Merge remote-tracking branch 'cros/upstream' into 'cros/master'

Change-Id: I8810fdf4e8a133a39c2f267e00ab2d31fc7f479d
diff --git a/data/Makefile.am b/data/Makefile.am
index e70ec6e..357275e 100644
--- a/data/Makefile.am
+++ b/data/Makefile.am
@@ -12,4 +12,5 @@
 	mbim-service-ms-host-shutdown.json \
 	mbim-service-proxy-control.json \
 	mbim-service-qmi.json \
-	mbim-service-atds.json
+	mbim-service-atds.json \
+	mbim-service-intel-firmware-update.json
diff --git a/data/mbim-service-intel-firmware-update.json b/data/mbim-service-intel-firmware-update.json
new file mode 100644
index 0000000..cd55164
--- /dev/null
+++ b/data/mbim-service-intel-firmware-update.json
@@ -0,0 +1,11 @@
+[
+  // *********************************************************************************
+  { "type" : "Service",
+    "name" : "Intel Firmware Update" },
+
+  // *********************************************************************************
+  { "name"         : "Modem Reboot",
+    "service"      : "Intel Firmware Update",
+    "type"         : "Command",
+    "set"          : [] }
+]
diff --git a/docs/man/Makefile.am b/docs/man/Makefile.am
index 674edab..bb32c48 100644
--- a/docs/man/Makefile.am
+++ b/docs/man/Makefile.am
@@ -10,6 +10,7 @@
 	$(top_srcdir)/src/mbimcli/mbimcli-dss.c \
 	$(top_srcdir)/src/mbimcli/mbimcli-ms-firmware-id.c \
 	$(top_srcdir)/src/mbimcli/mbimcli-ms-host-shutdown.c \
+	$(top_srcdir)/src/mbimcli/mbimcli-intel-firmware-update.c \
 	$(top_srcdir)/src/mbimcli/mbimcli-phonebook.c \
 	$(top_srcdir)/src/mbimcli/mbimcli.c
 
diff --git a/docs/reference/libmbim-glib/Makefile.am b/docs/reference/libmbim-glib/Makefile.am
index 94d7c7b..d569d13 100644
--- a/docs/reference/libmbim-glib/Makefile.am
+++ b/docs/reference/libmbim-glib/Makefile.am
@@ -18,7 +18,8 @@
 	$(top_builddir)/src/libmbim-glib/generated/mbim-ms-firmware-id.sections \
 	$(top_builddir)/src/libmbim-glib/generated/mbim-ms-host-shutdown.sections \
 	$(top_builddir)/src/libmbim-glib/generated/mbim-qmi.sections \
-	$(top_builddir)/src/libmbim-glib/generated/mbim-atds.sections
+	$(top_builddir)/src/libmbim-glib/generated/mbim-atds.sections \
+	$(top_builddir)/src/libmbim-glib/generated/mbim-intel-firmware-update.sections
 
 $(DOC_MODULE)-sections.mstamp: $(ALL_SECTIONS)
 	$(AM_V_GEN) \
diff --git a/docs/reference/libmbim-glib/libmbim-glib-common.sections b/docs/reference/libmbim-glib/libmbim-glib-common.sections
index 6367ab9..8d564b9 100644
--- a/docs/reference/libmbim-glib/libmbim-glib-common.sections
+++ b/docs/reference/libmbim-glib/libmbim-glib-common.sections
@@ -25,6 +25,7 @@
 MBIM_UUID_MS_HOST_SHUTDOWN
 MBIM_UUID_PROXY_CONTROL
 MBIM_UUID_QMI
+MBIM_UUID_INTEL_FIRMWARE_UPDATE
 <SUBSECTION Methods>
 mbim_service_get_string
 mbim_service_lookup_name
@@ -59,6 +60,7 @@
 MbimCidMsHostShutdown
 MbimCidProxyControl
 MbimCidQmi
+MbimCidIntelFirmwareUpdate
 <SUBSECTION Methods>
 mbim_cid_can_set
 mbim_cid_can_query
@@ -76,6 +78,7 @@
 mbim_cid_ms_host_shutdown_get_string
 mbim_cid_proxy_control_get_string
 mbim_cid_qmi_get_string
+mbim_cid_intel_firmware_update_get_string
 <SUBSECTION Private>
 mbim_cid_atds_build_string_from_mask
 mbim_cid_basic_connect_build_string_from_mask
@@ -89,6 +92,7 @@
 mbim_cid_ms_host_shutdown_build_string_from_mask
 mbim_cid_proxy_control_build_string_from_mask
 mbim_cid_qmi_build_string_from_mask
+mbim_cid_intel_firmware_update_build_string_from_mask
 <SUBSECTION Standard>
 MBIM_TYPE_CID_ATDS
 MBIM_TYPE_CID_AUTH
@@ -102,6 +106,7 @@
 MBIM_TYPE_CID_MS_HOST_SHUTDOWN
 MBIM_TYPE_CID_PROXY_CONTROL
 MBIM_TYPE_CID_QMI
+MBIM_TYPE_CID_INTEL_FIRMWARE_UPDATE
 mbim_cid_atds_get_type
 mbim_cid_auth_get_type
 mbim_cid_basic_connect_get_type
@@ -114,6 +119,7 @@
 mbim_cid_ms_host_shutdown_get_type
 mbim_cid_proxy_control_get_type
 mbim_cid_qmi_get_type
+mbim_cid_intel_firmware_update_get_type
 </SECTION>
 
 <SECTION>
diff --git a/docs/reference/libmbim-glib/libmbim-glib-docs.xml b/docs/reference/libmbim-glib/libmbim-glib-docs.xml
index 8ad35c2..30c489e 100644
--- a/docs/reference/libmbim-glib/libmbim-glib-docs.xml
+++ b/docs/reference/libmbim-glib/libmbim-glib-docs.xml
@@ -71,6 +71,7 @@
     <xi:include href="xml/mbim-ms-host-shutdown.xml"/>
     <xi:include href="xml/mbim-qmi.xml"/>
     <xi:include href="xml/mbim-att-device-service.xml"/>
+    <xi:include href="xml/mbim-intel-firmware-update.xml"/>
   </chapter>
 
   <chapter>
diff --git a/src/libmbim-glib/generated/Makefile.am b/src/libmbim-glib/generated/Makefile.am
index b0722a0..ce69402 100644
--- a/src/libmbim-glib/generated/Makefile.am
+++ b/src/libmbim-glib/generated/Makefile.am
@@ -14,7 +14,8 @@
 	mbim-ms-host-shutdown.h \
 	mbim-proxy-control.h \
 	mbim-qmi.h \
-	mbim-atds.h
+	mbim-atds.h \
+	mbim-intel-firmware-update.h
 
 GENERATED_C = \
 	mbim-error-types.c \
@@ -31,7 +32,8 @@
 	mbim-ms-host-shutdown.c \
 	mbim-proxy-control.c \
 	mbim-qmi.c \
-	mbim-atds.c
+	mbim-atds.c \
+	mbim-intel-firmware-update.c
 
 GENERATED_SECTIONS = \
 	mbim-basic-connect.sections \
@@ -45,7 +47,8 @@
 	mbim-ms-host-shutdown.sections \
 	mbim-proxy-control.sections \
 	mbim-qmi.sections \
-	mbim-atds.sections
+	mbim-atds.sections \
+	mbim-intel-firmware-update.sections
 
 # Error types
 mbim-error-types.h: $(top_srcdir)/src/libmbim-glib/mbim-errors.h $(top_srcdir)/build-aux/templates/mbim-error-types-template.h
@@ -194,6 +197,15 @@
 			--input $(top_srcdir)/data/mbim-service-atds.json \
 			--output mbim-atds
 
+# Intel Firmware Update Service
+mbim-intel-firmware-update.h mbim-intel-firmware-update.c mbim-intel-firmware-update.sections: $(top_srcdir)/data/mbim-service-intel-firmware-update.json $(top_srcdir)/build-aux/mbim-codegen/*.py $(top_srcdir)/build-aux/mbim-codegen/mbim-codegen
+	$(AM_V_GEN)  \
+		rm -f mbim-intel-firmware-update.h && \
+		rm -f mbim-intel-firmware-update.c && \
+		$(top_srcdir)/build-aux/mbim-codegen/mbim-codegen \
+			--input $(top_srcdir)/data/mbim-service-intel-firmware-update.json \
+			--output mbim-intel-firmware-update
+
 BUILT_SOURCES = $(GENERATED_H) $(GENERATED_C)
 
 nodist_libmbim_glib_generated_la_SOURCES = \
diff --git a/src/libmbim-glib/libmbim-glib.h b/src/libmbim-glib/libmbim-glib.h
index 1b82de5..a7bf92c 100644
--- a/src/libmbim-glib/libmbim-glib.h
+++ b/src/libmbim-glib/libmbim-glib.h
@@ -50,6 +50,7 @@
 #include "mbim-ms-host-shutdown.h"
 #include "mbim-qmi.h"
 #include "mbim-atds.h"
+#include "mbim-intel-firmware-update.h"
 
 /* backwards compatibility */
 #include "mbim-compat.h"
diff --git a/src/libmbim-glib/mbim-cid.c b/src/libmbim-glib/mbim-cid.c
index 4f3cc7c..7f46466 100644
--- a/src/libmbim-glib/mbim-cid.c
+++ b/src/libmbim-glib/mbim-cid.c
@@ -157,6 +157,12 @@
     { NO_SET, QUERY, NO_NOTIFY }, /* MBIM_CID_ATDS_REGISTER_STATE */
 };
 
+/* Note: index of the array is CID-1 */
+#define MBIM_CID_INTEL_FIRMWARE_UPDATE_LAST MBIM_CID_INTEL_FIRMWARE_UPDATE_MODEM_REBOOT
+static const CidConfig cid_intel_firmware_update_config [MBIM_CID_INTEL_FIRMWARE_UPDATE_LAST] = {
+    { SET, NO_QUERY, NO_NOTIFY }, /* MBIM_CID_INTEL_FIRMWARE_UPDATE_MODEM_REBOOT */
+};
+
 /**
  * mbim_cid_can_set:
  * @service: a #MbimService.
@@ -201,6 +207,8 @@
         return cid_qmi_config[cid - 1].set;
     case MBIM_SERVICE_ATDS:
         return cid_atds_config[cid - 1].set;
+    case MBIM_SERVICE_INTEL_FIRMWARE_UPDATE:
+        return cid_intel_firmware_update_config[cid - 1].set;
     default:
         g_assert_not_reached ();
         return FALSE;
@@ -251,6 +259,8 @@
         return cid_qmi_config[cid - 1].query;
     case MBIM_SERVICE_ATDS:
         return cid_atds_config[cid - 1].query;
+    case MBIM_SERVICE_INTEL_FIRMWARE_UPDATE:
+        return cid_intel_firmware_update_config[cid - 1].query;
     default:
         g_assert_not_reached ();
         return FALSE;
@@ -301,6 +311,8 @@
         return cid_qmi_config[cid - 1].notify;
     case MBIM_SERVICE_ATDS:
         return cid_atds_config[cid - 1].notify;
+    case MBIM_SERVICE_INTEL_FIRMWARE_UPDATE:
+        return cid_intel_firmware_update_config[cid - 1].notify;
     default:
         g_assert_not_reached ();
         return FALSE;
diff --git a/src/libmbim-glib/mbim-cid.h b/src/libmbim-glib/mbim-cid.h
index d85d201..4be0dbf 100644
--- a/src/libmbim-glib/mbim-cid.h
+++ b/src/libmbim-glib/mbim-cid.h
@@ -251,6 +251,18 @@
     MBIM_CID_ATDS_REGISTER_STATE = 9,
 } MbimCidAtds;
 
+/**
+ * MbimCidIntelFirmwareUpdate:
+ * @MBIM_CID_INTEL_FIRMWARE_UPDATE_UNKNOWN: Unknown command.
+ * @MBIM_CID_INTEL_FIRMWARE_UPDATE_MODEM_REBOOT: Reboot modem for firmware update.
+ *
+ * MBIM commands in the %MBIM_SERVICE_INTEL_FIRMWARE_UPDATE service.
+ */
+typedef enum {
+    MBIM_CID_INTEL_FIRMWARE_UPDATE_UNKNOWN      = 0,
+    MBIM_CID_INTEL_FIRMWARE_UPDATE_MODEM_REBOOT = 1,
+} MbimCidIntelFirmwareUpdate;
+
 /* Command helpers */
 
 gboolean     mbim_cid_can_set       (MbimService service,
diff --git a/src/libmbim-glib/mbim-device.c b/src/libmbim-glib/mbim-device.c
index 90ca0bb..ee87fb4 100644
--- a/src/libmbim-glib/mbim-device.c
+++ b/src/libmbim-glib/mbim-device.c
@@ -147,140 +147,156 @@
 /* Message transactions (private) */
 
 typedef struct {
-    MbimDevice *self;
-    guint32 transaction_id;
-    TransactionType type;
+    MbimDevice      *self;
+    guint32          transaction_id;
+    TransactionType  type;
 } TransactionWaitContext;
 
 typedef struct {
-    MbimDevice *self;
-    MbimMessage *fragments;
-    MbimMessageType type;
-    guint32 transaction_id;
-    GSimpleAsyncResult *result;
-    GSource *timeout_source;
-    GCancellable *cancellable;
-    gulong cancellable_id;
+    MbimMessage            *fragments;
+    MbimMessageType         type;
+    guint32                 transaction_id;
+    GSource                *timeout_source;
+    GCancellable           *cancellable;
+    gulong                  cancellable_id;
     TransactionWaitContext *wait_ctx;
-} Transaction;
+} TransactionContext;
+
+static void
+transaction_context_free (TransactionContext *ctx)
+{
+    if (ctx->fragments)
+        mbim_message_unref (ctx->fragments);
+
+    if (ctx->timeout_source)
+        g_source_destroy (ctx->timeout_source);
+
+    if (ctx->cancellable) {
+        if (ctx->cancellable_id)
+            g_cancellable_disconnect (ctx->cancellable, ctx->cancellable_id);
+        g_object_unref (ctx->cancellable);
+    }
+
+    if (ctx->wait_ctx)
+        g_slice_free (TransactionWaitContext, ctx->wait_ctx);
+
+    g_slice_free (TransactionContext, ctx);
+}
 
 /* #define TRACE_TRANSACTION 1 */
 #ifdef TRACE_TRANSACTION
 static void
-trace_transaction (Transaction *tr,
-                   const gchar *state)
+transaction_task_trace (GTask       *task,
+                        const gchar *state)
 {
+    MbimDevice         *self;
+    TransactionContext *ctx;
+
+    self = g_task_get_source_object (task);
+    ctx  = g_task_get_task_data     (task);
+
     g_debug ("[%s,%u] transaction %s: %s",
-             tr->self->priv->path_display,
-             tr->transaction_id,
-             mbim_message_type_get_string (tr->type),
+             self->priv->path_display,
+             ctx->transaction_id,
+             mbim_message_type_get_string (ctx->type),
              state);
 }
 #else
-# define trace_transaction(...)
+# define transaction_task_trace(...)
 #endif
 
-static Transaction *
-transaction_new (MbimDevice          *self,
-                 MbimMessageType      type,
-                 guint32              transaction_id,
-                 GCancellable        *cancellable,
-                 GAsyncReadyCallback  callback,
-                 gpointer             user_data)
+static GTask *
+transaction_task_new (MbimDevice          *self,
+                      MbimMessageType      type,
+                      guint32              transaction_id,
+                      GCancellable        *cancellable,
+                      GAsyncReadyCallback  callback,
+                      gpointer             user_data)
 {
-    Transaction *tr;
+    GTask              *task;
+    TransactionContext *ctx;
 
-    tr = g_slice_new0 (Transaction);
-    tr->type = type;
-    tr->transaction_id = transaction_id;
-    tr->self = g_object_ref (self);
-    tr->result = g_simple_async_result_new (G_OBJECT (self),
-                                            callback,
-                                            user_data,
-                                            transaction_new);
-    if (cancellable)
-        tr->cancellable = g_object_ref (cancellable);
+    task = g_task_new (self, cancellable, callback, user_data);
 
-    trace_transaction (tr, "new");
+    ctx = g_slice_new0 (TransactionContext);
+    ctx->type = type;
+    ctx->transaction_id = transaction_id;
+    ctx->cancellable = (cancellable ? g_object_ref (cancellable) : NULL);
+    g_task_set_task_data (task, ctx, (GDestroyNotify) transaction_context_free);
 
-    return tr;
+    transaction_task_trace (task, "new");
+
+    return task;
 }
 
 static void
-transaction_complete_and_free (Transaction  *tr,
-                               const GError *error)
+transaction_task_complete_and_free (GTask        *task,
+                                    const GError *error)
 {
-    if (tr->timeout_source)
-        g_source_destroy (tr->timeout_source);
+    TransactionContext *ctx;
 
-    if (tr->cancellable) {
-        if (tr->cancellable_id)
-            g_cancellable_disconnect (tr->cancellable, tr->cancellable_id);
-        g_object_unref (tr->cancellable);
-    }
-
-    if (tr->wait_ctx)
-        g_slice_free (TransactionWaitContext, tr->wait_ctx);
+    ctx = g_task_get_task_data (task);
 
     if (error) {
-        trace_transaction (tr, "complete: error");
-        g_simple_async_result_set_from_error (tr->result, error);
-        if (tr->fragments)
-            mbim_message_unref (tr->fragments);
+        transaction_task_trace (task, "complete: error");
+        g_task_return_error (task, g_error_copy (error));
     } else {
-        trace_transaction (tr, "complete: response");
-        g_assert (tr->fragments != NULL);
-        g_simple_async_result_set_op_res_gpointer (tr->result,
-                                                   tr->fragments,
-                                                   (GDestroyNotify) mbim_message_unref);
+        transaction_task_trace (task, "complete: response");
+        g_assert (ctx->fragments != NULL);
+        g_task_return_pointer (task, mbim_message_ref (ctx->fragments), (GDestroyNotify) mbim_message_unref);
     }
 
-    g_simple_async_result_complete_in_idle (tr->result);
-    g_object_unref (tr->result);
-    g_object_unref (tr->self);
-    g_slice_free (Transaction, tr);
+    g_object_unref (task);
 }
 
-static Transaction *
+static GTask *
 device_release_transaction (MbimDevice      *self,
                             TransactionType  type,
                             MbimMessageType  expected_type,
                             guint32          transaction_id)
 {
-    Transaction *tr = NULL;
+    GTask              *task;
+    TransactionContext *ctx;
 
     /* Only return transaction if it was released from the HT */
-    if (self->priv->transactions[type]) {
-        tr = g_hash_table_lookup (self->priv->transactions[type], GUINT_TO_POINTER (transaction_id));
-        if (tr && ((tr->type == expected_type) || (expected_type == MBIM_MESSAGE_TYPE_INVALID))) {
-            /* If found, remove it from the HT */
-            trace_transaction (tr, "release");
-            g_hash_table_remove (self->priv->transactions[type], GUINT_TO_POINTER (transaction_id));
-            return tr;
-        }
+    if (!self->priv->transactions[type])
+        return NULL;
+
+    task = g_hash_table_lookup (self->priv->transactions[type], GUINT_TO_POINTER (transaction_id));
+    if (!task)
+        return NULL;
+
+    ctx = g_task_get_task_data (task);
+    if ((ctx->type == expected_type) || (expected_type == MBIM_MESSAGE_TYPE_INVALID)) {
+        /* If found, remove it from the HT */
+        transaction_task_trace (task, "release");
+        g_hash_table_remove (self->priv->transactions[type], GUINT_TO_POINTER (transaction_id));
+        return task;
     }
 
     return NULL;
 }
 
 static gboolean
-transaction_timed_out (TransactionWaitContext *ctx)
+transaction_timed_out (TransactionWaitContext *wait_ctx)
 {
-    Transaction *tr;
-    GError *error = NULL;
+    GTask              *task;
+    TransactionContext *ctx;
+    GError             *error = NULL;
 
-    tr = device_release_transaction (ctx->self,
-                                     ctx->type,
-                                     MBIM_MESSAGE_TYPE_INVALID,
-                                     ctx->transaction_id);
-    if (!tr)
+    task = device_release_transaction (wait_ctx->self,
+                                       wait_ctx->type,
+                                       MBIM_MESSAGE_TYPE_INVALID,
+                                       wait_ctx->transaction_id);
+    if (!task)
         /* transaction already completed */
         return FALSE;
 
-    tr->timeout_source = NULL;
+    ctx = g_task_get_task_data (task);
+    ctx->timeout_source = NULL;
 
     /* If no fragment was received, complete transaction with a timeout error */
-    if (!tr->fragments)
+    if (!ctx->fragments)
         error = g_error_new (MBIM_CORE_ERROR,
                              MBIM_CORE_ERROR_TIMEOUT,
                              "Transaction timed out");
@@ -291,78 +307,85 @@
                              "Fragment timed out");
 
         /* Also notify to the modem */
-        device_report_error (ctx->self,
-                             tr->transaction_id,
+        device_report_error (wait_ctx->self,
+                             wait_ctx->transaction_id,
                              error);
     }
 
-    transaction_complete_and_free (tr, error);
+    transaction_task_complete_and_free (task, error);
     g_error_free (error);
 
-    return FALSE;
+    return G_SOURCE_REMOVE;
 }
 
 static void
 transaction_cancelled (GCancellable           *cancellable,
-                       TransactionWaitContext *ctx)
+                       TransactionWaitContext *wait_ctx)
 {
-    Transaction *tr;
-    GError *error = NULL;
+    GTask              *task;
+    TransactionContext *ctx;
+    GError             *error = NULL;
 
-    tr = device_release_transaction (ctx->self,
-                                     ctx->type,
-                                     MBIM_MESSAGE_TYPE_INVALID,
-                                     ctx->transaction_id);
+    task = device_release_transaction (wait_ctx->self,
+                                       wait_ctx->type,
+                                       MBIM_MESSAGE_TYPE_INVALID,
+                                       wait_ctx->transaction_id);
 
     /* The transaction may have already been cancelled before we stored it in
      * the tracking table */
-    if (!tr)
+    if (!task)
         return;
 
-    tr->cancellable_id = 0;
+    ctx = g_task_get_task_data (task);
+    ctx->cancellable_id = 0;
 
     /* Complete transaction with an abort error */
     error = g_error_new (MBIM_CORE_ERROR,
                          MBIM_CORE_ERROR_ABORTED,
                          "Transaction aborted");
-    transaction_complete_and_free (tr, error);
+    transaction_task_complete_and_free (task, error);
     g_error_free (error);
 }
 
 static gboolean
 device_store_transaction (MbimDevice       *self,
                           TransactionType   type,
-                          Transaction      *tr,
+                          GTask            *task,
                           guint             timeout_ms,
                           GError          **error)
 {
-    trace_transaction (tr, "store");
+    TransactionContext *ctx;
+
+    transaction_task_trace (task, "store");
 
     if (G_UNLIKELY (!self->priv->transactions[type]))
         self->priv->transactions[type] = g_hash_table_new (g_direct_hash, g_direct_equal);
 
-    tr->wait_ctx = g_slice_new (TransactionWaitContext);
-    tr->wait_ctx->self = self;
+    ctx = g_task_get_task_data (task);
+
+    ctx->wait_ctx = g_slice_new (TransactionWaitContext);
+    ctx->wait_ctx->self = self;
      /* valid as long as the transaction is in the HT */
-    tr->wait_ctx->transaction_id = tr->transaction_id;
-    tr->wait_ctx->type = type;
+    ctx->wait_ctx->transaction_id = ctx->transaction_id;
+    ctx->wait_ctx->type = type;
 
     /* don't add timeout if one already exists */
-    if (!tr->timeout_source) {
-        tr->timeout_source = g_timeout_source_new (timeout_ms);
-        g_source_set_callback (tr->timeout_source, (GSourceFunc)transaction_timed_out, tr->wait_ctx, NULL);
-        g_source_attach (tr->timeout_source, g_main_context_get_thread_default ());
-        g_source_unref (tr->timeout_source);
+    if (!ctx->timeout_source) {
+        ctx->timeout_source = g_timeout_source_new (timeout_ms);
+        g_source_set_callback (ctx->timeout_source, (GSourceFunc)transaction_timed_out, ctx->wait_ctx, NULL);
+        g_source_attach (ctx->timeout_source, g_main_context_get_thread_default ());
+        g_source_unref (ctx->timeout_source);
     }
 
-    if (tr->cancellable && !tr->cancellable_id) {
+    /* Indication transactions don't have cancellable */
+    if (ctx->cancellable && !ctx->cancellable_id) {
         /* Note: transaction_cancelled() will also be called directly if the
          * cancellable is already cancelled */
-        tr->cancellable_id = g_cancellable_connect (tr->cancellable,
-                                                    (GCallback)transaction_cancelled,
-                                                    tr->wait_ctx,
-                                                    NULL);
-        if (!tr->cancellable_id) {
+        ctx->cancellable_id = g_cancellable_connect (ctx->cancellable,
+                                                     (GCallback)transaction_cancelled,
+                                                     ctx->wait_ctx,
+                                                     NULL);
+        if (!ctx->cancellable_id) {
             g_set_error_literal (error,
                                  MBIM_CORE_ERROR,
                                  MBIM_CORE_ERROR_ABORTED,
@@ -372,7 +395,7 @@
     }
 
     /* Keep in the HT */
-    g_hash_table_insert (self->priv->transactions[type], GUINT_TO_POINTER (tr->transaction_id), tr);
+    g_hash_table_insert (self->priv->transactions[type], GUINT_TO_POINTER (ctx->transaction_id), task);
 
     return TRUE;
 }
@@ -475,7 +498,7 @@
     GError *error = NULL;
     MbimMessage *indication;
 
-    if (g_simple_async_result_propagate_error (G_SIMPLE_ASYNC_RESULT (res), &error)) {
+    if (!(indication = g_task_propagate_pointer (G_TASK (res), &error))) {
         g_debug ("[%s] Error processing indication message: %s",
                  self->priv->path_display,
                  error->message);
@@ -483,39 +506,39 @@
         return;
     }
 
-    indication = g_simple_async_result_get_op_res_gpointer (G_SIMPLE_ASYNC_RESULT (res));
     g_signal_emit (self, signals[SIGNAL_INDICATE_STATUS], 0, indication);
+    mbim_message_unref (indication);
 }
 
 static void
 finalize_pending_open_request (MbimDevice *self)
 {
-    Transaction *tr;
-    GError      *error = NULL;
+    GTask  *task;
+    GError *error = NULL;
 
     if (!self->priv->open_transaction_id)
         return;
 
     /* Grab transaction. This is a _DONE message, so look for the request
      * that generated the _DONE */
-    tr = device_release_transaction (self,
-                                     TRANSACTION_TYPE_HOST,
-                                     MBIM_MESSAGE_TYPE_OPEN,
-                                     self->priv->open_transaction_id);
+    task = device_release_transaction (self,
+                                       TRANSACTION_TYPE_HOST,
+                                       MBIM_MESSAGE_TYPE_OPEN,
+                                       self->priv->open_transaction_id);
 
     /* If there is a valid open_transaction_id, there must be a valid transaction */
-    g_assert (tr);
+    g_assert (task);
 
     /* Clear right away before completing the transaction */
     self->priv->open_transaction_id = 0;
 
     error = g_error_new (MBIM_CORE_ERROR, MBIM_CORE_ERROR_UNKNOWN_STATE, "device state is unknown");
-    transaction_complete_and_free (tr, error);
+    transaction_task_complete_and_free (task, error);
     g_error_free (error);
 }
 
 static void
-process_message (MbimDevice  *self,
+process_message (MbimDevice        *self,
                  const MbimMessage *message)
 {
     gboolean is_partial_fragment;
@@ -553,32 +576,33 @@
     case MBIM_MESSAGE_TYPE_CLOSE_DONE:
     case MBIM_MESSAGE_TYPE_COMMAND_DONE:
     case MBIM_MESSAGE_TYPE_INDICATE_STATUS: {
-        GError *error = NULL;
-        Transaction *tr;
+        GError             *error = NULL;
+        GTask              *task;
+        TransactionContext *ctx;
 
         if (MBIM_MESSAGE_GET_MESSAGE_TYPE (message) == MBIM_MESSAGE_TYPE_INDICATE_STATUS) {
             /* Grab transaction */
-            tr = device_release_transaction (self,
-                                             TRANSACTION_TYPE_MODEM,
-                                             MBIM_MESSAGE_TYPE_INDICATE_STATUS,
-                                             mbim_message_get_transaction_id (message));
+            task = device_release_transaction (self,
+                                               TRANSACTION_TYPE_MODEM,
+                                               MBIM_MESSAGE_TYPE_INDICATE_STATUS,
+                                               mbim_message_get_transaction_id (message));
 
-            if (!tr)
+            if (!task)
                 /* Create new transaction for the indication */
-                tr = transaction_new (self,
-                                      MBIM_MESSAGE_TYPE_INDICATE_STATUS,
-                                      mbim_message_get_transaction_id (message),
-                                      NULL, /* no cancellable */
-                                      (GAsyncReadyCallback)indication_ready,
-                                      NULL);
+                task = transaction_task_new (self,
+                                             MBIM_MESSAGE_TYPE_INDICATE_STATUS,
+                                             mbim_message_get_transaction_id (message),
+                                             NULL, /* no cancellable */
+                                             (GAsyncReadyCallback) indication_ready,
+                                             NULL);
         } else {
             /* Grab transaction. This is a _DONE message, so look for the request
              * that generated the _DONE */
-            tr = device_release_transaction (self,
-                                             TRANSACTION_TYPE_HOST,
-                                             (MBIM_MESSAGE_GET_MESSAGE_TYPE (message) - 0x80000000),
-                                             mbim_message_get_transaction_id (message));
-            if (!tr) {
+            task = device_release_transaction (self,
+                                               TRANSACTION_TYPE_HOST,
+                                               (MBIM_MESSAGE_GET_MESSAGE_TYPE (message) - 0x80000000),
+                                               mbim_message_get_transaction_id (message));
+            if (!task) {
                 gchar *printable;
 
                 g_debug ("[%s] No transaction matched in received message",
@@ -604,65 +628,65 @@
 
             /* If the message doesn't have fragments, we're done */
             if (!_mbim_message_is_fragment (message)) {
-                g_assert (tr->fragments == NULL);
-                tr->fragments = mbim_message_dup (message);
-                transaction_complete_and_free (tr, NULL);
+                ctx = g_task_get_task_data (task);
+                g_assert (ctx->fragments == NULL);
+                ctx->fragments = mbim_message_dup (message);
+                transaction_task_complete_and_free (task, NULL);
                 return;
             }
         }
 
         /* More than one fragment expected; is this the first one? */
-        if (!tr->fragments)
-            tr->fragments = _mbim_message_fragment_collector_init (message, &error);
+        ctx = g_task_get_task_data (task);
+        if (!ctx->fragments)
+            ctx->fragments = _mbim_message_fragment_collector_init (message, &error);
         else
-            _mbim_message_fragment_collector_add (tr->fragments, message, &error);
+            _mbim_message_fragment_collector_add (ctx->fragments, message, &error);
 
         if (error) {
-            device_report_error (self,
-                                 tr->transaction_id,
-                                 error);
-            transaction_complete_and_free (tr, error);
+            device_report_error (self, ctx->transaction_id, error);
+            transaction_task_complete_and_free (task, error);
             g_error_free (error);
             return;
         }
 
         /* Did we get all needed fragments? */
-        if (_mbim_message_fragment_collector_complete (tr->fragments)) {
+        if (_mbim_message_fragment_collector_complete (ctx->fragments)) {
             /* Now, translate the whole message */
             if (mbim_utils_get_traces_enabled ()) {
                 gchar *printable;
 
-                printable = mbim_message_get_printable (tr->fragments, ">>>>>> ", FALSE);
+                printable = mbim_message_get_printable (ctx->fragments, ">>>>>> ", FALSE);
                 g_debug ("[%s] Received message (translated)...\n%s",
                          self->priv->path_display,
                          printable);
                 g_free (printable);
             }
 
-            transaction_complete_and_free (tr, NULL);
+            transaction_task_complete_and_free (task, NULL);
             return;
         }
 
         /* Need more fragments, store transaction */
         g_assert (device_store_transaction (self,
                                             TRANSACTION_TYPE_HOST,
-                                            tr,
+                                            task,
                                             MAX_TIME_BETWEEN_FRAGMENTS_MS,
                                             NULL));
         return;
     }
 
     case MBIM_MESSAGE_TYPE_FUNCTION_ERROR: {
-        Transaction *tr;
         GError *error_indication;
+        GTask  *task;
 
         /* Try to match this transaction just per transaction ID */
-        tr = device_release_transaction (self,
-                                         TRANSACTION_TYPE_HOST,
-                                         MBIM_MESSAGE_TYPE_INVALID,
-                                         mbim_message_get_transaction_id (message));
+        task = device_release_transaction (self,
+                                           TRANSACTION_TYPE_HOST,
+                                           MBIM_MESSAGE_TYPE_INVALID,
+                                           mbim_message_get_transaction_id (message));
 
-        if (!tr)
+        if (!task)
             g_debug ("[%s] No transaction matched in received function error message",
                      self->priv->path_display);
 
@@ -676,11 +700,15 @@
             g_free (printable);
         }
 
-        if (tr) {
-            if (tr->fragments)
-                mbim_message_unref (tr->fragments);
-            tr->fragments = mbim_message_dup (message);
-            transaction_complete_and_free (tr, NULL);
+        if (task) {
+            TransactionContext *ctx;
+
+            ctx = g_task_get_task_data (task);
+
+            if (ctx->fragments)
+                mbim_message_unref (ctx->fragments);
+            ctx->fragments = mbim_message_dup (message);
+            transaction_task_complete_and_free (task, NULL);
         }
 
         /* Signals are emitted regardless of whether the transaction matched or not */
@@ -767,39 +795,47 @@
     if (G_UNLIKELY (!self->priv->response))
         self->priv->response = g_byte_array_sized_new (500);
 
-    do {
-        GError *error = NULL;
-
-        status = g_io_channel_read_chars (source,
-                                          buffer,
-                                          self->priv->max_control_transfer,
-                                          &bytes_read,
-                                          &error);
-        if (status == G_IO_STATUS_ERROR) {
-            if (error) {
-                g_warning ("[%s] error reading from the IOChannel: '%s'",
-                           self->priv->path_display,
-                           error->message);
-                g_error_free (error);
-            }
+    /* The parse_response() message may end up triggering a close of the
+     * MbimDevice or even a full unref. We are going to make sure a valid
+     * reference is available for as long as we need it in the while()
+     * loop. */
+    g_object_ref (self);
+    {
+        do {
+            GError *error = NULL;
 
             /* Port is closed; we're done */
             if (!self->priv->iochannel_source)
                 break;
-        }
 
-        /* If no bytes read, just let g_io_channel wait for more data */
-        if (bytes_read == 0)
-            break;
+            status = g_io_channel_read_chars (source,
+                                              buffer,
+                                              self->priv->max_control_transfer,
+                                              &bytes_read,
+                                              &error);
+            if (status == G_IO_STATUS_ERROR) {
+                if (error) {
+                    g_warning ("[%s] error reading from the IOChannel: '%s'",
+                               self->priv->path_display,
+                               error->message);
+                    g_error_free (error);
+                }
+            }
 
-        if (bytes_read > 0)
-            g_byte_array_append (self->priv->response, (const guint8 *)buffer, bytes_read);
+            /* If no bytes read, just let g_io_channel wait for more data */
+            if (bytes_read == 0)
+                break;
 
-        /* Try to parse what we already got */
-        parse_response (self);
+            if (bytes_read > 0)
+                g_byte_array_append (self->priv->response, (const guint8 *)buffer, bytes_read);
 
-        /* And keep on if we were told to keep on */
-    } while (bytes_read == self->priv->max_control_transfer || status == G_IO_STATUS_AGAIN);
+            /* Try to parse what we already got */
+            parse_response (self);
+
+            /* And keep on if we were told to keep on */
+        } while (bytes_read == self->priv->max_control_transfer || status == G_IO_STATUS_AGAIN);
+    }
+    g_object_unref (self);
 
     return TRUE;
 }
@@ -2100,11 +2136,7 @@
                             GAsyncResult  *res,
                             GError       **error)
 {
-    if (g_simple_async_result_propagate_error (G_SIMPLE_ASYNC_RESULT (res), error))
-        return NULL;
-
-    return mbim_message_ref (g_simple_async_result_get_op_res_gpointer (
-                                 G_SIMPLE_ASYNC_RESULT (res)));
+    return g_task_propagate_pointer (G_TASK (res), error);
 }
 
 /**
@@ -2129,9 +2161,9 @@
                      GAsyncReadyCallback  callback,
                      gpointer             user_data)
 {
-    GError *error = NULL;
-    Transaction *tr;
-    guint32 transaction_id;
+    GError  *error = NULL;
+    GTask   *task;
+    guint32  transaction_id;
 
     g_return_if_fail (MBIM_IS_DEVICE (self));
     g_return_if_fail (message != NULL);
@@ -2144,38 +2176,38 @@
         mbim_message_set_transaction_id (message, transaction_id);
     }
 
-    tr = transaction_new (self,
-                          MBIM_MESSAGE_GET_MESSAGE_TYPE (message),
-                          transaction_id,
-                          cancellable,
-                          callback,
-                          user_data);
+    task = transaction_task_new (self,
+                                 MBIM_MESSAGE_GET_MESSAGE_TYPE (message),
+                                 transaction_id,
+                                 cancellable,
+                                 callback,
+                                 user_data);
 
     /* Device must be open */
     if (!self->priv->iochannel) {
         error = g_error_new (MBIM_CORE_ERROR,
                              MBIM_CORE_ERROR_WRONG_STATE,
                              "Device must be open to send commands");
-        transaction_complete_and_free (tr, error);
+        transaction_task_complete_and_free (task, error);
         g_error_free (error);
         return;
     }
 
     /* Setup context to match response */
-    if (!device_store_transaction (self, TRANSACTION_TYPE_HOST, tr, timeout * 1000, &error)) {
+    if (!device_store_transaction (self, TRANSACTION_TYPE_HOST, task, timeout * 1000, &error)) {
         g_prefix_error (&error, "Cannot store transaction: ");
-        transaction_complete_and_free (tr, error);
+        transaction_task_complete_and_free (task, error);
         g_error_free (error);
         return;
     }
 
     if (!device_send (self, message, &error)) {
         /* Match transaction so that we remove it from our tracking table */
-        tr = device_release_transaction (self,
-                                         TRANSACTION_TYPE_HOST,
-                                         MBIM_MESSAGE_GET_MESSAGE_TYPE (message),
-                                         mbim_message_get_transaction_id (message));
-        transaction_complete_and_free (tr, error);
+        task = device_release_transaction (self,
+                                           TRANSACTION_TYPE_HOST,
+                                           MBIM_MESSAGE_GET_MESSAGE_TYPE (message),
+                                           mbim_message_get_transaction_id (message));
+        transaction_task_complete_and_free (task, error);
         g_error_free (error);
         return;
     }
diff --git a/src/libmbim-glib/mbim-proxy.c b/src/libmbim-glib/mbim-proxy.c
index d59a4de..0e83f60 100644
--- a/src/libmbim-glib/mbim-proxy.c
+++ b/src/libmbim-glib/mbim-proxy.c
@@ -391,18 +391,14 @@
 /* Internal proxy device opening operation */
 
 typedef struct {
-    MbimProxy          *self;
-    MbimDevice         *device;
-    guint32             timeout_secs;
-    GSimpleAsyncResult *result;
+    MbimDevice *device;
+    guint32     timeout_secs;
 } InternalDeviceOpenContext;
 
 static void
 internal_device_open_context_free (InternalDeviceOpenContext *ctx)
 {
-    g_object_unref (ctx->result);
     g_object_unref (ctx->device);
-    g_object_unref (ctx->self);
     g_slice_free (InternalDeviceOpenContext, ctx);
 }
 
@@ -411,7 +407,7 @@
                              GAsyncResult  *res,
                              GError       **error)
 {
-    return !g_simple_async_result_propagate_error (G_SIMPLE_ASYNC_RESULT (res), error);
+    return g_task_propagate_boolean (G_TASK (res), error);
 }
 
 typedef struct {
@@ -425,16 +421,15 @@
 {
     GList *l;
 
-    /* Complete all pending open actions */
+    /* Complete all pending open tasks */
     for (l = info->pending; l; l = g_list_next (l)) {
-        GSimpleAsyncResult *simple = (GSimpleAsyncResult *)(l->data);
+        GTask *task = (GTask *)(l->data);
 
         if (error)
-            g_simple_async_result_set_from_error (simple, error);
+            g_task_return_error (task, g_error_copy (error));
         else
-            g_simple_async_result_set_op_res_gboolean (simple, TRUE);
-        g_simple_async_result_complete_in_idle (simple);
-        g_object_unref (simple);
+            g_task_return_boolean (task, TRUE);
+        g_object_unref (task);
     }
 
     g_list_free (info->pending);
@@ -511,24 +506,27 @@
 }
 
 static void
-internal_open (InternalDeviceOpenContext *ctx)
+internal_open (GTask *task)
 {
-    OpeningDevice *info;
+    MbimProxy                 *self;
+    InternalDeviceOpenContext *ctx;
+    OpeningDevice             *info;
+
+    self = g_task_get_source_object (task);
+    ctx  = g_task_get_task_data (task);
 
     /* If already being opened, queue it up */
-    info = peek_opening_device_info (ctx->self, ctx->device);
+    info = peek_opening_device_info (self, ctx->device);
     if (info) {
-        /* Propagate result object from context */
-        info->pending = g_list_append (info->pending, g_object_ref (ctx->result));
-        internal_device_open_context_free (ctx);
+        info->pending = g_list_append (info->pending, task);
         return;
     }
 
-    /* First time opening, go on */
+    /* First time opening */
     info = g_slice_new0 (OpeningDevice);
     info->device = g_object_ref (ctx->device);
-    info->pending = g_list_append (info->pending, g_object_ref (ctx->result));
-    ctx->self->priv->opening_devices = g_list_prepend (ctx->self->priv->opening_devices, info);
+    info->pending = g_list_append (info->pending, task);
+    self->priv->opening_devices = g_list_prepend (self->priv->opening_devices, info);
 
     /* Note: for now, only the first timeout request is taken into account */
 
@@ -538,22 +536,23 @@
                       ctx->timeout_secs,
                       NULL,
                       (GAsyncReadyCallback)device_open_ready,
-                      g_object_ref (ctx->self));
-
-    internal_device_open_context_free (ctx);
+                      g_object_ref (self));
 }
 
 static void
-internal_device_open_caps_query_ready (MbimDevice                *device,
-                                       GAsyncResult              *res,
-                                       InternalDeviceOpenContext *ctx)
+internal_device_open_caps_query_ready (MbimDevice   *device,
+                                       GAsyncResult *res,
+                                       GTask        *task)
 {
-    GError *error = NULL;
+    MbimProxy   *self;
+    GError      *error = NULL;
     MbimMessage *response;
-    GList *l;
+    GList       *l;
+
+    self = g_task_get_source_object (task);
 
     /* Always unblock all signals from all clients */
-    for (l = ctx->self->priv->clients; l; l = g_list_next (l))
+    for (l = self->priv->clients; l; l = g_list_next (l))
         g_signal_handlers_unblock_by_func (device, client_error_cb, l->data);
 
     response = mbim_device_command_finish (device, res, &error);
@@ -562,7 +561,7 @@
         if (g_error_matches (error, MBIM_PROTOCOL_ERROR, MBIM_PROTOCOL_ERROR_NOT_OPENED)) {
             g_debug ("device not-opened error reported, reopening");
             mbim_device_close_force (device, NULL);
-            internal_open (ctx);
+            internal_open (task);
             if (response)
                 mbim_message_unref (response);
             g_error_free (error);
@@ -574,9 +573,8 @@
         g_error_free (error);
     }
 
-    g_simple_async_result_set_op_res_gboolean (ctx->result, TRUE);
-    g_simple_async_result_complete (ctx->result);
-    internal_device_open_context_free (ctx);
+    g_task_return_boolean (task, TRUE);
+    g_object_unref (task);
 
     if (response)
         mbim_message_unref (response);
@@ -590,15 +588,14 @@
                       gpointer             user_data)
 {
     InternalDeviceOpenContext *ctx;
+    GTask                     *task;
+
+    task = g_task_new (self, NULL, callback, user_data);
 
     ctx = g_slice_new0 (InternalDeviceOpenContext);
-    ctx->self         = g_object_ref (self);
-    ctx->device       = g_object_ref (device);
+    ctx->device = g_object_ref (device);
     ctx->timeout_secs = timeout_secs;
-    ctx->result       = g_simple_async_result_new (G_OBJECT (self),
-                                                   callback,
-                                                   user_data,
-                                                   internal_device_open);
+    g_task_set_task_data (task, ctx, (GDestroyNotify) internal_device_open_context_free);
 
     /* If the device is flagged as already open, we still want to check
      * whether that's totally true, and we do that with a standard command
@@ -620,12 +617,12 @@
                              5,
                              NULL,
                              (GAsyncReadyCallback)internal_device_open_caps_query_ready,
-                             ctx);
+                             task);
         mbim_message_unref (message);
         return;
     }
 
-    internal_open (ctx);
+    internal_open (task);
 }
 
 /*****************************************************************************/
diff --git a/src/libmbim-glib/mbim-uuid.c b/src/libmbim-glib/mbim-uuid.c
index 4cb9a20..d77be39 100644
--- a/src/libmbim-glib/mbim-uuid.c
+++ b/src/libmbim-glib/mbim-uuid.c
@@ -244,6 +244,14 @@
     .e = { 0xb2, 0xe7, 0x0e, 0x52, 0x7d, 0xb3 }
 };
 
+static const MbimUuid uuid_intel_firmware_update = {
+    .a = { 0x0e, 0xd3, 0x74, 0xcb },
+    .b = { 0xf8, 0x35 },
+    .c = { 0x44, 0x74 },
+    .d = { 0xbc, 0x11 },
+    .e = { 0x3b, 0x3f, 0xd7, 0x6f, 0x56, 0x41 }
+};
+
 static GList *mbim_custom_service_list = NULL;
 
 typedef struct {
@@ -413,6 +421,8 @@
         return &uuid_qmi;
     case MBIM_SERVICE_ATDS:
         return &uuid_atds;
+    case MBIM_SERVICE_INTEL_FIRMWARE_UPDATE:
+        return &uuid_intel_firmware_update;
     default:
         for (l = mbim_custom_service_list; l != NULL; l = l->next) {
             if (service == ((MbimCustomService *)l->data)->service_id)
@@ -471,6 +481,9 @@
     if (mbim_uuid_cmp (uuid, &uuid_atds))
         return MBIM_SERVICE_ATDS;
 
+    if (mbim_uuid_cmp (uuid, &uuid_intel_firmware_update))
+        return MBIM_SERVICE_INTEL_FIRMWARE_UPDATE;
+
     for (l = mbim_custom_service_list; l != NULL; l = l->next) {
         if (mbim_uuid_cmp (&((MbimCustomService *)l->data)->uuid, uuid))
             return ((MbimCustomService *)l->data)->service_id;
diff --git a/src/libmbim-glib/mbim-uuid.h b/src/libmbim-glib/mbim-uuid.h
index 14db47e..59b6338 100644
--- a/src/libmbim-glib/mbim-uuid.h
+++ b/src/libmbim-glib/mbim-uuid.h
@@ -73,6 +73,7 @@
  * @MBIM_SERVICE_PROXY_CONTROL: Proxy Control service.
  * @MBIM_SERVICE_QMI: QMI-over-MBIM service.
  * @MBIM_SERVICE_ATDS: ATT Device service.
+ * @MBIM_SERVICE_INTEL_FIRMWARE_UPDATE: Intel firmware update service.
  * @MBIM_SERVICE_LAST: Internal value.
  *
  * Enumeration of the generic MBIM services.
@@ -91,6 +92,7 @@
     MBIM_SERVICE_PROXY_CONTROL    = 10,
     MBIM_SERVICE_QMI              = 11,
     MBIM_SERVICE_ATDS             = 12,
+    MBIM_SERVICE_INTEL_FIRMWARE_UPDATE = 13,
 #if defined LIBMBIM_GLIB_COMPILATION
     MBIM_SERVICE_LAST /*< skip >*/
 #endif
@@ -213,6 +215,15 @@
  */
 #define MBIM_UUID_ATDS mbim_uuid_from_service (MBIM_SERVICE_ATDS)
 
+/**
+ * MBIM_UUID_INTEL_FIRMWARE_UPDATE:
+ *
+ * Get the UUID of the %MBIM_SERVICE_INTEL_FIRMWARE_UPDATE service.
+ *
+ * Returns: (transfer none): a #MbimUuid.
+ */
+#define MBIM_UUID_INTEL_FIRMWARE_UPDATE mbim_uuid_from_service (MBIM_SERVICE_INTEL_FIRMWARE_UPDATE)
+
 const gchar *mbim_service_lookup_name (guint service);
 
 guint mbim_register_custom_service (const MbimUuid *uuid,
diff --git a/src/libmbim-glib/test/Makefile.am b/src/libmbim-glib/test/Makefile.am
index d492ed8..4310e6d 100644
--- a/src/libmbim-glib/test/Makefile.am
+++ b/src/libmbim-glib/test/Makefile.am
@@ -97,9 +97,7 @@
 	$(LIBMBIM_GLIB_LIBS)
 
 test_proxy_helpers_SOURCES = \
-	test-proxy-helpers.c \
-	$(top_srcdir)/src/libmbim-glib/mbim-proxy-helpers.h \
-	$(top_srcdir)/src/libmbim-glib/mbim-proxy-helpers.c
+	test-proxy-helpers.c
 test_proxy_helpers_CPPFLAGS = \
 	$(LIBMBIM_GLIB_CFLAGS) \
 	-I$(top_srcdir) \
diff --git a/src/libmbim-glib/test/test-uuid.c b/src/libmbim-glib/test/test-uuid.c
index 7b0ec28..accf45b 100644
--- a/src/libmbim-glib/test/test-uuid.c
+++ b/src/libmbim-glib/test/test-uuid.c
@@ -91,6 +91,13 @@
                           "883b7c26-985f-43fa-9804-27d7fb80959c");
 }
 
+static void
+test_uuid_intel_firmware_update (void)
+{
+    compare_uuid_strings (MBIM_UUID_INTEL_FIRMWARE_UPDATE,
+                          "0ed374cb-f835-4474-bc11-3b3fd76f5641");
+}
+
 /*****************************************************************************/
 
 static void
@@ -200,6 +207,7 @@
     g_test_add_func ("/libmbim-glib/uuid/dss",              test_uuid_dss);
     g_test_add_func ("/libmbim-glib/uuid/ms-firmware-id",   test_uuid_ms_firmware_id);
     g_test_add_func ("/libmbim-glib/uuid/ms-host-shutdown", test_uuid_ms_host_shutdown);
+    g_test_add_func ("/libmbim-glib/uuid/intel-firmware-update", test_uuid_intel_firmware_update);
 
     g_test_add_func ("/libmbim-glib/uuid/valid",           test_uuid_valid);
     g_test_add_func ("/libmbim-glib/uuid/valid/camelcase", test_uuid_valid_camelcase);
diff --git a/src/mbimcli/Makefile.am b/src/mbimcli/Makefile.am
index 0c38ad3..48f272f 100644
--- a/src/mbimcli/Makefile.am
+++ b/src/mbimcli/Makefile.am
@@ -18,7 +18,8 @@
 	mbimcli-dss.c \
 	mbimcli-ms-firmware-id.c \
 	mbimcli-ms-host-shutdown.c \
-	mbimcli-atds.c
+	mbimcli-atds.c \
+	mbimcli-intel-firmware-update.c
 
 mbimcli_LDADD = \
 	$(MBIMCLI_LIBS) \
diff --git a/src/mbimcli/mbimcli-intel-firmware-update.c b/src/mbimcli/mbimcli-intel-firmware-update.c
new file mode 100644
index 0000000..8eabf03
--- /dev/null
+++ b/src/mbimcli/mbimcli-intel-firmware-update.c
@@ -0,0 +1,159 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * mbimcli -- Command line interface to control MBIM devices
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Copyright 2018 Google LLC
+ */
+
+#include "config.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <locale.h>
+#include <string.h>
+
+#include <glib.h>
+#include <gio/gio.h>
+
+#include <libmbim-glib.h>
+
+#include "mbimcli.h"
+
+/* Context */
+typedef struct {
+    MbimDevice *device;
+    GCancellable *cancellable;
+} Context;
+static Context *ctx;
+
+/* Options */
+static gboolean modem_reboot_flag;
+
+static GOptionEntry entries[] = {
+    { "intel-modem-reboot", 0, 0, G_OPTION_ARG_NONE, &modem_reboot_flag,
+      "Reboot modem",
+      NULL
+    },
+    { NULL }
+};
+
+GOptionGroup *
+mbimcli_intel_firmware_update_get_option_group (void)
+{
+   GOptionGroup *group;
+
+   group = g_option_group_new ("intel-firmware-update",
+                               "Intel Firmware Update Service options",
+                               "Show Intel Firmware Update Service options",
+                               NULL,
+                               NULL);
+   g_option_group_add_entries (group, entries);
+
+   return group;
+}
+
+gboolean
+mbimcli_intel_firmware_update_options_enabled (void)
+{
+    static guint n_actions = 0;
+    static gboolean checked = FALSE;
+
+    if (checked)
+        return !!n_actions;
+
+    n_actions = modem_reboot_flag;
+
+    if (n_actions > 1) {
+        g_printerr ("error: too many Intel Firmware Update Service actions requested\n");
+        exit (EXIT_FAILURE);
+    }
+
+    checked = TRUE;
+    return !!n_actions;
+}
+
+static void
+context_free (Context *context)
+{
+    if (!context)
+        return;
+
+    if (context->cancellable)
+        g_object_unref (context->cancellable);
+    if (context->device)
+        g_object_unref (context->device);
+    g_slice_free (Context, context);
+}
+
+static void
+shutdown (gboolean operation_status)
+{
+    /* Cleanup context and finish async operation */
+    context_free (ctx);
+    mbimcli_async_operation_done (operation_status);
+}
+
+static void
+modem_reboot_ready (MbimDevice   *device,
+                    GAsyncResult *res)
+{
+    MbimMessage *response;
+    GError *error = NULL;
+
+    response = mbim_device_command_finish (device, res, &error);
+    if (!response || !mbim_message_response_get_result (response, MBIM_MESSAGE_TYPE_COMMAND_DONE, &error)) {
+        g_printerr ("error: operation failed: %s\n", error->message);
+        g_error_free (error);
+        if (response)
+            mbim_message_unref (response);
+        shutdown (FALSE);
+        return;
+    }
+
+    g_print ("[%s] Successfully requested modem to reboot for firmware update\n\n",
+             mbim_device_get_path_display (device));
+
+    mbim_message_unref (response);
+    shutdown (TRUE);
+}
+
+void
+mbimcli_intel_firmware_update_run (MbimDevice   *device,
+                          GCancellable *cancellable)
+{
+    /* Initialize context */
+    ctx = g_slice_new (Context);
+    ctx->device = g_object_ref (device);
+    ctx->cancellable = cancellable ? g_object_ref (cancellable) : NULL;
+
+    /* Request to reboot modem? */
+    if (modem_reboot_flag) {
+        MbimMessage *request;
+
+        g_debug ("Asynchronously rebooting modem...");
+        request = (mbim_message_intel_firmware_update_modem_reboot_set_new (NULL));
+        mbim_device_command (ctx->device,
+                             request,
+                             10,
+                             ctx->cancellable,
+                             (GAsyncReadyCallback)modem_reboot_ready,
+                             NULL);
+        mbim_message_unref (request);
+        return;
+    }
+
+    g_warn_if_reached ();
+}
diff --git a/src/mbimcli/mbimcli.c b/src/mbimcli/mbimcli.c
index 27bb634..c97c6dd 100644
--- a/src/mbimcli/mbimcli.c
+++ b/src/mbimcli/mbimcli.c
@@ -275,6 +275,9 @@
     case MBIM_SERVICE_ATDS:
         mbimcli_atds_run (dev, cancellable);
         return;
+    case MBIM_SERVICE_INTEL_FIRMWARE_UPDATE:
+        mbimcli_intel_firmware_update_run (dev, cancellable);
+        return;
     default:
         g_assert_not_reached ();
     }
@@ -349,6 +352,9 @@
     } else if (mbimcli_atds_options_enabled ()) {
         service = MBIM_SERVICE_ATDS;
         actions_enabled++;
+    } else if (mbimcli_intel_firmware_update_options_enabled ()) {
+        service = MBIM_SERVICE_INTEL_FIRMWARE_UPDATE;
+        actions_enabled++;
     }
 
     /* Noop */
@@ -392,6 +398,8 @@
                                 mbimcli_ms_host_shutdown_get_option_group ());
     g_option_context_add_group (context,
                                 mbimcli_atds_get_option_group ());
+    g_option_context_add_group (context,
+                                mbimcli_intel_firmware_update_get_option_group ());
     g_option_context_add_main_entries (context, main_entries, NULL);
     if (!g_option_context_parse (context, &argc, &argv, &error)) {
         g_printerr ("error: %s\n",
diff --git a/src/mbimcli/mbimcli.h b/src/mbimcli/mbimcli.h
index 02a1b78..a920872 100644
--- a/src/mbimcli/mbimcli.h
+++ b/src/mbimcli/mbimcli.h
@@ -35,6 +35,7 @@
 GOptionGroup *mbimcli_ms_firmware_id_get_option_group   (void);
 GOptionGroup *mbimcli_ms_host_shutdown_get_option_group (void);
 GOptionGroup *mbimcli_atds_get_option_group             (void);
+GOptionGroup *mbimcli_intel_firmware_update_get_option_group (void);
 
 gboolean      mbimcli_basic_connect_options_enabled     (void);
 gboolean      mbimcli_phonebook_options_enabled         (void);
@@ -42,6 +43,7 @@
 gboolean      mbimcli_ms_firmware_id_options_enabled    (void);
 gboolean      mbimcli_ms_host_shutdown_options_enabled  (void);
 gboolean      mbimcli_atds_options_enabled              (void);
+gboolean      mbimcli_intel_firmware_update_options_enabled (void);
 
 void          mbimcli_basic_connect_run                 (MbimDevice *device,
                                                          GCancellable *cancellable);
@@ -55,5 +57,7 @@
                                                          GCancellable *cancellable);
 void          mbimcli_atds_run                          (MbimDevice *device,
                                                          GCancellable *cancellable);
+void          mbimcli_intel_firmware_update_run         (MbimDevice *device,
+                                                         GCancellable *cancellable);
 
 #endif /* __MBIMCLI_H__ */