptr = (struct ncm_pointer16 *)(hdr + 1);
> +
> +     USETDW(hdr->dwSignature, NCM_HDR16_SIG);
> +     USETW(hdr->wHeaderLength, sizeof (*hdr));
> +     USETW(hdr->wSequence, sc->sc_tx_seq);
> +     sc->sc_tx_seq++;
> +     USETW(hdr->wNdpIndex, sizeof (*hdr));
> +
> +     len = m->m_pkthdr.len;
> +     USETDW(ptr->dwSignature, UMBIM_NCM_NTH16_SIG(umbim_session_id));
> +     USETW(ptr->wLength, sizeof (*ptr));
> +     USETW(ptr->wNextNdpIndex, 0);
> +     USETW(ptr->dgram[0].wDatagramIndex, UMBIM_HDR16_LEN);
> +     USETW(ptr->dgram[0].wDatagramLen, len);
> +     USETW(ptr->dgram[1].wDatagramIndex, 0);
> +     USETW(ptr->dgram[1].wDatagramLen, 0);
> +
> +     m_copydata(m, 0, len, (caddr_t)(ptr + 1));
> +     sc->sc_tx_m = m;
> +     len += UMBIM_HDR16_LEN;
> +     USETW(hdr->wBlockLength, len);
> +
> +     DPRINTFN(3, "%s: encap %d bytes\n", DEVNAM(sc), len);
> +     DDUMPN(5, sc->sc_tx_buf, len);
> +     usbd_setup_xfer(sc->sc_tx_xfer, sc->sc_tx_pipe, sc, sc->sc_tx_buf, len,
> +         USBD_FORCE_SHORT_XFER | USBD_NO_COPY, umbim_xfer_tout, umbim_txeof);
> +     err = usbd_transfer(sc->sc_tx_xfer);
> +     if (err != USBD_IN_PROGRESS) {
> +             DPRINTF("%s: start tx error: %s\n", DEVNAM(sc),
> +                 usbd_errstr(err));
> +             return 0;
> +     }
> +     return 1;
> +}
> +
> +void
> +umbim_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
> +{
> +     struct umbim_softc *sc = priv;
> +     struct ifnet *ifp = GET_IFP(sc);
> +     int      s;
> +
> +     s = splnet();
> +     ifp->if_flags &= ~IFF_OACTIVE;
> +     ifp->if_timer = 0;
> +
> +     m_freem(sc->sc_tx_m);
> +     sc->sc_tx_m = NULL;
> +
> +     if (status != USBD_NORMAL_COMPLETION) {
> +             if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) {
> +                     ifp->if_oerrors++;
> +                     DPRINTF("%s: tx error: %s\n", DEVNAM(sc),
> +                         usbd_errstr(status));
> +                     if (status == USBD_STALLED)
> +                             usbd_clear_endpoint_stall_async(sc->sc_tx_pipe);
> +             }
> +     } else {
> +             ifp->if_opackets++;
> +             if (IFQ_IS_EMPTY(&ifp->if_snd) == 0)
> +                     umbim_start(ifp);
> +     }
> +
> +     splx(s);
> +}
> +
> +void
> +umbim_decap(struct umbim_softc *sc, struct usbd_xfer *xfer)
> +{
> +     struct ifnet *ifp = GET_IFP(sc);
> +     int      s;
> +     void    *buf;
> +     uint32_t len;
> +     char    *dp;
> +     struct ncm_header16 *hdr16;
> +     struct ncm_header32 *hdr32;
> +     struct ncm_pointer16 *ptr16;
> +     struct ncm_pointer16_dgram *dgram16;
> +     struct ncm_pointer32_dgram *dgram32;
> +     uint32_t hsig, psig;
> +     int      hlen, blen;
> +     int      ptrlen, ptroff, dgentryoff;
> +     uint32_t doff, dlen;
> +     struct mbuf_list ml = MBUF_LIST_INITIALIZER();
> +     struct mbuf *m;
> +
> +     usbd_get_xfer_status(xfer, NULL, &buf, &len, NULL);
> +     DPRINTFN(4, "%s: recv %d bytes\n", DEVNAM(sc), len);
> +     DDUMPN(5, buf, len);
> +     s = splnet();
> +     if (len < sizeof (*hdr16))
> +             goto toosmall;
> +     if (len > sc->sc_maxpktlen) {
> +             DPRINTF("%s: packet too large (%d)\n", DEVNAM(sc), len);
> +             goto fail;
> +     }
> +
> +     hdr16 = (struct ncm_header16 *)buf;
> +     hsig = UGETDW(hdr16->dwSignature);
> +     hlen = UGETW(hdr16->wHeaderLength);
> +     switch (hsig) {
> +     case NCM_HDR16_SIG:
> +             blen = UGETW(hdr16->wBlockLength);
> +             if (hlen != sizeof (*hdr16)) {
> +                     DPRINTF("%s: bad header len %d for NTH16 (exp %zu)\n",
> +                         DEVNAM(sc), hlen, sizeof (*hdr16));
> +                     goto fail;
> +             }
> +             break;
> +     case NCM_HDR32_SIG:
> +             hdr32 = (struct ncm_header32 *)hdr16;
> +             blen = UGETDW(hdr32->dwBlockLength);
> +             if (hlen != sizeof (*hdr32)) {
> +                     DPRINTF("%s: bad header len %d for NTH32 (exp %zu)\n",
> +                         DEVNAM(sc), hlen, sizeof (*hdr32));
> +                     goto fail;
> +             }
> +             break;
> +     default:
> +             DPRINTF("%s: unsupported NCM header signature (0x%08x)\n",
> +                 DEVNAM(sc), hsig);
> +             goto fail;
> +     }
> +     if (len < hlen)
> +             goto toosmall;
> +     if (len < blen) {
> +             DPRINTF("%s: bad NTB len (%d) for %d bytes of data\n",
> +                 DEVNAM(sc), blen, len);
> +             goto fail;
> +     }
> +
> +     ptroff = hlen;
> +     ptr16 = (struct ncm_pointer16 *)(buf + ptroff);
> +     psig = UGETDW(ptr16->dwSignature);
> +     ptrlen = UGETW(ptr16->wLength);
> +     if (len < ptrlen + ptroff)
> +             goto toosmall;
> +     if (!UMBIM_NCM_NTH16_ISISG(psig) && !UMBIM_NCM_NTH32_ISISG(psig)) {
> +             DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n",
> +                 DEVNAM(sc), psig);
> +             goto fail;
> +     }
> +
> +     switch (hsig) {
> +     case NCM_HDR16_SIG:
> +             dgentryoff = offsetof(struct ncm_pointer16, dgram);
> +             break;
> +     case NCM_HDR32_SIG:
> +             dgentryoff = offsetof(struct ncm_pointer32, dgram);
> +             break;
> +     default:
> +             goto fail;
> +     }
> +
> +     while (dgentryoff < ptrlen) {
> +             switch (hsig) {
> +             case NCM_HDR16_SIG:
> +                     if (ptroff + dgentryoff < sizeof (*dgram16))
> +                             goto done;
> +                     dgram16 = (struct ncm_pointer16_dgram *)
> +                         (buf + ptroff + dgentryoff);
> +                     dgentryoff += sizeof (*dgram16);
> +                     dlen = UGETW(dgram16->wDatagramLen);
> +                     doff = UGETW(dgram16->wDatagramIndex);
> +                     break;
> +             case NCM_HDR32_SIG:
> +                     if (ptroff + dgentryoff < sizeof (*dgram32))
> +                             goto done;
> +                     dgram32 = (struct ncm_pointer32_dgram *)
> +                         (buf + ptroff + dgentryoff);
> +                     dgentryoff += sizeof (*dgram32);
> +                     dlen = UGETDW(dgram32->dwDatagramLen);
> +                     doff = UGETDW(dgram32->dwDatagramIndex);
> +                     break;
> +             default:
> +                     ifp->if_ierrors++;
> +                     goto done;
> +             }
> +
> +             /* Terminating zero entry */
> +             if (dlen == 0 && doff == 0)
> +                     break;
> +             if (len < dlen + doff) {
> +                     /* Skip giant datagram but continue processing */
> +                     DPRINTF("%s: datagram too large (%d @ off %d)\n",
> +                         DEVNAM(sc), dlen, doff);
> +                     continue;
> +             }
> +
> +             dp = buf + doff;
> +             DPRINTFN(3, "%s: decap %d bytes\n", DEVNAM(sc), dlen);
> +             m = m_devget(dp, dlen, 0);
> +             if (m == NULL) {
> +                     ifp->if_iqdrops++;
> +                     continue;
> +             }
> +
> +             ml_enqueue(&ml, m);
> +     }
> +done:
> +     if_input(ifp, &ml);
> +     splx(s);
> +     return;
> +toosmall:
> +     DPRINTF("%s: packet too small (%d)\n", DEVNAM(sc), len);
> +fail:
> +     ifp->if_ierrors++;
> +     splx(s);
> +}
> +
> +usbd_status
> +umbim_send_encap_command(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct usbd_xfer *xfer;
> +     usb_device_request_t req;
> +     char *buf;
> +
> +     if (len > sc->sc_ctrl_len)
> +             return USBD_INVAL;
> +
> +     if ((xfer = usbd_alloc_xfer(sc->sc_udev)) == NULL)
> +             return USBD_NOMEM;
> +     if ((buf = usbd_alloc_buffer(xfer, len)) == NULL) {
> +             usbd_free_xfer(xfer);
> +             return USBD_NOMEM;
> +     }
> +     memcpy(buf, data, len);

Why do you allocate an xfer for every command?  When you initialize the
interrut pipe you already know that you're going to use a single xfer
because commands are synchronous.

You could also avoid the memcpy by allocating DMA-reachable memory
directly instead of using malloc(9) for the command buffer.

> +
> +     /* XXX FIXME: if (total len > sc->sc_ctrl_len) => must fragment */
> +     req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
> +     req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
> +     USETW(req.wValue, 0);
> +     USETW(req.wIndex, sc->sc_ctrl_ifaceno);
> +     USETW(req.wLength, len);
> +     DELAY(umbim_delay);
> +     return usbd_request_async(xfer, &req, NULL, NULL);
> +}
> +
> +int
> +umbim_get_encap_response(struct umbim_softc *sc, void *buf, int *len)
> +{
> +     usb_device_request_t req;
> +     usbd_status err;
> +
> +     req.bmRequestType = UT_READ_CLASS_INTERFACE;
> +     req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
> +     USETW(req.wValue, 0);
> +     USETW(req.wIndex, sc->sc_ctrl_ifaceno);
> +     USETW(req.wLength, *len);
> +     /* XXX FIXME: re-assemble fragments */
> +
> +     DELAY(umbim_delay);
> +     err = usbd_do_request_flags(sc->sc_udev, &req, buf, USBD_SHORT_XFER_OK,
> +         len, umbim_xfer_tout);
> +     if (err == USBD_NORMAL_COMPLETION)
> +             return 1;
> +     DPRINTF("%s: ctrl recv: %s\n", DEVNAM(sc), usbd_errstr(err));
> +     return 0;
> +}
> +
> +void
> +umbim_ctrl_msg(struct umbim_softc *sc, uint32_t req, void *data, int len)
> +{
> +     uint32_t tid;
> +     struct umbim_msghdr *hdr = data;
> +     usbd_status err;
> +     int      s;
> +
> +     assertwaitok();
> +     if (usbd_is_dying(sc->sc_udev))
> +             return;
> +     if (len < sizeof (*hdr))
> +             return;
> +     tid = ++sc->sc_tid;
> +
> +     hdr->type = htole32(req);
> +     hdr->len = htole32(len);
> +     hdr->tid = htole32(tid);
> +
> +#ifdef UMBIM_DEBUG
> +     if (umbim_debug) {
> +             const char *op, *str;
> +             if (req == UMBIM_COMMAND_MSG) {
> +                     struct umbim_h2f_cmd *c = data;
> +                     if (letoh32(c->op) == UMBIM_CMDOP_SET)
> +                             op = "set";
> +                     else
> +                             op = "qry";
> +                     str = umbim_cid2str(letoh32(c->cid));
> +             } else {
> +                     op = "snd";
> +                     str = umbim_request2str(req);
> +             }
> +             DPRINTF("%s: -> %s %s (tid %u)\n", DEVNAM(sc), op, str, tid);
> +     }
> +#endif
> +     s = splusb();
> +     err = umbim_send_encap_command(sc, data, len);
> +     splx(s);
> +     if (err != USBD_NORMAL_COMPLETION) {
> +             log(LOG_ERR, "%s: send %s msg (tid %u) failed: %s\n",
> +                 DEVNAM(sc), umbim_request2str(req), tid, usbd_errstr(err));
> +
> +             /* will affect other transactions, too */
> +             usbd_abort_pipe(sc->sc_udev->default_pipe);
> +     } else {
> +             DPRINTFN(2, "%s: sent %s (tid %u)\n", DEVNAM(sc),
> +                 umbim_request2str(req), tid);
> +             DDUMPN(3, data, len);
> +     }
> +     return;
> +}
> +
> +void
> +umbim_open(struct umbim_softc *sc)
> +{
> +     struct umbim_h2f_openmsg msg;
> +
> +     memset(&msg, 0, sizeof (msg));
> +     msg.maxlen = htole32(sc->sc_ctrl_len);
> +     umbim_ctrl_msg(sc, UMBIM_OPEN_MSG, &msg, sizeof (msg));
> +     return;
> +}
> +
> +void
> +umbim_close(struct umbim_softc *sc)
> +{
> +     struct umbim_h2f_closemsg msg;
> +
> +     memset(&msg, 0, sizeof (msg));
> +     umbim_ctrl_msg(sc, UMBIM_CLOSE_MSG, &msg, sizeof (msg));
> +}
> +
> +int
> +umbim_setpin(struct umbim_softc *sc, int op, int is_puk, void *pin, int 
> pinlen,
> +    void *newpin, int newpinlen)
> +{
> +     struct umbim_cid_pin cp;
> +     int      off;
> +
> +     if (pinlen == 0)
> +             return 0;
> +     if (pinlen < 0 || pinlen > UMBIM_PIN_MAXLEN ||
> +         newpinlen < 0 || newpinlen > UMBIM_PIN_MAXLEN ||
> +         op < 0 || op > UMBIM_PIN_OP_CHANGE ||
> +         (is_puk && op != UMBIM_PIN_OP_ENTER))
> +             return EINVAL;
> +
> +     memset(&cp, 0, sizeof (cp));
> +     cp.type = htole32(is_puk ? UMBIM_PIN_TYPE_PUK1 : UMBIM_PIN_TYPE_PIN1);
> +
> +     off = offsetof(struct umbim_cid_pin, data);
> +     if (!umbim_addstr(&cp, sizeof (cp), &off, pin, pinlen,
> +         &cp.pin_offs, &cp.pin_size))
> +             return EINVAL;
> +
> +     cp.op  = htole32(op);
> +     if (newpinlen) {
> +             if (!umbim_addstr(&cp, sizeof (cp), &off, newpin, newpinlen,
> +                 &cp.newpin_offs, &cp.newpin_size))
> +                     return EINVAL;
> +     } else {
> +             if ((op == UMBIM_PIN_OP_CHANGE) || is_puk)
> +                     return EINVAL;
> +             if (!umbim_addstr(&cp, sizeof (cp), &off, NULL, 0,
> +                 &cp.newpin_offs, &cp.newpin_size))
> +                     return EINVAL;
> +     }
> +     umbim_cmd(sc, UMBIM_CID_PIN, UMBIM_CMDOP_SET, &cp, off);
> +     return 0;
> +}
> +
> +void
> +umbim_setdataclass(struct umbim_softc *sc)
> +{
> +     struct umbim_cid_registration_state rs;
> +     uint32_t         classes;
> +
> +     if (sc->sc_info.supportedclasses == UMBIM_DATACLASS_NONE)
> +             return;
> +
> +     memset(&rs, 0, sizeof (rs));
> +     rs.regaction = htole32(UMBIM_REGACTION_AUTOMATIC);
> +     classes = sc->sc_info.supportedclasses;
> +     if (sc->sc_info.preferredclasses != UMBIM_DATACLASS_NONE)
> +             classes &= sc->sc_info.preferredclasses;
> +     rs.data_class = htole32(classes);
> +     umbim_cmd(sc, UMBIM_CID_REGISTER_STATE, UMBIM_CMDOP_SET, &rs,
> +         sizeof (rs));
> +}
> +
> +void
> +umbim_radio(struct umbim_softc *sc, int on)
> +{
> +     struct umbim_cid_radio_state s;
> +
> +     DPRINTF("%s: set radio %s\n", DEVNAM(sc), on ? "on" : "off");
> +     memset(&s, 0, sizeof (s));
> +     s.state = htole32(on ? UMBIM_RADIO_STATE_ON : UMBIM_RADIO_STATE_OFF);
> +     umbim_cmd(sc, UMBIM_CID_RADIO_STATE, UMBIM_CMDOP_SET, &s, sizeof (s));
> +}
> +
> +void
> +umbim_packet_service(struct umbim_softc *sc, int attach)
> +{
> +     struct umbim_cid_packet_service s;
> +
> +     DPRINTF("%s: %s packet service\n", DEVNAM(sc),
> +         attach ? "attach" : "detach");
> +     memset(&s, 0, sizeof (s));
> +     s.action = htole32(attach ?
> +         UMBIM_PKTSERVICE_ACTION_ATTACH : UMBIM_PKTSERVICE_ACTION_DETACH);
> +     umbim_cmd(sc, UMBIM_CID_PACKET_SERVICE, UMBIM_CMDOP_SET, &s, sizeof 
> (s));
> +}
> +
> +void
> +umbim_connect(struct umbim_softc *sc)
> +{
> +     if (sc->sc_info.regstate == UMBIM_REGSTATE_ROAMING && !sc->sc_roaming) {
> +             log(LOG_INFO, "%s: connection disabled in roaming network\n",
> +                 DEVNAM(sc));
> +             return;
> +     }
> +     log(LOG_DEBUG, "%s: connecting ...\n", DEVNAM(sc));
> +     umbim_send_connect(sc, UMBIM_CONNECT_ACTIVATE);
> +}
> +
> +void
> +umbim_disconnect(struct umbim_softc *sc)
> +{
> +     log(LOG_DEBUG, "%s: disconnecting ...\n", DEVNAM(sc));
> +     umbim_send_connect(sc, UMBIM_CONNECT_DEACTIVATE);
> +}
> +
> +void
> +umbim_send_connect(struct umbim_softc *sc, int command)
> +{
> +     struct umbim_cid_connect *c;
> +     int      off;
> +
> +     /* Too large or the stack */
> +     c = malloc(sizeof (*c), M_USBDEV, M_WAIT|M_ZERO);
> +     c->sessionid = htole32(umbim_session_id);
> +     c->command = htole32(command);
> +     off = offsetof(struct umbim_cid_connect, data);
> +     if (!umbim_addstr(c, sizeof (*c), &off, sc->sc_info.apn,
> +         sc->sc_info.apnlen, &c->access_offs, &c->access_size))
> +             goto done;
> +     /* XXX FIXME: support user name and passphrase */
> +     c->user_offs = htole32(0);
> +     c->user_size = htole32(0);
> +     c->passwd_offs = htole32(0);
> +     c->passwd_size = htole32(0);
> +     c->authprot = htole32(UMBIM_AUTHPROT_NONE);
> +     c->compression = htole32(UMBIM_COMPRESSION_NONE);
> +     c->iptype = htole32(UMBIM_CONTEXT_IPTYPE_IPV4);
> +     memcpy(c->context, umbim_uuid_context_internet, sizeof (c->context));
> +     umbim_cmd(sc, UMBIM_CID_CONNECT, UMBIM_CMDOP_SET, c, off);
> +done:
> +     free(c, M_USBDEV, sizeof (*c));
> +     return;
> +}
> +
> +void
> +umbim_qry_ipconfig(struct umbim_softc *sc)
> +{
> +     struct umbim_cid_ip_configuration_info ipc;
> +
> +     memset(&ipc, 0, sizeof (ipc));
> +     ipc.sessionid = htole32(umbim_session_id);
> +     umbim_cmd(sc, UMBIM_CID_IP_CONFIGURATION, UMBIM_CMDOP_QRY,
> +         &ipc, sizeof (ipc));
> +}
> +
> +void
> +umbim_cmd(struct umbim_softc *sc, int cid, int op, void *data, int len)
> +{
> +     struct umbim_h2f_cmd *cmd;
> +     int     totlen;
> +
> +     /* XXX FIXME support sending fragments */
> +     if (sizeof (*cmd) + len > sc->sc_ctrl_len) {
> +             DPRINTF("%s: set %s msg too long: cannot send\n",
> +                 DEVNAM(sc), umbim_cid2str(cid));
> +             return;
> +     }
> +     cmd = sc->sc_ctrl_msg;
> +     memset(cmd, 0, sizeof (*cmd));
> +     cmd->frag.nfrag = htole32(1);
> +     memcpy(cmd->devid, umbim_uuid_basic_connect, sizeof (cmd->devid));
> +     cmd->cid = htole32(cid);
> +     cmd->op = htole32(op);
> +     cmd->infolen = htole32(len);
> +     totlen = sizeof (*cmd);
> +     if (len > 0) {
> +             memcpy(cmd + 1, data, len);
> +             totlen += len;
> +     }
> +     umbim_ctrl_msg(sc, UMBIM_COMMAND_MSG, cmd, totlen);
> +}
> +
> +void
> +umbim_command_done(struct umbim_softc *sc, void *data, int len)
> +{
> +     struct umbim_f2h_cmddone *cmd = data;
> +     uint32_t status;
> +     uint32_t cid;
> +     uint32_t infolen;
> +
> +     if (len < sizeof (*cmd)) {
> +             DPRINTF("%s: discard short %s messsage\n", DEVNAM(sc),
> +                 umbim_request2str(letoh32(cmd->hdr.type)));
> +             return;
> +     }
> +     cid = letoh32(cmd->cid);
> +     if (memcmp(cmd->devid, umbim_uuid_basic_connect, sizeof (cmd->devid))) {
> +             DPRINTF("%s: discard %s messsage for other UUID '%s'\n",
> +                 DEVNAM(sc), umbim_request2str(letoh32(cmd->hdr.type)),
> +                 umbim_uuid2str(cmd->devid));
> +             return;
> +     }
> +
> +     status = letoh32(cmd->status);
> +     switch (status) {
> +     case UMBIM_STATUS_SUCCESS:
> +             break;
> +     case UMBIM_STATUS_NOT_INITIALIZED:
> +             log(LOG_ERR, "%s: SIM not initialized (PIN missing)\n",
> +                 DEVNAM(sc));
> +             return;
> +     case UMBIM_STATUS_PIN_REQUIRED:
> +             sc->sc_info.pin_state = UMBIM_PIN_REQUIRED;
> +             /*FALLTHROUGH*/
> +     default:
> +             log(LOG_ERR, "%s: set/qry %s failed: %s\n", DEVNAM(sc),
> +                 umbim_cid2str(cid), umbim_status2str(status));
> +             return;
> +     }
> +
> +     infolen = letoh32(cmd->infolen);
> +     if (len < sizeof (*cmd) + infolen) {
> +             DPRINTF("%s: discard truncated %s messsage (want %d, got %d)\n",
> +                 DEVNAM(sc), umbim_cid2str(cid),
> +                 (int)sizeof (*cmd) + infolen, len);
> +             return;
> +     }
> +     DPRINTFN(2, "%s: set/qry %s done\n", DEVNAM(sc), umbim_cid2str(cid));
> +     umbim_decode_cid(sc, cid, cmd->info, infolen);
> +}
> +
> +void
> +umbim_decode_cid(struct umbim_softc *sc, uint32_t cid, void *data, int len)
> +{
> +     int      ok = 1;
> +
> +     switch (cid) {
> +     case UMBIM_CID_DEVICE_CAPS:
> +             ok = umbim_decode_devices_caps(sc, data, len);
> +             break;
> +     case UMBIM_CID_SUBSCRIBER_READY_STATUS:
> +             ok = umbim_decode_subscriber_status(sc, data, len);
> +             break;
> +     case UMBIM_CID_RADIO_STATE:
> +             ok = umbim_decode_radio_state(sc, data, len);
> +             break;
> +     case UMBIM_CID_PIN:
> +             ok = umbim_decode_pin(sc, data, len);
> +             break;
> +     case UMBIM_CID_REGISTER_STATE:
> +             ok = umbim_decode_register_state(sc, data, len);
> +             break;
> +     case UMBIM_CID_PACKET_SERVICE:
> +             ok = umbim_decode_packet_service(sc, data, len);
> +             break;
> +     case UMBIM_CID_SIGNAL_STATE:
> +             ok = umbim_decode_signal_state(sc, data, len);
> +             break;
> +     case UMBIM_CID_CONNECT:
> +             ok = umbim_decode_connect_info(sc, data, len);
> +             break;
> +     case UMBIM_CID_IP_CONFIGURATION:
> +             ok = umbim_decode_ip_configuration(sc, data, len);
> +             break;
> +     default:
> +             /*
> +              * Note: the above list is incomplete and only contains
> +              *      mandatory CIDs from the BASIC_CONNECT set.
> +              *      So alternate values are not unusual.
> +              */
> +             DPRINTFN(4, "%s: ignore %s\n", DEVNAM(sc), umbim_cid2str(cid));
> +             break;
> +     }
> +     if (!ok)
> +             DPRINTF("%s: discard %s with bad info length %d\n",
> +                 DEVNAM(sc), umbim_cid2str(cid), len);
> +     return;
> +}
> +
> +void
> +umbim_intr(struct usbd_xfer *xfer, void *priv, usbd_status status)
> +{
> +     struct umbim_softc *sc = priv;
> +     int      total_len;
> +
> +     if (status != USBD_NORMAL_COMPLETION) {
> +             DPRINTF("%s: notification error: %s\n", DEVNAM(sc),
> +                 usbd_errstr(status));
> +             if (status == USBD_STALLED)
> +                     usbd_clear_endpoint_stall_async(sc->sc_ctrl_pipe);
> +             return;
> +     }
> +     usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL);
> +     if (total_len < UCDC_NOTIFICATION_LENGTH) {
> +             DPRINTF("%s: short notification (%d<%d)\n", DEVNAM(sc),
> +                 total_len, UCDC_NOTIFICATION_LENGTH);
> +                 return;
> +     }
> +     if (sc->sc_intr_msg.bmRequestType != UCDC_NOTIFICATION) {
> +             DPRINTF("%s: unexpected notification (type=0x%02x)\n",
> +                 DEVNAM(sc), sc->sc_intr_msg.bmRequestType);
> +             return;
> +     }
> +
> +     switch (sc->sc_intr_msg.bNotification) {
> +     case UCDC_N_NETWORK_CONNECTION:
> +             log(LOG_DEBUG, "%s: network %sconnected\n", DEVNAM(sc),
> +                 UGETW(sc->sc_intr_msg.wValue) ? "" : "dis");
> +             break;
> +     case UCDC_N_RESPONSE_AVAILABLE:
> +             DPRINTFN(2, "%s: umbim_intr: response available\n", DEVNAM(sc));
> +             ++sc->sc_nresp;
> +             usb_add_task(sc->sc_udev, &sc->sc_get_response_task);
> +             break;
> +     case UCDC_N_CONNECTION_SPEED_CHANGE:
> +             DPRINTFN(2, "%s: umbim_intr: connection speed changed\n",
> +                 DEVNAM(sc));
> +             break;
> +     default:
> +             DPRINTF("%s: unexpected notifiation (0x%02x)\n",
> +                 DEVNAM(sc), sc->sc_intr_msg.bNotification);
> +             break;
> +     }
> +}
> +
> +/*
> + * Diagnostic routines
> + */
> +char *
> +umbim_ntop(struct sockaddr *sa)
> +{
> +#define NUMBUFS              4
> +     static char astr[NUMBUFS][INET_ADDRSTRLEN];
> +     static unsigned nbuf = 0;
> +     char    *s;
> +
> +     s = astr[nbuf++];
> +     if (nbuf >= NUMBUFS)
> +             nbuf = 0;
> +
> +     switch (sa->sa_family) {
> +     case AF_INET:
> +     default:
> +             inet_ntop(AF_INET, &satosin(sa)->sin_addr, s, sizeof (astr[0]));
> +             break;
> +     case AF_INET6:
> +             inet_ntop(AF_INET6, &satosin6(sa)->sin6_addr, s,
> +                 sizeof (astr[0]));
> +             break;
> +     }
> +     return s;
> +}

Please do not introduce this function.  The generic one has been removed
in order to stop using static buffers, introducing a new one will on
lead to confusion.

> +#ifdef UMBIM_DEBUG
> +char *
> +umbim_uuid2str(uint8_t uuid[UMBIM_UUID_LEN])
> +{
> +     static char uuidstr[2 * UMBIM_UUID_LEN + 5];
> +
> +#define UUID_BFMT    "%02X"
> +#define UUID_SEP     "-"
> +     snprintf(uuidstr, sizeof (uuidstr),
> +         UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_SEP
> +         UUID_BFMT UUID_BFMT UUID_SEP
> +         UUID_BFMT UUID_BFMT UUID_SEP
> +         UUID_BFMT UUID_BFMT UUID_SEP
> +         UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT,
> +         uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5],
> +         uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11],
> +         uuid[12], uuid[13], uuid[14], uuid[15]);
> +     return uuidstr;
> +}
> +
> +void
> +umbim_dump(void *buf, int len)
> +{
> +     int      i = 0;
> +     uint8_t *c = buf;
> +
> +     if (len == 0)
> +             return;
> +     while (i < len) {
> +             if ((i % 16) == 0) {
> +                     if (i > 0)
> +                             addlog("\n");
> +                     log(LOG_DEBUG, "%4d:  ", i);
> +             }
> +             addlog(" %02x", *c);
> +             c++;
> +             i++;
> +     }
> +     addlog("\n");
> +}
> +#endif /* UMBIM_DEBUG */
> Index: sys/dev/usb/if_umbim.h
> ===================================================================
> RCS file: sys/dev/usb/if_umbim.h
> diff -N sys/dev/usb/if_umbim.h
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ sys/dev/usb/if_umbim.h    1 Jun 2016 14:32:19 -0000
> @@ -0,0 +1,375 @@
> +/*   $OpenBSD$ */
> +
> +/*
> + * Copyright (c) 2016 genua mbH
> + * All rights reserved.
> + *
> + * Permission to use, copy, modify, and distribute this software for any
> + * purpose with or without fee is hereby granted, provided that the above
> + * copyright notice and this permission notice appear in all copies.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
> + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
> + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
> + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
> + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> + */
> +
> +/*
> + * Mobile Broadband Interface Model
> + * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
> + */
> +
> +struct umbim_valdescr {
> +     int      val;
> +     char    *descr;
> +};
> +
> +static const char *
> +umbim_val2descr(const struct umbim_valdescr *vdp, int val)
> +{
> +     static char sval[32];
> +
> +     while (vdp->descr != NULL) {
> +             if (vdp->val == val)
> +                     return vdp->descr;
> +             vdp++;
> +     }
> +     snprintf(sval, sizeof (sval), "#%d", val);
> +     return sval;
> +}
> +
> +#define UMBIM_REGSTATE_DESCRIPTIONS {                                \
> +     { UMBIM_REGSTATE_UNKNOWN,       "unknown" },            \
> +     { UMBIM_REGSTATE_DEREGISTERED,  "not registered" },     \
> +     { UMBIM_REGSTATE_SEARCHING,     "searching" },          \
> +     { UMBIM_REGSTATE_HOME,          "home network" },       \
> +     { UMBIM_REGSTATE_ROAMING,       "roaming network" },    \
> +     { UMBIM_REGSTATE_PARTNER,       "partner network" },    \
> +     { UMBIM_REGSTATE_DENIED,        "access denied" },      \
> +     { 0, NULL } }
> +
> +#define UMBIM_DATACLASS_DESCRIPTIONS {                                       
> \
> +     { UMBIM_DATACLASS_NONE,                         "none" },       \
> +     { UMBIM_DATACLASS_GPRS,                         "GPRS" },       \
> +     { UMBIM_DATACLASS_EDGE,                         "EDGE" },       \
> +     { UMBIM_DATACLASS_UMTS,                         "UMTS" },       \
> +     { UMBIM_DATACLASS_HSDPA,                        "HSDPA" },      \
> +     { UMBIM_DATACLASS_HSUPA,                        "HSUPA" },      \
> +     { UMBIM_DATACLASS_HSDPA|UMBIM_DATACLASS_HSUPA,  "HSPA" },       \
> +     { UMBIM_DATACLASS_LTE,                          "LTE" },        \
> +     { UMBIM_DATACLASS_1XRTT,                        "CDMA2000" },   \
> +     { UMBIM_DATACLASS_1XEVDO,                       "CDMA2000" },   \
> +     { UMBIM_DATACLASS_1XEVDO_REV_A,                 "CDMA2000" },   \
> +     { UMBIM_DATACLASS_1XEVDV,                       "CDMA2000" },   \
> +     { UMBIM_DATACLASS_3XRTT,                        "CDMA2000" },   \
> +     { UMBIM_DATACLASS_1XEVDO_REV_B,                 "CDMA2000" },   \
> +     { UMBIM_DATACLASS_UMB,                          "CDMA2000" },   \
> +     { UMBIM_DATACLASS_CUSTOM,                       "custom" },     \
> +     { 0, NULL } }
> +
> +#define UMBIM_1TO1_DESCRIPTION(m)    { (m), #m }
> +#define UMBIM_MESSAGES_DESCRIPTIONS {                                \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_OPEN_MSG),                 \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CLOSE_MSG),                \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_COMMAND_MSG),              \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_HOST_ERROR_MSG),           \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_OPEN_DONE),                \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CLOSE_DONE),               \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_COMMAND_DONE),             \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_FUNCTION_ERROR_MSG),       \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_INDICATE_STATUS_MSG),      \
> +     { 0, NULL } }
> +
> +#define UMBIM_STATUS_DESCRIPTION(m)  { UMBIM_STATUS_ ## m, #m }
> +#define UMBIM_STATUS_DESCRIPTIONS {                                  \
> +     UMBIM_STATUS_DESCRIPTION(SUCCESS),                              \
> +     UMBIM_STATUS_DESCRIPTION(BUSY),                                 \
> +     UMBIM_STATUS_DESCRIPTION(FAILURE),                              \
> +     UMBIM_STATUS_DESCRIPTION(SIM_NOT_INSERTED),                     \
> +     UMBIM_STATUS_DESCRIPTION(BAD_SIM),                              \
> +     UMBIM_STATUS_DESCRIPTION(PIN_REQUIRED),                         \
> +     UMBIM_STATUS_DESCRIPTION(PIN_DISABLED),                         \
> +     UMBIM_STATUS_DESCRIPTION(NOT_REGISTERED),                       \
> +     UMBIM_STATUS_DESCRIPTION(PROVIDERS_NOT_FOUND),                  \
> +     UMBIM_STATUS_DESCRIPTION(NO_DEVICE_SUPPORT),                    \
> +     UMBIM_STATUS_DESCRIPTION(PROVIDER_NOT_VISIBLE),                 \
> +     UMBIM_STATUS_DESCRIPTION(DATA_CLASS_NOT_AVAILABLE),             \
> +     UMBIM_STATUS_DESCRIPTION(PACKET_SERVICE_DETACHED),              \
> +     UMBIM_STATUS_DESCRIPTION(MAX_ACTIVATED_CONTEXTS),               \
> +     UMBIM_STATUS_DESCRIPTION(NOT_INITIALIZED),                      \
> +     UMBIM_STATUS_DESCRIPTION(VOICE_CALL_IN_PROGRESS),               \
> +     UMBIM_STATUS_DESCRIPTION(CONTEXT_NOT_ACTIVATED),                \
> +     UMBIM_STATUS_DESCRIPTION(SERVICE_NOT_ACTIVATED),                \
> +     UMBIM_STATUS_DESCRIPTION(INVALID_ACCESS_STRING),                \
> +     UMBIM_STATUS_DESCRIPTION(INVALID_USER_NAME_PWD),                \
> +     UMBIM_STATUS_DESCRIPTION(RADIO_POWER_OFF),                      \
> +     UMBIM_STATUS_DESCRIPTION(INVALID_PARAMETERS),                   \
> +     UMBIM_STATUS_DESCRIPTION(READ_FAILURE),                         \
> +     UMBIM_STATUS_DESCRIPTION(WRITE_FAILURE),                        \
> +     UMBIM_STATUS_DESCRIPTION(NO_PHONEBOOK),                         \
> +     UMBIM_STATUS_DESCRIPTION(PARAMETER_TOO_LONG),                   \
> +     UMBIM_STATUS_DESCRIPTION(STK_BUSY),                             \
> +     UMBIM_STATUS_DESCRIPTION(OPERATION_NOT_ALLOWED),                \
> +     UMBIM_STATUS_DESCRIPTION(MEMORY_FAILURE),                       \
> +     UMBIM_STATUS_DESCRIPTION(INVALID_MEMORY_INDEX),                 \
> +     UMBIM_STATUS_DESCRIPTION(MEMORY_FULL),                          \
> +     UMBIM_STATUS_DESCRIPTION(FILTER_NOT_SUPPORTED),                 \
> +     UMBIM_STATUS_DESCRIPTION(DSS_INSTANCE_LIMIT),                   \
> +     UMBIM_STATUS_DESCRIPTION(INVALID_DEVICE_SERVICE_OPERATION),     \
> +     UMBIM_STATUS_DESCRIPTION(AUTH_INCORRECT_AUTN),                  \
> +     UMBIM_STATUS_DESCRIPTION(AUTH_SYNC_FAILURE),                    \
> +     UMBIM_STATUS_DESCRIPTION(AUTH_AMF_NOT_SET),                     \
> +     UMBIM_STATUS_DESCRIPTION(CONTEXT_NOT_SUPPORTED),                \
> +     UMBIM_STATUS_DESCRIPTION(SMS_UNKNOWN_SMSC_ADDRESS),             \
> +     UMBIM_STATUS_DESCRIPTION(SMS_NETWORK_TIMEOUT),                  \
> +     UMBIM_STATUS_DESCRIPTION(SMS_LANG_NOT_SUPPORTED),               \
> +     UMBIM_STATUS_DESCRIPTION(SMS_ENCODING_NOT_SUPPORTED),           \
> +     UMBIM_STATUS_DESCRIPTION(SMS_FORMAT_NOT_SUPPORTED),             \
> +     { 0, NULL } }
> +
> +#define UMBIM_ERROR_DESCRIPTION(m)   { UMBIM_ERROR_ ## m, #m }
> +#define UMBIM_ERROR_DESCRIPTIONS {                                   \
> +     UMBIM_ERROR_DESCRIPTION(TIMEOUT_FRAGMENT),                      \
> +     UMBIM_ERROR_DESCRIPTION(FRAGMENT_OUT_OF_SEQUENCE),              \
> +     UMBIM_ERROR_DESCRIPTION(LENGTH_MISMATCH),                       \
> +     UMBIM_ERROR_DESCRIPTION(DUPLICATED_TID),                        \
> +     UMBIM_ERROR_DESCRIPTION(NOT_OPENED),                            \
> +     UMBIM_ERROR_DESCRIPTION(UNKNOWN),                               \
> +     UMBIM_ERROR_DESCRIPTION(CANCEL),                                \
> +     UMBIM_ERROR_DESCRIPTION(MAX_TRANSFER),                          \
> +     { 0, NULL } }
> +
> +#define UMBIM_CID_DESCRIPTIONS {                                             
> \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_DEVICE_CAPS),                  \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_SUBSCRIBER_READY_STATUS),      \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_RADIO_STATE),                  \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PIN),                          \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PIN_LIST),                     \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_HOME_PROVIDER),                \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PREFERRED_PROVIDERS),          \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_VISIBLE_PROVIDERS),            \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_REGISTER_STATE),               \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PACKET_SERVICE),               \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_SIGNAL_STATE),                 \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_CONNECT),                      \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PROVISIONED_CONTEXTS),         \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_SERVICE_ACTIVATION),           \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_IP_CONFIGURATION),             \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_DEVICE_SERVICES),              \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST),\
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_PACKET_STATISTICS),            \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_NETWORK_IDLE_HINT),            \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_EMERGENCY_MODE),               \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_IP_PACKET_FILTERS),            \
> +     UMBIM_1TO1_DESCRIPTION(UMBIM_CID_MULTICARRIER_PROVIDERS),       \
> +     { 0, NULL } }
> +
> +#define UMBIM_SIMSTATE_DESCRIPTIONS {                                        
> \
> +     { UMBIM_SIMSTATE_NOTINITIALIZED, "not initialized" },           \
> +     { UMBIM_SIMSTATE_INITIALIZED, "initialized" },                  \
> +     { UMBIM_SIMSTATE_NOTINSERTED, "not inserted" },                 \
> +     { UMBIM_SIMSTATE_BADSIM, "bad type" },                          \
> +     { UMBIM_SIMSTATE_FAILURE, "failed" },                           \
> +     { UMBIM_SIMSTATE_NOTACTIVATED, "not activated" },               \
> +     { UMBIM_SIMSTATE_LOCKED, "locked" },                            \
> +     { 0, NULL } }
> +
> +#define UMBIM_PINTYPE_DESCRIPTIONS {                                 \
> +     { UMBIM_PIN_TYPE_NONE, "none" },                                \
> +     { UMBIM_PIN_TYPE_CUSTOM, "custom" },                            \
> +     { UMBIM_PIN_TYPE_PIN1, "PIN1" },                                \
> +     { UMBIM_PIN_TYPE_PIN2, "PIN2" },                                \
> +     { UMBIM_PIN_TYPE_DEV_SIM_PIN, "device PIN" },                   \
> +     { UMBIM_PIN_TYPE_DEV_FIRST_SIM_PIN, "device 1st PIN" },         \
> +     { UMBIM_PIN_TYPE_NETWORK_PIN, "network PIN" },                  \
> +     { UMBIM_PIN_TYPE_NETWORK_SUBSET_PIN, "network subset PIN" },    \
> +     { UMBIM_PIN_TYPE_SERVICE_PROVIDER_PIN, "provider PIN" },        \
> +     { UMBIM_PIN_TYPE_CORPORATE_PIN, "corporate PIN" },              \
> +     { UMBIM_PIN_TYPE_SUBSIDY_LOCK, "subsidy lock" },                \
> +     { UMBIM_PIN_TYPE_PUK1, "PUK" },                                 \
> +     { UMBIM_PIN_TYPE_PUK2, "PUK2" },                                \
> +     { UMBIM_PIN_TYPE_DEV_FIRST_SIM_PUK, "device 1st PUK" },         \
> +     { UMBIM_PIN_TYPE_NETWORK_PUK, "network PUK" },                  \
> +     { UMBIM_PIN_TYPE_NETWORK_SUBSET_PUK, "network subset PUK" },    \
> +     { UMBIM_PIN_TYPE_SERVICE_PROVIDER_PUK, "provider PUK" },        \
> +     { UMBIM_PIN_TYPE_CORPORATE_PUK, "corporate PUK" },              \
> +     { 0, NULL } }
> +
> +#define UMBIM_PKTSRV_STATE_DESCRIPTIONS {                            \
> +     { UMBIM_PKTSERVICE_STATE_UNKNOWN, "unknown" },                  \
> +     { UMBIM_PKTSERVICE_STATE_ATTACHING, "attaching" },              \
> +     { UMBIM_PKTSERVICE_STATE_ATTACHED, "attached" },                \
> +     { UMBIM_PKTSERVICE_STATE_DETACHING, "detaching" },              \
> +     { UMBIM_PKTSERVICE_STATE_DETACHED, "detached" },                \
> +     { 0, NULL } }
> +
> +#define UMBIM_ACTIVATION_STATE_DESCRIPTIONS {                                
> \
> +     { UMBIM_ACTIVATION_STATE_UNKNOWN, "unknown" },                  \
> +     { UMBIM_ACTIVATION_STATE_ACTIVATED, "activated" },              \
> +     { UMBIM_ACTIVATION_STATE_ACTIVATING, "activating" },            \
> +     { UMBIM_ACTIVATION_STATE_DEACTIVATED, "deactivated" },          \
> +     { UMBIM_ACTIVATION_STATE_DEACTIVATING, "deactivating" },        \
> +     { 0, NULL } }
> +
> +/*
> + * Driver internal state
> + */
> +enum umbim_state {
> +     UMBIM_S_DOWN = 0,       /* interface down */
> +     UMBIM_S_OPEN,           /* UMBIM device has been opened */
> +     UMBIM_S_RADIO,          /* radio is on */
> +     UMBIM_S_SIMREADY,       /* SIM is ready */
> +     UMBIM_S_ATTACHED,       /* packet service is attached */
> +     UMBIM_S_CONNECTED,      /* connected to provider */
> +     UMBIM_S_UP,             /* have IP configuration */
> +};
> +
> +#define UMBIM_INTERNAL_STATE_DESCRIPTIONS {  \
> +     { UMBIM_S_DOWN, "down" },               \
> +     { UMBIM_S_OPEN, "open" },               \
> +     { UMBIM_S_RADIO, "radio on" },          \
> +     { UMBIM_S_SIMREADY, "SIM is ready" },   \
> +     { UMBIM_S_ATTACHED, "attached" },       \
> +     { UMBIM_S_CONNECTED, "connected" },     \
> +     { UMBIM_S_UP, "up" },                   \
> +     { 0, NULL } }
> +
> +/*
> + * UMBIM parameters (SIOC[GS]UMBIMPARAM ioctls)
> + */
> +struct umbim_parameter {
> +     int                     op;
> +     int                     is_puk;
> +     char                    pin[UMBIM_PIN_MAXLEN];
> +     int                     pinlen;
> +
> +     char                    newpin[UMBIM_PIN_MAXLEN];
> +     int                     newpinlen;
> +
> +#define UMBIM_APN_MAXLEN             100
> +     uint16_t                apn[UMBIM_APN_MAXLEN];
> +     int                     apnlen;
> +
> +     int                     roaming;
> +     uint32_t                preferredclasses;
> +};
> +
> +/*
> + * UMBIM device status info (SIOCGUMBIMINFO ioctl)
> + */
> +struct umbim_info {
> +     enum umbim_state        state;
> +     int                     enable_roaming;
> +#define UMBIM_PIN_REQUIRED   0
> +#define UMBIM_PIN_UNLOCKED   1
> +#define UMBIM_PUK_REQUIRED   2
> +     int                     pin_state;
> +     int                     pin_attempts_left;
> +     int                     activation;
> +     int                     sim_state;
> +     int                     regstate;
> +     int                     regmode;
> +     int                     nwerror;
> +     int                     packetstate;
> +     uint32_t                supportedclasses; /* what the hw supports */
> +     uint32_t                preferredclasses; /* what the user prefers */
> +     uint32_t                highestclass;   /* what the network offers */
> +     uint32_t                cellclass;
> +#define UMBIM_PROVIDERNAME_MAXLEN    20
> +     uint16_t                provider[UMBIM_PROVIDERNAME_MAXLEN];
> +#define UMBIM_PHONENR_MAXLEN         22
> +     uint16_t                pn[UMBIM_PHONENR_MAXLEN];
> +#define UMBIM_SUBSCRIBERID_MAXLEN    15
> +     uint16_t                sid[UMBIM_SUBSCRIBERID_MAXLEN];
> +#define UMBIM_ICCID_MAXLEN           20
> +     uint16_t                iccid[UMBIM_ICCID_MAXLEN];
> +#define UMBIM_ROAMINGTEXT_MAXLEN     63
> +     uint16_t                roamingtxt[UMBIM_ROAMINGTEXT_MAXLEN];
> +
> +#define UMBIM_DEVID_MAXLEN           18
> +     uint16_t                devid[UMBIM_DEVID_MAXLEN];
> +#define UMBIM_FWINFO_MAXLEN          30
> +     uint16_t                fwinfo[UMBIM_FWINFO_MAXLEN];
> +#define UMBIM_HWINFO_MAXLEN          30
> +     uint16_t                hwinfo[UMBIM_HWINFO_MAXLEN];
> +
> +     uint16_t                apn[UMBIM_APN_MAXLEN];
> +     int                     apnlen;
> +
> +#define UMBIM_VALUE_UNKNOWN  -999
> +     int                     rssi;
> +#define UMBIM_BER_EXCELLENT  0
> +#define UMBIM_BER_VERYGOOD   1
> +#define UMBIM_BER_GOOD               2
> +#define UMBIM_BER_OK         3
> +#define UMBIM_BER_MEDIUM     4
> +#define UMBIM_BER_BAD                5
> +#define UMBIM_BER_VERYBAD    6
> +#define UMBIM_BER_EXTREMELYBAD       7
> +     int                     ber;
> +
> +     int                     hw_radio_on;
> +     int                     sw_radio_on;
> +
> +     uint64_t                uplink_speed;
> +     uint64_t                downlink_speed;
> +
> +#define UMBIM_MAX_DNSSRV             2
> +     u_int32_t               ipv4dns[UMBIM_MAX_DNSSRV];
> +};
> +
> +#ifdef _KERNEL
> +/*
> + * UMBIM device
> + */
> +struct umbim_softc {
> +     struct device            sc_dev;
> +     struct ifnet             sc_if;
> +#define GET_IFP(sc)  (&(sc)->sc_if)
> +     struct usbd_device      *sc_udev;
> +
> +     int                      sc_ver_maj;
> +     int                      sc_ver_min;
> +     int                      sc_ctrl_len;
> +     int                      sc_maxpktlen;
> +     int                      sc_maxsessions;
> +
> +     struct usb_task          sc_umbim_task;
> +     struct usb_task          sc_get_response_task;
> +     int                      sc_nresp;
> +     struct timeout           sc_statechg_timer;
> +
> +     uint8_t                  sc_ctrl_ifaceno;
> +     struct usbd_pipe        *sc_ctrl_pipe;
> +     struct usb_cdc_notification sc_intr_msg;
> +     struct usbd_interface   *sc_data_iface;
> +
> +     void                    *sc_resp_buf;
> +     void                    *sc_ctrl_msg;
> +
> +     int                      sc_rx_ep;
> +     struct usbd_xfer        *sc_rx_xfer;
> +     void                    *sc_rx_buf;
> +     struct usbd_pipe        *sc_rx_pipe;
> +     unsigned                 sc_rx_nerr;
> +
> +     int                      sc_tx_ep;
> +     struct usbd_xfer        *sc_tx_xfer;
> +     void                    *sc_tx_buf;
> +     struct usbd_pipe        *sc_tx_pipe;
> +     struct mbuf             *sc_tx_m;
> +     uint32_t                 sc_tx_seq;
> +
> +     uint32_t                 sc_tid;
> +
> +#define UMBIM_IFADDR_NONE    ((void *)-1)
> +     void                    *sc_saved_ifaddr;
> +
> +#define sc_state             sc_info.state
> +#define sc_roaming           sc_info.enable_roaming
> +     struct umbim_info        sc_info;
> +};
> +#endif /* _KERNEL */
> Index: sys/dev/usb/uhub.c
> ===================================================================
> RCS file: /cvs/src/sys/dev/usb/uhub.c,v
> retrieving revision 1.88
> diff -u -p -u -p -r1.88 uhub.c
> --- sys/dev/usb/uhub.c        29 Nov 2015 16:30:48 -0000      1.88
> +++ sys/dev/usb/uhub.c        1 Jun 2016 14:32:19 -0000
> @@ -523,7 +523,9 @@ uhub_port_connect(struct uhub_softc *sc,
>  {
>       struct usbd_port *up = &sc->sc_hub->hub->ports[port-1];
>       int speed;
> +     int retry = 1;
>  
> +again:
>       /* We have a connect status change, handle it. */
>       usbd_clear_port_feature(sc->sc_hub, port, UHF_C_PORT_CONNECTION);
>  
> @@ -613,6 +615,11 @@ uhub_port_connect(struct uhub_softc *sc,
>                * some other serious problem.  Since we cannot leave
>                * at 0 we have to disable the port instead.
>                */
> +             if (retry--) {
> +                     printf("%s: port %d: retrying\n", DEVNAME(sc), port);
> +                     goto again;
> +             }
> +
>               printf("%s: device problem, disabling port %d\n", DEVNAME(sc),
>                   port);
>               usbd_clear_port_feature(sc->sc_hub, port, UHF_PORT_ENABLE);
> Index: sys/dev/usb/umbim.h
> ===================================================================
> RCS file: sys/dev/usb/umbim.h
> diff -N sys/dev/usb/umbim.h
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ sys/dev/usb/umbim.h       1 Jun 2016 14:32:19 -0000
> @@ -0,0 +1,670 @@
> +/*   $OpenBSD$ */
> +
> +/*
> + * Copyright (c) 2016 genua mbH
> + * All rights reserved.
> + *
> + * Permission to use, copy, modify, and distribute this software for any
> + * purpose with or without fee is hereby granted, provided that the above
> + * copyright notice and this permission notice appear in all copies.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
> + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
> + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
> + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
> + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> + */
> +
> +/*
> + * Mobile Broadband Interface Model
> + * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
> + */
> +#ifndef _UMBIM_H_
> +#define _UMBIM_H_
> +
> +#define UDESCSUB_UMBIM                       27
> +#define UMBIM_INTERFACE_ALTSETTING   1
> +
> +#define UMBIM_RESET_FUNCTION         0x05
> +
> +/*
> + * Registration state (UMBIM_REGISTER_STATE)
> + */
> +#define UMBIM_REGSTATE_UNKNOWN                       0
> +#define UMBIM_REGSTATE_DEREGISTERED          1
> +#define UMBIM_REGSTATE_SEARCHING             2
> +#define UMBIM_REGSTATE_HOME                  3
> +#define UMBIM_REGSTATE_ROAMING                       4
> +#define UMBIM_REGSTATE_PARTNER                       5
> +#define UMBIM_REGSTATE_DENIED                        6
> +
> +/*
> + * Data classes mask (UMBIM_DATA_CLASS)
> + */
> +#define UMBIM_DATACLASS_NONE                 0x00000000
> +#define UMBIM_DATACLASS_GPRS                 0x00000001
> +#define UMBIM_DATACLASS_EDGE                 0x00000002
> +#define UMBIM_DATACLASS_UMTS                 0x00000004
> +#define UMBIM_DATACLASS_HSDPA                        0x00000008
> +#define UMBIM_DATACLASS_HSUPA                        0x00000010
> +#define UMBIM_DATACLASS_LTE                  0x00000020
> +#define UMBIM_DATACLASS_1XRTT                        0x00010000
> +#define UMBIM_DATACLASS_1XEVDO                       0x00020000
> +#define UMBIM_DATACLASS_1XEVDO_REV_A         0x00040000
> +#define UMBIM_DATACLASS_1XEVDV                       0x00080000
> +#define UMBIM_DATACLASS_3XRTT                        0x00100000
> +#define UMBIM_DATACLASS_1XEVDO_REV_B         0x00200000
> +#define UMBIM_DATACLASS_UMB                  0x00400000
> +#define UMBIM_DATACLASS_CUSTOM                       0x80000000
> +
> +/*
> + * Cell classes mask (UMBIM_CELLULAR_CLASS)
> + */
> +#define UMBIM_CELLCLASS_GSM                  0x00000001
> +#define UMBIM_CELLCLASS_CDMA                 0x00000002
> +
> +/*
> + * UUIDs
> + */
> +#define UMBIM_UUID_LEN               16
> +
> +#define UMBIM_UUID_BASIC_CONNECT {                           \
> +             0xa2, 0x89, 0xcc, 0x33, 0xbc, 0xbb, 0x8b, 0x4f, \
> +             0xb6, 0xb0, 0x13, 0x3e, 0xc2, 0xaa, 0xe6, 0xdf  \
> +     }
> +
> +#define UMBIM_UUID_CONTEXT_INTERNET {                                \
> +             0x7e, 0x5e, 0x2a, 0x7e, 0x4e, 0x6f, 0x72, 0x72, \
> +             0x73, 0x6b, 0x65, 0x6e, 0x7e, 0x5e, 0x2a, 0x7e  \
> +     }
> +
> +#define UMBIM_UUID_CONTEXT_VPN {                             \
> +             0x9b, 0x9f, 0x7b, 0xbe, 0x89, 0x52, 0x44, 0xb7, \
> +             0x83, 0xac, 0xca, 0x41, 0x31, 0x8d, 0xf7, 0xa0  \
> +     }
> +
> +#define UMBIM_CTRLMSG_MINLEN         64
> +#define UMBIM_CTRLMSG_MAXLEN         (4 * 1204)
> +
> +#define UMBIM_MAXSEGSZ_MINVAL                (2 * 1024)
> +
> +/*
> + * Control messages (host to function)
> + */
> +#define UMBIM_OPEN_MSG                       1U
> +#define UMBIM_CLOSE_MSG                      2U
> +#define UMBIM_COMMAND_MSG            3U
> +#define UMBIM_HOST_ERROR_MSG         4U
> +
> +/*
> + * Control messages (function to host)
> + */
> +#define UMBIM_OPEN_DONE                      0x80000001U
> +#define UMBIM_CLOSE_DONE             0x80000002U
> +#define UMBIM_COMMAND_DONE           0x80000003U
> +#define UMBIM_FUNCTION_ERROR_MSG     0x80000004U
> +#define UMBIM_INDICATE_STATUS_MSG    0x80000007U
> +
> +/*
> + * Generic status codes
> + */
> +#define UMBIM_STATUS_SUCCESS                 0
> +#define UMBIM_STATUS_BUSY                    1
> +#define UMBIM_STATUS_FAILURE                 2
> +#define UMBIM_STATUS_SIM_NOT_INSERTED                3
> +#define UMBIM_STATUS_BAD_SIM                 4
> +#define UMBIM_STATUS_PIN_REQUIRED            5
> +#define UMBIM_STATUS_PIN_DISABLED            6
> +#define UMBIM_STATUS_NOT_REGISTERED          7
> +#define UMBIM_STATUS_PROVIDERS_NOT_FOUND     8
> +#define UMBIM_STATUS_NO_DEVICE_SUPPORT               9
> +#define UMBIM_STATUS_PROVIDER_NOT_VISIBLE    10
> +#define UMBIM_STATUS_DATA_CLASS_NOT_AVAILABLE        11
> +#define UMBIM_STATUS_PACKET_SERVICE_DETACHED 12
> +#define UMBIM_STATUS_MAX_ACTIVATED_CONTEXTS  13
> +#define UMBIM_STATUS_NOT_INITIALIZED         14
> +#define UMBIM_STATUS_VOICE_CALL_IN_PROGRESS  15
> +#define UMBIM_STATUS_CONTEXT_NOT_ACTIVATED   16
> +#define UMBIM_STATUS_SERVICE_NOT_ACTIVATED   17
> +#define UMBIM_STATUS_INVALID_ACCESS_STRING   18
> +#define UMBIM_STATUS_INVALID_USER_NAME_PWD   19
> +#define UMBIM_STATUS_RADIO_POWER_OFF         20
> +#define UMBIM_STATUS_INVALID_PARAMETERS              21
> +#define UMBIM_STATUS_READ_FAILURE            22
> +#define UMBIM_STATUS_WRITE_FAILURE           23
> +#define UMBIM_STATUS_NO_PHONEBOOK            25
> +#define UMBIM_STATUS_PARAMETER_TOO_LONG              26
> +#define UMBIM_STATUS_STK_BUSY                        27
> +#define UMBIM_STATUS_OPERATION_NOT_ALLOWED   28
> +#define UMBIM_STATUS_MEMORY_FAILURE          29
> +#define UMBIM_STATUS_INVALID_MEMORY_INDEX    30
> +#define UMBIM_STATUS_MEMORY_FULL             31
> +#define UMBIM_STATUS_FILTER_NOT_SUPPORTED    32
> +#define UMBIM_STATUS_DSS_INSTANCE_LIMIT              33
> +#define UMBIM_STATUS_INVALID_DEVICE_SERVICE_OPERATION        34
> +#define UMBIM_STATUS_AUTH_INCORRECT_AUTN     35
> +#define UMBIM_STATUS_AUTH_SYNC_FAILURE               36
> +#define UMBIM_STATUS_AUTH_AMF_NOT_SET                37
> +#define UMBIM_STATUS_CONTEXT_NOT_SUPPORTED   38
> +#define UMBIM_STATUS_SMS_UNKNOWN_SMSC_ADDRESS        100
> +#define UMBIM_STATUS_SMS_NETWORK_TIMEOUT     101
> +#define UMBIM_STATUS_SMS_LANG_NOT_SUPPORTED  102
> +#define UMBIM_STATUS_SMS_ENCODING_NOT_SUPPORTED      103
> +#define UMBIM_STATUS_SMS_FORMAT_NOT_SUPPORTED        104
> +
> +/*
> + * Message formats
> + */
> +struct umbim_msghdr {
> +     /* Msg header */
> +     uint32_t        type;           /* message type */
> +     uint32_t        len;            /* message length */
> +     uint32_t        tid;            /* transaction id */
> +} __packed;
> +
> +struct umbim_fraghdr {
> +     uint32_t        nfrag;          /* total # of fragments */
> +     uint32_t        currfrag;       /* current fragment */
> +} __packed;
> +
> +struct umbim_fragmented_msg_hdr {
> +     struct umbim_msghdr     hdr;
> +     struct umbim_fraghdr    frag;
> +} __packed;
> +
> +struct umbim_h2f_openmsg {
> +     struct umbim_msghdr     hdr;
> +     uint32_t                maxlen;
> +} __packed;
> +
> +struct umbim_h2f_closemsg {
> +     struct umbim_msghdr     hdr;
> +} __packed;
> +
> +struct umbim_h2f_cmd {
> +     struct umbim_msghdr     hdr;
> +     struct umbim_fraghdr    frag;
> +     uint8_t                 devid[UMBIM_UUID_LEN];
> +     uint32_t                cid;            /* command id */
> +#define UMBIM_CMDOP_QRY              0
> +#define UMBIM_CMDOP_SET              1
> +     uint32_t                op;
> +     uint32_t                infolen;
> +     uint8_t                 info[];
> +} __packed;
> +
> +struct umbim_f2h_indicate_status {
> +     struct umbim_msghdr     hdr;
> +     struct umbim_fraghdr    frag;
> +     uint8_t                 devid[UMBIM_UUID_LEN];
> +     uint32_t                cid;            /* command id */
> +     uint32_t                infolen;
> +     uint8_t                 info[];
> +} __packed;
> +
> +struct umbim_f2h_hosterr {
> +     struct umbim_msghdr     hdr;
> +
> +#define UMBIM_ERROR_TIMEOUT_FRAGMENT         1
> +#define UMBIM_ERROR_FRAGMENT_OUT_OF_SEQUENCE 2
> +#define UMBIM_ERROR_LENGTH_MISMATCH          3
> +#define UMBIM_ERROR_DUPLICATED_TID           4
> +#define UMBIM_ERROR_NOT_OPENED                       5
> +#define UMBIM_ERROR_UNKNOWN                  6
> +#define UMBIM_ERROR_CANCEL                   7
> +#define UMBIM_ERROR_MAX_TRANSFER             8
> +     uint32_t                err;
> +} __packed;
> +
> +struct umbim_f2h_openclosedone {
> +     struct umbim_msghdr     hdr;
> +     int32_t                 status;
> +} __packed;
> +
> +struct umbim_f2h_cmddone {
> +     struct umbim_msghdr     hdr;
> +     struct umbim_fraghdr    frag;
> +     uint8_t                 devid[UMBIM_UUID_LEN];
> +     uint32_t                cid;            /* command id */
> +     int32_t                 status;
> +     uint32_t                infolen;
> +     uint8_t                 info[];
> +} __packed;
> +
> +/*
> + * Messages and commands for UMBIM_UUID_BASIC_CONNECT
> + */
> +#define UMBIM_CID_DEVICE_CAPS                                1
> +#define UMBIM_CID_SUBSCRIBER_READY_STATUS            2
> +#define UMBIM_CID_RADIO_STATE                                3
> +#define UMBIM_CID_PIN                                        4
> +#define UMBIM_CID_PIN_LIST                           5
> +#define UMBIM_CID_HOME_PROVIDER                              6
> +#define UMBIM_CID_PREFERRED_PROVIDERS                        7
> +#define UMBIM_CID_VISIBLE_PROVIDERS                  8
> +#define UMBIM_CID_REGISTER_STATE                     9
> +#define UMBIM_CID_PACKET_SERVICE                     10
> +#define UMBIM_CID_SIGNAL_STATE                               11
> +#define UMBIM_CID_CONNECT                            12
> +#define UMBIM_CID_PROVISIONED_CONTEXTS                       13
> +#define UMBIM_CID_SERVICE_ACTIVATION                 14
> +#define UMBIM_CID_IP_CONFIGURATION                   15
> +#define UMBIM_CID_DEVICE_SERVICES                    16
> +#define UMBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST              19
> +#define UMBIM_CID_PACKET_STATISTICS                  20
> +#define UMBIM_CID_NETWORK_IDLE_HINT                  21
> +#define UMBIM_CID_EMERGENCY_MODE                     22
> +#define UMBIM_CID_IP_PACKET_FILTERS                  23
> +#define UMBIM_CID_MULTICARRIER_PROVIDERS             24
> +
> +struct umbim_cid_subscriber_ready_info {
> +#define UMBIM_SIMSTATE_NOTINITIALIZED                0
> +#define UMBIM_SIMSTATE_INITIALIZED           1
> +#define UMBIM_SIMSTATE_NOTINSERTED           2
> +#define UMBIM_SIMSTATE_BADSIM                        3
> +#define UMBIM_SIMSTATE_FAILURE                       4
> +#define UMBIM_SIMSTATE_NOTACTIVATED          5
> +#define UMBIM_SIMSTATE_LOCKED                        6
> +     uint32_t        ready;
> +
> +     uint32_t        sid_offs;
> +     uint32_t        sid_size;
> +
> +     uint32_t        icc_offs;
> +     uint32_t        icc_size;
> +
> +#define UMBIM_SIMUNIQEID_NONE                        0
> +#define UMBIM_SIMUNIQEID_PROTECT             1
> +     uint32_t        info;
> +
> +     uint32_t        no_pn;
> +     struct {
> +             uint32_t        offs;
> +             uint32_t        size;
> +     }
> +                     pn[];
> +} __packed;
> +
> +struct umbim_cid_radio_state {
> +#define UMBIM_RADIO_STATE_OFF                        0
> +#define UMBIM_RADIO_STATE_ON                 1
> +     uint32_t        state;
> +} __packed;
> +
> +struct umbim_cid_radio_state_info {
> +     uint32_t        hw_state;
> +     uint32_t        sw_state;
> +} __packed;
> +
> +struct umbim_cid_pin {
> +#define UMBIM_PIN_TYPE_NONE                  0
> +#define UMBIM_PIN_TYPE_CUSTOM                        1
> +#define UMBIM_PIN_TYPE_PIN1                  2
> +#define UMBIM_PIN_TYPE_PIN2                  3
> +#define UMBIM_PIN_TYPE_DEV_SIM_PIN           4
> +#define UMBIM_PIN_TYPE_DEV_FIRST_SIM_PIN     5
> +#define UMBIM_PIN_TYPE_NETWORK_PIN           6
> +#define UMBIM_PIN_TYPE_NETWORK_SUBSET_PIN    7
> +#define UMBIM_PIN_TYPE_SERVICE_PROVIDER_PIN  8
> +#define UMBIM_PIN_TYPE_CORPORATE_PIN         9
> +#define UMBIM_PIN_TYPE_SUBSIDY_LOCK          10
> +#define UMBIM_PIN_TYPE_PUK1                  11
> +#define UMBIM_PIN_TYPE_PUK2                  12
> +#define UMBIM_PIN_TYPE_DEV_FIRST_SIM_PUK     13
> +#define UMBIM_PIN_TYPE_NETWORK_PUK           14
> +#define UMBIM_PIN_TYPE_NETWORK_SUBSET_PUK    15
> +#define UMBIM_PIN_TYPE_SERVICE_PROVIDER_PUK  16
> +#define UMBIM_PIN_TYPE_CORPORATE_PUK         17
> +     uint32_t        type;
> +
> +#define UMBIM_PIN_OP_ENTER                   0
> +#define UMBIM_PIN_OP_ENABLE                  1
> +#define UMBIM_PIN_OP_DISABLE                 2
> +#define UMBIM_PIN_OP_CHANGE                  3
> +     uint32_t        op;
> +     uint32_t        pin_offs;
> +     uint32_t        pin_size;
> +     uint32_t        newpin_offs;
> +     uint32_t        newpin_size;
> +#define UMBIM_PIN_MAXLEN     32
> +     uint8_t         data[2 * UMBIM_PIN_MAXLEN];
> +} __packed;
> +
> +struct umbim_cid_pin_info {
> +     uint32_t        type;
> +
> +#define UMBIM_PIN_STATE_UNLOCKED             0
> +#define UMBIM_PIN_STATE_LOCKED                       1
> +     uint32_t        state;
> +     uint32_t        remaining_attempts;
> +} __packed;
> +
> +struct umbim_cid_pin_list_info {
> +     struct umbim_pin_desc {
> +
> +#define UMBIM_PINMODE_NOTSUPPORTED           0
> +#define UMBIM_PINMODE_ENABLED                        1
> +#define UMBIM_PINMODE_DISABLED                       2
> +             uint32_t        mode;
> +
> +#define UMBIM_PINFORMAT_UNKNOWN                      0
> +#define UMBIM_PINFORMAT_NUMERIC                      1
> +#define UMBIM_PINFORMAT_ALPHANUMERIC         2
> +             uint32_t        format;
> +
> +             uint32_t        minlen;
> +             uint32_t        maxlen;
> +     }
> +             pin1,
> +             pin2,
> +             dev_sim_pin,
> +             first_dev_sim_pin,
> +             net_pin,
> +             net_sub_pin,
> +             svp_pin,
> +             corp_pin,
> +             subsidy_lock,
> +             custom;
> +} __packed;
> +
> +struct umbim_cid_device_caps {
> +#define UMBIM_DEVTYPE_UNKNOWN                        0
> +#define UMBIM_DEVTYPE_EMBEDDED                       1
> +#define UMBIM_DEVTYPE_REMOVABLE                      2
> +#define UMBIM_DEVTYPE_REMOTE                 3
> +     uint32_t        devtype;
> +
> +     uint32_t        cellclass;      /* values: UMBIM_CELLULAR_CLASS */
> +     uint32_t        voiceclass;
> +     uint32_t        simclass;
> +     uint32_t        dataclass;      /* values: UMBIM_DATA_CLASS */
> +     uint32_t        smscaps;
> +     uint32_t        cntrlcaps;
> +     uint32_t        max_sessions;
> +
> +     uint32_t        custdataclass_offs;
> +     uint32_t        custdataclass_size;
> +
> +     uint32_t        devid_offs;
> +     uint32_t        devid_size;
> +
> +     uint32_t        fwinfo_offs;
> +     uint32_t        fwinfo_size;
> +
> +     uint32_t        hwinfo_offs;
> +     uint32_t        hwinfo_size;
> +
> +     uint32_t        data[];
> +} __packed;
> +
> +struct umbim_cid_registration_state {
> +     uint32_t        provid_offs;
> +     uint32_t        provid_size;
> +
> +#define UMBIM_REGACTION_AUTOMATIC            0
> +#define UMBIM_REGACTION_MANUAL                       1
> +     uint32_t        regaction;
> +     uint32_t        data_class;
> +
> +     uint32_t        data[];
> +} __packed;
> +
> +struct umbim_cid_registration_state_info {
> +     uint32_t        nwerror;
> +
> +     uint32_t        regstate;       /* values: UMBIM_REGISTER_STATE */
> +
> +#define UMBIM_REGMODE_UNKNOWN                        0
> +#define UMBIM_REGMODE_AUTOMATIC                      1
> +#define UMBIM_REGMODE_MANUAL                 2
> +     uint32_t        regmode;
> +
> +     uint32_t        availclasses;   /* values: UMBIM_DATA_CLASS */
> +     uint32_t        curcellclass;   /* values: UMBIM_CELLULAR_CLASS */
> +
> +     uint32_t        provid_offs;
> +     uint32_t        provid_size;
> +
> +     uint32_t        provname_offs;
> +     uint32_t        provname_size;
> +
> +     uint32_t        roamingtxt_offs;
> +     uint32_t        roamingtxt_size;
> +
> +#define UMBIM_REGFLAGS_NONE                  0
> +#define UMBIM_REGFLAGS_MANUAL_NOT_AVAILABLE  1
> +#define UMBIM_REGFLAGS_PACKETSERVICE_AUTOATTACH      2
> +     uint32_t        regflag;
> +
> +     uint32_t        data[];
> +} __packed;
> +
> +struct umbim_cid_packet_service {
> +#define UMBIM_PKTSERVICE_ACTION_ATTACH               0
> +#define UMBIM_PKTSERVICE_ACTION_DETACH               1
> +     uint32_t        action;
> +} __packed;
> +
> +struct umbim_cid_packet_service_info {
> +     uint32_t        nwerror;
> +
> +#define UMBIM_PKTSERVICE_STATE_UNKNOWN               0
> +#define UMBIM_PKTSERVICE_STATE_ATTACHING     1
> +#define UMBIM_PKTSERVICE_STATE_ATTACHED              2
> +#define UMBIM_PKTSERVICE_STATE_DETACHING     3
> +#define UMBIM_PKTSERVICE_STATE_DETACHED              4
> +     uint32_t        state;
> +
> +     uint32_t        highest_dataclass;
> +     uint64_t        uplink_speed;
> +     uint64_t        downlink_speed;
> +} __packed;
> +
> +struct umbim_cid_signal_state {
> +     uint32_t        rssi;
> +     uint32_t        err_rate;
> +     uint32_t        ss_intvl;
> +     uint32_t        rssi_thr;
> +     uint32_t        err_thr;
> +} __packed;
> +
> +struct umbim_cid_connect {
> +     uint32_t        sessionid;
> +
> +#define UMBIM_CONNECT_DEACTIVATE     0
> +#define UMBIM_CONNECT_ACTIVATE               1
> +     uint32_t        command;
> +
> +#define UMBIM_ACCESS_MAXLEN          200
> +     uint32_t        access_offs;
> +     uint32_t        access_size;
> +
> +#define UMBIM_USER_MAXLEN            510
> +     uint32_t        user_offs;
> +     uint32_t        user_size;
> +
> +#define UMBIM_PASSWD_MAXLEN          510
> +     uint32_t        passwd_offs;
> +     uint32_t        passwd_size;
> +
> +#define UMBIM_COMPRESSION_NONE               0
> +#define UMBIM_COMPRESSION_ENABLE     1
> +     uint32_t        compression;
> +
> +#define UMBIM_AUTHPROT_NONE          0
> +#define UMBIM_AUTHPROT_PAP           1
> +#define UMBIM_AUTHPROT_CHAP          2
> +#define UMBIM_AUTHPROT_MSCHAP                3
> +     uint32_t        authprot;
> +
> +#define UMBIM_CONTEXT_IPTYPE_DEFAULT 0
> +#define UMBIM_CONTEXT_IPTYPE_IPV4    1
> +#define UMBIM_CONTEXT_IPTYPE_IPV6    2
> +#define UMBIM_CONTEXT_IPTYPE_IPV4V6  3
> +#define UMBIM_CONTEXT_IPTYPE_IPV4ANDV6       4
> +     uint32_t        iptype;
> +
> +     uint8_t         context[UMBIM_UUID_LEN];
> +
> +     uint8_t         data[UMBIM_ACCESS_MAXLEN + UMBIM_USER_MAXLEN +
> +                          UMBIM_PASSWD_MAXLEN];
> +
> +} __packed;
> +
> +struct umbim_cid_connect_info {
> +     uint32_t        sessionid;
> +
> +#define UMBIM_ACTIVATION_STATE_UNKNOWN               0
> +#define UMBIM_ACTIVATION_STATE_ACTIVATED     1
> +#define UMBIM_ACTIVATION_STATE_ACTIVATING    2
> +#define UMBIM_ACTIVATION_STATE_DEACTIVATED   3
> +#define UMBIM_ACTIVATION_STATE_DEACTIVATING  4
> +     uint32_t        activation;
> +
> +     uint32_t        voice;
> +     uint32_t        iptype;
> +     uint8_t         context[UMBIM_UUID_LEN];
> +     uint32_t        nwerror;
> +} __packed;
> +
> +struct umbim_cid_ipv4_element {
> +     uint32_t        prefixlen;
> +     uint32_t        addr;
> +} __packed;
> +
> +struct umbim_cid_ipv6_element {
> +     uint32_t        prefixlen;
> +     uint8_t         addr[16];
> +} __packed;
> +
> +struct umbim_cid_ip_configuration_info {
> +     uint32_t        sessionid;
> +
> +#define UMBIM_IPCONF_HAS_ADDRINFO    0x0001
> +#define UMBIM_IPCONF_HAS_GWINFO              0x0002
> +#define UMBIM_IPCONF_HAS_DNSINFO     0x0004
> +#define UMBIM_IPCONF_HAS_MTUINFO     0x0008
> +     uint32_t        ipv4_available;
> +     uint32_t        ipv6_available;
> +
> +     uint32_t        ipv4_naddr;
> +     uint32_t        ipv4_addroffs;
> +     uint32_t        ipv6_naddr;
> +     uint32_t        ipv6_addroffs;
> +
> +     uint32_t        ipv4_gwoffs;
> +     uint32_t        ipv6_gwoffs;
> +
> +     uint32_t        ipv4_ndnssrv;
> +     uint32_t        ipv4_dnssrvoffs;
> +     uint32_t        ipv6_ndnssrv;
> +     uint32_t        ipv6_dnssrvoffs;
> +
> +     uint32_t        ipv4_mtu;
> +     uint32_t        ipv6_mtu;
> +
> +     uint32_t        data[];
> +} __packed;
> +
> +struct umbim_cid_packet_statistics_info {
> +     uint32_t        in_discards;
> +     uint32_t        in_errors;
> +     uint64_t        in_octets;
> +     uint64_t        in_packets;
> +     uint64_t        out_octets;
> +     uint64_t        out_packets;
> +     uint32_t        out_errors;
> +     uint32_t        out_discards;
> +} __packed;
> +
> +
> +#ifdef _KERNEL
> +
> +struct umbim_descriptor {
> +     uByte   bLength;
> +     uByte   bDescriptorType;
> +     uByte   bDescriptorSubtype;
> +#define UMBIM_VER_MAJOR(v)   (((v) >> 8) & 0x0f)
> +#define UMBIM_VER_MINOR(v)   ((v) & 0x0f)
> +     uWord   bcdMBIMVersion;
> +     uWord   wMaxControlMessage;
> +     uByte   bNumberFilters;
> +     uByte   bMaxFilterSize;
> +     uWord   wMaxSegmentSize;
> +     uByte   bmNetworkCapabilities;
> +} __packed;
> +
> +/*
> + * NCM Encoding
> + */
> +#define UMBIM_HDR16_LEN              \
> +     (sizeof (struct ncm_header16) + sizeof (struct ncm_pointer16))
> +#define UMBIM_HDR32_LEN              \
> +     (sizeof (struct ncm_header32) + sizeof (struct ncm_pointer32))
> +
> +struct ncm_header16 {
> +#define NCM_HDR16_SIG                0x484d434e
> +     uDWord  dwSignature;
> +     uWord   wHeaderLength;
> +     uWord   wSequence;
> +     uWord   wBlockLength;
> +     uWord   wNdpIndex;
> +} __packed;
> +
> +struct ncm_header32 {
> +#define NCM_HDR32_SIG                0x686d636e
> +     uDWord  dwSignature;
> +     uWord   wHeaderLength;
> +     uWord   wSequence;
> +     uDWord  dwBlockLength;
> +     uDWord  dwNdpIndex;
> +} __packed;
> +
> +
> +#define UMBIM_NCM_NTH_SIDSHIFT       24
> +#define UMBIM_NCM_NTH_GETSID(s)      (((s) > UMBIM_NCM_NTH_SIDSHIFT) & 0xff)
> +
> +struct ncm_pointer16_dgram {
> +     uWord   wDatagramIndex;
> +     uWord   wDatagramLen;
> +} __packed;
> +
> +struct ncm_pointer16 {
> +#define UMBIM_NCM_NTH16_IPS   0x00535049
> +#define UMBIM_NCM_NTH16_ISISG(s) (((s) & 0x00ffffff) == UMBIM_NCM_NTH16_IPS)
> +#define UMBIM_NCM_NTH16_SIG(s)       \
> +             ((((s) & 0xff) << UMBIM_NCM_NTH_SIDSHIFT) | UMBIM_NCM_NTH16_IPS)
> +     uDWord  dwSignature;
> +     uWord   wLength;
> +     uWord   wNextNdpIndex;
> +
> +     /* Minimum is two datagrams, but can be more */
> +     struct ncm_pointer16_dgram dgram[2];
> +} __packed;
> +
> +struct ncm_pointer32_dgram {
> +     uDWord  dwDatagramIndex;
> +     uDWord  dwDatagramLen;
> +} __packed;
> +
> +struct ncm_pointer32 {
> +#define UMBIM_NCM_NTH32_IPS  0x00737069
> +#define UMBIM_NCM_NTH32_ISISG(s)     \
> +             (((s) & 0x00ffffff) == UMBIM_NCM_NTH32_IPS)
> +#define UMBIM_NCM_NTH32_SIG(s)               \
> +             ((((s) & 0xff) << UMBIM_NCM_NTH_SIDSHIFT) | UMBIM_NCM_NTH32_IPS)
> +     uDWord  dwSignature;
> +     uWord   wLength;
> +     uWord   wReserved6;
> +     uDWord  dwNextNdpIndex;
> +     uDWord  dwReserved12;
> +
> +     /* Minimum is two datagrams, but can be more */
> +     struct ncm_pointer32_dgram dgram[2];
> +} __packed;
> +
> +#endif /* _KERNEL */
> +
> +#endif /* _UMBIM_H_ */
> Index: sys/dev/usb/usb.h
> ===================================================================
> RCS file: /cvs/src/sys/dev/usb/usb.h,v
> retrieving revision 1.55
> diff -u -p -u -p -r1.55 usb.h
> --- sys/dev/usb/usb.h 24 May 2016 05:35:01 -0000      1.55
> +++ sys/dev/usb/usb.h 1 Jun 2016 14:32:19 -0000
> @@ -508,6 +508,7 @@ typedef struct usb_port_status usb_port_
>  #define       UISUBCLASS_ETHERNET_NETWORKING_CONTROL_MODEL 6
>  #define       UISUBCLASS_ATM_NETWORKING_CONTROL_MODEL 7
>  #define       UISUBCLASS_MOBILE_DIRECT_LINE_MODEL    10
> +#define       UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL 14
>  #define   UIPROTO_CDC_AT                     1
>  
>  #define UICLASS_HID          0x03
> @@ -545,6 +546,7 @@ typedef struct usb_port_status usb_port_
>  
>  #define UICLASS_CDC_DATA     0x0a
>  #define  UISUBCLASS_DATA             0
> +#define   UIPROTO_DATA_MBIM          0x02    /* MBIM */
>  #define   UIPROTO_DATA_ISDNBRI               0x30    /* Physical iface */
>  #define   UIPROTO_DATA_HDLC          0x31    /* HDLC */
>  #define   UIPROTO_DATA_TRANSPARENT   0x32    /* Transparent */
> Index: sys/net/if_types.h
> ===================================================================
> RCS file: /cvs/src/sys/net/if_types.h,v
> retrieving revision 1.20
> diff -u -p -u -p -r1.20 if_types.h
> --- sys/net/if_types.h        7 Mar 2016 19:33:26 -0000       1.20
> +++ sys/net/if_types.h        1 Jun 2016 14:32:19 -0000
> @@ -268,5 +268,6 @@
>  #define      IFT_CARP        0xf7            /* Common Address Redundancy 
> Protocol */
>  #define IFT_BLUETOOTH        0xf8            /* Bluetooth */
>  #define IFT_PFLOW    0xf9            /* pflow */
> +#define IFT_MBIM     0xfa            /* Mobile Broadband Interface Model */
>  
>  #endif /* _NET_IF_TYPES_H_ */
> Index: sys/netinet/in.c
> ===================================================================
> RCS file: /cvs/src/sys/netinet/in.c,v
> retrieving revision 1.127
> diff -u -p -u -p -r1.127 in.c
> --- sys/netinet/in.c  18 Apr 2016 06:43:51 -0000      1.127
> +++ sys/netinet/in.c  1 Jun 2016 14:32:19 -0000
> @@ -83,9 +83,7 @@
>  
>  
>  void in_socktrim(struct sockaddr_in *);
> -void in_len2mask(struct in_addr *, int);
> -int in_lifaddr_ioctl(struct socket *, u_long, caddr_t,
> -     struct ifnet *);
> +int in_lifaddr_ioctl(u_long, caddr_t, struct ifnet *, int);
>  
>  void in_purgeaddr(struct ifaddr *);
>  int in_addhost(struct in_ifaddr *, struct sockaddr_in *);
> @@ -172,14 +170,11 @@ in_len2mask(struct in_addr *mask, int le
>  int
>  in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp)
>  {
> -     struct ifreq *ifr = (struct ifreq *)data;
> -     struct ifaddr *ifa;
> -     struct in_ifaddr *ia = NULL;
> -     struct in_aliasreq *ifra = (struct in_aliasreq *)data;
> -     struct sockaddr_in oldaddr;
> -     int error;
> -     int newifaddr;
> -     int s;
> +     int privileged;
> +
> +     privileged = 0;
> +     if ((so->so_state & SS_PRIV) != 0)
> +             privileged++;
>  
>       switch (cmd) {
>  #ifdef MROUTING
> @@ -189,18 +184,33 @@ in_control(struct socket *so, u_long cmd
>  #endif /* MROUTING */
>       case SIOCALIFADDR:
>       case SIOCDLIFADDR:
> -             if ((so->so_state & SS_PRIV) == 0)
> +             if (!privileged)
>                       return (EPERM);
>               /* FALLTHROUGH */
>       case SIOCGLIFADDR:
>               if (ifp == NULL)
>                       return (EINVAL);
> -             return in_lifaddr_ioctl(so, cmd, data, ifp);
> +             return in_lifaddr_ioctl(cmd, data, ifp, privileged);
>       default:
>               if (ifp == NULL)
>                       return (EOPNOTSUPP);
>       }
>  
> +     return (in_ioctl(cmd, data, ifp, privileged));
> +}
> +
> +int
> +in_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
> +{
> +     struct ifreq *ifr = (struct ifreq *)data;
> +     struct ifaddr *ifa;
> +     struct in_ifaddr *ia = NULL;
> +     struct in_aliasreq *ifra = (struct in_aliasreq *)data;
> +     struct sockaddr_in oldaddr;
> +     int error;
> +     int newifaddr;
> +     int s;
> +
>       TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
>               if (ifa->ifa_addr->sa_family == AF_INET) {
>                       ia = ifatoia(ifa);
> @@ -225,7 +235,7 @@ in_control(struct socket *so, u_long cmd
>                       return (EADDRNOTAVAIL);
>               /* FALLTHROUGH */
>       case SIOCSIFADDR:
> -             if ((so->so_state & SS_PRIV) == 0)
> +             if (!privileged)
>                       return (EPERM);
>  
>               if (ia == NULL) {
> @@ -250,7 +260,7 @@ in_control(struct socket *so, u_long cmd
>       case SIOCSIFNETMASK:
>       case SIOCSIFDSTADDR:
>       case SIOCSIFBRDADDR:
> -             if ((so->so_state & SS_PRIV) == 0)
> +             if (!privileged)
>                       return (EPERM);
>               /* FALLTHROUGH */
>  
> @@ -410,8 +420,7 @@ in_control(struct socket *so, u_long cmd
>   *   other values may be returned from in_ioctl()
>   */
>  int
> -in_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data,
> -    struct ifnet *ifp)
> +in_lifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
>  {
>       struct if_laddrreq *iflr = (struct if_laddrreq *)data;
>       struct ifaddr *ifa;
> @@ -481,7 +490,7 @@ in_lifaddr_ioctl(struct socket *so, u_lo
>               ifra.ifra_mask.sin_len = sizeof(struct sockaddr_in);
>               in_len2mask(&ifra.ifra_mask.sin_addr, iflr->prefixlen);
>  
> -             return in_control(so, SIOCAIFADDR, (caddr_t)&ifra, ifp);
> +             return in_ioctl(SIOCAIFADDR, (caddr_t)&ifra, ifp, privileged);
>           }
>       case SIOCGLIFADDR:
>       case SIOCDLIFADDR:
> @@ -566,7 +575,8 @@ in_lifaddr_ioctl(struct socket *so, u_lo
>                       memcpy(&ifra.ifra_dstaddr, &ia->ia_sockmask,
>                           ia->ia_sockmask.sin_len);
>  
> -                     return in_control(so, SIOCDIFADDR, (caddr_t)&ifra, ifp);
> +                     return in_ioctl(SIOCDIFADDR, (caddr_t)&ifra, ifp,
> +                         privileged);
>               }
>           }
>       }
> Index: sys/netinet/in.h
> ===================================================================
> RCS file: /cvs/src/sys/netinet/in.h,v
> retrieving revision 1.115
> diff -u -p -u -p -r1.115 in.h
> --- sys/netinet/in.h  20 Oct 2015 20:22:42 -0000      1.115
> +++ sys/netinet/in.h  1 Jun 2016 14:32:19 -0000
> @@ -791,6 +791,7 @@ extern       struct in_addr zeroin_addr;
>  
>  struct mbuf;
>  
> +void    in_purgeaddr(struct ifaddr *);
>  int     in_broadcast(struct in_addr, u_int);
>  int     in_canforward(struct in_addr);
>  int     in_cksum(struct mbuf *, int);
> @@ -798,6 +799,7 @@ int          in4_cksum(struct mbuf *, u_int8_t
>  void    in_proto_cksum_out(struct mbuf *, struct ifnet *);
>  void    in_ifdetach(struct ifnet *);
>  int     in_mask2len(struct in_addr *);
> +void    in_len2mask(struct in_addr *, int);
>  
>  char   *inet_ntoa(struct in_addr);
>  int     inet_nat64(int, const void *, void *, const void *, u_int8_t);
> Index: sys/netinet/in_var.h
> ===================================================================
> RCS file: /cvs/src/sys/netinet/in_var.h,v
> retrieving revision 1.38
> diff -u -p -u -p -r1.38 in_var.h
> --- sys/netinet/in_var.h      21 Jan 2016 11:23:48 -0000      1.38
> +++ sys/netinet/in_var.h      1 Jun 2016 14:32:19 -0000
> @@ -157,6 +157,7 @@ void      in_delmulti(struct in_multi *);
>  int  in_hasmulti(struct in_addr *, struct ifnet *);
>  void in_ifscrub(struct ifnet *, struct in_ifaddr *);
>  int  in_control(struct socket *, u_long, caddr_t, struct ifnet *);
> +int  in_ioctl(u_long, caddr_t, struct ifnet *, int);
>  void in_prefixlen2mask(struct in_addr *, int);
>  #endif
>  
> Index: sys/netinet6/in6.c
> ===================================================================
> RCS file: /cvs/src/sys/netinet6/in6.c,v
> retrieving revision 1.186
> diff -u -p -u -p -r1.186 in6.c
> --- sys/netinet6/in6.c        3 Mar 2016 12:57:15 -0000       1.186
> +++ sys/netinet6/in6.c        1 Jun 2016 14:32:19 -0000
> @@ -118,7 +118,8 @@ const struct in6_addr in6mask64 = IN6MAS
>  const struct in6_addr in6mask96 = IN6MASK96;
>  const struct in6_addr in6mask128 = IN6MASK128;
>  
> -int in6_lifaddr_ioctl(struct socket *, u_long, caddr_t, struct ifnet *);
> +int in6_lifaddr_ioctl(u_long, caddr_t, struct ifnet *, int);
> +int in6_ioctl(u_long, caddr_t, struct ifnet *, int);
>  int in6_ifinit(struct ifnet *, struct in6_ifaddr *, int);
>  void in6_unlink_ifa(struct in6_ifaddr *, struct ifnet *);
>  
> @@ -165,11 +166,7 @@ in6_mask2len(struct in6_addr *mask, u_ch
>  int
>  in6_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp)
>  {
> -     struct  in6_ifreq *ifr = (struct in6_ifreq *)data;
> -     struct  in6_ifaddr *ia6 = NULL;
> -     struct  in6_aliasreq *ifra = (struct in6_aliasreq *)data;
> -     struct sockaddr_in6 *sa6;
> -     int s, privileged;
> +     int privileged;
>  
>       privileged = 0;
>       if ((so->so_state & SS_PRIV) != 0)
> @@ -183,6 +180,18 @@ in6_control(struct socket *so, u_long cm
>       }
>  #endif
>  
> +     return (in6_ioctl(cmd, data, ifp, privileged));
> +}
> +
> +int
> +in6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int privileged)
> +{
> +     struct  in6_ifreq *ifr = (struct in6_ifreq *)data;
> +     struct  in6_ifaddr *ia6 = NULL;
> +     struct  in6_aliasreq *ifra = (struct in6_aliasreq *)data;
> +     struct sockaddr_in6 *sa6;
> +     int s;
> +
>       if (ifp == NULL)
>               return (EOPNOTSUPP);
>  
> @@ -206,7 +215,7 @@ in6_control(struct socket *so, u_long cm
>                       return (EPERM);
>               /* FALLTHROUGH */
>       case SIOCGLIFADDR:
> -             return in6_lifaddr_ioctl(so, cmd, data, ifp);
> +             return in6_lifaddr_ioctl(cmd, data, ifp, privileged);
>       }
>  
>       /*
> @@ -939,8 +948,7 @@ in6_unlink_ifa(struct in6_ifaddr *ia6, s
>   * address encoding scheme. (see figure on page 8)
>   */
>  int
> -in6_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data,
> -    struct ifnet *ifp)
> +in6_lifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, int 
> privileged)
>  {
>       struct if_laddrreq *iflr = (struct if_laddrreq *)data;
>       struct ifaddr *ifa;
> @@ -1047,7 +1055,8 @@ in6_lifaddr_ioctl(struct socket *so, u_l
>               in6_prefixlen2mask(&ifra.ifra_prefixmask.sin6_addr, prefixlen);
>  
>               ifra.ifra_flags = iflr->flags & ~IFLR_PREFIX;
> -             return in6_control(so, SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp);
> +             return in6_ioctl(SIOCAIFADDR_IN6, (caddr_t)&ifra, ifp,
> +                 privileged);
>           }
>       case SIOCGLIFADDR:
>       case SIOCDLIFADDR:
> @@ -1142,8 +1151,8 @@ in6_lifaddr_ioctl(struct socket *so, u_l
>                           ia6->ia_prefixmask.sin6_len);
>  
>                       ifra.ifra_flags = ia6->ia6_flags;
> -                     return in6_control(so, SIOCDIFADDR_IN6, (caddr_t)&ifra,
> -                         ifp);
> +                     return in6_ioctl(SIOCDIFADDR_IN6, (caddr_t)&ifra, ifp,
> +                         privileged);
>               }
>           }
>       }
> Index: sys/netinet6/in6_var.h
> ===================================================================
> RCS file: /cvs/src/sys/netinet6/in6_var.h,v
> retrieving revision 1.62
> diff -u -p -u -p -r1.62 in6_var.h
> --- sys/netinet6/in6_var.h    3 Mar 2016 12:57:15 -0000       1.62
> +++ sys/netinet6/in6_var.h    1 Jun 2016 14:32:19 -0000
> @@ -394,6 +394,7 @@ int       in6_hasmulti(struct in6_addr *, stru
>  struct in6_multi_mship *in6_joingroup(struct ifnet *, struct in6_addr *, int 
> *);
>  int  in6_leavegroup(struct in6_multi_mship *);
>  int  in6_control(struct socket *, u_long, caddr_t, struct ifnet *);
> +int  in6_ioctl(u_long, caddr_t, struct ifnet *, int);
>  int  in6_update_ifa(struct ifnet *, struct in6_aliasreq *,
>       struct in6_ifaddr *);
>  void in6_purgeaddr(struct ifaddr *);
> Index: sys/sys/sockio.h
> ===================================================================
> RCS file: /cvs/src/sys/sys/sockio.h,v
> retrieving revision 1.64
> diff -u -p -u -p -r1.64 sockio.h
> --- sys/sys/sockio.h  31 May 2016 22:35:02 -0000      1.64
> +++ sys/sys/sockio.h  1 Jun 2016 14:32:19 -0000
> @@ -202,6 +202,10 @@
>  #define SIOCGIFPARENT        _IOWR('i', 179, struct if_parent) /* get parent 
> if */
>  #define SIOCDIFPARENT        _IOW('i', 180, struct ifreq)    /* del parent 
> if */
>  
> +#define      SIOCGUMBIMINFO  _IOWR('i', 190, struct ifreq)   /* get UMBIM 
> info */
> +#define      SIOCSUMBIMPARAM  _IOW('i', 191, struct ifreq)   /* set UMBIM 
> param */
> +#define      SIOCGUMBIMPARAM _IOWR('i', 192, struct ifreq)   /* get UMBIM 
> param */
> +
>  #define      SIOCSVH         _IOWR('i', 245, struct ifreq)   /* set carp 
> param */
>  #define      SIOCGVH         _IOWR('i', 246, struct ifreq)   /* get carp 
> param */
>  
> 
> 
> 

Reply via email to