Import of Linux/MIPS 2.1.36

19 files changed, 4310 insertions, 3042 deletions

diff --git a/net/ax25/Makefile b/net/ax25/Makefile
index 172d89eed..b89b517c7 100644
--- a/net/ax25/Makefile
+++ b/net/ax25/Makefile
@@ -9,11 +9,21 @@
 
 
 O_TARGET := ax25.o
-O_OBJS	 := sysctl_net_ax25.o ax25_in.o ax25_out.o ax25_route.o ax25_subr.o ax25_timer.o
+O_OBJS	 := ax25_addr.o ax25_dev.o ax25_iface.o ax25_in.o ax25_ip.o ax25_out.o \
+	    ax25_route.o ax25_std_in.o ax25_std_subr.o ax25_std_timer.o \
+	    ax25_subr.o ax25_timer.o ax25_uid.o
 M_OBJS   := $(O_TARGET)
 
 OX_OBJS  += af_ax25.o
 
+ifeq ($(CONFIG_AX25_DAMA_SLAVE),y)
+O_OBJS += ax25_ds_in.o ax25_ds_subr.o ax25_ds_timer.o
+endif
+
+ifeq ($(CONFIG_SYSCTL),y)
+O_OBJS += sysctl_net_ax25.o
+endif
+
 include $(TOPDIR)/Rules.make
 
 tar:
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 7d08fed10..489993da6 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1,10 +1,10 @@
 /*
- *	AX.25 release 034
+ *	AX.25 release 036
  *
- *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
- *	releases, misbehave and/or generally screw up. It might even work. 
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new
+ *	releases, misbehave and/or generally screw up. It might even work.
  *
- *	This code REQUIRES 2.1.10 or higher/ NET3.029
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
  *
  *	This module:
  *		This module is free software; you can redistribute it and/or
@@ -86,13 +86,16 @@
  *			Joerg(DL1BKE)		Moved BPQ Ethernet to seperate driver.
  *	AX.25 034	Jonathan(G4KLX)		2.1 changes
  *			Alan(GW4PTS)		Small POSIXisations
- *
- *	To do:
- *		Restructure the ax25_rcv code to be cleaner/faster and
- *		copy only when needed.
- *		Consider better arbitrary protocol support.
+ *	AX.25 035	Alan(GW4PTS)		Started fixing to the new
+ *						format.
+ *			Hans(PE1AYX)		Fixed interface to IP layer.
+ *			Alan(GW4PTS)		Added asynchronous support.
+ *			Frederic(F1OAT)		Support for pseudo-digipeating.
+ *			Jonathan(G4KLX)		Support for packet forwarding.
+ *	AX.25 036	Jonathan(G4KLX)		Major restructuring.
+ *			Joerg(DL1BKE)		Fixed DAMA Slave.
  */
- 
+
 #include <linux/config.h>
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
 #include <linux/module.h>
@@ -126,112 +129,21 @@
 #include <net/ip.h>
 #include <net/arp.h>
 
-/*
- *	The null address is defined as a callsign of all spaces with an
- *	SSID of zero.
- */
-ax25_address null_ax25_address = {{0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x00}};
-
 ax25_cb *volatile ax25_list = NULL;
 
-/*
- *	ax25 -> ascii conversion
- */
-char *ax2asc(ax25_address *a)
-{
-	static char buf[11];
-	char c, *s;
-	int n;
-
-	for (n = 0, s = buf; n < 6; n++) {
-		c = (a->ax25_call[n] >> 1) & 0x7F;
-
-		if (c != ' ') *s++ = c;
-	}
-	
-	*s++ = '-';
-
-	if ((n = ((a->ax25_call[6] >> 1) & 0x0F)) > 9) {
-		*s++ = '1';
-		n -= 10;
-	}
-	
-	*s++ = n + '0';
-	*s++ = '\0';
-
-	if (*buf == '\0' || *buf == '-')
-	   return "*";
-
-	return buf;
-
-}
-
-/*
- *	ascii -> ax25 conversion
- */
-ax25_address *asc2ax(char *callsign)
-{
-	static ax25_address addr;
-	char *s;
-	int n;
-
-	for (s = callsign, n = 0; n < 6; n++) {
-		if (*s != '\0' && *s != '-')
-			addr.ax25_call[n] = *s++;
-		else
-			addr.ax25_call[n] = ' ';
-		addr.ax25_call[n] <<= 1;
-		addr.ax25_call[n] &= 0xFE;
-	}
-
-	if (*s++ == '\0') {
-		addr.ax25_call[6] = 0x00;
-		return &addr;
-	}
-
-	addr.ax25_call[6] = *s++ - '0';
-	
-	if (*s != '\0') {
-		addr.ax25_call[6] *= 10;
-		addr.ax25_call[6] += *s++ - '0';
-	}
-
-	addr.ax25_call[6] <<= 1;
-	addr.ax25_call[6] &= 0x1E;
-
-	return &addr;
-}
-
-/*
- *	Compare two ax.25 addresses
- */
-int ax25cmp(ax25_address *a, ax25_address *b)
-{
-	int ct = 0;
-
-	while (ct < 6) {
-		if ((a->ax25_call[ct] & 0xFE) != (b->ax25_call[ct] & 0xFE))	/* Clean off repeater bits */
-			return 1;
-		ct++;
-	}
-
- 	if ((a->ax25_call[ct] & 0x1E) == (b->ax25_call[ct] & 0x1E))	/* SSID without control bit */
- 		return 0;
-
- 	return 2;			/* Partial match */
-}
+static struct proto_ops ax25_proto_ops;
 
 /*
  *	Free an allocated ax25 control block. This is done to centralise
  *	the MOD count code.
  */
-static void ax25_free_cb(ax25_cb *ax25)
+void ax25_free_cb(ax25_cb *ax25)
 {
 	if (ax25->digipeat != NULL) {
 		kfree_s(ax25->digipeat, sizeof(ax25_digi));
 		ax25->digipeat = NULL;
 	}
-	
+
 	kfree_s(ax25, sizeof(ax25_cb));
 
 	MOD_DEC_USE_COUNT;
@@ -244,7 +156,7 @@ static void ax25_remove_socket(ax25_cb *ax25)
 {
 	ax25_cb *s;
 	unsigned long flags;
-	
+
 	save_flags(flags);
 	cli();
 
@@ -272,12 +184,16 @@ static void ax25_remove_socket(ax25_cb *ax25)
  */
 static void ax25_kill_by_device(struct device *dev)
 {
+	ax25_dev *ax25_dev;
 	ax25_cb *s;
-	
+
+	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
+		return;
+
 	for (s = ax25_list; s != NULL; s = s->next) {
-		if (s->device == dev) {
-			s->state  = AX25_STATE_0;
-			s->device = NULL;
+		if (s->ax25_dev == ax25_dev) {
+			s->state    = AX25_STATE_0;
+			s->ax25_dev = NULL;
 			if (s->sk != NULL) {
 				s->sk->state     = TCP_CLOSE;
 				s->sk->err       = ENETUNREACH;
@@ -320,7 +236,7 @@ static int ax25_device_event(struct notifier_block *this,unsigned long event, vo
 /*
  *	Add a socket to the bound sockets list.
  */
-static void ax25_insert_socket(ax25_cb *ax25)
+void ax25_insert_socket(ax25_cb *ax25)
 {
 	unsigned long flags;
 
@@ -337,7 +253,7 @@ static void ax25_insert_socket(ax25_cb *ax25)
  *	Find a socket that wants to accept the SABM we have just
  *	received.
  */
-static struct sock *ax25_find_listener(ax25_address *addr, struct device *dev, int type)
+struct sock *ax25_find_listener(ax25_address *addr, int digi, struct device *dev, int type)
 {
 	unsigned long flags;
 	ax25_cb *s;
@@ -346,9 +262,11 @@ static struct sock *ax25_find_listener(ax25_address *addr, struct device *dev, i
 	cli();
 
 	for (s = ax25_list; s != NULL; s = s->next) {
+		if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
+			continue;
 		if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 && s->sk->type == type && s->sk->state == TCP_LISTEN) {
 			/* If device is null we match any device */
-			if (s->device == NULL || s->device == dev) {
+			if (s->ax25_dev == NULL || s->ax25_dev->dev == dev) {
 				restore_flags(flags);
 				return s->sk;
 			}
@@ -362,7 +280,7 @@ static struct sock *ax25_find_listener(ax25_address *addr, struct device *dev, i
 /*
  *	Find an AX.25 socket given both ends.
  */
-static struct sock *ax25_find_socket(ax25_address *my_addr, ax25_address *dest_addr, int type)
+struct sock *ax25_find_socket(ax25_address *my_addr, ax25_address *dest_addr, int type)
 {
 	ax25_cb *s;
 	unsigned long flags;
@@ -386,7 +304,7 @@ static struct sock *ax25_find_socket(ax25_address *my_addr, ax25_address *dest_a
  *	Find an AX.25 control block given both ends. It will only pick up
  *	floating AX.25 control blocks or non Raw socket bound control blocks.
  */
-static ax25_cb *ax25_find_cb(ax25_address *my_addr, ax25_address *dest_addr, struct device *dev)
+ax25_cb *ax25_find_cb(ax25_address *my_addr, ax25_address *dest_addr, ax25_digi *digi, struct device *dev)
 {
 	ax25_cb *s;
 	unsigned long flags;
@@ -397,7 +315,13 @@ static ax25_cb *ax25_find_cb(ax25_address *my_addr, ax25_address *dest_addr, str
 	for (s = ax25_list; s != NULL; s = s->next) {
 		if (s->sk != NULL && s->sk->type != SOCK_SEQPACKET)
 			continue;
-		if (ax25cmp(&s->source_addr, my_addr) == 0 && ax25cmp(&s->dest_addr, dest_addr) == 0 && s->device == dev) {
+		if (ax25cmp(&s->source_addr, my_addr) == 0 && ax25cmp(&s->dest_addr, dest_addr) == 0 && s->ax25_dev->dev == dev) {
+			if (digi != NULL) {
+				if (s->digipeat == NULL && digi->ndigi != 0)
+					continue;
+				if (s->digipeat != NULL && ax25digicmp(s->digipeat, digi) != 0)
+					continue;
+			}
 			restore_flags(flags);
 			return s;
 		}
@@ -411,7 +335,7 @@ static ax25_cb *ax25_find_cb(ax25_address *my_addr, ax25_address *dest_addr, str
 /*
  *	Look for any matching address - RAW sockets can bind to arbitrary names
  */
-static struct sock *ax25_addr_match(ax25_address *addr)
+struct sock *ax25_addr_match(ax25_address *addr)
 {
 	unsigned long flags;
 	ax25_cb *s;
@@ -431,25 +355,24 @@ static struct sock *ax25_addr_match(ax25_address *addr)
 	return NULL;
 }
 
-static void ax25_send_to_raw(struct sock *sk, struct sk_buff *skb, int proto)
+void ax25_send_to_raw(struct sock *sk, struct sk_buff *skb, int proto)
 {
 	struct sk_buff *copy;
-	
+
 	while (sk != NULL) {
-		if (sk->type == SOCK_RAW && sk->protocol == proto && sk->rmem_alloc <= sk->rcvbuf) {
+		if (sk->type == SOCK_RAW &&
+		    sk->protocol == proto &&
+		    atomic_read(&sk->rmem_alloc) <= sk->rcvbuf) {
 			if ((copy = skb_clone(skb, GFP_ATOMIC)) == NULL)
 				return;
 
-			copy->sk = sk;
-			atomic_add(copy->truesize, &sk->rmem_alloc);
-			skb_queue_tail(&sk->receive_queue, copy);
-			if (!sk->dead)
-				sk->data_ready(sk, skb->len);
+			if (sock_queue_rcv_skb(sk, copy) != 0)
+				kfree_skb(copy, FREE_READ);
 		}
 
 		sk = sk->next;
 	}
-}	
+}
 
 /*
  *	Deferred destroy.
@@ -474,15 +397,15 @@ void ax25_destroy_socket(ax25_cb *ax25)	/* Not static as it's used by the timer
 {
 	struct sk_buff *skb;
 	unsigned long flags;
-	
+
 	save_flags(flags);
 	cli();
-	
+
 	del_timer(&ax25->timer);
-	
+
 	ax25_remove_socket(ax25);
 	ax25_clear_queues(ax25);	/* Flush the queues */
-	
+
 	if (ax25->sk != NULL) {
 		while ((skb = skb_dequeue(&ax25->sk->receive_queue)) != NULL) {
 			if (skb->sk != ax25->sk) {			/* A pending connection */
@@ -494,9 +417,11 @@ void ax25_destroy_socket(ax25_cb *ax25)	/* Not static as it's used by the timer
 			kfree_skb(skb, FREE_READ);
 		}
 	}
-	
+
 	if (ax25->sk != NULL) {
-		if (ax25->sk->wmem_alloc || ax25->sk->rmem_alloc) { /* Defer: outstanding buffers */
+		if (atomic_read(&ax25->sk->wmem_alloc) != 0 ||
+		    atomic_read(&ax25->sk->rmem_alloc) != 0) {
+			/* Defer: outstanding buffers */
 			init_timer(&ax25->timer);
 			ax25->timer.expires  = jiffies + 10 * HZ;
 			ax25->timer.function = ax25_destroy_timer;
@@ -514,80 +439,6 @@ void ax25_destroy_socket(ax25_cb *ax25)	/* Not static as it's used by the timer
 }
 
 /*
- *	Callsign/UID mapper. This is in kernel space for security on multi-amateur machines.
- */
-
-ax25_uid_assoc *ax25_uid_list;
-
-int ax25_uid_policy = 0;
-
-ax25_address *ax25_findbyuid(uid_t uid)
-{
-	ax25_uid_assoc *a;
-	
-	for (a = ax25_uid_list; a != NULL; a = a->next) {
-		if (a->uid == uid)
-			return &a->call;
-	}
-
-	return NULL;
-}
-
-static int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
-{
-	ax25_uid_assoc *a;
-	
-	switch (cmd) {
-		case SIOCAX25GETUID:
-			for (a = ax25_uid_list; a != NULL; a = a->next) {
-				if (ax25cmp(&sax->sax25_call, &a->call) == 0)
-					return a->uid;
-			}
-			return -ENOENT;
-
-		case SIOCAX25ADDUID:
-			if (!suser())
-				return -EPERM;
-			if (ax25_findbyuid(sax->sax25_uid))
-				return -EEXIST;
-			if (sax->sax25_uid == 0)
-				return -EINVAL;
-			a = (ax25_uid_assoc *)kmalloc(sizeof(*a), GFP_KERNEL);
-			if (a == NULL)
-				return -ENOMEM;
-			a->uid  = sax->sax25_uid;
-			a->call = sax->sax25_call;
-			a->next = ax25_uid_list;
-			ax25_uid_list = a;
-			return 0;
-
-		case SIOCAX25DELUID: {
-			ax25_uid_assoc **l;
-			
-			if (!suser())
-				return -EPERM;
-			l = &ax25_uid_list;
-			while ((*l) != NULL) {
-				if (ax25cmp(&((*l)->call), &(sax->sax25_call)) == 0) {
-					a = *l;
-					*l = (*l)->next;
-					kfree_s(a, sizeof(*a));
-					return 0;
-				}
-				
-				l = &((*l)->next);
-			}
-			return -ENOENT;
-		}
-		
-		default:
-			return -EINVAL;
-	}
-
-	return -EINVAL;	/*NOTREACHED */
-}
-
-/*
  * dl1bke 960311: set parameters for existing AX.25 connections,
  *		  includes a KILL command to abort any connection.
  *		  VERY useful for debugging ;-)
@@ -595,28 +446,32 @@ static int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static int ax25_ctl_ioctl(const unsigned int cmd, void *arg)
 {
 	struct ax25_ctl_struct ax25_ctl;
-	struct device *dev;
+	ax25_dev *ax25_dev;
 	ax25_cb *ax25;
 	unsigned long flags;
 	int err;
-	
+
 	if ((err = verify_area(VERIFY_READ, arg, sizeof(ax25_ctl))) != 0)
 		return err;
 
 	copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl));
-	
-	if ((dev = ax25rtr_get_dev(&ax25_ctl.port_addr)) == NULL)
+
+	if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)
 		return -ENODEV;
 
-	if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, dev)) == NULL)
+	if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, NULL, ax25_dev->dev)) == NULL)
 		return -ENOTCONN;
 
 	switch (ax25_ctl.cmd) {
 		case AX25_KILL:
 			ax25_clear_queues(ax25);
-			ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-				
+			ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 			ax25->state = AX25_STATE_0;
+#ifdef CONFIG_AX25_DAMA_SLAVE
+			if (ax25_dev->dama.slave && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
+				ax25_dama_off(ax25);
+#endif
+
 			if (ax25->sk != NULL) {
 				ax25->sk->state     = TCP_CLOSE;
 				ax25->sk->err       = ENETRESET;
@@ -626,26 +481,25 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void *arg)
 				ax25->sk->dead  = 1;
 			}
 
-			ax25_dama_off(ax25);
 			ax25_set_timer(ax25);
 	  		break;
 
 	  	case AX25_WINDOW:
-	  		if (ax25->modulus == MODULUS) {
-	  			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7) 
+	  		if (ax25->modulus == AX25_MODULUS) {
+	  			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)
 	  				return -EINVAL;
 	  		} else {
-	  			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63) 
+	  			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)
 	  				return -EINVAL;
 	  		}
 	  		ax25->window = ax25_ctl.arg;
 	  		break;
 
 	  	case AX25_T1:
-  			if (ax25_ctl.arg < 1) 
+  			if (ax25_ctl.arg < 1)
   				return -EINVAL;
-  			ax25->rtt = (ax25_ctl.arg * PR_SLOWHZ) / 2;
-  			ax25->t1 = ax25_ctl.arg * PR_SLOWHZ;
+  			ax25->rtt = (ax25_ctl.arg * AX25_SLOWHZ) / 2;
+  			ax25->t1 = ax25_ctl.arg * AX25_SLOWHZ;
   			save_flags(flags); cli();
   			if (ax25->t1timer > ax25->t1)
   				ax25->t1timer = ax25->t1;
@@ -653,77 +507,69 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void *arg)
   			break;
 
 	  	case AX25_T2:
-	  		if (ax25_ctl.arg < 1) 
+	  		if (ax25_ctl.arg < 1)
 	  			return -EINVAL;
 	  		save_flags(flags); cli();
-	  		ax25->t2 = ax25_ctl.arg * PR_SLOWHZ;
+	  		ax25->t2 = ax25_ctl.arg * AX25_SLOWHZ;
 	  		if (ax25->t2timer > ax25->t2)
 	  			ax25->t2timer = ax25->t2;
 	  		restore_flags(flags);
 	  		break;
 
 	  	case AX25_N2:
-	  		if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31) 
+	  		if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)
 	  			return -EINVAL;
 	  		ax25->n2count = 0;
 	  		ax25->n2 = ax25_ctl.arg;
 	  		break;
 
 	  	case AX25_T3:
-	  		if (ax25_ctl.arg < 0) 
+	  		if (ax25_ctl.arg < 0)
 	  			return -EINVAL;
 	  		save_flags(flags); cli();
-	  		ax25->t3 = ax25_ctl.arg * PR_SLOWHZ;
+	  		ax25->t3 = ax25_ctl.arg * AX25_SLOWHZ;
 	  		if (ax25->t3timer != 0)
 	  			ax25->t3timer = ax25->t3;
 	  		restore_flags(flags);
 	  		break;
 
 	  	case AX25_IDLE:
-	  		if (ax25_ctl.arg < 0) 
+	  		if (ax25_ctl.arg < 0)
 	  			return -EINVAL;
 			save_flags(flags); cli();
-	  		ax25->idle = ax25_ctl.arg * PR_SLOWHZ * 60;
+	  		ax25->idle = ax25_ctl.arg * AX25_SLOWHZ * 60;
 	  		if (ax25->idletimer != 0)
 	  			ax25->idletimer = ax25->idle;
 	  		restore_flags(flags);
 	  		break;
 
 	  	case AX25_PACLEN:
-	  		if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535) 
+	  		if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)
 	  			return -EINVAL;
-#if 0
-	  		if (ax25_ctl.arg > 256) /* we probably want this */
-	  			printk(KERN_WARNING "ax25_ctl_ioctl: Warning --- huge paclen %d\n", (int)ax25_ctl.arg);
-#endif	  			
 	  		ax25->paclen = ax25_ctl.arg;
 	  		break;
 
-	  	case AX25_MAXQUEUE:
-	  		if (ax25_ctl.arg < 1)
-	  			return -EINVAL;
-	  		ax25->maxqueue = ax25_ctl.arg;
-	  		break;
-
 	  	default:
 	  		return -EINVAL;
 	  }
-	  
+
 	  return 0;
 }
 
 /*
  * Create an empty AX.25 control block.
  */
-static ax25_cb *ax25_create_cb(void)
+ax25_cb *ax25_create_cb(void)
 {
 	ax25_cb *ax25;
 
-	if ((ax25 = (ax25_cb *)kmalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
+	if ((ax25 = kmalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
 		return NULL;
 
 	MOD_INC_USE_COUNT;
 
+	memset(ax25, 0x00, sizeof(*ax25));
+
 	skb_queue_head_init(&ax25->write_queue);
 	skb_queue_head_init(&ax25->frag_queue);
 	skb_queue_head_init(&ax25->ack_queue);
@@ -731,235 +577,77 @@ static ax25_cb *ax25_create_cb(void)
 
 	init_timer(&ax25->timer);
 
-	ax25->dama_slave = 0;
-
 	ax25->rtt     = AX25_DEF_T1 / 2;
 	ax25->t1      = AX25_DEF_T1;
 	ax25->t2      = AX25_DEF_T2;
 	ax25->t3      = AX25_DEF_T3;
 	ax25->n2      = AX25_DEF_N2;
 	ax25->paclen  = AX25_DEF_PACLEN;
-	ax25->maxqueue= AX25_DEF_MAXQUEUE;
 	ax25->idle    = AX25_DEF_IDLE;
 
 	if (AX25_DEF_AXDEFMODE) {
-		ax25->modulus = EMODULUS;
+		ax25->modulus = AX25_EMODULUS;
 		ax25->window  = AX25_DEF_EWINDOW;
 	} else {
-		ax25->modulus = MODULUS;
+		ax25->modulus = AX25_MODULUS;
 		ax25->window  = AX25_DEF_WINDOW;
 	}
 
-	ax25->fragno    = 0;
-	ax25->fraglen   = 0;
-	ax25->hdrincl   = 0;
-	ax25->backoff   = AX25_DEF_BACKOFF;
-	ax25->condition = 0x00;
-	ax25->t1timer   = 0;
-	ax25->t2timer   = 0;
-	ax25->t3timer   = 0;
-	ax25->n2count   = 0;
-	ax25->idletimer = 0;
-
-	ax25->va      = 0;
-	ax25->vr      = 0;
-	ax25->vs      = 0;
-
-	ax25->device   = NULL;
-	ax25->digipeat = NULL;
-	ax25->sk       = NULL;
-
-	ax25->state    = AX25_STATE_0;
-
-	memset(&ax25->dest_addr,   '\0', AX25_ADDR_LEN);
-	memset(&ax25->source_addr, '\0', AX25_ADDR_LEN);
+	ax25->backoff = AX25_DEF_BACKOFF;
+	ax25->state   = AX25_STATE_0;
 
 	return ax25;
 }
 
 /*
- *	Find out if we are a DAMA slave for this device and count the
- *	number of connections.
- *
- *	dl1bke 951121
- */
-int ax25_dev_is_dama_slave(struct device *dev)
-{
-	ax25_cb *ax25;
-	int count = 0;
-	
-	for (ax25 = ax25_list; ax25 != NULL; ax25 = ax25->next) {
-		if (ax25->device == dev && ax25->dama_slave) {
-			count++;
-			break;
-		}
-	}
-		
-	return count;
-}
-
-/*
  *	Fill in a created AX.25 created control block with the default
  *	values for a particular device.
  */
-static void ax25_fillin_cb(ax25_cb *ax25, struct device *dev)
+void ax25_fillin_cb(ax25_cb *ax25, ax25_dev *ax25_dev)
 {
-	ax25->device  = dev;
-
-	ax25->rtt      = ax25_dev_get_value(dev, AX25_VALUES_T1);
-	ax25->t1       = ax25_dev_get_value(dev, AX25_VALUES_T1);
-	ax25->t2       = ax25_dev_get_value(dev, AX25_VALUES_T2);
-	ax25->t3       = ax25_dev_get_value(dev, AX25_VALUES_T3);
-	ax25->n2       = ax25_dev_get_value(dev, AX25_VALUES_N2);
-	ax25->paclen   = ax25_dev_get_value(dev, AX25_VALUES_PACLEN);
-	ax25->maxqueue = ax25_dev_get_value(dev, AX25_VALUES_MAXQUEUE);
-	ax25->idle     = ax25_dev_get_value(dev, AX25_VALUES_IDLE);
-
-	ax25->dama_slave = 0;
-
-	if (ax25_dev_get_value(dev, AX25_VALUES_AXDEFMODE)) {
-		ax25->modulus = EMODULUS;
-		ax25->window  = ax25_dev_get_value(dev, AX25_VALUES_EWINDOW);
+	ax25->ax25_dev = ax25_dev;
+
+	ax25->rtt      = ax25_dev->values[AX25_VALUES_T1];
+	ax25->t1       = ax25_dev->values[AX25_VALUES_T1];
+	ax25->t2       = ax25_dev->values[AX25_VALUES_T2];
+	ax25->t3       = ax25_dev->values[AX25_VALUES_T3];
+	ax25->n2       = ax25_dev->values[AX25_VALUES_N2];
+	ax25->paclen   = ax25_dev->values[AX25_VALUES_PACLEN];
+	ax25->idle     = ax25_dev->values[AX25_VALUES_IDLE];
+
+	if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
+		ax25->modulus = AX25_EMODULUS;
+		ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
 	} else {
-		ax25->modulus = MODULUS;
-		ax25->window  = ax25_dev_get_value(dev, AX25_VALUES_WINDOW);
+		ax25->modulus = AX25_MODULUS;
+		ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
 	}
 
-	ax25->backoff = ax25_dev_get_value(dev, AX25_VALUES_BACKOFF);
-}
-
-int ax25_send_frame(struct sk_buff *skb, ax25_address *src, ax25_address *dest,
-	ax25_digi *digi, struct device *dev)
-{
-	ax25_cb *ax25;
-
-	if (skb == NULL)
-		return 0;
-
-	/*
-	 * Look for an existing connection.
-	 */
-	for (ax25 = ax25_list; ax25 != NULL; ax25 = ax25->next) {
-		if (ax25->sk != NULL && ax25->sk->type != SOCK_SEQPACKET)
-			continue;
-
-		if (ax25cmp(&ax25->source_addr, src) == 0 && ax25cmp(&ax25->dest_addr, dest) == 0 && ax25->device == dev) {
-			if (ax25_queue_length(ax25, skb) > ax25->maxqueue * ax25->window) {
-				kfree_skb(skb, FREE_WRITE);
-			} else {
-				ax25_output(ax25, skb);
-			}
-			ax25->idletimer = ax25->idle;
-			return 1;		/* It already existed */
-		}
-	}
-
-	if ((ax25 = ax25_create_cb()) == NULL)
-		return 0;
-
-	ax25_fillin_cb(ax25, dev);
-
-	ax25->source_addr = *src;
-	ax25->dest_addr   = *dest;
-
-	if (digi != NULL) {
-		if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
-			ax25_free_cb(ax25);
-			return 0;
-		}
-		*ax25->digipeat = *digi;
-	} else {
-		ax25_rt_build_path(ax25, dest, dev);
-	}
-
-	if (ax25_dev_is_dama_slave(ax25->device))
-		dama_establish_data_link(ax25);
-	else
-		ax25_establish_data_link(ax25);
-
-	/* idle timeouts only for mode vc connections */
-
-	ax25->idletimer = ax25->idle;
-		
-	ax25_insert_socket(ax25);
-
-	ax25->state = AX25_STATE_1;
-
-	ax25_set_timer(ax25);
-
-	ax25_output(ax25, skb);
-			
-	return 1;			/* We had to create it */	
-}
-
-/*
- *	Return the state of an AX.25 link given source, destination, and
- *	device.
- */
-int ax25_link_up(ax25_address *src, ax25_address *dest, struct device *dev)
-{
-	ax25_cb *ax25;
-
-	for (ax25 = ax25_list; ax25 != NULL; ax25 = ax25->next) {
-		if (ax25->sk != NULL && ax25->sk->type != SOCK_SEQPACKET)
-			continue;
-
-		if (ax25cmp(&ax25->source_addr, src) == 0 && ax25cmp(&ax25->dest_addr, dest) == 0 && ax25->device == dev)
-			return 1;
-	}
-
-	return 0;
-}
-
-/*
- *	Find the AX.25 device that matches the hardware address supplied.
- */
-struct device *ax25rtr_get_dev(ax25_address *addr)
-{
-	struct device *dev;
-	
-	for (dev = dev_base; dev != NULL; dev = dev->next)
-		if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25 &&
-		    ax25cmp(addr, (ax25_address*) dev->dev_addr) == 0)
-		     	return dev;
-
-	return NULL;
+	ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
 }
 
 /*
  *	Handling for system calls applied via the various interfaces to an
  *	AX25 socket object
  */
-static int ax25_fcntl(struct socket *sock, unsigned int cmd, unsigned long arg)
-{
-	return -EINVAL;
-}
 
-static int ax25_setsockopt(struct socket *sock, int level, int optname,
-	char *optval, int optlen)
+static int ax25_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
 {
-	struct sock *sk;
-	int err, opt;
-
-	sk = (struct sock *)sock->data;
-	
-	if (level == SOL_SOCKET)
-		return sock_setsockopt(sk, level, optname, optval, optlen);
+	struct sock *sk = sock->sk;
+	int opt;
 
 	if (level != SOL_AX25)
-		return -EOPNOTSUPP;
+		return -ENOPROTOOPT;
 
-	if (optval == NULL)
+	if (optlen < sizeof(int))
 		return -EINVAL;
 
-	if ((err = verify_area(VERIFY_READ, optval, sizeof(int))) != 0)
-		return err;
-
-	get_user(opt, (int *)optval);
+	if (get_user(opt, (int *)optval))
+		return -EFAULT;
 
 	switch (optname) {
 		case AX25_WINDOW:
-			if (sk->protinfo.ax25->modulus == MODULUS) {
+			if (sk->protinfo.ax25->modulus == AX25_MODULUS) {
 				if (opt < 1 || opt > 7)
 					return -EINVAL;
 			} else {
@@ -972,13 +660,13 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 		case AX25_T1:
 			if (opt < 1)
 				return -EINVAL;
-			sk->protinfo.ax25->rtt = (opt * PR_SLOWHZ) / 2;
+			sk->protinfo.ax25->rtt = (opt * AX25_SLOWHZ) / 2;
 			return 0;
 
 		case AX25_T2:
 			if (opt < 1)
 				return -EINVAL;
-			sk->protinfo.ax25->t2 = opt * PR_SLOWHZ;
+			sk->protinfo.ax25->t2 = opt * AX25_SLOWHZ;
 			return 0;
 
 		case AX25_N2:
@@ -990,27 +678,33 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 		case AX25_T3:
 			if (opt < 1)
 				return -EINVAL;
-			sk->protinfo.ax25->t3 = opt * PR_SLOWHZ;
+			sk->protinfo.ax25->t3 = opt * AX25_SLOWHZ;
 			return 0;
-			
+
 		case AX25_IDLE:
 			if (opt < 0)
 				return -EINVAL;
-			sk->protinfo.ax25->idle = opt * PR_SLOWHZ * 60;
+			sk->protinfo.ax25->idle = opt * AX25_SLOWHZ * 60;
 			return 0;
 
 		case AX25_BACKOFF:
-			sk->protinfo.ax25->backoff = opt ? 1 : 0;
+			if (opt < 0 || opt > 2)
+				return -EINVAL;
+			sk->protinfo.ax25->backoff = opt;
 			return 0;
 
 		case AX25_EXTSEQ:
-			sk->protinfo.ax25->modulus = opt ? EMODULUS : MODULUS;
+			sk->protinfo.ax25->modulus = opt ? AX25_EMODULUS : AX25_MODULUS;
 			return 0;
 
 		case AX25_HDRINCL:
 			sk->protinfo.ax25->hdrincl = opt ? 1 : 0;
 			return 0;
-			
+
+		case AX25_IAMDIGI:
+			sk->protinfo.ax25->iamdigi = opt ? 1 : 0;
+			return 0;
+
 		case AX25_PACLEN:
 			if (opt < 16 || opt > 65535)
 				return -EINVAL;
@@ -1022,20 +716,17 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 	}
 }
 
-static int ax25_getsockopt(struct socket *sock, int level, int optname,
-	char *optval, int *optlen)
+static int ax25_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
 {
-	struct sock *sk;
+	struct sock *sk = sock->sk;
 	int val = 0;
-	int err; 
+	int len;
 
-	sk = (struct sock *)sock->data;
-	
-	if (level == SOL_SOCKET)
-		return sock_getsockopt(sk, level, optname, optval, optlen);
-	
 	if (level != SOL_AX25)
-		return -EOPNOTSUPP;
+		return -ENOPROTOOPT;
+
+	if (get_user(len, optlen))
+		return -EFAULT;
 
 	switch (optname) {
 		case AX25_WINDOW:
@@ -1043,11 +734,11 @@ static int ax25_getsockopt(struct socket *sock, int level, int optname,
 			break;
 
 		case AX25_T1:
-			val = (sk->protinfo.ax25->t1 * 2) / PR_SLOWHZ;
+			val = (sk->protinfo.ax25->t1 * 2) / AX25_SLOWHZ;
 			break;
 
 		case AX25_T2:
-			val = sk->protinfo.ax25->t2 / PR_SLOWHZ;
+			val = sk->protinfo.ax25->t2 / AX25_SLOWHZ;
 			break;
 
 		case AX25_N2:
@@ -1055,11 +746,11 @@ static int ax25_getsockopt(struct socket *sock, int level, int optname,
 			break;
 
 		case AX25_T3:
-			val = sk->protinfo.ax25->t3 / PR_SLOWHZ;
+			val = sk->protinfo.ax25->t3 / AX25_SLOWHZ;
 			break;
-			
+
 		case AX25_IDLE:
-			val = sk->protinfo.ax25->idle / (PR_SLOWHZ * 60);
+			val = sk->protinfo.ax25->idle / (AX25_SLOWHZ * 60);
 			break;
 
 		case AX25_BACKOFF:
@@ -1067,13 +758,17 @@ static int ax25_getsockopt(struct socket *sock, int level, int optname,
 			break;
 
 		case AX25_EXTSEQ:
-			val = (sk->protinfo.ax25->modulus == EMODULUS);
+			val = (sk->protinfo.ax25->modulus == AX25_EMODULUS);
 			break;
 
 		case AX25_HDRINCL:
 			val = sk->protinfo.ax25->hdrincl;
 			break;
-			
+
+		case AX25_IAMDIGI:
+			val = sk->protinfo.ax25->iamdigi;
+			break;
+
 		case AX25_PACLEN:
 			val = sk->protinfo.ax25->paclen;
 			break;
@@ -1082,22 +777,20 @@ static int ax25_getsockopt(struct socket *sock, int level, int optname,
 			return -ENOPROTOOPT;
 	}
 
-	if ((err = verify_area(VERIFY_WRITE, optlen, sizeof(int))) != 0)
-		return err;
-
-	put_user(sizeof(int), optlen);
+	len = min(len, sizeof(int));
 
-	if ((err = verify_area(VERIFY_WRITE, optval, sizeof(int))) != 0)
-		return err;
+	if (put_user(len, optlen))
+		return -EFAULT;
 
-	put_user(val, (int *) optval);
+	if (copy_to_user(optval, &val, len))
+		return -EFAULT;
 
 	return 0;
 }
 
 static int ax25_listen(struct socket *sock, int backlog)
 {
-	struct sock *sk = (struct sock *)sock->data;
+	struct sock *sk = sock->sk;
 
 	if (sk->type == SOCK_SEQPACKET && sk->state != TCP_LISTEN) {
 		sk->max_ack_backlog = backlog;
@@ -1108,19 +801,7 @@ static int ax25_listen(struct socket *sock, int backlog)
 	return -EOPNOTSUPP;
 }
 
-static void def_callback1(struct sock *sk)
-{
-	if (!sk->dead)
-		wake_up_interruptible(sk->sleep);
-}
-
-static void def_callback2(struct sock *sk, int len)
-{
-	if (!sk->dead)
-		wake_up_interruptible(sk->sleep);
-}
-
-static int ax25_create(struct socket *sock, int protocol)
+int ax25_create(struct socket *sock, int protocol)
 {
 	struct sock *sk;
 	ax25_cb *ax25;
@@ -1141,13 +822,23 @@ static int ax25_create(struct socket *sock, int protocol)
 				case AX25_P_ARP:
 				case AX25_P_IP:
 #endif
-#if defined(CONFIG_NETROM) || defined(CONFIG_NETROM_MODULE)
+#ifdef CONFIG_NETROM
 				case AX25_P_NETROM:
 #endif
-#if defined(CONFIG_ROSE) || defined(CONFIG_ROSE_MODULE)
+#ifdef CONFIG_ROSE
 				case AX25_P_ROSE:
 #endif
 					return -ESOCKTNOSUPPORT;
+#ifdef CONFIG_NETROM_MODULE
+				case AX25_P_NETROM:
+					if (ax25_protocol_is_registered(AX25_P_NETROM))
+						return -ESOCKTNOSUPPORT;
+#endif
+#ifdef CONFIG_ROSE_MODULE
+				case AX25_P_ROSE:
+					if (ax25_protocol_is_registered(AX25_P_ROSE))
+						return -ESOCKTNOSUPPORT;
+#endif
 				default:
 					break;
 			}
@@ -1166,39 +857,19 @@ static int ax25_create(struct socket *sock, int protocol)
 		return -ENOMEM;
 	}
 
-	skb_queue_head_init(&sk->receive_queue);
-	skb_queue_head_init(&sk->write_queue);
-	skb_queue_head_init(&sk->back_log);
-
-	sk->socket        = sock;
-	sk->type          = sock->type;
-	sk->protocol      = protocol;
-	sk->next          = NULL;
-	sk->allocation	  = GFP_KERNEL;
-	sk->rcvbuf        = SK_RMEM_MAX;
-	sk->sndbuf        = SK_WMEM_MAX;
-	sk->state         = TCP_CLOSE;
-	sk->priority      = SOPRI_NORMAL;
-	sk->mtu           = AX25_MTU;	/* 256 */
-	sk->zapped        = 1;
-
-	sk->state_change = def_callback1;
-	sk->data_ready   = def_callback2;
-	sk->write_space  = def_callback1;
-	sk->error_report = def_callback1;
-
-	if (sock != NULL) {
-		sock->data = (void *)sk;
-		sk->sleep  = sock->wait;
-	}
+	sock_init_data(sock, sk);
+	
+	sock->ops    = &ax25_proto_ops;
+	sk->protocol = protocol;
+	sk->mtu      = AX25_MTU;	/* 256 */
 
 	ax25->sk          = sk;
 	sk->protinfo.ax25 = ax25;
-	
+
 	return 0;
 }
 
-static struct sock *ax25_make_new(struct sock *osk, struct device *dev)
+struct sock *ax25_make_new(struct sock *osk, struct device *dev)
 {
 	struct sock *sk;
 	ax25_cb *ax25;
@@ -1211,11 +882,6 @@ static struct sock *ax25_make_new(struct sock *osk, struct device *dev)
 		return NULL;
 	}
 
-	ax25_fillin_cb(ax25, dev);
-
-	sk->type   = osk->type;
-	sk->socket = osk->socket;
-
 	switch (osk->type) {
 		case SOCK_DGRAM:
 			break;
@@ -1227,30 +893,24 @@ static struct sock *ax25_make_new(struct sock *osk, struct device *dev)
 			return NULL;
 	}
 
-	skb_queue_head_init(&sk->receive_queue);
-	skb_queue_head_init(&sk->write_queue);
-	skb_queue_head_init(&sk->back_log);
-
-	sk->next        = NULL;
-	sk->priority    = osk->priority;
-	sk->protocol    = osk->protocol;
-	sk->rcvbuf      = osk->rcvbuf;
-	sk->sndbuf      = osk->sndbuf;
-	sk->debug       = osk->debug;
-	sk->state       = TCP_ESTABLISHED;
-	sk->window      = osk->window;
-	sk->mtu         = osk->mtu;
-	sk->sleep       = osk->sleep;
-	sk->zapped      = osk->zapped;
-
-	sk->state_change = def_callback1;
-	sk->data_ready   = def_callback2;
-	sk->write_space  = def_callback1;
-	sk->error_report = def_callback1;
+	sock_init_data(NULL, sk);
+	
+	sk->type     = osk->type;
+	sk->socket   = osk->socket;
+	sk->priority = osk->priority;
+	sk->protocol = osk->protocol;
+	sk->rcvbuf   = osk->rcvbuf;
+	sk->sndbuf   = osk->sndbuf;
+	sk->debug    = osk->debug;
+	sk->state    = TCP_ESTABLISHED;
+	sk->mtu      = osk->mtu;
+	sk->sleep    = osk->sleep;
+	sk->zapped   = osk->zapped;
 
 	ax25->modulus = osk->protinfo.ax25->modulus;
 	ax25->backoff = osk->protinfo.ax25->backoff;
 	ax25->hdrincl = osk->protinfo.ax25->hdrincl;
+	ax25->iamdigi = osk->protinfo.ax25->iamdigi;
 	ax25->rtt     = osk->protinfo.ax25->rtt;
 	ax25->t1      = osk->protinfo.ax25->t1;
 	ax25->t2      = osk->protinfo.ax25->t2;
@@ -1258,19 +918,18 @@ static struct sock *ax25_make_new(struct sock *osk, struct device *dev)
 	ax25->n2      = osk->protinfo.ax25->n2;
 	ax25->idle    = osk->protinfo.ax25->idle;
 	ax25->paclen  = osk->protinfo.ax25->paclen;
+	ax25->window  = osk->protinfo.ax25->window;
 
-	ax25->window   = osk->protinfo.ax25->window;
-	ax25->maxqueue = osk->protinfo.ax25->maxqueue;
-
+	ax25->ax25_dev    = osk->protinfo.ax25->ax25_dev;
 	ax25->source_addr = osk->protinfo.ax25->source_addr;
-	
+
 	if (osk->protinfo.ax25->digipeat != NULL) {
-		if ((ax25->digipeat = (ax25_digi *)kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
+		if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
 			sk_free(sk);
 			ax25_free_cb(ax25);
 			return NULL;
 		}
-		
+
 		*ax25->digipeat = *osk->protinfo.ax25->digipeat;
 	}
 
@@ -1282,14 +941,17 @@ static struct sock *ax25_make_new(struct sock *osk, struct device *dev)
 
 static int ax25_dup(struct socket *newsock, struct socket *oldsock)
 {
-	struct sock *sk = (struct sock *)oldsock->data;
+	struct sock *sk = oldsock->sk;
+
+	if (sk == NULL || newsock == NULL)
+		return -EINVAL;
 
 	return ax25_create(newsock, sk->protocol);
 }
 
 static int ax25_release(struct socket *sock, struct socket *peer)
 {
-	struct sock *sk = (struct sock *)sock->data;
+	struct sock *sk = sock->sk;
 
 	if (sk == NULL) return 0;
 
@@ -1304,37 +966,32 @@ static int ax25_release(struct socket *sock, struct socket *peer)
 				break;
 
 			case AX25_STATE_1:
-				ax25_send_control(sk->protinfo.ax25, DISC, POLLON, C_COMMAND);
-				sk->protinfo.ax25->state = AX25_STATE_0;
-				sk->state                = TCP_CLOSE;
-				sk->shutdown            |= SEND_SHUTDOWN;
-				sk->state_change(sk);
-				sk->dead                 = 1;
-				ax25_destroy_socket(sk->protinfo.ax25);
-				break;
-
 			case AX25_STATE_2:
-				if (sk->protinfo.ax25->dama_slave)
-					ax25_send_control(sk->protinfo.ax25, DISC, POLLON, C_COMMAND);
-				else
-					ax25_send_control(sk->protinfo.ax25, DM, POLLON, C_RESPONSE);
+				ax25_clear_queues(sk->protinfo.ax25);
+				ax25_send_control(sk->protinfo.ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 				sk->protinfo.ax25->state = AX25_STATE_0;
 				sk->state                = TCP_CLOSE;
 				sk->shutdown            |= SEND_SHUTDOWN;
 				sk->state_change(sk);
 				sk->dead                 = 1;
 				ax25_destroy_socket(sk->protinfo.ax25);
-				break;			
+				break;
 
 			case AX25_STATE_3:
 			case AX25_STATE_4:
 				ax25_clear_queues(sk->protinfo.ax25);
 				sk->protinfo.ax25->n2count = 0;
-				if (!sk->protinfo.ax25->dama_slave) {
-					ax25_send_control(sk->protinfo.ax25, DISC, POLLON, C_COMMAND);
-					sk->protinfo.ax25->t3timer = 0;
-				} else {
-					sk->protinfo.ax25->t3timer = sk->protinfo.ax25->t3;	/* DAMA slave timeout */
+				switch (sk->protinfo.ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
+					case AX25_PROTO_STD_SIMPLEX:
+					case AX25_PROTO_STD_DUPLEX:
+						ax25_send_control(sk->protinfo.ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+						sk->protinfo.ax25->t3timer = 0;
+						break;
+#ifdef AX25_CONFIG_DAMA_SLAVE
+					case AX25_PROTO_DAMA_SLAVE:
+						sk->protinfo.ax25->t3timer = 0;
+						break;
+#endif
 				}
 				sk->protinfo.ax25->t1timer = sk->protinfo.ax25->t1 = ax25_calculate_t1(sk->protinfo.ax25);
 				sk->protinfo.ax25->state   = AX25_STATE_2;
@@ -1356,8 +1013,8 @@ static int ax25_release(struct socket *sock, struct socket *peer)
 		ax25_destroy_socket(sk->protinfo.ax25);
 	}
 
-	sock->data = NULL;	
-	sk->socket = NULL;	/* Not used, but we should do this. **/
+	sock->sk   = NULL;	
+	sk->socket = NULL;	/* Not used, but we should do this */
 
 	return 0;
 }
@@ -1370,92 +1027,91 @@ static int ax25_release(struct socket *sock, struct socket *peer)
  */
 static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-	struct sock *sk;
+	struct sock *sk = sock->sk;
 	struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
-	struct device *dev;
 	ax25_address *call;
-	
-	sk = (struct sock *)sock->data;
-	
+	ax25_dev *ax25_dev = NULL;
+
 	if (sk->zapped == 0)
 		return -EINVAL;
-		
+
 	if (addr_len != sizeof(struct sockaddr_ax25) && addr_len != sizeof(struct full_sockaddr_ax25))
 		return -EINVAL;
 
+	if (addr->fsa_ax25.sax25_family != AF_AX25)
+		return -EINVAL;
+
 	call = ax25_findbyuid(current->euid);
 	if (call == NULL && ax25_uid_policy && !suser())
 		return -EACCES;
-		
+
 	if (call == NULL)
 		sk->protinfo.ax25->source_addr = addr->fsa_ax25.sax25_call;
 	else
 		sk->protinfo.ax25->source_addr = *call;
 
-	if (sk->debug)
-		printk("AX25: source address set to %s\n", ax2asc(&sk->protinfo.ax25->source_addr));
+	SOCK_DEBUG(sk, "AX25: source address set to %s\n", ax2asc(&sk->protinfo.ax25->source_addr));
 
 	if (addr_len == sizeof(struct full_sockaddr_ax25) && addr->fsa_ax25.sax25_ndigis == 1) {
 		if (ax25cmp(&addr->fsa_digipeater[0], &null_ax25_address) == 0) {
-			dev = NULL;
-			if (sk->debug)
-				printk("AX25: bound to any device\n");
+			ax25_dev = NULL;
+			SOCK_DEBUG(sk, "AX25: bound to any device\n");
 		} else {
-			if ((dev = ax25rtr_get_dev(&addr->fsa_digipeater[0])) == NULL) {
-				if (sk->debug)
-					printk("AX25: bind failed - no device\n");
+			if ((ax25_dev = ax25_addr_ax25dev(&addr->fsa_digipeater[0])) == NULL) {
+				SOCK_DEBUG(sk, "AX25: bind failed - no device\n");
 				return -EADDRNOTAVAIL;
 			}
-			if (sk->debug)
-				printk("AX25: bound to device %s\n", dev->name);
+			SOCK_DEBUG(sk, "AX25: bound to device %s\n", ax25_dev->dev->name);
 		}
 	} else {
-		if ((dev = ax25rtr_get_dev(&addr->fsa_ax25.sax25_call)) == NULL) {
-			if (sk->debug)
-				printk("AX25: bind failed - no device\n");
+		if ((ax25_dev = ax25_addr_ax25dev(&addr->fsa_ax25.sax25_call)) == NULL) {
+			SOCK_DEBUG(sk, "AX25: bind failed - no device\n");
 			return -EADDRNOTAVAIL;
 		}
-		if (sk->debug)
-			printk("AX25: bound to device %s\n", dev->name);
+		SOCK_DEBUG(sk, "AX25: bound to device %s\n", ax25_dev->dev->name);
 	}
 
-	ax25_fillin_cb(sk->protinfo.ax25, dev);
+	if (ax25_dev != NULL)
+		ax25_fillin_cb(sk->protinfo.ax25, ax25_dev);
+
 	ax25_insert_socket(sk->protinfo.ax25);
 
 	sk->zapped = 0;
-
-	if (sk->debug)
-		printk("AX25: socket is bound\n");
-
+	SOCK_DEBUG(sk, "AX25: socket is bound\n");
 	return 0;
 }
 
-static int ax25_connect(struct socket *sock, struct sockaddr *uaddr,
-	int addr_len, int flags)
+/*
+ *	FIXME: nonblock behaviour looks like it may have a bug.
+ */
+static int ax25_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)
 {
-	struct sock *sk = (struct sock *)sock->data;
+	struct sock *sk = sock->sk;
 	struct sockaddr_ax25 *addr = (struct sockaddr_ax25 *)uaddr;
 	int err;
-	
+
 	if (sk->state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
 		sock->state = SS_CONNECTED;
 		return 0;	/* Connect completed during a ERESTARTSYS event */
 	}
-	
+
 	if (sk->state == TCP_CLOSE && sock->state == SS_CONNECTING) {
 		sock->state = SS_UNCONNECTED;
 		return -ECONNREFUSED;
 	}
-	
+
 	if (sk->state == TCP_ESTABLISHED && sk->type == SOCK_SEQPACKET)
 		return -EISCONN;	/* No reconnect on a seqpacket socket */
-		
-	sk->state   = TCP_CLOSE;	
+
+	sk->state   = TCP_CLOSE;
 	sock->state = SS_UNCONNECTED;
 
 	if (addr_len != sizeof(struct sockaddr_ax25) && addr_len != sizeof(struct full_sockaddr_ax25))
 		return -EINVAL;
 
+	if (addr->sax25_family != AF_AX25)
+		return -EINVAL;
+
 	/*
 	 *	Handle digi-peaters to be used.
 	 */
@@ -1468,19 +1124,23 @@ static int ax25_connect(struct socket *sock, struct sockaddr *uaddr,
 			return -EINVAL;
 
 		if (sk->protinfo.ax25->digipeat == NULL) {
-			if ((sk->protinfo.ax25->digipeat = (ax25_digi *)kmalloc(sizeof(ax25_digi), GFP_KERNEL)) == NULL)
+			if ((sk->protinfo.ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_KERNEL)) == NULL)
 				return -ENOBUFS;
 		}
 
-		sk->protinfo.ax25->digipeat->ndigi = addr->sax25_ndigis;
+		sk->protinfo.ax25->digipeat->ndigi      = addr->sax25_ndigis;
+		sk->protinfo.ax25->digipeat->lastrepeat = -1;
 
 		while (ct < addr->sax25_ndigis) {
-			sk->protinfo.ax25->digipeat->repeated[ct] = 0;
-			sk->protinfo.ax25->digipeat->calls[ct]    = fsa->fsa_digipeater[ct];
+			if ((fsa->fsa_digipeater[ct].ax25_call[6] & AX25_HBIT) && sk->protinfo.ax25->iamdigi) {
+				sk->protinfo.ax25->digipeat->repeated[ct] = 1;
+				sk->protinfo.ax25->digipeat->lastrepeat   = ct;
+			} else {
+				sk->protinfo.ax25->digipeat->repeated[ct] = 0;
+			}
+			sk->protinfo.ax25->digipeat->calls[ct] = fsa->fsa_digipeater[ct];
 			ct++;
 		}
-
-		sk->protinfo.ax25->digipeat->lastrepeat = 0;
 	}
 
 	/*
@@ -1491,41 +1151,52 @@ static int ax25_connect(struct socket *sock, struct sockaddr *uaddr,
 	if (sk->zapped) {
 		if ((err = ax25_rt_autobind(sk->protinfo.ax25, &addr->sax25_call)) < 0)
 			return err;
-		ax25_fillin_cb(sk->protinfo.ax25, sk->protinfo.ax25->device);
+		ax25_fillin_cb(sk->protinfo.ax25, sk->protinfo.ax25->ax25_dev);
 		ax25_insert_socket(sk->protinfo.ax25);
 	} else {
-		if (sk->protinfo.ax25->device == NULL)
+		if (sk->protinfo.ax25->ax25_dev == NULL)
 			return -EHOSTUNREACH;
 	}
-		
-	if (sk->type == SOCK_SEQPACKET && ax25_find_cb(&sk->protinfo.ax25->source_addr, &addr->sax25_call, sk->protinfo.ax25->device) != NULL)
+
+	if (sk->type == SOCK_SEQPACKET && ax25_find_cb(&sk->protinfo.ax25->source_addr, &addr->sax25_call, NULL, sk->protinfo.ax25->ax25_dev->dev) != NULL)
 		return -EADDRINUSE;			/* Already such a connection */
 
 	sk->protinfo.ax25->dest_addr = addr->sax25_call;
-	
+
 	/* First the easy one */
 	if (sk->type != SOCK_SEQPACKET) {
 		sock->state = SS_CONNECTED;
 		sk->state   = TCP_ESTABLISHED;
 		return 0;
 	}
-	
-	/* Move to connecting socket, ax.25 lapb WAIT_UA.. */	
+
+	/* Move to connecting socket, ax.25 lapb WAIT_UA.. */
 	sock->state        = SS_CONNECTING;
 	sk->state          = TCP_SYN_SENT;
-	
-	if (ax25_dev_is_dama_slave(sk->protinfo.ax25->device))
-		dama_establish_data_link(sk->protinfo.ax25);
-	else
-		ax25_establish_data_link(sk->protinfo.ax25);
-		
+
+	switch (sk->protinfo.ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
+		case AX25_PROTO_STD_SIMPLEX:
+		case AX25_PROTO_STD_DUPLEX:
+			ax25_std_establish_data_link(sk->protinfo.ax25);
+			break;
+
+#ifdef CONFIG_AX25_DAMA_SLAVE
+		case AX25_PROTO_DAMA_SLAVE:
+			if (sk->protinfo.ax25->ax25_dev->dama.slave)
+				ax25_ds_establish_data_link(sk->protinfo.ax25);
+			else
+				ax25_std_establish_data_link(sk->protinfo.ax25);
+			break;
+#endif
+	}
+
 	sk->protinfo.ax25->state = AX25_STATE_1;
 	ax25_set_timer(sk->protinfo.ax25);		/* Start going SABM SABM until a UA or a give up and DM */
-	
+
 	/* Now the loop */
 	if (sk->state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
 		return -EINPROGRESS;
-		
+
 	cli();	/* To avoid races on the sleep */
 
 	/* A DM or timeout will go to closed, a UA will go to ABM */
@@ -1543,14 +1214,14 @@ static int ax25_connect(struct socket *sock, struct sockaddr *uaddr,
 		sock->state = SS_UNCONNECTED;
 		return sock_error(sk);	/* Always set at this point */
 	}
-	
+
 	sock->state = SS_CONNECTED;
 
 	sti();
-	
+
 	return 0;
 }
-	
+
 static int ax25_socketpair(struct socket *sock1, struct socket *sock2)
 {
 	return -EOPNOTSUPP;
@@ -1562,19 +1233,20 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
 	struct sock *newsk;
 	struct sk_buff *skb;
 
-	if (newsock->data)
-		sk_free(newsock->data);
+	if (newsock->sk != NULL)
+		ax25_destroy_socket(newsock->sk->protinfo.ax25);
 
-	newsock->data = NULL;
-	
-	sk = (struct sock *)sock->data;
+	newsock->sk = NULL;
+
+	if ((sk = sock->sk) == NULL)
+		return -EINVAL;
 
 	if (sk->type != SOCK_SEQPACKET)
 		return -EOPNOTSUPP;
-	
+
 	if (sk->state != TCP_LISTEN)
 		return -EINVAL;
-		
+
 	/*
 	 *	The write queue this time is holding sockets ready to use
 	 *	hooked into the SABM we saved
@@ -1584,7 +1256,7 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
 		if ((skb = skb_dequeue(&sk->receive_queue)) == NULL) {
 			if (flags & O_NONBLOCK) {
 				sti();
-				return 0;
+				return -EWOULDBLOCK;
 			}
 			interruptible_sleep_on(sk->sleep);
 			if (current->signal & ~current->blocked) {
@@ -1602,20 +1274,17 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
 	skb->sk = NULL;
 	kfree_skb(skb, FREE_READ);
 	sk->ack_backlog--;
-	newsock->data = newsk;
+	newsock->sk = newsk;
 
 	return 0;
 }
 
-static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
-	int *uaddr_len, int peer)
+static int ax25_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer)
 {
 	struct full_sockaddr_ax25 *sax = (struct full_sockaddr_ax25 *)uaddr;
-	struct sock *sk;
+	struct sock *sk = sock->sk;
 	unsigned char ndigi, i;
-	
-	sk = (struct sock *)sock->data;
-	
+
 	if (peer != 0) {
 		if (sk->state != TCP_ESTABLISHED)
 			return -ENOTCONN;
@@ -1637,321 +1306,18 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
 		sax->fsa_ax25.sax25_ndigis = 1;
 		*uaddr_len = sizeof(struct full_sockaddr_ax25);
 
-		if (sk->protinfo.ax25->device != NULL)
-			memcpy(&sax->fsa_digipeater[0], sk->protinfo.ax25->device->dev_addr, AX25_ADDR_LEN);
+		if (sk->protinfo.ax25->ax25_dev != NULL)
+			memcpy(&sax->fsa_digipeater[0], sk->protinfo.ax25->ax25_dev->dev->dev_addr, AX25_ADDR_LEN);
 		else
 			sax->fsa_digipeater[0] = null_ax25_address;
 	}
-	
-	return 0;
-}
- 
-static int ax25_rcv(struct sk_buff *skb, struct device *dev, ax25_address *dev_addr, struct packet_type *ptype)
-{
-	struct sock *make;
-	struct sock *sk;
-	int type = 0;
-	ax25_digi dp;
-	ax25_cb *ax25;
-	ax25_address src, dest;
-	struct sock *raw;
-	int mine = 0;
-	int dama;
-
-	/*
-	 *	Process the AX.25/LAPB frame.
-	 */
-	 
-	skb->h.raw = skb->data;
-	
-#ifdef CONFIG_FIREWALL
-	if (call_in_firewall(PF_AX25, skb->dev, skb->h.raw, NULL) != FW_ACCEPT) {
-		kfree_skb(skb, FREE_READ);
-		return 0;
-	}
-#endif	
-
-	/*
-	 *	Parse the address header.
-	 */
-	 
-	if (ax25_parse_addr(skb->data, skb->len, &src, &dest, &dp, &type, &dama) == NULL) {
-		kfree_skb(skb, FREE_READ);
-		return 0;
-	}
-
-	/*
-	 *	Ours perhaps ?
-	 */
-	if (dp.lastrepeat + 1 < dp.ndigi) {		/* Not yet digipeated completely */
-		if (ax25cmp(&dp.calls[dp.lastrepeat + 1], dev_addr) == 0) {
-			struct device *dev_out = dev;
-			
-			skb=skb_unshare(skb, GFP_ATOMIC, FREE_READ);
-			if(skb==NULL)
-				return 0;
-
-			/* We are the digipeater. Mark ourselves as repeated
-			   and throw the packet back out of the same device */
-			dp.lastrepeat++;
-			dp.repeated[(int)dp.lastrepeat] = 1;
-
-			if (ax25_dev_get_value(dev, AX25_VALUES_DIGI) & AX25_DIGI_XBAND) {
-				while (dp.lastrepeat + 1 < dp.ndigi) {
-					struct device *dev_scan;
-					if ((dev_scan = ax25rtr_get_dev(&dp.calls[dp.lastrepeat + 1])) == NULL)
-						break;
-					dp.lastrepeat++;
-					dp.repeated[(int)dp.lastrepeat] = 1;
-					dev_out = dev_scan;
-				}
-				if (dev != dev_out && (ax25_dev_get_value(dev_out, AX25_VALUES_DIGI) & AX25_DIGI_XBAND) == 0) {
-					kfree_skb(skb, FREE_READ);
-					return 0;
-				}
-			}
-
-			if (dev == dev_out && (ax25_dev_get_value(dev, AX25_VALUES_DIGI) & AX25_DIGI_INBAND) == 0) {
-				kfree_skb(skb, FREE_READ);
-				return 0;
-			}
-
-			build_ax25_addr(skb->data, &src, &dest, &dp, type, MODULUS);
-#ifdef CONFIG_FIREWALL
-			if (call_fw_firewall(PF_AX25, skb->dev, skb->data, NULL) != FW_ACCEPT) {
-				kfree_skb(skb, FREE_READ);
-				return 0;
-			}
-#endif
-
-			skb->arp = 1;
-			ax25_queue_xmit(skb, dev_out, SOPRI_NORMAL);
-		} else {
-			kfree_skb(skb, FREE_READ);
-		}
-
-		return 0;
-	}
-
-	/*
-	 *	Pull of the AX.25 headers leaving the CTRL/PID bytes
-	 */
-	skb_pull(skb, size_ax25_addr(&dp));
-
-	/* For our port addresses ? */
-	if (ax25cmp(&dest, dev_addr) == 0)
-		mine = 1;
-
-	/* Also match on any registered callsign from L3/4 */
-	if (!mine && ax25_listen_mine(&dest, dev))
-		mine = 1;
-	
-	if ((*skb->data & ~0x10) == LAPB_UI) {	/* UI frame - bypass LAPB processing */
-		skb->h.raw = skb->data + 2;		/* skip control and pid */
-
-		if ((raw = ax25_addr_match(&dest)) != NULL)
-			ax25_send_to_raw(raw, skb, skb->data[1]);
-
-		if (!mine && ax25cmp(&dest, (ax25_address *)dev->broadcast) != 0) {
-			kfree_skb(skb, FREE_READ);
-			return 0;
-		}
-
-		/* Now we are pointing at the pid byte */
-		switch (skb->data[1]) {
-#ifdef CONFIG_INET		
-			case AX25_P_IP:
-				skb_pull(skb,2);		/* drop PID/CTRL */
-				ip_rcv(skb, dev, ptype);	/* Note ptype here is the wrong one, fix me later */
-				break;
-
-			case AX25_P_ARP:
-				skb_pull(skb,2);
-				arp_rcv(skb, dev, ptype);	/* Note ptype here is wrong... */
-				break;
-#endif				
-			case AX25_P_TEXT:
-				/* Now find a suitable dgram socket */
-				if ((sk = ax25_find_socket(&dest, &src, SOCK_DGRAM)) != NULL) {
-					if (sk->rmem_alloc >= sk->rcvbuf) {
-						kfree_skb(skb, FREE_READ);
-					} else {
-						/*
-						 *	Remove the control and PID.
-						 */
-						skb_pull(skb, 2);
-						skb_queue_tail(&sk->receive_queue, skb);
-						skb->sk = sk;
-						atomic_add(skb->truesize, &sk->rmem_alloc);
-						if (!sk->dead)
-							sk->data_ready(sk, skb->len);
-					}
-				} else {
-					kfree_skb(skb, FREE_READ);
-				}
-				break;	
-
-			default:
-				kfree_skb(skb, FREE_READ);	/* Will scan SOCK_AX25 RAW sockets */
-				break;
-		}
-
-		return 0;
-	}
-
-	/*
-	 *	Is connected mode supported on this device ?
-	 *	If not, should we DM the incoming frame (except DMs) or
-	 *	silently ignore them. For now we stay quiet.
-	 */
-	if (!ax25_dev_get_value(dev, AX25_VALUES_CONMODE)) {
-		kfree_skb(skb, FREE_READ);
-		return 0;
-	}
-	
-	/* LAPB */
-	
-	/* AX.25 state 1-4 */
-	
-	if ((ax25 = ax25_find_cb(&dest, &src, dev)) != NULL) {
-		/*
-		 *	Process the frame. If it is queued up internally it returns one otherwise we 
-		 *	free it immediately. This routine itself wakes the user context layers so we
-		 *	do no further work
-		 */
-		if (ax25_process_rx_frame(ax25, skb, type, dama) == 0)
-			kfree_skb(skb, FREE_READ);
-
-		return 0;
-	}
-
-	/* AX.25 state 0 (disconnected) */
-
-	/* a) received not a SABM(E) */
-	
-	if ((*skb->data & ~PF) != SABM && (*skb->data & ~PF) != SABME) {
-		/*
-		 *	Never reply to a DM. Also ignore any connects for
-		 *	addresses that are not our interfaces and not a socket.
-		 */
-		if ((*skb->data & ~PF) != DM && mine)
-			ax25_return_dm(dev, &src, &dest, &dp);
-
-		kfree_skb(skb, FREE_READ);
-		return 0;
-	}
-
-	/* b) received SABM(E) */
-	
-	if ((sk = ax25_find_listener(&dest, dev, SOCK_SEQPACKET)) != NULL) {
-		if (sk->ack_backlog == sk->max_ack_backlog || (make = ax25_make_new(sk, dev)) == NULL) {
-			if (mine)
-				ax25_return_dm(dev, &src, &dest, &dp);
-
-			kfree_skb(skb, FREE_READ);
-			return 0;
-		}
-		
-		ax25 = make->protinfo.ax25;
-
-		skb_queue_head(&sk->receive_queue, skb);
-
-		skb->sk     = make;
-		make->state = TCP_ESTABLISHED;
-		make->pair  = sk;
-
-		sk->ack_backlog++;
-	} else {
-		if (!mine) {
-			kfree_skb(skb, FREE_READ);
-			return 0;
-		}
-		
-		if ((ax25 = ax25_create_cb()) == NULL) {
-			ax25_return_dm(dev, &src, &dest, &dp);
-			kfree_skb(skb, FREE_READ);
-			return 0;
-		}
-
-		ax25_fillin_cb(ax25, dev);
-		ax25->idletimer = ax25->idle;
-	}
-
-	ax25->source_addr = dest;
-	ax25->dest_addr   = src;
-
-	/*
-	 *	Sort out any digipeated paths.
-	 */
-	if (dp.ndigi != 0 && ax25->digipeat == NULL && (ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
-		kfree_skb(skb, FREE_READ);
-		ax25_destroy_socket(ax25);
-		return 0;
-	}
-
-	if (dp.ndigi == 0) {
-		if (ax25->digipeat != NULL) {
-			kfree_s(ax25->digipeat, sizeof(ax25_digi));
-			ax25->digipeat = NULL;
-		}
-	} else {
-		/* Reverse the source SABM's path */
-		ax25_digi_invert(&dp, ax25->digipeat);
-	}
-
-	if ((*skb->data & ~PF) == SABME) {
-		ax25->modulus = EMODULUS;
-		ax25->window  = ax25_dev_get_value(dev, AX25_VALUES_EWINDOW);
-	} else {
-		ax25->modulus = MODULUS;
-		ax25->window  = ax25_dev_get_value(dev, AX25_VALUES_WINDOW);
-	}
-
-	ax25->device = dev;
-	
-	ax25_send_control(ax25, UA, POLLON, C_RESPONSE);
-
-	if (dama) ax25_dama_on(ax25);	/* bke 951121 */
-
-	ax25->dama_slave = dama;
-	ax25->t3timer = ax25->t3;
-	ax25->state   = AX25_STATE_3;
-
-	ax25_insert_socket(ax25);
-
-	ax25_set_timer(ax25);
-
-	if (sk != NULL) {
-		if (!sk->dead)
-			sk->data_ready(sk, skb->len);
-	} else {
-		kfree_skb(skb, FREE_READ);
-	}
 
 	return 0;
 }
 
-/*
- *	Receive an AX.25 frame via a SLIP interface.
- */
-static int kiss_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *ptype)
+static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, int len, struct scm_cookie *scm)
 {
-	skb->sk = NULL;		/* Initially we don't know who it's for */
-
-	if ((*skb->data & 0x0F) != 0) {
-		kfree_skb(skb, FREE_READ);	/* Not a KISS data frame */
-		return 0;
-	}
-
-	skb_pull(skb, AX25_KISS_HEADER_LEN);	/* Remove the KISS byte */
-
-	return ax25_rcv(skb, dev, (ax25_address *)dev->dev_addr, ptype);
-}
-
-
-static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, int len, int noblock, int flags)
-{
-	struct sock *sk = (struct sock *)sock->data;
+	struct sock *sk = sock->sk;
 	struct sockaddr_ax25 *usax = (struct sockaddr_ax25 *)msg->msg_name;
 	int err;
 	struct sockaddr_ax25 sax;
@@ -1962,25 +1328,22 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, int len, int no
 	ax25_digi dtmp;
 	int lv;
 	int addr_len = msg->msg_namelen;
-	
-	if (sk->err)
-		return sock_error(sk);
 
-	if (flags || msg->msg_control)
+	if (msg->msg_flags & ~MSG_DONTWAIT)
 		return -EINVAL;
 
 	if (sk->zapped)
 		return -EADDRNOTAVAIL;
-		
+
 	if (sk->shutdown & SEND_SHUTDOWN) {
 		send_sig(SIGPIPE, current, 0);
 		return -EPIPE;
 	}
-		
-	if (sk->protinfo.ax25->device == NULL)
+
+	if (sk->protinfo.ax25->ax25_dev == NULL)
 		return -ENETUNREACH;
-		
-	if (usax) {
+
+	if (usax != NULL) {
 		if (addr_len != sizeof(struct sockaddr_ax25) && addr_len != sizeof(struct full_sockaddr_ax25))
 			return -EINVAL;
 		if (usax->sax25_family != AF_AX25)
@@ -2023,28 +1386,21 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, int len, int no
 		sax.sax25_call   = sk->protinfo.ax25->dest_addr;
 		dp = sk->protinfo.ax25->digipeat;
 	}
-	
-	if (sk->debug)
-		printk("AX.25: sendto: Addresses built.\n");
+
+	SOCK_DEBUG(sk, "AX.25: sendto: Addresses built.\n");
 
 	/* Build a packet */
-	if (sk->debug)
-		printk("AX.25: sendto: building packet.\n");
+	SOCK_DEBUG(sk, "AX.25: sendto: building packet.\n");
 
 	/* Assume the worst case */
-	size = len + 3 + size_ax25_addr(dp) + AX25_BPQ_HEADER_LEN;
+	size = len + 3 + ax25_addr_size(dp) + AX25_BPQ_HEADER_LEN;
 
-	if ((skb = sock_alloc_send_skb(sk, size, 0, 0, &err)) == NULL)
+	if ((skb = sock_alloc_send_skb(sk, size, 0, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
 		return err;
 
-	skb->sk   = sk;
-	skb->free = 1;
-	skb->arp  = 1;
-
 	skb_reserve(skb, size - len);
 
-	if (sk->debug)
-		printk("AX.25: Appending user data\n");
+	SOCK_DEBUG(sk, "AX.25: Appending user data\n");
 
 	/* User data follows immediately after the AX.25 data */
 	memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
@@ -2053,8 +1409,7 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, int len, int no
 	asmptr  = skb_push(skb, 1);
 	*asmptr = sk->protocol;
 
-	if (sk->debug)
-		printk("AX.25: Transmitting buffer\n");
+	SOCK_DEBUG(sk, "AX.25: Transmitting buffer\n");
 
 	if (sk->type == SOCK_SEQPACKET) {
 		/* Connected mode sockets go via the LAPB machine */
@@ -2063,51 +1418,47 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, int len, int no
 			return -ENOTCONN;
 		}
 
-		ax25_output(sk->protinfo.ax25, skb);	/* Shove it onto the queue and kick */
+		ax25_output(sk->protinfo.ax25, sk->protinfo.ax25->paclen, skb);	/* Shove it onto the queue and kick */
 
 		return len;
 	} else {
-		asmptr = skb_push(skb, 1 + size_ax25_addr(dp));
+		asmptr = skb_push(skb, 1 + ax25_addr_size(dp));
 
-		if (sk->debug) {
-			printk("Building AX.25 Header (dp=%p).\n", dp);
-			if (dp != 0)
-				printk("Num digipeaters=%d\n", dp->ndigi);
-		}
+		SOCK_DEBUG(sk, "Building AX.25 Header (dp=%p).\n", dp);
+
+		if (dp != NULL)
+			SOCK_DEBUG(sk, "Num digipeaters=%d\n", dp->ndigi);
 
 		/* Build an AX.25 header */
-		asmptr += (lv = build_ax25_addr(asmptr, &sk->protinfo.ax25->source_addr, &sax.sax25_call, dp, C_COMMAND, MODULUS));
+		asmptr += (lv = ax25_addr_build(asmptr, &sk->protinfo.ax25->source_addr, &sax.sax25_call, dp, AX25_COMMAND, AX25_MODULUS));
 
-		if (sk->debug)
-			printk("Built header (%d bytes)\n",lv);
+		SOCK_DEBUG(sk, "Built header (%d bytes)\n",lv);
 
 		skb->h.raw = asmptr;
-	
-		if (sk->debug)
-			printk("base=%p pos=%p\n", skb->data, asmptr);
 
-		*asmptr = LAPB_UI;
+		SOCK_DEBUG(sk, "base=%p pos=%p\n", skb->data, asmptr);
+
+		*asmptr = AX25_UI;
 
 		/* Datagram frames go straight out of the door as UI */
-		ax25_queue_xmit(skb, sk->protinfo.ax25->device, SOPRI_NORMAL);
+		skb->dev      = sk->protinfo.ax25->ax25_dev->dev;
+		skb->priority = SOPRI_NORMAL;
+
+		ax25_queue_xmit(skb);
 
 		return len;
 	}
-		
 }
 
-static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, int size, int noblock, int flags, int *addr_len)
+static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, int size, int flags, struct scm_cookie *scm)
 {
-	struct sock *sk = (struct sock *)sock->data;
+	struct sock *sk = sock->sk;
 	struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
 	int copied, length;
 	struct sk_buff *skb;
 	int er;
 	int dama;
 
-	if (addr_len != NULL)
-		*addr_len = sizeof(*sax);
-
 	/*
 	 * 	This works for seqpacket too. The receiver has ordered the
 	 *	queue for us! We do one quick check first though
@@ -2116,7 +1467,7 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, int size, int n
 		return -ENOTCONN;
 
 	/* Now we can treat all alike */
-	if ((skb = skb_recv_datagram(sk, flags, noblock, &er)) == NULL)
+	if ((skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &er)) == NULL)
 		return er;
 
 	if (sk->protinfo.ax25->hdrincl) {
@@ -2137,16 +1488,11 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, int size, int n
 
 	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 	
-	if (sax) {
+	if (sax != NULL) {
 		ax25_digi digi;
 		ax25_address dest;
 
-		if (addr_len == (int *)0)
-			return -EINVAL;
-		if (*addr_len != sizeof(struct sockaddr_ax25) && *addr_len != sizeof(struct full_sockaddr_ax25))
-			return -EINVAL;
-
-		ax25_parse_addr(skb->data, skb->len, NULL, &dest, &digi, NULL, &dama);
+		ax25_addr_parse(skb->data, skb->len, NULL, &dest, &digi, NULL, &dama);
 
 		sax->sax25_family = AF_AX25;
 		/* We set this correctly, even though we may not let the
@@ -2155,9 +1501,7 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, int size, int n
 		sax->sax25_ndigis = digi.ndigi;
 		sax->sax25_call   = dest;
 
-		*addr_len = sizeof(struct sockaddr_ax25);
-
-		if (*addr_len == sizeof(struct full_sockaddr_ax25) && sax->sax25_ndigis != 0) {
+		if (sax->sax25_ndigis != 0) {
 			int ct           = 0;
 			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)sax;
 
@@ -2165,15 +1509,15 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, int size, int n
 				fsa->fsa_digipeater[ct] = digi.calls[ct];
 				ct++;
 			}
-
-			*addr_len = sizeof(struct full_sockaddr_ax25);
 		}
 	}
 
+	msg->msg_namelen = sizeof(struct full_sockaddr_ax25);
+
 	skb_free_datagram(sk, skb);
 
 	return copied;
-}		
+}
 
 static int ax25_shutdown(struct socket *sk, int how)
 {
@@ -2181,16 +1525,10 @@ static int ax25_shutdown(struct socket *sk, int how)
 	return -EOPNOTSUPP;
 }
 
-static int ax25_select(struct socket *sock , int sel_type, select_table *wait)
-{
-	struct sock *sk = (struct sock *)sock->data;
-
-	return datagram_select(sk, sel_type, wait);
-}
-
 static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
-	struct sock *sk = (struct sock *)sock->data;
+	struct sock *sk = sock->sk;
+	struct ax25_info_struct ax25_info;
 	int err;
 	long amount = 0;
 
@@ -2198,7 +1536,7 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 		case TIOCOUTQ:
 			if ((err = verify_area(VERIFY_WRITE, (void *)arg, sizeof(int))) != 0)
 				return err;
-			amount = sk->sndbuf - sk->wmem_alloc;
+			amount = sk->sndbuf - atomic_read(&sk->wmem_alloc);
 			if (amount < 0)
 				amount = 0;
 			put_user(amount, (int *)arg);
@@ -2253,12 +1591,42 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 			if (!suser())
 				return -EPERM;
 			return ax25_rt_ioctl(cmd, (void *)arg);
-			
+
 		case SIOCAX25CTLCON:
 			if (!suser())
 				return -EPERM;
 			return ax25_ctl_ioctl(cmd, (void *)arg);
 
+		case SIOCAX25GETINFO:
+			if ((err = verify_area(VERIFY_WRITE, (void *)arg, sizeof(ax25_info))) != 0)
+				return err;
+			ax25_info.t1        = sk->protinfo.ax25->t1;
+			ax25_info.t2        = sk->protinfo.ax25->t2;
+			ax25_info.t3        = sk->protinfo.ax25->t3;
+			ax25_info.idle      = sk->protinfo.ax25->idle;
+			ax25_info.n2        = sk->protinfo.ax25->n2;
+			ax25_info.t1timer   = sk->protinfo.ax25->t1timer;
+			ax25_info.t2timer   = sk->protinfo.ax25->t2timer;
+			ax25_info.t3timer   = sk->protinfo.ax25->t3timer;
+			ax25_info.idletimer = sk->protinfo.ax25->idletimer;
+			ax25_info.n2count   = sk->protinfo.ax25->n2count;
+			ax25_info.state     = sk->protinfo.ax25->state;
+			ax25_info.rcv_q     = atomic_read(&sk->rmem_alloc);
+			ax25_info.snd_q     = atomic_read(&sk->wmem_alloc);
+			copy_to_user((void *)arg, &ax25_info, sizeof(ax25_info));
+			return 0;
+
+		case SIOCAX25ADDFWD:
+		case SIOCAX25DELFWD: {
+			struct ax25_fwd_struct ax25_fwd;
+			if (!suser())
+				return -EPERM;
+			if ((err = verify_area(VERIFY_READ, (void *)arg, sizeof(ax25_fwd))) != 0)
+				return err;
+			copy_from_user(&ax25_fwd, (void *)arg, sizeof(ax25_fwd));
+			return ax25_fwd_ioctl(cmd, &ax25_fwd);
+		}
+
 		case SIOCGIFADDR:
 		case SIOCSIFADDR:
 		case SIOCGIFDSTADDR:
@@ -2279,11 +1647,9 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 	return 0;
 }
 
-
 static int ax25_get_info(char *buffer, char **start, off_t offset, int length, int dummy)
 {
 	ax25_cb *ax25;
-	struct device *dev;
 	const char *devname;
 	int len = 0;
 	off_t pos = 0;
@@ -2291,13 +1657,13 @@ static int ax25_get_info(char *buffer, char **start, off_t offset, int length, i
 
 	cli();
 
-	len += sprintf(buffer, "dest_addr src_addr  dev  st  vs  vr  va    t1     t2     t3      idle   n2  rtt wnd paclen   dama Snd-Q Rcv-Q\n");
+	len += sprintf(buffer, "dest_addr src_addr  dev  st  vs  vr  va    t1     t2     t3      idle   n2  rtt wnd paclen   Snd-Q Rcv-Q\n");
 
 	for (ax25 = ax25_list; ax25 != NULL; ax25 = ax25->next) {
-		if ((dev = ax25->device) == NULL)
+		if (ax25->ax25_dev == NULL)
 			devname = "???";
 		else
-			devname = dev->name;
+			devname = ax25->ax25_dev->dev->name;
 
 		len += sprintf(buffer + len, "%-9s ",
 			ax2asc(&ax25->dest_addr));
@@ -2305,36 +1671,34 @@ static int ax25_get_info(char *buffer, char **start, off_t offset, int length, i
 			ax2asc(&ax25->source_addr), devname,
 			ax25->state,
 			ax25->vs, ax25->vr, ax25->va,
-			ax25->t1timer / PR_SLOWHZ,
-			ax25->t1      / PR_SLOWHZ,
-			ax25->t2timer / PR_SLOWHZ,
-			ax25->t2      / PR_SLOWHZ,
-			ax25->t3timer / PR_SLOWHZ,
-			ax25->t3      / PR_SLOWHZ,
-			ax25->idletimer / (PR_SLOWHZ * 60),
-			ax25->idle      / (PR_SLOWHZ * 60),
+			ax25->t1timer / AX25_SLOWHZ,
+			ax25->t1      / AX25_SLOWHZ,
+			ax25->t2timer / AX25_SLOWHZ,
+			ax25->t2      / AX25_SLOWHZ,
+			ax25->t3timer / AX25_SLOWHZ,
+			ax25->t3      / AX25_SLOWHZ,
+			ax25->idletimer / (AX25_SLOWHZ * 60),
+			ax25->idle      / (AX25_SLOWHZ * 60),
 			ax25->n2count, ax25->n2,
-			ax25->rtt     / PR_SLOWHZ,
+			ax25->rtt     / AX25_SLOWHZ,
 			ax25->window,
 			ax25->paclen);
-			
-		len += sprintf(buffer + len, " %s", ax25->dama_slave ? " slave" : "    no");
 
 		if (ax25->sk != NULL) {
 			len += sprintf(buffer + len, " %5d %5d\n",
-				ax25->sk->wmem_alloc,
-				ax25->sk->rmem_alloc);
+				atomic_read(&ax25->sk->wmem_alloc),
+				atomic_read(&ax25->sk->rmem_alloc));
 		} else {
 			len += sprintf(buffer + len, "\n");
 		}
-		
+
 		pos = begin + len;
 
 		if (pos < offset) {
 			len   = 0;
 			begin = pos;
 		}
-		
+
 		if (pos > offset + length)
 			break;
 	}
@@ -2347,12 +1711,17 @@ static int ax25_get_info(char *buffer, char **start, off_t offset, int length, i
 	if (len > length) len = length;
 
 	return(len);
-} 
+}
+
+static struct net_proto_family ax25_family_ops =
+{
+	AF_AX25,
+	ax25_create
+};
 
 static struct proto_ops ax25_proto_ops = {
 	AF_AX25,
-	
-	ax25_create,
+
 	ax25_dup,
 	ax25_release,
 	ax25_bind,
@@ -2360,13 +1729,13 @@ static struct proto_ops ax25_proto_ops = {
 	ax25_socketpair,
 	ax25_accept,
 	ax25_getname,
-	ax25_select,
+	datagram_poll,
 	ax25_ioctl,
 	ax25_listen,
 	ax25_shutdown,
 	ax25_setsockopt,
 	ax25_getsockopt,
-	ax25_fcntl,
+	sock_no_fcntl,
 	ax25_sendmsg,
 	ax25_recvmsg
 };
@@ -2374,11 +1743,11 @@ static struct proto_ops ax25_proto_ops = {
 /*
  *	Called by socket.c on kernel start up
  */
-static struct packet_type ax25_packet_type = 
+static struct packet_type ax25_packet_type =
 {
 	0,	/* MUTTER ntohs(ETH_P_AX25),*/
 	0,		/* copy */
-	kiss_rcv,
+	ax25_kiss_rcv,
 	NULL,
 	NULL,
 };
@@ -2388,30 +1757,24 @@ static struct notifier_block ax25_dev_notifier = {
 	0
 };
 
-static struct symbol_table ax25_syms = {
-#include <linux/symtab_begin.h>
-	X(ax25_encapsulate),
-	X(ax25_rebuild_header),
-#if defined(CONFIG_NETROM_MODULE) || defined(CONFIG_ROSE_MODULE)
-	X(ax25_findbyuid),
-	X(ax25_link_up),
-	X(ax25_linkfail_register),
-	X(ax25_linkfail_release),
-	X(ax25_listen_register),
-	X(ax25_listen_release),
-	X(ax25_protocol_register),
-	X(ax25_protocol_release),
-	X(ax25_send_frame),
-	X(ax25_uid_policy),
-	X(ax25cmp),
-	X(ax2asc),
-	X(asc2ax),
-	X(null_ax25_address),
-#endif
-#include <linux/symtab_end.h>
-};
+EXPORT_SYMBOL(ax25_encapsulate);
+EXPORT_SYMBOL(ax25_rebuild_header);
+EXPORT_SYMBOL(ax25_findbyuid);
+EXPORT_SYMBOL(ax25_link_up);
+EXPORT_SYMBOL(ax25_linkfail_register);
+EXPORT_SYMBOL(ax25_linkfail_release);
+EXPORT_SYMBOL(ax25_listen_register);
+EXPORT_SYMBOL(ax25_listen_release);
+EXPORT_SYMBOL(ax25_protocol_register);
+EXPORT_SYMBOL(ax25_protocol_release);
+EXPORT_SYMBOL(ax25_send_frame);
+EXPORT_SYMBOL(ax25_uid_policy);
+EXPORT_SYMBOL(ax25cmp);
+EXPORT_SYMBOL(ax2asc);
+EXPORT_SYMBOL(asc2ax);
+EXPORT_SYMBOL(null_ax25_address);
 
-#ifdef CONFIG_PROC_FS			  
+#ifdef CONFIG_PROC_FS
 static struct proc_dir_entry proc_ax25_route = {
 	PROC_NET_AX25_ROUTE, 10, "ax25_route",
 	S_IFREG | S_IRUGO, 1, 0, 0,
@@ -2428,172 +1791,29 @@ static struct proc_dir_entry proc_ax25_calls = {
 	PROC_NET_AX25_CALLS, 10, "ax25_calls",
 	S_IFREG | S_IRUGO, 1, 0, 0,
 	0, &proc_net_inode_operations,
-	ax25_cs_get_info
+	ax25_uid_get_info
 };
 #endif
 
 void ax25_proto_init(struct net_proto *pro)
 {
-	sock_register(ax25_proto_ops.family, &ax25_proto_ops);
+	sock_register(&ax25_family_ops);
 	ax25_packet_type.type = htons(ETH_P_AX25);
-	dev_add_pack(&ax25_packet_type);	
+	dev_add_pack(&ax25_packet_type);
 	register_netdevice_notifier(&ax25_dev_notifier);
-	register_symtab(&ax25_syms);
+#ifdef CONFIG_SYSCTL
 	ax25_register_sysctl();
+#endif
 
-#ifdef CONFIG_PROC_FS			  
+#ifdef CONFIG_PROC_FS
 	proc_net_register(&proc_ax25_route);
 	proc_net_register(&proc_ax25);
 	proc_net_register(&proc_ax25_calls);
-#endif	
-
-	printk(KERN_INFO "G4KLX/GW4PTS AX.25 for Linux. Version 0.34 for Linux NET3.037 (Linux 2.1)\n");
-}
-
-/*
- *	A small shim to dev_queue_xmit to add the KISS control byte.
- */
-void ax25_queue_xmit(struct sk_buff *skb, struct device *dev, int pri)
-{
-	unsigned char *ptr;
-	
-#ifdef CONFIG_FIREWALL
-	if (call_out_firewall(PF_AX25, skb->dev, skb->data, NULL) != FW_ACCEPT) {
-		dev_kfree_skb(skb, FREE_WRITE);
-		return;
-	}
-#endif	
-
-	skb->protocol = htons(ETH_P_AX25);
-
-	ptr = skb_push(skb, 1);
-	*ptr++ = 0;			/* KISS */
-	dev_queue_xmit(skb, dev, pri);
-}
-
-/*
- *	IP over AX.25 encapsulation.
- */
-
-/*
- *	Shove an AX.25 UI header on an IP packet and handle ARP
- */
-
-#ifdef CONFIG_INET
- 
-int ax25_encapsulate(struct sk_buff *skb, struct device *dev, unsigned short type, void *daddr,
-		void *saddr, unsigned len)
-{
-  	/* header is an AX.25 UI frame from us to them */
- 	unsigned char *buff = skb_push(skb, AX25_HEADER_LEN);
-
-  	*buff++ = 0;	/* KISS DATA */
-  	
-	if (daddr != NULL)
-		memcpy(buff, daddr, dev->addr_len);	/* Address specified */
-
-  	buff[6] &= ~LAPB_C;
-  	buff[6] &= ~LAPB_E;
-  	buff[6] |= SSSID_SPARE;
-  	buff += AX25_ADDR_LEN;
-
-  	if (saddr != NULL)
-  		memcpy(buff, saddr, dev->addr_len);
-  	else
-  		memcpy(buff, dev->dev_addr, dev->addr_len);
-
-  	buff[6] &= ~LAPB_C;
-  	buff[6] |= LAPB_E;
-  	buff[6] |= SSSID_SPARE;
-  	buff   += AX25_ADDR_LEN;
-
-  	*buff++ = LAPB_UI;	/* UI */
-
-  	/* Append a suitable AX.25 PID */
-  	switch (type) {
-  		case ETH_P_IP:
-  			*buff++ = AX25_P_IP;
- 			break;
-
-  		case ETH_P_ARP:
-  			*buff++ = AX25_P_ARP;
-  			break;
-  		default:
-  			printk(KERN_ERR "AX.25 wrong protocol type 0x%x2.2\n", type);
-  			*buff++ = 0;
-  			break;
- 	}
-	
-	if (daddr != NULL)
-	  	return AX25_HEADER_LEN;
+#endif
 
-	return -AX25_HEADER_LEN;	/* Unfinished header */
+	printk(KERN_INFO "G4KLX/GW4PTS AX.25 for Linux. Version 0.36 for Linux NET3.038 (Linux 2.1)\n");
 }
 
-int ax25_rebuild_header(unsigned char *bp, struct device *dev, unsigned long dest, struct sk_buff *skb)
-{
-	struct sk_buff *ourskb;
-	int mode;
-
-  	if (arp_find(bp + 1, dest, dev, dev->pa_addr, skb))
-  		return 1;
-
-	if (bp[16] == AX25_P_IP) {
-		mode = ax25_ip_mode_get((ax25_address *)(bp + 1), dev);
-		if (mode == 'V' || (mode == ' ' && ax25_dev_get_value(dev, AX25_VALUES_IPDEFMODE))) {
-			/*
-			 *	This is a workaround to try to keep the device locking
-			 *	straight until skb->free=0 is abolished post 1.4.
-			 *
-			 *	We clone the buffer and release the original thereby
-			 *	keeping it straight
-			 *
-			 *	Note: we report 1 back so the caller will
-			 *	not feed the frame direct to the physical device
-			 *	We don't want that to happen. (It won't be upset
-			 *	as we have pulled the frame from the queue by
-			 *	freeing it).
-			 */
-			if ((ourskb = skb_clone(skb, GFP_ATOMIC)) == NULL) {
-				dev_kfree_skb(skb, FREE_WRITE);
-				return 1;
-			}
-
-			ourskb->sk = skb->sk;
-
-			if (ourskb->sk != NULL)
-				atomic_add(ourskb->truesize, &ourskb->sk->wmem_alloc);
-
-			dev_kfree_skb(skb, FREE_WRITE);
-
-			skb_pull(ourskb, AX25_HEADER_LEN - 1);	/* Keep PID */
-
-			ax25_send_frame(ourskb, (ax25_address *)(bp + 8), (ax25_address *)(bp + 1), NULL, dev);
-
-			return 1;
-		}
-	}
-
-  	bp[7]  &= ~LAPB_C;
-  	bp[7]  &= ~LAPB_E;
-  	bp[7]  |= SSSID_SPARE;
-
-  	bp[14] &= ~LAPB_C;
-  	bp[14] |= LAPB_E;
-  	bp[14] |= SSSID_SPARE;
-  	
-  	/*
-  	 * dl1bke 960317: we use ax25_queue_xmit here to allow mode datagram
-  	 *		  over ethernet. I don't know if this is valid, though.
-  	 */
-	ax25_dg_build_path(skb, (ax25_address *)(bp + 1), dev);
-	ax25_queue_xmit(skb, dev, SOPRI_NORMAL);
-
-  	return 1;
-}	
-
-#endif
-
 #ifdef MODULE
 int init_module(void)
 {
@@ -2611,15 +1831,18 @@ void cleanup_module(void)
 	proc_net_unregister(PROC_NET_AX25_ROUTE);
 #endif
 	ax25_rt_free();
+	ax25_uid_free();
+	ax25_dev_free();
 
+#ifdef CONFIG_SYSCTL
 	ax25_unregister_sysctl();
-
+#endif
 	unregister_netdevice_notifier(&ax25_dev_notifier);
 
 	ax25_packet_type.type = htons(ETH_P_AX25);
-	dev_remove_pack(&ax25_packet_type);	
+	dev_remove_pack(&ax25_packet_type);
 
-	sock_unregister(ax25_proto_ops.family);
+	sock_unregister(AF_AX25);
 }
 #endif
 
diff --git a/net/ax25/ax25_addr.c b/net/ax25/ax25_addr.c
new file mode 100644
index 000000000..4c2bd8996
--- /dev/null
+++ b/net/ax25/ax25_addr.c
@@ -0,0 +1,311 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	Most of this code is based on the SDL diagrams published in the 7th
+ *	ARRL Computer Networking Conference papers. The diagrams have mistakes
+ *	in them, but are mostly correct. Before you modify the code could you
+ *	read the SDL diagrams as the code is not obvious and probably very
+ *	easy to break;
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Split from ax25_subr.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+/*
+ *	The null address is defined as a callsign of all spaces with an
+ *	SSID of zero.
+ */
+ax25_address null_ax25_address = {{0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x00}};
+
+/*
+ *	ax25 -> ascii conversion
+ */
+char *ax2asc(ax25_address *a)
+{
+	static char buf[11];
+	char c, *s;
+	int n;
+
+	for (n = 0, s = buf; n < 6; n++) {
+		c = (a->ax25_call[n] >> 1) & 0x7F;
+
+		if (c != ' ') *s++ = c;
+	}
+
+	*s++ = '-';
+
+	if ((n = ((a->ax25_call[6] >> 1) & 0x0F)) > 9) {
+		*s++ = '1';
+		n -= 10;
+	}
+
+	*s++ = n + '0';
+	*s++ = '\0';
+
+	if (*buf == '\0' || *buf == '-')
+	   return "*";
+
+	return buf;
+
+}
+
+/*
+ *	ascii -> ax25 conversion
+ */
+ax25_address *asc2ax(char *callsign)
+{
+	static ax25_address addr;
+	char *s;
+	int n;
+
+	for (s = callsign, n = 0; n < 6; n++) {
+		if (*s != '\0' && *s != '-')
+			addr.ax25_call[n] = *s++;
+		else
+			addr.ax25_call[n] = ' ';
+		addr.ax25_call[n] <<= 1;
+		addr.ax25_call[n] &= 0xFE;
+	}
+
+	if (*s++ == '\0') {
+		addr.ax25_call[6] = 0x00;
+		return &addr;
+	}
+
+	addr.ax25_call[6] = *s++ - '0';
+
+	if (*s != '\0') {
+		addr.ax25_call[6] *= 10;
+		addr.ax25_call[6] += *s++ - '0';
+	}
+
+	addr.ax25_call[6] <<= 1;
+	addr.ax25_call[6] &= 0x1E;
+
+	return &addr;
+}
+
+/*
+ *	Compare two ax.25 addresses
+ */
+int ax25cmp(ax25_address *a, ax25_address *b)
+{
+	int ct = 0;
+
+	while (ct < 6) {
+		if ((a->ax25_call[ct] & 0xFE) != (b->ax25_call[ct] & 0xFE))	/* Clean off repeater bits */
+			return 1;
+		ct++;
+	}
+
+ 	if ((a->ax25_call[ct] & 0x1E) == (b->ax25_call[ct] & 0x1E))	/* SSID without control bit */
+ 		return 0;
+
+ 	return 2;			/* Partial match */
+}
+
+/*
+ *	Compare two AX.25 digipeater paths.
+ */
+int ax25digicmp(ax25_digi *digi1, ax25_digi *digi2)
+{
+	int i;
+
+	if (digi1->ndigi != digi2->ndigi)
+		return 1;
+
+	if (digi1->lastrepeat != digi2->lastrepeat)
+		return 1;
+
+	for (i = 0; i < digi1->ndigi; i++)
+		if (ax25cmp(&digi1->calls[i], &digi2->calls[i]) != 0)
+			return 1;
+
+	return 0;
+}
+
+/*
+ *	Given an AX.25 address pull of to, from, digi list, command/response and the start of data
+ *
+ */
+unsigned char *ax25_addr_parse(unsigned char *buf, int len, ax25_address *src, ax25_address *dest, ax25_digi *digi, int *flags, int *dama)
+{
+	int d = 0;
+
+	if (len < 14) return NULL;
+
+	if (flags != NULL) {
+		*flags = 0;
+
+		if (buf[6] & AX25_CBIT)
+			*flags = AX25_COMMAND;
+		if (buf[13] & AX25_CBIT)
+			*flags = AX25_RESPONSE;
+	}
+
+	if (dama != NULL) 
+		*dama = ~buf[13] & AX25_DAMA_FLAG;
+
+	/* Copy to, from */
+	if (dest != NULL) 
+		memcpy(dest, buf + 0, AX25_ADDR_LEN);
+
+	if (src != NULL)  
+		memcpy(src,  buf + 7, AX25_ADDR_LEN);
+
+	buf += 2 * AX25_ADDR_LEN;
+	len -= 2 * AX25_ADDR_LEN;
+	digi->lastrepeat = -1;
+	digi->ndigi      = 0;
+
+	while (!(buf[-1] & AX25_EBIT)) {
+		if (d >= AX25_MAX_DIGIS)  return NULL;	/* Max of 6 digis */
+		if (len < 7) return NULL;	/* Short packet */
+
+		if (digi != NULL) {
+			memcpy(&digi->calls[d], buf, AX25_ADDR_LEN);
+			digi->ndigi = d + 1;
+			if (buf[6] & AX25_HBIT) {
+				digi->repeated[d] = 1;
+				digi->lastrepeat  = d;
+			} else {
+				digi->repeated[d] = 0;
+			}
+		}
+
+		buf += AX25_ADDR_LEN;
+		len -= AX25_ADDR_LEN;
+		d++;
+	}
+
+	return buf;
+}
+
+/*
+ *	Assemble an AX.25 header from the bits
+ */
+int ax25_addr_build(unsigned char *buf, ax25_address *src, ax25_address *dest, ax25_digi *d, int flag, int modulus)
+{
+	int len = 0;
+	int ct  = 0;
+
+	memcpy(buf, dest, AX25_ADDR_LEN);
+	buf[6] &= ~(AX25_EBIT | AX25_CBIT);
+	buf[6] |= AX25_SSSID_SPARE;
+
+	if (flag == AX25_COMMAND) buf[6] |= AX25_CBIT;
+
+	buf += AX25_ADDR_LEN;
+	len += AX25_ADDR_LEN;
+
+	memcpy(buf, src, AX25_ADDR_LEN);
+	buf[6] &= ~(AX25_EBIT | AX25_CBIT);
+	buf[6] &= ~AX25_SSSID_SPARE;
+
+	if (modulus == AX25_MODULUS)
+		buf[6] |= AX25_SSSID_SPARE;
+	else
+		buf[6] |= AX25_ESSID_SPARE;
+
+	if (flag == AX25_RESPONSE) buf[6] |= AX25_CBIT;
+
+	/*
+	 *	Fast path the normal digiless path
+	 */
+	if (d == NULL || d->ndigi == 0) {
+		buf[6] |= AX25_EBIT;
+		return 2 * AX25_ADDR_LEN;
+	}	
+
+	buf += AX25_ADDR_LEN;
+	len += AX25_ADDR_LEN;
+
+	while (ct < d->ndigi) {
+		memcpy(buf, &d->calls[ct], AX25_ADDR_LEN);
+
+		if (d->repeated[ct])
+			buf[6] |= AX25_HBIT;
+		else
+			buf[6] &= ~AX25_HBIT;
+
+		buf[6] &= ~AX25_EBIT;
+		buf[6] |= AX25_SSSID_SPARE;
+
+		buf += AX25_ADDR_LEN;
+		len += AX25_ADDR_LEN;
+		ct++;
+	}
+
+	buf[-1] |= AX25_EBIT;
+
+	return len;
+}
+
+int ax25_addr_size(ax25_digi *dp)
+{
+	if (dp == NULL)
+		return 2 * AX25_ADDR_LEN;
+
+	return AX25_ADDR_LEN * (2 + dp->ndigi);
+}
+
+/* 
+ *	Reverse Digipeat List. May not pass both parameters as same struct
+ */
+void ax25_digi_invert(ax25_digi *in, ax25_digi *out)
+{
+	int ct = 0;
+
+	out->ndigi      = in->ndigi;
+	out->lastrepeat = in->ndigi - in->lastrepeat - 2;
+
+	/* Invert the digipeaters */
+
+	while (ct < in->ndigi) {
+		out->calls[ct]    = in->calls[in->ndigi - ct - 1];
+		if (ct <= out->lastrepeat) {
+			out->calls[ct].ax25_call[6] |= AX25_HBIT;
+			out->repeated[ct]            = 1;
+		} else {
+			out->calls[ct].ax25_call[6] &= ~AX25_HBIT;
+			out->repeated[ct]            = 0;
+		}
+		ct++;
+	}
+}
+
+#endif
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
new file mode 100644
index 000000000..1dc039233
--- /dev/null
+++ b/net/ax25/ax25_dev.c
@@ -0,0 +1,238 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	Other kernels modules in this kit are generally BSD derived. See the copyright headers.
+ *
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Split from ax25_route.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+ax25_dev *ax25_dev_list = NULL;
+
+ax25_dev *ax25_dev_ax25dev(struct device *dev)
+{
+	ax25_dev *ax25_dev;
+
+	for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
+		if (ax25_dev->dev == dev)
+			return ax25_dev;
+
+	return NULL;
+}
+
+ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
+{
+	ax25_dev *ax25_dev;
+
+	for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
+		if (ax25cmp(addr, (ax25_address *)ax25_dev->dev->dev_addr) == 0)
+			return ax25_dev;
+
+	return NULL;
+}
+
+/*
+ *	This is called when an interface is brought up. These are
+ *	reasonable defaults.
+ */
+void ax25_dev_device_up(struct device *dev)
+{
+	ax25_dev *ax25_dev;
+	unsigned long flags;
+
+	if ((ax25_dev = kmalloc(sizeof(*ax25_dev), GFP_ATOMIC)) == NULL) {
+		printk(KERN_ERR "ax25_dev_device_up out of memory\n");
+		return;
+	}
+
+#ifdef CONFIG_SYSCTL
+	ax25_unregister_sysctl();
+#endif
+
+	memset(ax25_dev, 0x00, sizeof(*ax25_dev));
+
+	ax25_dev->dev     = dev;
+	ax25_dev->forward = NULL;
+
+	ax25_dev->values[AX25_VALUES_IPDEFMODE] = AX25_DEF_IPDEFMODE;
+	ax25_dev->values[AX25_VALUES_AXDEFMODE] = AX25_DEF_AXDEFMODE;
+	ax25_dev->values[AX25_VALUES_BACKOFF]   = AX25_DEF_BACKOFF;
+	ax25_dev->values[AX25_VALUES_CONMODE]   = AX25_DEF_CONMODE;
+	ax25_dev->values[AX25_VALUES_WINDOW]    = AX25_DEF_WINDOW;
+	ax25_dev->values[AX25_VALUES_EWINDOW]   = AX25_DEF_EWINDOW;
+	ax25_dev->values[AX25_VALUES_T1]        = AX25_DEF_T1;
+	ax25_dev->values[AX25_VALUES_T2]        = AX25_DEF_T2;
+	ax25_dev->values[AX25_VALUES_T3]        = AX25_DEF_T3;
+	ax25_dev->values[AX25_VALUES_IDLE]	= AX25_DEF_IDLE;
+	ax25_dev->values[AX25_VALUES_N2]        = AX25_DEF_N2;
+	ax25_dev->values[AX25_VALUES_PACLEN]	= AX25_DEF_PACLEN;
+#ifdef CONFIG_AX25_DAMA_SLAVE
+	ax25_dev->values[AX25_VALUES_PROTOCOL]	= AX25_PROTO_DAMA_SLAVE;
+#else
+	ax25_dev->values[AX25_VALUES_PROTOCOL]  = AX25_DEF_PROTOCOL;
+#endif
+	ax25_dev->values[AX25_VALUES_DS_TIMEOUT]= AX25_DEF_DS_TIMEOUT;
+
+	save_flags(flags); cli();
+	ax25_dev->next = ax25_dev_list;
+	ax25_dev_list  = ax25_dev;
+	restore_flags(flags);
+
+#ifdef CONFIG_SYSCTL
+	ax25_register_sysctl();
+#endif
+}
+
+void ax25_dev_device_down(struct device *dev)
+{
+	ax25_dev *s, *ax25_dev;
+	unsigned long flags;
+
+	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
+		return;
+
+#ifdef CONFIG_SYSCTL
+	ax25_unregister_sysctl();
+#endif
+
+	save_flags(flags); cli();
+
+#ifdef CONFIG_AX25_DAMA_SLAVE
+	ax25_ds_del_timer(ax25_dev);
+#endif
+
+	/*
+	 *	Remove any packet forwarding that points to this device.
+	 */
+	for (s = ax25_dev_list; s != NULL; s = s->next)
+		if (s->forward == dev)
+			s->forward = NULL;
+
+	if ((s = ax25_dev_list) == ax25_dev) {
+		ax25_dev_list = s->next;
+		restore_flags(flags);
+		kfree_s(ax25_dev, sizeof(ax25_dev));
+#ifdef CONFIG_SYSCTL
+		ax25_register_sysctl();
+#endif
+		return;
+	}
+
+	while (s != NULL && s->next != NULL) {
+		if (s->next == ax25_dev) {
+			s->next = ax25_dev->next;
+			restore_flags(flags);
+			kfree_s(ax25_dev, sizeof(ax25_dev));
+#ifdef CONFIG_SYSCTL
+			ax25_register_sysctl();
+#endif
+			return;
+		}
+
+		s = s->next;
+	}
+
+	restore_flags(flags);
+#ifdef CONFIG_SYSCTL
+	ax25_register_sysctl();
+#endif
+}
+
+int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
+{
+	ax25_dev *ax25_dev, *fwd_dev;
+
+	if ((ax25_dev = ax25_addr_ax25dev(&fwd->port_from)) == NULL)
+		return -EINVAL;
+
+	switch (cmd) {
+		case SIOCAX25ADDFWD:
+			if ((fwd_dev = ax25_addr_ax25dev(&fwd->port_to)) == NULL)
+				return -EINVAL;
+			if (ax25_dev->forward != NULL)
+				return -EINVAL;
+			ax25_dev->forward = fwd_dev->dev;
+			break;
+
+		case SIOCAX25DELFWD:
+			if (ax25_dev->forward == NULL)
+				return -EINVAL;
+			ax25_dev->forward = NULL;
+			break;
+
+		default:
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
+struct device *ax25_fwd_dev(struct device *dev)
+{
+	ax25_dev *ax25_dev;
+
+	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
+		return dev;
+
+	if (ax25_dev->forward == NULL)
+		return dev;
+
+	return ax25_dev->forward;
+}
+
+#ifdef MODULE
+
+/*
+ *	Free all memory associated with device structures.
+ */
+void ax25_dev_free(void)
+{
+	ax25_dev *s, *ax25_dev = ax25_dev_list;
+
+	while (ax25_dev != NULL) {
+		s        = ax25_dev;
+		ax25_dev = ax25_dev->next;
+
+		kfree_s(s, sizeof(ax25_dev));
+	}
+}
+
+#endif
+
+#endif
diff --git a/net/ax25/ax25_ds_in.c b/net/ax25/ax25_ds_in.c
new file mode 100644
index 000000000..6af2ba91b
--- /dev/null
+++ b/net/ax25/ax25_ds_in.c
@@ -0,0 +1,562 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	Most of this code is based on the SDL diagrams published in the 7th
+ *	ARRL Computer Networking Conference papers. The diagrams have mistakes
+ *	in them, but are mostly correct. Before you modify the code could you
+ *	read the SDL diagrams as the code is not obvious and probably very
+ *	easy to break;
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Cloned from ax25_in.c
+ *			Joerg(DL1BKE)	Fixed it.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25_DAMA_SLAVE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <net/ip.h>			/* For ip_rcv */
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+/*
+ *	State machine for state 1, Awaiting Connection State.
+ *	The handling of the timer(s) is in file ax25_timer.c.
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_ds_state1_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int pf, int type)
+{
+	switch (frametype) {
+		case AX25_SABM:
+			ax25->modulus = AX25_MODULUS;
+			ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_SABME:
+			ax25->modulus = AX25_EMODULUS;
+			ax25->window  = ax25->ax25_dev->values[AX25_VALUES_EWINDOW];
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_DISC:
+			ax25_send_control(ax25, AX25_DM, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_UA:
+			ax25_calculate_rtt(ax25);
+			ax25->t1timer = 0;
+			ax25->t3timer = ax25->t3;
+			ax25->idletimer = ax25->idle;
+			ax25->vs      = 0;
+			ax25->va      = 0;
+			ax25->vr      = 0;
+			ax25->state   = AX25_STATE_3;
+			ax25->n2count = 0;
+			if (ax25->sk != NULL) {
+				ax25->sk->state = TCP_ESTABLISHED;
+				/* For WAIT_SABM connections we will produce an accept ready socket here */
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+			}
+			ax25_dama_on(ax25);
+
+			/* according to DK4EG´s spec we are required to
+			 * send a RR RESPONSE FINAL NR=0. Please mail
+			 * <jr@lykos.oche.de> if this causes problems
+			 * with the TheNetNode DAMA Master implementation.
+			 */ 
+
+			ax25_std_enquiry_response(ax25);
+			break;
+
+		case AX25_DM:
+			if (pf) {
+				if (ax25->modulus == AX25_MODULUS) {
+					ax25_clear_queues(ax25);
+					ax25->state = AX25_STATE_0;
+					if (ax25->sk != NULL) {
+						ax25->sk->state     = TCP_CLOSE;
+						ax25->sk->err       = ECONNREFUSED;
+						ax25->sk->shutdown |= SEND_SHUTDOWN;
+						if (!ax25->sk->dead)
+							ax25->sk->state_change(ax25->sk);
+						ax25->sk->dead      = 1;
+					}
+				} else {
+					ax25->modulus = AX25_MODULUS;
+					ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+				}
+			}
+			break;
+
+		default:
+			if (pf)
+				ax25_send_control(ax25, AX25_SABM, AX25_POLLON, AX25_COMMAND);
+			break;
+	}
+
+	return 0;
+}
+
+/*
+ *	State machine for state 2, Awaiting Release State.
+ *	The handling of the timer(s) is in file ax25_timer.c
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_ds_state2_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int pf, int type)
+{
+	switch (frametype) {
+		case AX25_SABM:
+		case AX25_SABME:
+			ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+			ax25->dama_slave = 0;
+			ax25_dama_off(ax25);
+			break;
+
+		case AX25_DISC:
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->state = AX25_STATE_0;
+			ax25_dama_off(ax25);
+
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = 0;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_DM:
+		case AX25_UA:
+			if (pf) {
+				ax25->state = AX25_STATE_0;
+				ax25_dama_off(ax25);
+
+				if (ax25->sk != NULL) {
+					ax25->sk->state     = TCP_CLOSE;
+					ax25->sk->err       = 0;
+					ax25->sk->shutdown |= SEND_SHUTDOWN;
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+					ax25->sk->dead      = 1;
+				}
+			}
+			break;
+
+		case AX25_I:
+		case AX25_REJ:
+		case AX25_RNR:
+		case AX25_RR:
+			if (pf) {
+				ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+				ax25->dama_slave = 0;
+				ax25_dama_off(ax25);
+			}
+			break;
+
+		default:
+			break;
+	}
+
+	return 0;
+}
+
+/*
+ *	State machine for state 3, Connected State.
+ *	The handling of the timer(s) is in file ax25_timer.c
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_ds_state3_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int ns, int nr, int pf, int type)
+{
+	int queued = 0;
+
+	switch (frametype) {
+		case AX25_SABM:
+		case AX25_SABME:
+			if (frametype == AX25_SABM) {
+				ax25->modulus = AX25_MODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+			} else {
+				ax25->modulus = AX25_EMODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_EWINDOW];
+			}
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->condition = 0x00;
+			ax25->t1timer   = 0;
+			ax25->t3timer   = ax25->t3;
+			ax25->idletimer = ax25->idle;
+			ax25->vs        = 0;
+			ax25->va        = 0;
+			ax25->vr        = 0;
+			ax25_requeue_frames(ax25);
+			ax25_dama_on(ax25);
+			break;
+
+		case AX25_DISC:
+			ax25_clear_queues(ax25);
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			ax25_dama_off(ax25);
+
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = 0;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_DM:
+			ax25_clear_queues(ax25);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			ax25_dama_off(ax25);
+
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = ECONNRESET;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_RR:
+		case AX25_RNR:
+			if (frametype == AX25_RR)
+				ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			else
+				ax25->condition |= AX25_COND_PEER_RX_BUSY;
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_check_iframes_acked(ax25, nr);
+				if (type == AX25_COMMAND && pf)
+					ax25_ds_enquiry_response(ax25);
+			} else {
+				ax25_ds_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_REJ:
+			ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_frames_acked(ax25, nr);
+				ax25_calculate_rtt(ax25);
+				ax25->n2count = 0;
+				ax25->t1timer = 0;
+				ax25->t3timer = ax25->t3;
+				ax25_requeue_frames(ax25);
+				if (type == AX25_COMMAND && pf)
+					ax25_ds_enquiry_response(ax25);
+			} else {
+				ax25_ds_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_I:
+			if (!ax25_validate_nr(ax25, nr)) {
+				ax25_ds_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+				break;
+			}
+			if (ax25->condition & AX25_COND_PEER_RX_BUSY) {
+				ax25_frames_acked(ax25, nr);
+				ax25->n2count = 0;
+			} else {
+				ax25_check_iframes_acked(ax25, nr);
+			}
+			if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+				if (pf) ax25_ds_enquiry_response(ax25);
+				break;
+			}
+			if (ns == ax25->vr) {
+				ax25->vr = (ax25->vr + 1) % ax25->modulus;
+				queued = ax25_rx_iframe(ax25, skb);
+				if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+					ax25->vr = ns;	/* ax25->vr - 1 */
+					if (pf) ax25_ds_enquiry_response(ax25);
+					break;
+				}
+				ax25->condition &= ~AX25_COND_REJECT;
+				if (pf) {
+					ax25_ds_enquiry_response(ax25);
+				} else {
+					if (!(ax25->condition & AX25_COND_ACK_PENDING)) {
+						ax25->t2timer = ax25->t2;
+						ax25->condition |= AX25_COND_ACK_PENDING;
+					}
+				}
+			} else {
+				if (ax25->condition & AX25_COND_REJECT) {
+					if (pf) ax25_ds_enquiry_response(ax25);
+				} else {
+					ax25->condition |= AX25_COND_REJECT;
+					ax25_ds_enquiry_response(ax25);
+					ax25->condition &= ~AX25_COND_ACK_PENDING;
+				}
+			}
+			break;
+
+		case AX25_FRMR:
+		case AX25_ILLEGAL:
+			ax25_ds_establish_data_link(ax25);
+			ax25->state = AX25_STATE_1;
+			break;
+
+		default:
+			break;
+	}
+
+	return queued;
+}
+
+/*
+ *	State machine for state 4, Timer Recovery State.
+ *	The handling of the timer(s) is in file ax25_timer.c
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_ds_state4_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int ns, int nr, int pf, int type)
+{
+	int queued = 0;
+
+	switch (frametype) {
+		case AX25_SABM:
+		case AX25_SABME:
+			if (frametype == AX25_SABM) {
+				ax25->modulus = AX25_MODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+			} else {
+				ax25->modulus = AX25_EMODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_EWINDOW];
+			}
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->condition = 0x00;
+			ax25->t1timer   = 0;
+			ax25->t3timer   = ax25->t3;
+			ax25->idletimer = ax25->idle;
+			ax25->vs        = 0;
+			ax25->va        = 0;
+			ax25->vr        = 0;
+			ax25->state     = AX25_STATE_3;
+			ax25->n2count   = 0;
+			ax25_requeue_frames(ax25);
+			ax25_dama_on(ax25);
+			break;
+
+		case AX25_DISC:
+			ax25_clear_queues(ax25);
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			ax25_dama_off(ax25);
+
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = 0;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_DM:
+			ax25_clear_queues(ax25);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			ax25_dama_off(ax25);
+
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = ECONNRESET;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_RR:
+		case AX25_RNR:
+			if (frametype == AX25_RR)
+				ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			else
+				ax25->condition |= AX25_COND_PEER_RX_BUSY;
+			if (type == AX25_RESPONSE && pf) {
+				ax25->t1timer = 0;
+				if (ax25_validate_nr(ax25, nr)) {
+					ax25_frames_acked(ax25, nr);
+					ax25->n2count = 0;
+					if (ax25->vs == ax25->va) {
+						ax25->t3timer = ax25->t3;
+						ax25->state   = AX25_STATE_3;
+					} else {
+						ax25_requeue_frames(ax25);
+					}
+				} else {
+					ax25_ds_nr_error_recovery(ax25);
+					ax25->state = AX25_STATE_1;
+				}
+				break;
+			}
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_frames_acked(ax25, nr);
+				ax25->n2count = 0;
+				if (type == AX25_COMMAND && pf)
+					ax25_ds_enquiry_response(ax25);
+			} else {
+				ax25_ds_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_REJ:
+			ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			if (pf) {
+				ax25->t1timer = 0;
+				if (ax25_validate_nr(ax25, nr)) {
+					ax25_frames_acked(ax25, nr);
+					ax25->n2count = 0;
+					if (ax25->vs == ax25->va) {
+						ax25->t3timer = ax25->t3;
+						ax25->state   = AX25_STATE_3;
+					} else {
+						ax25_requeue_frames(ax25);
+					}
+					if (type == AX25_COMMAND && pf)
+						ax25_ds_enquiry_response(ax25);
+				} else {
+					ax25_ds_nr_error_recovery(ax25);
+					ax25->state = AX25_STATE_1;
+				}
+				break;
+			}
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_frames_acked(ax25, nr);
+				ax25->n2count = 0;
+				ax25_requeue_frames(ax25);
+				if (type == AX25_COMMAND && pf)
+					ax25_ds_enquiry_response(ax25);
+			} else {
+				ax25_ds_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_I:
+			if (!ax25_validate_nr(ax25, nr)) {
+				ax25_ds_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+				break;
+			}
+			ax25_frames_acked(ax25, nr);
+			ax25->n2count = 0;
+			if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+				if (pf) ax25_ds_enquiry_response(ax25);
+				break;
+			}
+			if (ns == ax25->vr) {
+				ax25->vr = (ax25->vr + 1) % ax25->modulus;
+				queued = ax25_rx_iframe(ax25, skb);
+				if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+					ax25->vr = ns;	/* ax25->vr - 1 */
+					if (pf) ax25_ds_enquiry_response(ax25);
+					break;
+				}
+				ax25->condition &= ~AX25_COND_REJECT;
+				if (pf) {
+					ax25_ds_enquiry_response(ax25);
+				} else {
+					if (!(ax25->condition & AX25_COND_ACK_PENDING)) {
+						ax25->t2timer = ax25->t2;
+						ax25->condition |= AX25_COND_ACK_PENDING;
+					}
+				}
+			} else {
+				if (ax25->condition & AX25_COND_REJECT) {
+					if (pf) ax25_ds_enquiry_response(ax25);
+				} else {
+					ax25->condition |= AX25_COND_REJECT;
+					ax25_ds_enquiry_response(ax25);
+					ax25->condition &= ~AX25_COND_ACK_PENDING;
+				}
+			}
+			break;
+
+		case AX25_FRMR:
+		case AX25_ILLEGAL:
+			ax25_ds_establish_data_link(ax25);
+			ax25->state = AX25_STATE_1;
+			break;
+
+		default:
+			break;
+	}
+
+	return queued;
+}
+
+/*
+ *	Higher level upcall for a LAPB frame
+ */
+int ax25_ds_frame_in(ax25_cb *ax25, struct sk_buff *skb, int type)
+{
+	int queued = 0, frametype, ns, nr, pf;
+
+	frametype = ax25_decode(ax25, skb, &ns, &nr, &pf);
+
+	switch (ax25->state) {
+		case AX25_STATE_1:
+			queued = ax25_ds_state1_machine(ax25, skb, frametype, pf, type);
+			break;
+		case AX25_STATE_2:
+			queued = ax25_ds_state2_machine(ax25, skb, frametype, pf, type);
+			break;
+		case AX25_STATE_3:
+			queued = ax25_ds_state3_machine(ax25, skb, frametype, ns, nr, pf, type);
+			break;
+		case AX25_STATE_4:
+			queued = ax25_ds_state4_machine(ax25, skb, frametype, ns, nr, pf, type);
+			break;
+	}
+
+	return queued;
+}
+
+#endif
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
new file mode 100644
index 000000000..cc15542ab
--- /dev/null
+++ b/net/ax25/ax25_ds_subr.c
@@ -0,0 +1,225 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	Most of this code is based on the SDL diagrams published in the 7th
+ *	ARRL Computer Networking Conference papers. The diagrams have mistakes
+ *	in them, but are mostly correct. Before you modify the code could you
+ *	read the SDL diagrams as the code is not obvious and probably very
+ *	easy to break;
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Cloned from ax25_out.c and ax25_subr.c.
+ *			Joerg(DL1BKE)	Changed ax25_ds_enquiry_response(),
+ *					fixed ax25_dama_on() and ax25_dama_off().
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25_DAMA_SLAVE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+void ax25_ds_nr_error_recovery(ax25_cb *ax25)
+{
+	ax25_ds_establish_data_link(ax25);
+}
+
+/*
+ *	dl1bke 960114: transmit I frames on DAMA poll
+ */
+void ax25_ds_enquiry_response(ax25_cb *ax25)
+{
+	ax25_cb *ax25o;
+
+	/* Please note that neither DK4EG´s nor DG2FEF´s
+	 * DAMA spec mention the following behaviour as seen
+	 * with TheFirmware:
+	 *
+	 * 	DB0ACH->DL1BKE <RR C P R0> [DAMA]
+	 *	DL1BKE->DB0ACH <I NR=0 NS=0>
+	 *	DL1BKE-7->DB0PRA-6 DB0ACH <I C S3 R5>
+	 *	DL1BKE->DB0ACH <RR R F R0>
+	 *
+	 * The Flexnet DAMA Master implementation apparently
+	 * insists on the "proper" AX.25 behaviour:
+	 *
+	 * 	DB0ACH->DL1BKE <RR C P R0> [DAMA]
+	 *	DL1BKE->DB0ACH <RR R F R0>
+	 *	DL1BKE->DB0ACH <I NR=0 NS=0>
+	 *	DL1BKE-7->DB0PRA-6 DB0ACH <I C S3 R5>
+	 *
+	 * Flexnet refuses to send us *any* I frame if we send
+	 * a REJ in case AX25_COND_REJECT is set. It is superfluous in 
+	 * this mode anyway (a RR or RNR invokes the retransmission).
+	 * Is this a Flexnet bug?
+	 */
+
+	ax25_std_enquiry_response(ax25);
+
+	if (!(ax25->condition & AX25_COND_PEER_RX_BUSY)) {
+		ax25_requeue_frames(ax25);
+		ax25_kick(ax25);
+	}
+
+	if (ax25->state == AX25_STATE_1 || ax25->state == AX25_STATE_2 || skb_peek(&ax25->ack_queue) != NULL)
+		ax25_ds_t1_timeout(ax25);
+	else
+		ax25->n2count = 0;
+
+	ax25->t3timer = ax25->t3;
+	ax25_ds_set_timer(ax25->ax25_dev);
+
+	for (ax25o = ax25_list; ax25o != NULL; ax25o = ax25o->next) {
+		if (ax25o == ax25)
+			continue;
+
+		if (ax25o->ax25_dev != ax25->ax25_dev)
+			continue;
+
+		if (ax25o->state == AX25_STATE_1 || ax25o->state == AX25_STATE_2) {
+			ax25_ds_t1_timeout(ax25o);
+			continue;
+		}
+
+		if (!(ax25o->condition & AX25_COND_PEER_RX_BUSY) && 
+		    (ax25o->state == AX25_STATE_3 || 
+		    (ax25o->state == AX25_STATE_4 && ax25o->t1timer == 0))) {
+			ax25_requeue_frames(ax25o);
+			ax25_kick(ax25o);
+		}
+
+		if (ax25o->state == AX25_STATE_1 || ax25o->state == AX25_STATE_2 || skb_peek(&ax25o->ack_queue) != NULL)
+			ax25_ds_t1_timeout(ax25o);
+
+		ax25o->t3timer = ax25o->t3;
+	}
+}
+
+void ax25_ds_establish_data_link(ax25_cb *ax25)
+{
+	ax25->condition = 0x00;
+	ax25->n2count   = 0;
+
+	ax25->t3timer = ax25->t3;
+	ax25->t2timer = 0;
+	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+}
+
+/*
+ *	:::FIXME:::
+ *	This is a kludge. Not all drivers recognize kiss commands. 
+ *	We need a driver level  request to switch duplex mode, that does 
+ *	either SCC changing, PI config or KISS as required. Currently
+ *	this request isn't reliable.
+ *
+ */
+static void ax25_kiss_cmd(ax25_dev *ax25_dev, unsigned char cmd, unsigned char param)
+{
+	struct sk_buff *skb;
+	unsigned char *p;
+
+	if (ax25_dev->dev == NULL)
+		return;
+
+	if ((skb = alloc_skb(2, GFP_ATOMIC)) == NULL)
+		return;
+
+	p = skb_put(skb, 2);
+
+	*p++ = cmd;
+	*p++ = param;
+
+	skb->arp      = 1;
+	skb->dev      = ax25_dev->dev;
+	skb->priority = SOPRI_NORMAL;
+	skb->protocol = htons(ETH_P_AX25);
+
+	dev_queue_xmit(skb);
+}
+
+/*
+ *	A nasty problem arises if we count the number of DAMA connections
+ *	wrong, especially when connections on the device already existed
+ *	and our network node (or the sysop) decides to turn on DAMA Master
+ *	mode. We thus flag the 'real' slave connections with 
+ *	ax25->dama_slave=1 and look on every disconnect if still slave
+ *	connections exist.
+ */
+
+static int ax25_check_dama_slave(ax25_dev *ax25_dev)
+{
+	ax25_cb *ax25;
+
+	for (ax25 = ax25_list; ax25 != NULL ; ax25 = ax25->next)
+		if (ax25->ax25_dev == ax25_dev && ax25->dama_slave && ax25->state > AX25_STATE_1)
+			return 1;
+
+	return 0;
+}
+
+void ax25_dev_dama_on(ax25_dev *ax25_dev)
+{
+	if (ax25_dev == NULL)
+		return;
+
+	if (ax25_dev->dama.slave == 0)
+		ax25_kiss_cmd(ax25_dev, 5, 1);
+
+	ax25_dev->dama.slave = 1;
+	ax25_ds_set_timer(ax25_dev);
+}
+
+void ax25_dev_dama_off(ax25_dev *ax25_dev)
+{
+	if (ax25_dev == NULL)
+		return;
+
+	if (ax25_dev->dama.slave && !ax25_check_dama_slave(ax25_dev))
+	{
+		ax25_kiss_cmd(ax25_dev, 5, 0);
+		ax25_dev->dama.slave = 0;
+		ax25_ds_del_timer(ax25_dev);
+	}
+}
+
+void ax25_dama_on(ax25_cb *ax25)
+{
+	ax25_dev_dama_on(ax25->ax25_dev);
+	ax25->dama_slave = 1;
+}
+
+void ax25_dama_off(ax25_cb *ax25)
+{
+	ax25_dev_dama_off(ax25->ax25_dev);
+	ax25->dama_slave = 0;
+}
+
+#endif
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
new file mode 100644
index 000000000..1b9d3c95f
--- /dev/null
+++ b/net/ax25/ax25_ds_timer.c
@@ -0,0 +1,313 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Cloned from ax25_timer.c.
+ *			Joerg(DL1BKE)	Added DAMA Slave Timeout timer
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25_DAMA_SLAVE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+static void ax25_ds_timeout(unsigned long);
+
+/*
+ *	Add DAMA slave timeout timer to timer list.
+ *	Unlike the connection based timers the timeout function gets 
+ *	triggered every second. Please note that NET_AX25_DAMA_SLAVE_TIMEOUT
+ *	(aka /proc/sys/net/ax25/{dev}/dama_slave_timeout) is still in
+ *	1/10th of a second.
+ */
+
+static void ax25_ds_add_timer(ax25_dev *ax25_dev)
+{
+	struct timer_list *t = &ax25_dev->dama.slave_timer;
+	t->data		= (unsigned long) ax25_dev;
+	t->function	= &ax25_ds_timeout;
+	t->expires	= jiffies + HZ;
+	add_timer(t);
+}
+
+void ax25_ds_del_timer(ax25_dev *ax25_dev)
+{
+	if (ax25_dev) del_timer(&ax25_dev->dama.slave_timer);
+}
+
+void ax25_ds_set_timer(ax25_dev *ax25_dev)
+{
+	if (ax25_dev == NULL)		/* paranoia */
+		return;
+
+	del_timer(&ax25_dev->dama.slave_timer);
+	ax25_dev->dama.slave_timeout = ax25_dev->values[AX25_VALUES_DS_TIMEOUT] / 10;
+	ax25_ds_add_timer(ax25_dev);
+}
+
+/*
+ *	DAMA Slave Timeout
+ *	Silently discard all (slave) connections in case our master forgot us...
+ */
+
+static void ax25_ds_timeout(unsigned long arg)
+{
+	ax25_dev *ax25_dev = (struct ax25_dev *) arg;
+	ax25_cb *ax25;
+	
+	if (ax25_dev == NULL || !ax25_dev->dama.slave)
+		return;			/* Yikes! */
+	
+	if (!ax25_dev->dama.slave_timeout || --ax25_dev->dama.slave_timeout)
+	{
+		ax25_ds_set_timer(ax25_dev);
+		return;
+	}
+	
+	for (ax25=ax25_list; ax25 != NULL; ax25 = ax25->next)
+	{
+		if (ax25->ax25_dev != ax25_dev || !ax25->dama_slave)
+			continue;
+
+		ax25_link_failed(&ax25->dest_addr, ax25_dev->dev);
+		ax25_clear_queues(ax25);
+		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+		ax25->state = AX25_STATE_0;
+
+		if (ax25->sk != NULL)
+		{
+			SOCK_DEBUG(ax25->sk, "AX.25 DAMA Slave Timeout\n");
+			ax25->sk->state     = TCP_CLOSE;
+			ax25->sk->err       = ETIMEDOUT;
+			ax25->sk->shutdown |= SEND_SHUTDOWN;
+			if (!ax25->sk->dead)
+				ax25->sk->state_change(ax25->sk);
+			ax25->sk->dead      = 1;
+		}
+		
+		ax25_set_timer(ax25);	/* notify socket... */
+	}
+	
+	ax25_dev_dama_off(ax25_dev);
+}
+
+
+/*
+ *	AX.25 TIMER 
+ *
+ *	This routine is called every 100ms. Decrement timer by this
+ *	amount - if expired then process the event.
+ */
+void ax25_ds_timer(ax25_cb *ax25)
+{
+	switch (ax25->state) {
+		case AX25_STATE_0:
+			/* Magic here: If we listen() and a new link dies before it
+			   is accepted() it isn't 'dead' so doesn't get removed. */
+			if (ax25->sk == NULL || ax25->sk->destroy || (ax25->sk->state == TCP_LISTEN && ax25->sk->dead)) {
+				del_timer(&ax25->timer);
+				ax25_destroy_socket(ax25);
+				return;
+			}
+			break;
+
+		case AX25_STATE_3:
+		case AX25_STATE_4:
+			/*
+			 * Check the state of the receive buffer.
+			 */
+			if (ax25->sk != NULL) {
+				if (atomic_read(&ax25->sk->rmem_alloc) < (ax25->sk->rcvbuf / 2) && (ax25->condition & AX25_COND_OWN_RX_BUSY)) {
+					ax25->condition &= ~AX25_COND_OWN_RX_BUSY;
+					break;
+				}
+			}
+			break;
+
+		default:
+			break;
+	}
+	
+	/* dl1bke 960114: T3 works much like the IDLE timeout, but
+	 *                gets reloaded with every frame for this
+	 *		  connection.
+	 */
+
+	if (ax25->t3timer > 0 && --ax25->t3timer == 0) {
+		ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+		ax25_clear_queues(ax25);
+		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+
+		ax25->state = AX25_STATE_0;
+		ax25_dama_off(ax25);
+
+		if (ax25->sk != NULL) {
+			SOCK_DEBUG(ax25->sk, "AX.25 T3 Timeout\n");
+			ax25->sk->state     = TCP_CLOSE;
+			ax25->sk->err       = ETIMEDOUT;
+			ax25->sk->shutdown |= SEND_SHUTDOWN;
+			if (!ax25->sk->dead)
+				ax25->sk->state_change(ax25->sk);
+			ax25->sk->dead      = 1;
+		}
+
+		ax25_set_timer(ax25);
+
+		return;
+	}
+
+	/* dl1bke 960228: close the connection when IDLE expires.
+	 *		  unlike T3 this timer gets reloaded only on
+	 *		  I frames.
+	 */
+
+	if (ax25->idletimer > 0 && --ax25->idletimer == 0) {
+		ax25_clear_queues(ax25);
+
+		ax25->n2count = 0;
+		ax25->t3timer = ax25->t3;
+
+		/* state 1 or 2 should not happen, but... */
+
+		if (ax25->state == AX25_STATE_1 || ax25->state == AX25_STATE_2)
+			ax25->state = AX25_STATE_0;
+		else
+			ax25->state = AX25_STATE_2;
+
+		ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+
+		if (ax25->sk != NULL) {
+			ax25->sk->state     = TCP_CLOSE;
+			ax25->sk->err       = 0;
+			ax25->sk->shutdown |= SEND_SHUTDOWN;
+			if (!ax25->sk->dead)
+				ax25->sk->state_change(ax25->sk);
+			ax25->sk->dead      = 1;
+			ax25->sk->destroy   = 1;
+		}
+	}
+
+	ax25_set_timer(ax25);
+}
+
+/* dl1bke 960114: The DAMA protocol requires to send data and SABM/DISC
+ *                within the poll of any connected channel. Remember 
+ *                that we are not allowed to send anything unless we
+ *                get polled by the Master.
+ *
+ *                Thus we'll have to do parts of our T1 handling in
+ *                ax25_enquiry_response().
+ */
+void ax25_ds_t1_timeout(ax25_cb *ax25)
+{	
+	switch (ax25->state) {
+		case AX25_STATE_1: 
+			if (ax25->n2count == ax25->n2) {
+				if (ax25->modulus == AX25_MODULUS) {
+					ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+					ax25_clear_queues(ax25);
+					ax25->state = AX25_STATE_0;
+					if (ax25->sk != NULL) {
+						ax25->sk->state     = TCP_CLOSE;
+						ax25->sk->err       = ETIMEDOUT;
+						ax25->sk->shutdown |= SEND_SHUTDOWN;
+						if (!ax25->sk->dead)
+							ax25->sk->state_change(ax25->sk);
+						ax25->sk->dead      = 1;
+					}
+				} else {
+					ax25->modulus = AX25_MODULUS;
+					ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+					ax25->n2count = 0;
+					ax25_send_control(ax25, AX25_SABM, AX25_POLLOFF, AX25_COMMAND);
+				}
+			} else {
+				ax25->n2count++;
+				if (ax25->modulus == AX25_MODULUS)
+					ax25_send_control(ax25, AX25_SABM, AX25_POLLOFF, AX25_COMMAND);
+				else
+					ax25_send_control(ax25, AX25_SABME, AX25_POLLOFF, AX25_COMMAND);
+			}
+			break;
+
+		case AX25_STATE_2:
+			if (ax25->n2count == ax25->n2) {
+				ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+				ax25_clear_queues(ax25);
+				ax25->state = AX25_STATE_0;
+				ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+
+				if (ax25->sk != NULL) {
+					ax25->sk->state     = TCP_CLOSE;
+					ax25->sk->err       = ETIMEDOUT;
+					ax25->sk->shutdown |= SEND_SHUTDOWN;
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+					ax25->sk->dead      = 1;
+				}
+			} else {
+				ax25->n2count++;
+			}
+			break;
+
+		case AX25_STATE_3: 
+			ax25->n2count = 1;
+			ax25->state   = AX25_STATE_4;
+			break;
+
+		case AX25_STATE_4:
+			if (ax25->n2count == ax25->n2) {
+				ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+				ax25_clear_queues(ax25);
+				ax25_send_control(ax25, AX25_DM, AX25_POLLON, AX25_RESPONSE);
+				ax25->state = AX25_STATE_0;
+				if (ax25->sk != NULL) {
+					SOCK_DEBUG(ax25->sk, "AX.25 link Failure\n");
+					ax25->sk->state     = TCP_CLOSE;
+					ax25->sk->err       = ETIMEDOUT;
+					ax25->sk->shutdown |= SEND_SHUTDOWN;
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+					ax25->sk->dead      = 1;
+				}
+			} else {
+				ax25->n2count++;
+			}
+			break;
+	}
+
+	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+
+	ax25_set_timer(ax25);
+}
+
+#endif
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
new file mode 100644
index 000000000..94e62000a
--- /dev/null
+++ b/net/ax25/ax25_iface.c
@@ -0,0 +1,282 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Split from ax25_timer.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+static struct protocol_struct {
+	struct protocol_struct *next;
+	unsigned int pid;
+	int (*func)(struct sk_buff *, ax25_cb *);
+} *protocol_list = NULL;
+
+static struct linkfail_struct {
+	struct linkfail_struct *next;
+	void (*func)(ax25_address *, struct device *);
+} *linkfail_list = NULL;
+
+static struct listen_struct {
+	struct listen_struct *next;
+	ax25_address  callsign;
+	struct device *dev;
+} *listen_list = NULL;
+
+int ax25_protocol_register(unsigned int pid, int (*func)(struct sk_buff *, ax25_cb *))
+{
+	struct protocol_struct *protocol;
+	unsigned long flags;
+
+	if (pid == AX25_P_TEXT || pid == AX25_P_SEGMENT)
+		return 0;
+#ifdef CONFIG_INET
+	if (pid == AX25_P_IP || pid == AX25_P_ARP)
+		return 0;
+#endif
+	if ((protocol = kmalloc(sizeof(*protocol), GFP_ATOMIC)) == NULL)
+		return 0;
+
+	protocol->pid  = pid;
+	protocol->func = func;
+
+	save_flags(flags);
+	cli();
+
+	protocol->next = protocol_list;
+	protocol_list  = protocol;
+
+	restore_flags(flags);
+
+	return 1;
+}
+
+void ax25_protocol_release(unsigned int pid)
+{
+	struct protocol_struct *s, *protocol = protocol_list;
+	unsigned long flags;
+
+	if (protocol == NULL)
+		return;
+
+	save_flags(flags);
+	cli();
+
+	if (protocol->pid == pid) {
+		protocol_list = protocol->next;
+		restore_flags(flags);
+		kfree_s(protocol, sizeof(struct protocol_struct));
+		return;
+	}
+
+	while (protocol != NULL && protocol->next != NULL) {
+		if (protocol->next->pid == pid) {
+			s = protocol->next;
+			protocol->next = protocol->next->next;
+			restore_flags(flags);
+			kfree_s(s, sizeof(struct protocol_struct));
+			return;
+		}
+
+		protocol = protocol->next;
+	}
+
+	restore_flags(flags);
+}
+
+int ax25_linkfail_register(void (*func)(ax25_address *, struct device *))
+{
+	struct linkfail_struct *linkfail;
+	unsigned long flags;
+
+	if ((linkfail = kmalloc(sizeof(*linkfail), GFP_ATOMIC)) == NULL)
+		return 0;
+
+	linkfail->func = func;
+
+	save_flags(flags);
+	cli();
+
+	linkfail->next = linkfail_list;
+	linkfail_list  = linkfail;
+
+	restore_flags(flags);
+
+	return 1;
+}
+
+void ax25_linkfail_release(void (*func)(ax25_address *, struct device *))
+{
+	struct linkfail_struct *s, *linkfail = linkfail_list;
+	unsigned long flags;
+
+	if (linkfail == NULL)
+		return;
+
+	save_flags(flags);
+	cli();
+
+	if (linkfail->func == func) {
+		linkfail_list = linkfail->next;
+		restore_flags(flags);
+		kfree_s(linkfail, sizeof(struct linkfail_struct));
+		return;
+	}
+
+	while (linkfail != NULL && linkfail->next != NULL) {
+		if (linkfail->next->func == func) {
+			s = linkfail->next;
+			linkfail->next = linkfail->next->next;
+			restore_flags(flags);
+			kfree_s(s, sizeof(struct linkfail_struct));
+			return;
+		}
+
+		linkfail = linkfail->next;
+	}
+
+	restore_flags(flags);
+}
+
+int ax25_listen_register(ax25_address *callsign, struct device *dev)
+{
+	struct listen_struct *listen;
+	unsigned long flags;
+
+	if (ax25_listen_mine(callsign, dev))
+		return 0;
+
+	if ((listen = kmalloc(sizeof(*listen), GFP_ATOMIC)) == NULL)
+		return 0;
+
+	listen->callsign = *callsign;
+	listen->dev      = dev;
+
+	save_flags(flags);
+	cli();
+
+	listen->next = listen_list;
+	listen_list  = listen;
+
+	restore_flags(flags);
+
+	return 1;
+}
+
+void ax25_listen_release(ax25_address *callsign, struct device *dev)
+{
+	struct listen_struct *s, *listen = listen_list;
+	unsigned long flags;
+
+	if (listen == NULL)
+		return;
+
+	save_flags(flags);
+	cli();
+
+	if (ax25cmp(&listen->callsign, callsign) == 0 && listen->dev == dev) {
+		listen_list = listen->next;
+		restore_flags(flags);
+		kfree_s(listen, sizeof(struct listen_struct));
+		return;
+	}
+
+	while (listen != NULL && listen->next != NULL) {
+		if (ax25cmp(&listen->next->callsign, callsign) == 0 && listen->next->dev == dev) {
+			s = listen->next;
+			listen->next = listen->next->next;
+			restore_flags(flags);
+			kfree_s(s, sizeof(struct listen_struct));
+			return;
+		}
+
+		listen = listen->next;
+	}
+
+	restore_flags(flags);
+}
+
+int (*ax25_protocol_function(unsigned int pid))(struct sk_buff *, ax25_cb *)
+{
+	struct protocol_struct *protocol;
+
+	for (protocol = protocol_list; protocol != NULL; protocol = protocol->next)
+		if (protocol->pid == pid)
+			return protocol->func;
+
+	return NULL;
+}
+
+int ax25_listen_mine(ax25_address *callsign, struct device *dev)
+{
+	struct listen_struct *listen;
+
+	for (listen = listen_list; listen != NULL; listen = listen->next)
+		if (ax25cmp(&listen->callsign, callsign) == 0 && (listen->dev == dev || listen->dev == NULL))
+			return 1;
+
+	return 0;
+}
+
+void ax25_link_failed(ax25_address *callsign, struct device *dev)
+{
+	struct linkfail_struct *linkfail;
+
+	for (linkfail = linkfail_list; linkfail != NULL; linkfail = linkfail->next)
+		(linkfail->func)(callsign, dev);
+}
+
+/*
+ *	Return the state of an AX.25 link given source, destination, and
+ *	device.
+ */
+int ax25_link_up(ax25_address *src, ax25_address *dest, ax25_digi *digi, struct device *dev)
+{
+	return ax25_find_cb(src, dest, digi, dev) != NULL;
+}
+
+int ax25_protocol_is_registered(unsigned int pid)
+{
+	struct protocol_struct *protocol;
+
+	for (protocol = protocol_list; protocol != NULL; protocol = protocol->next)
+		if (protocol->pid == pid)
+			return 1;
+
+	return 0;
+}
+
+#endif
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 3ef1c3fdf..ec9ce4da0 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -1,10 +1,10 @@
 /*
- *	AX.25 release 033
+ *	AX.25 release 036
  *
  *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
  *	releases, misbehave and/or generally screw up. It might even work. 
  *
- *	This code REQUIRES 1.2.1 or higher/ NET3.029
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
  *
  *	This module:
  *		This module is free software; you can redistribute it and/or
@@ -35,6 +35,9 @@
  *	AX.25 032	Darryl(G7LED)	AX.25 segmentation fixed.
  *	AX.25 033	Jonathan(G4KLX)	Remove auto-router.
  *					Modularisation changes.
+ *	AX.25 035	Hans(PE1AYX)	Fixed interface to IP layer.
+ *	AX.25 036	Jonathan(G4KLX)	Move DAMA code into own file.
+ *			Joerg(DL1BKE)	Fixed DAMA Slave.
  */
 
 #include <linux/config.h>
@@ -53,16 +56,16 @@
 #include <linux/inet.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/firewall.h>
 #include <net/sock.h>
 #include <net/ip.h>			/* For ip_rcv */
+#include <net/arp.h>			/* For arp_rcv */
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 
-static int ax25_rx_iframe(ax25_cb *, struct sk_buff *);
-
 /*
  *	Given a fragment, queue it on the fragment queue and if the fragment
  *	is complete, send it back to ax25_rx_iframe.
@@ -71,12 +74,12 @@ static int ax25_rx_fragment(ax25_cb *ax25, struct sk_buff *skb)
 {
 	struct sk_buff *skbn, *skbo;
 	int hdrlen, nhdrlen;
-	
+
 	if (ax25->fragno != 0) {
-		if (!(*skb->data & SEG_FIRST)) {
-			if ((ax25->fragno - 1) == (*skb->data & SEG_REM)) {
+		if (!(*skb->data & AX25_SEG_FIRST)) {
+			if ((ax25->fragno - 1) == (*skb->data & AX25_SEG_REM)) {
 				/* Enqueue fragment */
-				ax25->fragno = *skb->data & SEG_REM;
+				ax25->fragno = *skb->data & AX25_SEG_REM;
 				skb_pull(skb, 1);	/* skip fragno */
 				ax25->fraglen += skb->len;
 				skb_queue_tail(&ax25->frag_queue, skb);
@@ -89,14 +92,7 @@ static int ax25_rx_fragment(ax25_cb *ax25, struct sk_buff *skb)
 						return 1;
 					}
 
-					skbn->free = 1;
-					skbn->arp  = 1;
-					skbn->dev  = ax25->device;
-
-					if (ax25->sk != NULL) {
-						skbn->sk = ax25->sk;
-						atomic_add(skbn->truesize, &ax25->sk->rmem_alloc);
-					}
+					skbn->dev = ax25->ax25_dev->dev;
 
 					skb_reserve(skbn, AX25_MAX_HEADER_LEN);
 
@@ -125,16 +121,16 @@ static int ax25_rx_fragment(ax25_cb *ax25, struct sk_buff *skb)
 					if (ax25_rx_iframe(ax25, skbn) == 0)
 						kfree_skb(skbn, FREE_READ);
 				}
-				
+
 				return 1;
 			}
 		}
 	} else {
 		/* First fragment received */
-		if (*skb->data & SEG_FIRST) {
+		if (*skb->data & AX25_SEG_FIRST) {
 			while ((skbo = skb_dequeue(&ax25->frag_queue)) != NULL)
 				kfree_skb(skbo, FREE_READ);
-			ax25->fragno = *skb->data & SEG_REM;
+			ax25->fragno = *skb->data & AX25_SEG_REM;
 			skb_pull(skb, 1);		/* skip fragno */
 			ax25->fraglen = skb->len;
 			skb_queue_tail(&ax25->frag_queue, skb);
@@ -149,23 +145,36 @@ static int ax25_rx_fragment(ax25_cb *ax25, struct sk_buff *skb)
  *	This is where all valid I frames are sent to, to be dispatched to
  *	whichever protocol requires them.
  */
-static int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
+int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
 {
 	int (*func)(struct sk_buff *, ax25_cb *);
 	volatile int queued = 0;
 	unsigned char pid;
-	
+
 	if (skb == NULL) return 0;
 
 	ax25->idletimer = ax25->idle;
-	
+
 	pid = *skb->data;
 
 #ifdef CONFIG_INET
 	if (pid == AX25_P_IP) {
+		/* working around a TCP bug to keep additional listeners 
+		 * happy. TCP re-uses the buffer and destroys the original
+		 * content.
+		 */
+		struct sk_buff *skbn = skb_copy(skb, GFP_ATOMIC);
+		if (skbn != NULL) {
+			kfree_skb(skb, FREE_READ);
+			skb = skbn;
+		}
+
 		skb_pull(skb, 1);	/* Remove PID */
-		skb->h.raw = skb->data;
-		ip_rcv(skb, ax25->device, NULL);	/* Wrong ptype */
+		skb->h.raw    = skb->data;
+		skb->nh.raw   = skb->data;
+		skb->dev      = ax25->ax25_dev->dev;
+		skb->pkt_type = PACKET_HOST;
+		ip_rcv(skb, skb->dev, NULL);	/* Wrong ptype */
 		return 1;
 	}
 #endif
@@ -178,643 +187,319 @@ static int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
 		skb_pull(skb, 1);	/* Remove PID */
 		return (*func)(skb, ax25);
 	}
-	
-	if (ax25->sk != NULL && ax25_dev_get_value(ax25->device, AX25_VALUES_TEXT) && ax25->sk->protocol == pid) {
+
+	if (ax25->sk != NULL && ax25->ax25_dev->values[AX25_VALUES_CONMODE] == 2 && ax25->sk->protocol == pid) {
 		if (sock_queue_rcv_skb(ax25->sk, skb) == 0)
 			queued = 1;
 		else
-			ax25->condition |= OWN_RX_BUSY_CONDITION;
+			ax25->condition |= AX25_COND_OWN_RX_BUSY;
 	}
 
 	return queued;
 }
 
 /*
- *	State machine for state 1, Awaiting Connection State.
- *	The handling of the timer(s) is in file ax25_timer.c.
- *	Handling of state 0 and connection release is in ax25.c.
+ *	Higher level upcall for a LAPB frame
  */
-static int ax25_state1_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int pf, int type, int dama)
+static int ax25_process_rx_frame(ax25_cb *ax25, struct sk_buff *skb, int type, int dama)
 {
-	switch (frametype) {
-		case SABM:
-			ax25->modulus = MODULUS;
-			ax25->window  = ax25_dev_get_value(ax25->device, AX25_VALUES_WINDOW);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			break;
-
-		case SABME:
-			ax25->modulus = EMODULUS;
-			ax25->window  = ax25_dev_get_value(ax25->device, AX25_VALUES_EWINDOW);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			break;
+	int queued = 0;
 
-		case DISC:
-			ax25_send_control(ax25, DM, pf, C_RESPONSE);
-			break;
+	if (ax25->state == AX25_STATE_0)
+		return 0;
 
-		case UA:
-			if (pf || dama) {
-				if (dama) ax25_dama_on(ax25); /* bke */
-					
-				ax25_calculate_rtt(ax25);
-				ax25->t1timer = 0;
-				ax25->t3timer = ax25->t3;
-				ax25->idletimer = ax25->idle;
-				ax25->vs      = 0;
-				ax25->va      = 0;
-				ax25->vr      = 0;
-				ax25->state   = AX25_STATE_3;
-				ax25->n2count = 0;
-				ax25->dama_slave = dama;	/* bke */
-					
-				if (ax25->sk != NULL) {
-					ax25->sk->state = TCP_ESTABLISHED;
-					/* For WAIT_SABM connections we will produce an accept ready socket here */
-					if (!ax25->sk->dead)
-						ax25->sk->state_change(ax25->sk);
-				}
-			}
-			break;
+	del_timer(&ax25->timer);
 
-		case DM:
-			if (pf) {
-				if (ax25->modulus == MODULUS) {
-					ax25_clear_queues(ax25);
-					ax25->state = AX25_STATE_0;
-					if (ax25->sk != NULL) {
-						ax25->sk->state     = TCP_CLOSE;
-						ax25->sk->err       = ECONNREFUSED;
-						ax25->sk->shutdown |= SEND_SHUTDOWN;
-						if (!ax25->sk->dead)
-							ax25->sk->state_change(ax25->sk);
-						ax25->sk->dead      = 1;
-					}
-				} else {
-					ax25->modulus = MODULUS;
-					ax25->window  = ax25_dev_get_value(ax25->device, AX25_VALUES_WINDOW);
-				}
-			}
+	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
+		case AX25_PROTO_STD_SIMPLEX:
+		case AX25_PROTO_STD_DUPLEX:
+			queued = ax25_std_frame_in(ax25, skb, type);
 			break;
 
-		default:
-			if (dama && pf)
-				ax25_send_control(ax25, SABM, POLLON, C_COMMAND);
+#ifdef CONFIG_AX25_DAMA_SLAVE
+		case AX25_PROTO_DAMA_SLAVE:
+			if (dama || ax25->ax25_dev->dama.slave)
+				queued = ax25_ds_frame_in(ax25, skb, type);
+			else
+				queued = ax25_std_frame_in(ax25, skb, type);
 			break;
+#endif
 	}
 
-	return 0;
+	ax25_set_timer(ax25);
+
+	return queued;
 }
 
-/*
- *	State machine for state 2, Awaiting Release State.
- *	The handling of the timer(s) is in file ax25_timer.c
- *	Handling of state 0 and connection release is in ax25.c.
- */
-static int ax25_state2_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int pf, int type)
+static int ax25_rcv(struct sk_buff *skb, struct device *dev, ax25_address *dev_addr, struct packet_type *ptype)
 {
-	switch (frametype) {
-		case SABM:
-		case SABME:
-			ax25_send_control(ax25, DM, pf, C_RESPONSE);
-			if (ax25->dama_slave)
-				ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-			break;
-
-		case DISC:
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			if (ax25->dama_slave) {
-				ax25->state = AX25_STATE_0;
-				ax25_dama_off(ax25);
-				if (ax25->sk != NULL) {
-					ax25->sk->state     = TCP_CLOSE;
-					ax25->sk->err       = 0;
-					ax25->sk->shutdown |= SEND_SHUTDOWN;
-					if (!ax25->sk->dead)
-						ax25->sk->state_change(ax25->sk);
-					ax25->sk->dead      = 1;
-				}
-			}
-			break;
+	struct sock *make;
+	struct sock *sk;
+	int type = 0;
+	ax25_digi dp, reverse_dp;
+	ax25_cb *ax25;
+	ax25_address src, dest;
+	ax25_address *next_digi = NULL;
+	ax25_dev *ax25_dev;
+	struct sock *raw;
+	int mine = 0;
+	int dama;
+
+	/*
+	 *	Process the AX.25/LAPB frame.
+	 */
+
+	skb->h.raw = skb->data;
+
+	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) {
+		kfree_skb(skb, FREE_READ);
+		return 0;
+	}
 
-		case UA:
-			if (pf) {
-				ax25->state = AX25_STATE_0;
-				ax25_dama_off(ax25);
-				if (ax25->sk != NULL) {
-					ax25->sk->state     = TCP_CLOSE;
-					ax25->sk->err       = 0;
-					ax25->sk->shutdown |= SEND_SHUTDOWN;
-					if (!ax25->sk->dead)
-						ax25->sk->state_change(ax25->sk);
-					ax25->sk->dead      = 1;
-				}
-			}
-			break;
+	if (call_in_firewall(PF_AX25, skb->dev, skb->h.raw, NULL,&skb) != FW_ACCEPT) {
+		kfree_skb(skb, FREE_READ);
+		return 0;
+	}
 
-		case DM:
-			if (pf) {
-				ax25->state = AX25_STATE_0;
-				ax25_dama_off(ax25);
-				if (ax25->sk != NULL) {
-					ax25->sk->state     = TCP_CLOSE;
-					ax25->sk->err       = 0;
-					ax25->sk->shutdown |= SEND_SHUTDOWN;
-					if (!ax25->sk->dead)
-						ax25->sk->state_change(ax25->sk);
-					ax25->sk->dead      = 1;
-				}
-			}
-			break;
+	/*
+	 *	Parse the address header.
+	 */
 
-		case I:
-		case REJ:
-		case RNR:
-		case RR:
-			if (pf) {
-				if (ax25->dama_slave)
-					ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-				else
-					ax25_send_control(ax25, DM, POLLON, C_RESPONSE);
-			}
-			break;
-				
-		default:
-			break;
+	if (ax25_addr_parse(skb->data, skb->len, &src, &dest, &dp, &type, &dama) == NULL) {
+		kfree_skb(skb, FREE_READ);
+		return 0;
 	}
 
-	return 0;
-}
+	/*
+	 *	Ours perhaps ?
+	 */
+	if (dp.lastrepeat + 1 < dp.ndigi)		/* Not yet digipeated completely */
+		next_digi = &dp.calls[dp.lastrepeat + 1];
 
-/*
- *	State machine for state 3, Connected State.
- *	The handling of the timer(s) is in file ax25_timer.c
- *	Handling of state 0 and connection release is in ax25.c.
- */
-static int ax25_state3_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int ns, int nr, int pf, int type, int dama)
-{
-	int queued = 0;
+	/*
+	 *	Pull of the AX.25 headers leaving the CTRL/PID bytes
+	 */
+	skb_pull(skb, ax25_addr_size(&dp));
 
-	switch (frametype) {
-		case SABM:
-			if (dama) ax25_dama_on(ax25);
-			ax25->modulus   = MODULUS;
-			ax25->window    = ax25_dev_get_value(ax25->device, AX25_VALUES_WINDOW);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			ax25->condition = 0x00;
-			ax25->t1timer   = 0;
-			ax25->t3timer   = ax25->t3;
-			ax25->idletimer = ax25->idle;
-			ax25->vs        = 0;
-			ax25->va        = 0;
-			ax25->vr        = 0;
-			ax25->dama_slave = dama;
-			break;
+	/* For our port addresses ? */
+	if (ax25cmp(&dest, dev_addr) == 0 && dp.lastrepeat + 1 == dp.ndigi)
+		mine = 1;
 
-		case SABME:
-			if (dama) ax25_dama_on(ax25);
-			ax25->modulus   = EMODULUS;
-			ax25->window    = ax25_dev_get_value(ax25->device, AX25_VALUES_EWINDOW);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			ax25->condition = 0x00;
-			ax25->t1timer   = 0;
-			ax25->t3timer   = ax25->t3;
-			ax25->idletimer = ax25->idle;
-			ax25->vs        = 0;
-			ax25->va        = 0;
-			ax25->vr        = 0;
-			ax25->dama_slave = dama;
-			break;
+	/* Also match on any registered callsign from L3/4 */
+	if (!mine && ax25_listen_mine(&dest, dev) && dp.lastrepeat + 1 == dp.ndigi)
+		mine = 1;
 
-		case DISC:
-			ax25_clear_queues(ax25);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			ax25->t3timer = 0;
-			ax25->state   = AX25_STATE_0;
-			ax25_dama_off(ax25);
-			if (ax25->sk != NULL) {
-				ax25->sk->state     = TCP_CLOSE;
-				ax25->sk->err       = 0;
-				ax25->sk->shutdown |= SEND_SHUTDOWN;
-				if (!ax25->sk->dead)
-					ax25->sk->state_change(ax25->sk);
-				ax25->sk->dead      = 1;
-			}
-			break;
+	/* UI frame - bypass LAPB processing */
+	if ((*skb->data & ~0x10) == AX25_UI && dp.lastrepeat + 1 == dp.ndigi) {
+		skb->h.raw = skb->data + 2;		/* skip control and pid */
 
-		case DM:
-			ax25_clear_queues(ax25);
-			ax25->t3timer = 0;
-			ax25->state   = AX25_STATE_0;
-			ax25_dama_off(ax25);
-			if (ax25->sk != NULL) {
-				ax25->sk->state     = TCP_CLOSE;
-				ax25->sk->err       = ECONNRESET;
-				ax25->sk->shutdown |= SEND_SHUTDOWN;
-				if (!ax25->sk->dead)
-					ax25->sk->state_change(ax25->sk);
-				ax25->sk->dead      = 1;
-			}
-			break;
+		if ((raw = ax25_addr_match(&dest)) != NULL)
+			ax25_send_to_raw(raw, skb, skb->data[1]);
 
-		case RNR:
-			ax25->condition |= PEER_RX_BUSY_CONDITION;
-			ax25_check_need_response(ax25, type, pf);
-			if (ax25_validate_nr(ax25, nr)) {
-				ax25_check_iframes_acked(ax25, nr);
-				dama_check_need_response(ax25, type, pf);
-			} else {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-			}
-			break;
-			
-		case RR:
-			ax25->condition &= ~PEER_RX_BUSY_CONDITION;
-			ax25_check_need_response(ax25, type, pf);
-			if (ax25_validate_nr(ax25, nr)) {
-				ax25_check_iframes_acked(ax25, nr);
-				dama_check_need_response(ax25, type, pf);
-			} else {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-			}
-			break;
-				
-		case REJ:
-			ax25->condition &= ~PEER_RX_BUSY_CONDITION;
-			ax25_check_need_response(ax25, type, pf);
-			if (ax25_validate_nr(ax25, nr)) {
-				ax25_frames_acked(ax25, nr);
-				ax25_calculate_rtt(ax25);
-				ax25->t1timer = 0;
-				ax25->t3timer = ax25->t3;
-				ax25_requeue_frames(ax25);
-				dama_check_need_response(ax25, type, pf);
-			} else {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-			}
-			break;
-			
-		case I:
-#ifndef AX25_BROKEN_NETMAC
-			if (type != C_COMMAND)
-				break;
-#endif
-			if (!ax25_validate_nr(ax25, nr)) {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
+		if (!mine && ax25cmp(&dest, (ax25_address *)dev->broadcast) != 0) {
+			kfree_skb(skb, FREE_READ);
+			return 0;
+		}
+
+		/* Now we are pointing at the pid byte */
+		switch (skb->data[1]) {
+#ifdef CONFIG_INET
+			case AX25_P_IP:
+				skb_pull(skb,2);		/* drop PID/CTRL */
+				skb->h.raw    = skb->data;
+				skb->nh.raw   = skb->data;
+				skb->dev      = dev;
+				skb->pkt_type = PACKET_HOST;
+				ip_rcv(skb, dev, ptype);	/* Note ptype here is the wrong one, fix me later */
 				break;
-			}
-			if (ax25->condition & PEER_RX_BUSY_CONDITION) {
-				ax25_frames_acked(ax25, nr);
-			} else {
-				ax25_check_iframes_acked(ax25, nr);
-			}
-			if (ax25->condition & OWN_RX_BUSY_CONDITION) {
-				if (pf)	{
-					if (ax25->dama_slave)
-						dama_enquiry_response(ax25);
-					else
-						ax25_enquiry_response(ax25);
-				}
+
+			case AX25_P_ARP:
+				skb_pull(skb,2);
+				skb->h.raw    = skb->data;
+				skb->nh.raw   = skb->data;
+				skb->dev      = dev;
+				skb->pkt_type = PACKET_HOST;
+				arp_rcv(skb, dev, ptype);	/* Note ptype here is wrong... */
 				break;
-			}
-			if (ns == ax25->vr) {
-				ax25->vr = (ax25->vr + 1) % ax25->modulus;
-				queued = ax25_rx_iframe(ax25, skb);
-				if (ax25->condition & OWN_RX_BUSY_CONDITION) {
-					ax25->vr = ns;	/* ax25->vr - 1 */
-					if (pf) {
-						if (ax25->dama_slave)
-							dama_enquiry_response(ax25);
-						else
-							ax25_enquiry_response(ax25);
-					}
-					break;
-				}
-				ax25->condition &= ~REJECT_CONDITION;
-				if (pf) {
-					if (ax25->dama_slave)
-						dama_enquiry_response(ax25);
-					else
-						ax25_enquiry_response(ax25);
-				} else {
-					if (!(ax25->condition & ACK_PENDING_CONDITION)) {
-						ax25->t2timer = ax25->t2;
-						ax25->condition |= ACK_PENDING_CONDITION;
-					}
-				}
-			} else {
-				if (ax25->condition & REJECT_CONDITION) {
-					if (pf) {
-						if (ax25->dama_slave)
-							dama_enquiry_response(ax25);
-						else
-							ax25_enquiry_response(ax25);
+#endif
+			case AX25_P_TEXT:
+				/* Now find a suitable dgram socket */
+				if ((sk = ax25_find_socket(&dest, &src, SOCK_DGRAM)) != NULL) {
+					if (atomic_read(&sk->rmem_alloc) >= sk->rcvbuf) {
+						kfree_skb(skb, FREE_READ);
+					} else {
+						/*
+						 *	Remove the control and PID.
+						 */
+						skb_pull(skb, 2);
+						if (sock_queue_rcv_skb(sk, skb) != 0)
+							kfree_skb(skb, FREE_READ);
 					}
 				} else {
-					ax25->condition |= REJECT_CONDITION;
-					if (ax25->dama_slave)
-						dama_enquiry_response(ax25);
-					else
-						ax25_send_control(ax25, REJ, pf, C_RESPONSE);
-					ax25->condition &= ~ACK_PENDING_CONDITION;
+					kfree_skb(skb, FREE_READ);
 				}
-			}
-			break;
+				break;
 
-		case FRMR:
-		case ILLEGAL:
-			ax25_establish_data_link(ax25);
-			ax25->state = AX25_STATE_1;
-			break;
+			default:
+				kfree_skb(skb, FREE_READ);	/* Will scan SOCK_AX25 RAW sockets */
+				break;
+		}
 
-		default:
-			break;
+		return 0;
 	}
 
-	return queued;
-}
+	/*
+	 *	Is connected mode supported on this device ?
+	 *	If not, should we DM the incoming frame (except DMs) or
+	 *	silently ignore them. For now we stay quiet.
+	 */
+	if (ax25_dev->values[AX25_VALUES_CONMODE] == 0) {
+		kfree_skb(skb, FREE_READ);
+		return 0;
+	}
 
-/*
- *	State machine for state 4, Timer Recovery State.
- *	The handling of the timer(s) is in file ax25_timer.c
- *	Handling of state 0 and connection release is in ax25.c.
- */
-static int ax25_state4_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int ns, int nr, int pf, int type, int dama)
-{
-	int queued = 0;
+	/* LAPB */
 
-	switch (frametype) {
-		case SABM:
-			if (dama) ax25_dama_on(ax25);
-			ax25->dama_slave = dama;
-			ax25->modulus   = MODULUS;
-			ax25->window    = ax25_dev_get_value(ax25->device, AX25_VALUES_WINDOW);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			ax25->condition = 0x00;
-			ax25->t1timer   = 0;
-			ax25->t3timer   = ax25->t3;
-			ax25->idletimer = ax25->idle;
-			ax25->vs        = 0;
-			ax25->va        = 0;
-			ax25->vr        = 0;
-			ax25->state     = AX25_STATE_3;
-			ax25->n2count   = 0;
-			break;
+	/* AX.25 state 1-4 */
 
-		case SABME:
-			if (dama) ax25_dama_on(ax25);
-			ax25->dama_slave = dama;
-			ax25->modulus   = EMODULUS;
-			ax25->window    = ax25_dev_get_value(ax25->device, AX25_VALUES_EWINDOW);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			ax25->condition = 0x00;
-			ax25->t1timer   = 0;
-			ax25->t3timer   = ax25->t3;
-			ax25->idletimer = ax25->idle;
-			ax25->vs        = 0;
-			ax25->va        = 0;
-			ax25->vr        = 0;
-			ax25->state     = AX25_STATE_3;
-			ax25->n2count   = 0;
-			break;
+	ax25_digi_invert(&dp, &reverse_dp);
 
-		case DISC:
-			ax25_clear_queues(ax25);
-			ax25_send_control(ax25, UA, pf, C_RESPONSE);
-			ax25->t3timer = 0;
-			ax25->state   = AX25_STATE_0;
-			ax25_dama_off(ax25);
-			if (ax25->sk != NULL) {
-				ax25->sk->state     = TCP_CLOSE;
-				ax25->sk->err       = 0;
-				ax25->sk->shutdown |= SEND_SHUTDOWN;
-				if (!ax25->sk->dead)
-					ax25->sk->state_change(ax25->sk);
-				ax25->sk->dead      = 1;
-			}
-			break;
+	if ((ax25 = ax25_find_cb(&dest, &src, &reverse_dp, dev)) != NULL) {
+		/*
+		 *	Process the frame. If it is queued up internally it returns one otherwise we
+		 *	free it immediately. This routine itself wakes the user context layers so we
+		 *	do no further work
+		 */
+		if (ax25_process_rx_frame(ax25, skb, type, dama) == 0)
+			kfree_skb(skb, FREE_READ);
 
-		case DM:
-			ax25_clear_queues(ax25);
-			ax25->t3timer = 0;
-			ax25->state   = AX25_STATE_0;
-			ax25_dama_off(ax25);
-			if (ax25->sk != NULL) {
-				ax25->sk->state     = TCP_CLOSE;
-				ax25->sk->err       = ECONNRESET;
-				ax25->sk->shutdown |= SEND_SHUTDOWN;
-				if (!ax25->sk->dead)
-					ax25->sk->state_change(ax25->sk);
-				ax25->sk->dead      = 1;
-			}
-			break;
+		return 0;
+	}
 
-		case RNR:
-			ax25->condition |= PEER_RX_BUSY_CONDITION;
-			if (type == C_RESPONSE && pf) {
-				ax25->t1timer = 0;
-				if (ax25_validate_nr(ax25, nr)) {
-					ax25_frames_acked(ax25, nr);
-					if (ax25->vs == ax25->va) {
-						ax25->t3timer = ax25->t3;
-						ax25->n2count = 0;
-						ax25->state   = AX25_STATE_3;
-					}
-				} else {
-					ax25_nr_error_recovery(ax25);
-					ax25->state = AX25_STATE_1;
-				}
-				break;
-			}
-			 
-			ax25_check_need_response(ax25, type, pf);
-			if (ax25_validate_nr(ax25, nr)) {
-				ax25_frames_acked(ax25, nr);
-				dama_check_need_response(ax25, type, pf);
-			} else {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-			}
-			break;
-			
-		case RR:
-			ax25->condition &= ~PEER_RX_BUSY_CONDITION;
-			if (pf && (type == C_RESPONSE || (ax25->dama_slave && type == C_COMMAND))) {
-				ax25->t1timer = 0;
-				if (ax25_validate_nr(ax25, nr)) {
-					ax25_frames_acked(ax25, nr);
-					if (ax25->vs == ax25->va) {
-						ax25->t3timer = ax25->t3;
-						ax25->n2count = 0;
-						ax25->state   = AX25_STATE_3;
-					} else {
-						ax25_requeue_frames(ax25);
-					}
-					dama_check_need_response(ax25, type, pf);
-				} else {
-					ax25_nr_error_recovery(ax25);
-					ax25->state = AX25_STATE_1;
-				}
-				break;
-			}
+	/* AX.25 state 0 (disconnected) */
 
-			ax25_check_need_response(ax25, type, pf);
-			if (ax25_validate_nr(ax25, nr)) {
-				ax25_frames_acked(ax25, nr);
-				dama_check_need_response(ax25, type, pf);
-			} else {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-			}
-			break;
+	/* a) received not a SABM(E) */
 
-		case REJ:
-			ax25->condition &= ~PEER_RX_BUSY_CONDITION;
-			if (pf && (type == C_RESPONSE || (ax25->dama_slave && type == C_COMMAND))) {
-				ax25->t1timer = 0;
-				if (ax25_validate_nr(ax25, nr)) {
-					ax25_frames_acked(ax25, nr);
-					if (ax25->vs == ax25->va) {
-						ax25->t3timer = ax25->t3;
-						ax25->n2count = 0;
-						ax25->state   = AX25_STATE_3;
-					} else {
-						ax25_requeue_frames(ax25);
-					}
-					dama_check_need_response(ax25, type, pf);
-				} else {
-					ax25_nr_error_recovery(ax25);
-					ax25->state = AX25_STATE_1;
-				}
-				break;
-			}
-			
-			ax25_check_need_response(ax25, type, pf);	
-			if (ax25_validate_nr(ax25, nr)) {
-				ax25_frames_acked(ax25, nr);
-				if(ax25->vs != ax25->va) {
-					ax25_requeue_frames(ax25);
-				}
-				dama_check_need_response(ax25, type, pf);
-			} else {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-			}
-			break;
+	if ((*skb->data & ~AX25_PF) != AX25_SABM && (*skb->data & ~AX25_PF) != AX25_SABME) {
+		/*
+		 *	Never reply to a DM. Also ignore any connects for
+		 *	addresses that are not our interfaces and not a socket.
+		 */
+		if ((*skb->data & ~AX25_PF) != AX25_DM && mine)
+			ax25_return_dm(dev, &src, &dest, &dp);
 
-		case I:
-#ifndef	AX25_BROKEN_NETMAC
-			if (type != C_COMMAND)
-				break;
+		kfree_skb(skb, FREE_READ);
+		return 0;
+	}
+
+	/* b) received SABM(E) */
+
+	if (dp.lastrepeat + 1 == dp.ndigi)
+		sk = ax25_find_listener(&dest, 0, dev, SOCK_SEQPACKET);
+	else
+		sk = ax25_find_listener(next_digi, 1, dev, SOCK_SEQPACKET);
+
+	if (sk != NULL) {
+		if (sk->ack_backlog == sk->max_ack_backlog || (make = ax25_make_new(sk, dev)) == NULL) {
+			if (mine) ax25_return_dm(dev, &src, &dest, &dp);
+			kfree_skb(skb, FREE_READ);
+			return 0;
+		}
+
+		ax25 = make->protinfo.ax25;
+
+		skb_queue_head(&sk->receive_queue, skb);
+
+		skb->sk     = make;
+		make->state = TCP_ESTABLISHED;
+		make->pair  = sk;
+
+		sk->ack_backlog++;
+	} else {
+		if (!mine) {
+			kfree_skb(skb, FREE_READ);
+			return 0;
+		}
+
+		if ((ax25 = ax25_create_cb()) == NULL) {
+			ax25_return_dm(dev, &src, &dest, &dp);
+			kfree_skb(skb, FREE_READ);
+			return 0;
+		}
+
+		ax25_fillin_cb(ax25, ax25_dev);
+		ax25->idletimer = ax25->idle;
+	}
+
+	ax25->source_addr = dest;
+	ax25->dest_addr   = src;
+
+	/*
+	 *	Sort out any digipeated paths.
+	 */
+	if (dp.ndigi != 0 && ax25->digipeat == NULL && (ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
+		kfree_skb(skb, FREE_READ);
+		ax25_destroy_socket(ax25);
+		return 0;
+	}
+
+	if (dp.ndigi == 0) {
+		if (ax25->digipeat != NULL) {
+			kfree_s(ax25->digipeat, sizeof(ax25_digi));
+			ax25->digipeat = NULL;
+		}
+	} else {
+		/* Reverse the source SABM's path */
+		*ax25->digipeat = reverse_dp;
+	}
+
+	if ((*skb->data & ~AX25_PF) == AX25_SABME) {
+		ax25->modulus = AX25_EMODULUS;
+		ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
+	} else {
+		ax25->modulus = AX25_MODULUS;
+		ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
+	}
+
+	ax25_send_control(ax25, AX25_UA, AX25_POLLON, AX25_RESPONSE);
+
+#ifdef CONFIG_AX25_DAMA_SLAVE
+	if (dama && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
+		ax25_dama_on(ax25);
 #endif
-			if (!ax25_validate_nr(ax25, nr)) {
-				ax25_nr_error_recovery(ax25);
-				ax25->state = AX25_STATE_1;
-				break;
-			}
-			ax25_frames_acked(ax25, nr);
-			if (ax25->condition & OWN_RX_BUSY_CONDITION) {
-				if (pf) {
-					if (ax25->dama_slave)
-						ax25_enquiry_response(ax25);
-					else
-						dama_enquiry_response(ax25);
-				}
-				break;
-			}
-			if (ns == ax25->vr) {
-				ax25->vr = (ax25->vr + 1) % ax25->modulus;
-				queued = ax25_rx_iframe(ax25, skb);
-				if (ax25->condition & OWN_RX_BUSY_CONDITION) {
-					ax25->vr = ns;	/* ax25->vr - 1 */
-					if (pf) {
-						if (ax25->dama_slave)
-							dama_enquiry_response(ax25);
-						else
-							ax25_enquiry_response(ax25);
-					}
-					break;
-				}
-				ax25->condition &= ~REJECT_CONDITION;
-				if (pf) {
-					if (ax25->dama_slave)
-						dama_enquiry_response(ax25);
-					else
-						ax25_enquiry_response(ax25);
-				} else {
-					if (!(ax25->condition & ACK_PENDING_CONDITION)) {
-						ax25->t2timer = ax25->t2;
-						ax25->condition |= ACK_PENDING_CONDITION;
-					}
-				}
-			} else {
-				if (ax25->condition & REJECT_CONDITION) {
-					if (pf) {
-						if (ax25->dama_slave)
-							dama_enquiry_response(ax25);
-						else
-							ax25_enquiry_response(ax25);
-					}
-				} else {
-					ax25->condition |= REJECT_CONDITION;
-					if (ax25->dama_slave)
-						dama_enquiry_response(ax25);
-					else
-						ax25_send_control(ax25, REJ, pf, C_RESPONSE);
-					ax25->condition &= ~ACK_PENDING_CONDITION;
-				}
-			}
-			break;
-		
-		case FRMR:
-		case ILLEGAL:
-			ax25_establish_data_link(ax25);
-			ax25->state = AX25_STATE_1;
-			break;
 
-		default:
-			break;
+	ax25->t3timer = ax25->t3;
+	ax25->state   = AX25_STATE_3;
+
+	ax25_insert_socket(ax25);
+
+	ax25_set_timer(ax25);
+
+	if (sk != NULL) {
+		if (!sk->dead)
+			sk->data_ready(sk, skb->len);
+	} else {
+		kfree_skb(skb, FREE_READ);
 	}
 
-	return queued;
+	return 0;
 }
 
 /*
- *	Higher level upcall for a LAPB frame
+ *	Receive an AX.25 frame via a SLIP interface.
  */
-int ax25_process_rx_frame(ax25_cb *ax25, struct sk_buff *skb, int type, int dama)
+int ax25_kiss_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *ptype)
 {
-	int queued = 0, frametype, ns, nr, pf;
-	
-	if (ax25->state == AX25_STATE_0)
-		return 0;
-
-	del_timer(&ax25->timer);
-
-	frametype = ax25_decode(ax25, skb, &ns, &nr, &pf);
+	skb->sk = NULL;		/* Initially we don't know who it's for */
 
-	switch (ax25->state) {
-		case AX25_STATE_1:
-			queued = ax25_state1_machine(ax25, skb, frametype, pf, type, dama);
-			break;
-		case AX25_STATE_2:
-			queued = ax25_state2_machine(ax25, skb, frametype, pf, type);
-			break;
-		case AX25_STATE_3:
-			queued = ax25_state3_machine(ax25, skb, frametype, ns, nr, pf, type, dama);
-			break;
-		case AX25_STATE_4:
-			queued = ax25_state4_machine(ax25, skb, frametype, ns, nr, pf, type, dama);
-			break;
+	if ((*skb->data & 0x0F) != 0) {
+		kfree_skb(skb, FREE_READ);	/* Not a KISS data frame */
+		return 0;
 	}
 
-	ax25_set_timer(ax25);
+	skb_pull(skb, AX25_KISS_HEADER_LEN);	/* Remove the KISS byte */
 
-	return queued;
+	return ax25_rcv(skb, dev, (ax25_address *)dev->dev_addr, ptype);
 }
 
 #endif
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
new file mode 100644
index 000000000..ec882c50d
--- /dev/null
+++ b/net/ax25/ax25_ip.c
@@ -0,0 +1,178 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new
+ *	releases, misbehave and/or generally screw up. It might even work.
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Split from af_ax25.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/termios.h>	/* For TIOCINQ/OUTQ */
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/notifier.h>
+#include <linux/proc_fs.h>
+#include <linux/stat.h>
+#include <linux/firewall.h>
+#include <linux/sysctl.h>
+#include <net/ip.h>
+#include <net/arp.h>
+
+/*
+ *	IP over AX.25 encapsulation.
+ */
+
+/*
+ *	Shove an AX.25 UI header on an IP packet and handle ARP
+ */
+
+#ifdef CONFIG_INET
+
+int ax25_encapsulate(struct sk_buff *skb, struct device *dev, unsigned short type, void *daddr, void *saddr, unsigned len)
+{
+  	/* header is an AX.25 UI frame from us to them */
+ 	unsigned char *buff = skb_push(skb, AX25_HEADER_LEN);
+
+  	*buff++ = 0x00;	/* KISS DATA */
+
+	if (daddr != NULL)
+		memcpy(buff, daddr, dev->addr_len);	/* Address specified */
+
+  	buff[6] &= ~AX25_CBIT;
+  	buff[6] &= ~AX25_EBIT;
+  	buff[6] |= AX25_SSSID_SPARE;
+  	buff    += AX25_ADDR_LEN;
+
+  	if (saddr != NULL)
+  		memcpy(buff, saddr, dev->addr_len);
+  	else
+  		memcpy(buff, dev->dev_addr, dev->addr_len);
+
+  	buff[6] &= ~AX25_CBIT;
+  	buff[6] |= AX25_EBIT;
+  	buff[6] |= AX25_SSSID_SPARE;
+  	buff    += AX25_ADDR_LEN;
+
+  	*buff++  = AX25_UI;	/* UI */
+
+  	/* Append a suitable AX.25 PID */
+  	switch (type) {
+  		case ETH_P_IP:
+  			*buff++ = AX25_P_IP;
+ 			break;
+  		case ETH_P_ARP:
+  			*buff++ = AX25_P_ARP;
+  			break;
+  		default:
+  			printk(KERN_ERR "AX.25 wrong protocol type 0x%x2.2\n", type);
+  			*buff++ = 0;
+  			break;
+ 	}
+
+	if (daddr != NULL)
+	  	return AX25_HEADER_LEN;
+
+	return -AX25_HEADER_LEN;	/* Unfinished header */
+}
+
+int ax25_rebuild_header(struct sk_buff *skb)
+{
+	struct sk_buff *ourskb;
+	int mode;
+	unsigned char *bp  = skb->data;
+	struct device *dev = skb->dev;
+	ax25_dev *ax25_dev;
+
+  	if (arp_find(bp + 1, skb))
+  		return 1;
+
+	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
+		return 1;
+
+	if (bp[16] == AX25_P_IP) {
+		mode = ax25_ip_mode_get((ax25_address *)(bp + 1), dev);
+		if (mode == 'V' || (mode == ' ' && ax25_dev->values[AX25_VALUES_IPDEFMODE])) {
+			/*
+			 *	We copy the buffer and release the original thereby
+			 *	keeping it straight
+			 *
+			 *	Note: we report 1 back so the caller will
+			 *	not feed the frame direct to the physical device
+			 *	We don't want that to happen. (It won't be upset
+			 *	as we have pulled the frame from the queue by
+			 *	freeing it).
+			 *
+			 *	NB: TCP modifies buffers that are still
+			 *	on a device queue, thus we use skb_copy()
+			 *      instead of using skb_clone() unless this
+			 *	gets fixed.
+			 */
+			if ((ourskb = skb_copy(skb, GFP_ATOMIC)) == NULL) {
+				dev_kfree_skb(skb, FREE_WRITE);
+				return 1;
+			}
+
+			if (skb->sk != NULL)
+				skb_set_owner_w(ourskb, skb->sk);
+
+			kfree_skb(skb, FREE_WRITE);
+
+			skb_pull(ourskb, AX25_HEADER_LEN - 1);	/* Keep PID */
+
+			ax25_send_frame(ourskb, ax25_dev->values[AX25_VALUES_PACLEN], (ax25_address *)(bp + 8), (ax25_address *)(bp + 1), NULL, dev);
+
+			return 1;
+		}
+	}
+
+  	bp[7]  &= ~AX25_CBIT;
+  	bp[7]  &= ~AX25_EBIT;
+  	bp[7]  |= AX25_SSSID_SPARE;
+
+  	bp[14] &= ~AX25_CBIT;
+  	bp[14] |= AX25_EBIT;
+  	bp[14] |= AX25_SSSID_SPARE;
+
+	ax25_dg_build_path(skb, (ax25_address *)(bp + 1), dev);
+
+	skb->dev      = dev;
+	skb->priority = SOPRI_NORMAL;
+
+	ax25_queue_xmit(skb);
+
+  	return 1;
+}
+
+#endif
+
+#endif
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index be265b344..7072c632e 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -1,10 +1,10 @@
 /*
- *	AX.25 release 033
+ *	AX.25 release 036
  *
  *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
  *	releases, misbehave and/or generally screw up. It might even work. 
  *
- *	This code REQUIRES 1.2.1 or higher/ NET3.029
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
  *
  *	This module:
  *		This module is free software; you can redistribute it and/or
@@ -47,6 +47,7 @@
 #include <linux/inet.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/firewall.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -54,68 +55,119 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 
+int ax25_send_frame(struct sk_buff *skb, int paclen, ax25_address *src, ax25_address *dest, ax25_digi *digi, struct device *dev)
+{
+	ax25_dev *ax25_dev;
+	ax25_cb *ax25;
+
+	if (skb == NULL)
+		return 0;
+
+	/*
+	 * Look for an existing connection.
+	 */
+	if ((ax25 = ax25_find_cb(src, dest, digi, dev)) != NULL) {
+		ax25_output(ax25, paclen, skb);
+		ax25->idletimer = ax25->idle;
+		return 1;		/* It already existed */
+	}
+
+	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
+		return 0;
+
+	if ((ax25 = ax25_create_cb()) == NULL)
+		return 0;
+
+	ax25_fillin_cb(ax25, ax25_dev);
+
+	ax25->source_addr = *src;
+	ax25->dest_addr   = *dest;
+
+	if (digi != NULL) {
+		if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
+			ax25_free_cb(ax25);
+			return 0;
+		}
+		*ax25->digipeat = *digi;
+	} else {
+		ax25_rt_build_path(ax25, dest, dev);
+	}
+
+	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
+		case AX25_PROTO_STD_SIMPLEX:
+		case AX25_PROTO_STD_DUPLEX:
+			ax25_std_establish_data_link(ax25);
+			break;
+
+#ifdef CONFIG_AX25_DAMA_SLAVE
+		case AX25_PROTO_DAMA_SLAVE:
+			if (ax25_dev->dama.slave)
+				ax25_ds_establish_data_link(ax25);
+			else
+				ax25_std_establish_data_link(ax25);
+			break;
+#endif
+	}
+
+	/* idle timeouts only for mode vc connections */
+
+	ax25->idletimer = ax25->idle;
+
+	ax25_insert_socket(ax25);
+
+	ax25->state = AX25_STATE_1;
+
+	ax25_set_timer(ax25);
+
+	ax25_output(ax25, paclen, skb);
+
+	return 1;			/* We had to create it */
+}
+
 /*
- * All outgoing AX.25 I frames pass via this routine. Therefore this is
- * where the fragmentation of frames takes place.
+ *	All outgoing AX.25 I frames pass via this routine. Therefore this is
+ *	where the fragmentation of frames takes place. If fragment is set to
+ *	zero then we are not allowed to do fragmentation, even if the frame
+ *	is too large.
  */
-void ax25_output(ax25_cb *ax25, struct sk_buff *skb)
+void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
 {
 	struct sk_buff *skbn;
 	unsigned char *p;
-	int frontlen, mtu, len, fragno, ka9qfrag, first = 1;
+	int frontlen, len, fragno, ka9qfrag, first = 1;
 	long flags;
-	
-	/*
-	 * dl1bke 960301: We use the new PACLEN parameter as MTU of the AX.25 layer.
-	 *                This will (hopefully) allow user programs to write() data
-	 *                w/o having to think of the maximal amount of data we can
-	 *		  send with one call. It's called PACLEN to (1) avoid confusion
-	 *		  with (IP) MTU and (2) TAPR calls this PACLEN, too ;-)
-	 */
 
-	mtu = ax25->paclen;
-	
-	if ((skb->len - 1) > mtu) {
+	if ((skb->len - 1) > paclen) {
 		if (*skb->data == AX25_P_TEXT) {
 			skb_pull(skb, 1); /* skip PID */
 			ka9qfrag = 0;
 		} else {
-			mtu -= 2;	/* Allow for fragment control info */
+			paclen -= 2;	/* Allow for fragment control info */
 			ka9qfrag = 1;
 		}
-		
-		fragno = skb->len / mtu;
-		if (skb->len % mtu == 0) fragno--;
+
+		fragno = skb->len / paclen;
+		if (skb->len % paclen == 0) fragno--;
 
 		frontlen = skb_headroom(skb);	/* Address space + CTRL */
 
 		while (skb->len > 0) {
 			save_flags(flags); 
 			cli();
-			/* 
-			 * do _not_ use sock_alloc_send_skb, our socket may have
-			 * sk->shutdown set...
-			 */
-			if ((skbn = alloc_skb(mtu + 2 + frontlen, GFP_ATOMIC)) == NULL) {
+
+			if ((skbn = alloc_skb(paclen + 2 + frontlen, GFP_ATOMIC)) == NULL) {
 				restore_flags(flags);
 				printk(KERN_DEBUG "ax25_output: alloc_skb returned NULL\n");
-				if (skb_device_locked(skb))
-					skb_device_unlock(skb);
 				return;
 			}
 
-			skbn->sk   = skb->sk;
-			
-			if (skbn->sk)
-				atomic_add(skbn->truesize, &skbn->sk->wmem_alloc);
+			if (skb->sk != NULL)
+				skb_set_owner_w(skbn, skb->sk);
 			
 			restore_flags(flags);
 			
-			skbn->free = 1;
-			skbn->arp  = 1;
+			len = (paclen > skb->len) ? skb->len : paclen;
 
-			len = (mtu > skb->len) ? skb->len : mtu;
-			
 			if (ka9qfrag == 1) {
 				skb_reserve(skbn, frontlen + 2);
 
@@ -126,7 +178,7 @@ void ax25_output(ax25_cb *ax25, struct sk_buff *skb)
 
 				*p = fragno--;
 				if (first) {
-					*p |= SEG_FIRST;
+					*p |= AX25_SEG_FIRST;
 					first = 0;
 				}
 			} else {
@@ -139,16 +191,16 @@ void ax25_output(ax25_cb *ax25, struct sk_buff *skb)
 			skb_pull(skb, len);
 			skb_queue_tail(&ax25->write_queue, skbn); /* Throw it on the queue */
 		}
-		
-		skb->free = 1;
+
 		kfree_skb(skb, FREE_WRITE);
 	} else {
 		skb_queue_tail(&ax25->write_queue, skb);	  /* Throw it on the queue */
 	}
 
-	if (ax25->state == AX25_STATE_3 || ax25->state == AX25_STATE_4) {
-		if (!ax25->dama_slave)		/* bke 960114: we aren't allowed to transmit */
-			ax25_kick(ax25);	/* in DAMA mode unless we received a Poll */
+	if (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_STD_SIMPLEX ||
+	    ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_STD_DUPLEX) {
+		if (ax25->state == AX25_STATE_3 || ax25->state == AX25_STATE_4)
+			ax25_kick(ax25);
 	}
 }
 
@@ -163,23 +215,23 @@ static void ax25_send_iframe(ax25_cb *ax25, struct sk_buff *skb, int poll_bit)
 	if (skb == NULL)
 		return;
 
-	if (ax25->modulus == MODULUS) {
+	if (ax25->modulus == AX25_MODULUS) {
 		frame = skb_push(skb, 1);
 
-		*frame = I;
-		*frame |= (poll_bit) ? PF : 0;
+		*frame = AX25_I;
+		*frame |= (poll_bit) ? AX25_PF : 0;
 		*frame |= (ax25->vr << 5);
 		*frame |= (ax25->vs << 1);
 	} else {
 		frame = skb_push(skb, 2);
 
-		frame[0] = I;
+		frame[0] = AX25_I;
 		frame[0] |= (ax25->vs << 1);
-		frame[1] = (poll_bit) ? EPF : 0;
+		frame[1] = (poll_bit) ? AX25_EPF : 0;
 		frame[1] |= (ax25->vr << 1);
 	}
 
-	ax25_transmit_buffer(ax25, skb, C_COMMAND);	
+	ax25_transmit_buffer(ax25, skb, AX25_COMMAND);
 }
 
 void ax25_kick(ax25_cb *ax25)
@@ -193,8 +245,8 @@ void ax25_kick(ax25_cb *ax25)
 	start = (skb_peek(&ax25->ack_queue) == NULL) ? ax25->va : ax25->vs;
 	end   = (ax25->va + ax25->window) % ax25->modulus;
 
-	if (!(ax25->condition & PEER_RX_BUSY_CONDITION) &&
-	    start != end                                   &&
+	if (!(ax25->condition & AX25_COND_PEER_RX_BUSY) &&
+	    start != end                                &&
 	    skb_peek(&ax25->write_queue) != NULL) {
 
 		ax25->vs = start;
@@ -216,18 +268,29 @@ void ax25_kick(ax25_cb *ax25)
 				break;
 			}
 
+			if (skb->sk != NULL)
+				skb_set_owner_w(skbn, skb->sk);
+
 			next = (ax25->vs + 1) % ax25->modulus;
-#ifdef notdef
-			last = (next == end) || skb_peek(&ax25->write_queue) == NULL;
-#else
 			last = (next == end);
-#endif
+
 			/*
 			 * Transmit the frame copy.
 			 * bke 960114: do not set the Poll bit on the last frame
 			 * in DAMA mode.
 			 */
-			ax25_send_iframe(ax25, skbn, (last && !ax25->dama_slave) ? POLLON : POLLOFF);
+			switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
+				case AX25_PROTO_STD_SIMPLEX:
+				case AX25_PROTO_STD_DUPLEX:
+					ax25_send_iframe(ax25, skbn, (last) ? AX25_POLLON : AX25_POLLOFF);
+					break;
+
+#ifdef CONFIG_AX25_DAMA_SLAVE
+				case AX25_PROTO_DAMA_SLAVE:
+					ax25_send_iframe(ax25, skbn, AX25_POLLOFF);
+					break;
+#endif
+			}
 
 			ax25->vs = next;
 
@@ -235,12 +298,10 @@ void ax25_kick(ax25_cb *ax25)
 			 * Requeue the original data frame.
 			 */
 			skb_queue_tail(&ax25->ack_queue, skb);
-#ifdef notdef
-		} while (!last);
-#else
+
 		} while (!last && (skb = skb_dequeue(&ax25->write_queue)) != NULL);
-#endif
-		ax25->condition &= ~ACK_PENDING_CONDITION;
+
+		ax25->condition &= ~AX25_COND_ACK_PENDING;
 
 		if (ax25->t1timer == 0) {
 			ax25->t3timer = 0;
@@ -255,7 +316,7 @@ void ax25_transmit_buffer(ax25_cb *ax25, struct sk_buff *skb, int type)
 {
 	unsigned char *ptr;
 
-	if (ax25->device == NULL) {
+	if (ax25->ax25_dev == NULL) {
 		if (ax25->sk != NULL) {
 			ax25->sk->state     = TCP_CLOSE;
 			ax25->sk->err       = ENETUNREACH;
@@ -267,77 +328,42 @@ void ax25_transmit_buffer(ax25_cb *ax25, struct sk_buff *skb, int type)
 		return;
 	}
 
-	if (skb_headroom(skb) < size_ax25_addr(ax25->digipeat)) {
+	if (skb_headroom(skb) < ax25_addr_size(ax25->digipeat)) {
 		printk(KERN_CRIT "ax25_transmit_buffer: not enough room for digi-peaters\n");
-		skb->free = 1;
 		kfree_skb(skb, FREE_WRITE);
 		return;
 	}
 
-	ptr = skb_push(skb, size_ax25_addr(ax25->digipeat));
-	build_ax25_addr(ptr, &ax25->source_addr, &ax25->dest_addr, ax25->digipeat, type, ax25->modulus);
+	ptr = skb_push(skb, ax25_addr_size(ax25->digipeat));
+	ax25_addr_build(ptr, &ax25->source_addr, &ax25->dest_addr, ax25->digipeat, type, ax25->modulus);
 
-	skb->arp = 1;
+	skb->dev      = ax25->ax25_dev->dev;
+	skb->priority = SOPRI_NORMAL;
 
-	ax25_queue_xmit(skb, ax25->device, SOPRI_NORMAL);
+	ax25_queue_xmit(skb);
 }
 
 /*
- * The following routines are taken from page 170 of the 7th ARRL Computer
- * Networking Conference paper, as is the whole state machine.
+ *	A small shim to dev_queue_xmit to add the KISS control byte, and do
+ *	any packet forwarding in operation.
  */
-
-void ax25_nr_error_recovery(ax25_cb *ax25)
-{
-	ax25_establish_data_link(ax25);
-}
-
-void ax25_establish_data_link(ax25_cb *ax25)
+void ax25_queue_xmit(struct sk_buff *skb)
 {
-	ax25->condition = 0x00;
-	ax25->n2count   = 0;
+	unsigned char *ptr;
 
-	if (ax25->modulus == MODULUS) {
-		ax25_send_control(ax25, SABM, POLLON, C_COMMAND);
-	} else {
-		ax25_send_control(ax25, SABME, POLLON, C_COMMAND);
+	if (call_out_firewall(PF_AX25, skb->dev, skb->data, NULL, &skb) != FW_ACCEPT) {
+		dev_kfree_skb(skb, FREE_WRITE);
+		return;
 	}
-	
-	ax25->t3timer = 0;
-	ax25->t2timer = 0;
-	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
-}
-
-void ax25_transmit_enquiry(ax25_cb *ax25)
-{
-	if (ax25->condition & OWN_RX_BUSY_CONDITION)
-		ax25_send_control(ax25, RNR, POLLON, C_COMMAND);
-	else
-		ax25_send_control(ax25, RR, POLLON, C_COMMAND);
-
-	ax25->condition &= ~ACK_PENDING_CONDITION;
 
-	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
-}
- 	
-void ax25_enquiry_response(ax25_cb *ax25)
-{
-	if (ax25->condition & OWN_RX_BUSY_CONDITION)
-		ax25_send_control(ax25, RNR, POLLON, C_RESPONSE);
-	else
-		ax25_send_control(ax25, RR, POLLON, C_RESPONSE);
-
-	ax25->condition &= ~ACK_PENDING_CONDITION;
-}
+	skb->protocol = htons(ETH_P_AX25);
+	skb->dev      = ax25_fwd_dev(skb->dev);
+	skb->arp      = 1;
 
-void ax25_timeout_response(ax25_cb *ax25)
-{
-	if (ax25->condition & OWN_RX_BUSY_CONDITION)
-		ax25_send_control(ax25, RNR, POLLOFF, C_RESPONSE);
-	else
-		ax25_send_control(ax25, RR, POLLOFF, C_RESPONSE);
+	ptr  = skb_push(skb, 1);
+	*ptr = 0x00;			/* KISS */
 
-	ax25->condition &= ~ACK_PENDING_CONDITION;
+	dev_queue_xmit(skb);
 }
 
 void ax25_check_iframes_acked(ax25_cb *ax25, unsigned short nr)
@@ -355,100 +381,4 @@ void ax25_check_iframes_acked(ax25_cb *ax25, unsigned short nr)
 	}
 }
 
-/*
- *	dl1bke 960114: shouldn't ax25/dama_check_need_response reside as
- *                static inline void ...() in ax25.h, should it? ;-)
- */
-void ax25_check_need_response(ax25_cb *ax25, int type, int pf)
-{
-	if (!ax25->dama_slave && type == C_COMMAND && pf)
-		ax25_enquiry_response(ax25);
-}
-
-/*
- *	dl1bke 960114: transmit I frames on DAMA poll
- */
-void dama_enquiry_response(ax25_cb *ax25)
-{
-	ax25_cb *ax25o;
-	
-	if (!(ax25->condition & PEER_RX_BUSY_CONDITION)) {
-		ax25_requeue_frames(ax25);
-		ax25_kick(ax25);
-	}
-
-	if (ax25->state == AX25_STATE_1 || ax25->state == AX25_STATE_2 ||
-	    skb_peek(&ax25->ack_queue) != NULL) {
-		ax25_t1_timeout(ax25);
-	} else {
-		ax25->n2count = 0;
-	}
-	
-	ax25->t3timer = ax25->t3;
-	
-
-	/* The FLEXNET DAMA master implementation refuses to send us ANY */
-	/* I frame for this connection if we send a REJ here, probably   */
-	/* due to its frame collector scheme? A simple RR or  RNR will   */
-	/* invoke the retransmission, and in fact REJs are superfluous   */
-	/* in DAMA mode anyway...					 */
-	
-#if 0
-	if (ax25->condition & REJECT_CONDITION)
-		ax25_send_control(ax25, REJ, POLLOFF, C_RESPONSE);
-	else
-#endif	
-		ax25_enquiry_response(ax25);
-		
-	/* Note that above response to the poll could be sent behind the  */
-	/* transmissions of the other channels as well... This version    */	
-	/* gives better performance on FLEXNET nodes. (Why, Gunter?)	  */
-
-	for (ax25o = ax25_list; ax25o != NULL; ax25o = ax25o->next) {
-		if (ax25o == ax25)
-			continue;
-
-		if (ax25o->device != ax25->device)
-			continue;
-
-		if (ax25o->state == AX25_STATE_1 || ax25o->state == AX25_STATE_2) {
-			ax25_t1_timeout(ax25o);
-			continue;
-		}
-
-		if (!ax25o->dama_slave)
-			continue;
-			
-		if ( !(ax25o->condition & PEER_RX_BUSY_CONDITION) && 
-		     (ax25o->state == AX25_STATE_3 || 
-		     (ax25o->state == AX25_STATE_4 && ax25o->t1timer == 0))) {
-			ax25_requeue_frames(ax25o);
-			ax25_kick(ax25o);
-		}
-		
-		if (ax25o->state == AX25_STATE_1 || ax25o->state == AX25_STATE_2 ||
-		    skb_peek(&ax25o->ack_queue) != NULL) {
-			ax25_t1_timeout(ax25o);
-		}
-
-		ax25o->t3timer = ax25o->t3;
-	}
-}
-
-void dama_check_need_response(ax25_cb *ax25, int type, int pf)
-{
-	if (ax25->dama_slave && type == C_COMMAND && pf)
-		dama_enquiry_response(ax25);
-}
-
-void dama_establish_data_link(ax25_cb *ax25)
-{
-	ax25->condition = 0x00;
-	ax25->n2count   = 0;
-
-	ax25->t3timer = ax25->t3;
-	ax25->t2timer = 0;
-	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
-}
-
 #endif
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index b4606111e..04a7c8542 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -1,10 +1,10 @@
 /*
- *	AX.25 release 033
+ *	AX.25 release 036
  *
  *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
  *	releases, misbehave and/or generally screw up. It might even work. 
  *
- *	This code REQUIRES 1.2.1 or higher/ NET3.029
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
  *
  *	This module:
  *		This module is free software; you can redistribute it and/or
@@ -39,8 +39,10 @@
  *					on routes.
  *	AX.25 033	Jonathan(G4KLX)	Remove auto-router.
  *			Joerg(DL1BKE)	Moved BPQ Ethernet driver to seperate device.
+ *	AX.25 035	Frederic(F1OAT)	Support for pseudo-digipeating.
+ *			Jonathan(G4KLX)	Support for packet forwarding.
  */
- 
+
 #include <linux/config.h>
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
 #include <linux/errno.h>
@@ -65,22 +67,9 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 
-static struct ax25_route {
-	struct ax25_route *next;
-	ax25_address callsign;
-	struct device *dev;
-	ax25_digi *digipeat;
-	char ip_mode;
-} *ax25_route = NULL;
-
-struct ax25_dev ax25_device[AX25_MAX_DEVICES] = {
-	{"", NULL}, {"", NULL}, {"", NULL}, {"", NULL}, {"", NULL},
-	{"", NULL}, {"", NULL}, {"", NULL}, {"", NULL}, {"", NULL},
-	{"", NULL}, {"", NULL}, {"", NULL}, {"", NULL}, {"", NULL},
-	{"", NULL}, {"", NULL}, {"", NULL}, {"", NULL}, {"", NULL}
-};
+static ax25_route *ax25_route_list = NULL;
 
-static struct ax25_route *ax25_find_route(ax25_address *, struct device *);
+static ax25_route *ax25_find_route(ax25_address *, struct device *);
 
 /*
  * small macro to drop non-digipeated digipeaters and reverse path
@@ -100,28 +89,28 @@ static inline void ax25_route_invert(ax25_digi *in, ax25_digi *out)
 
 void ax25_rt_device_down(struct device *dev)
 {
-	struct ax25_route *s, *t, *ax25_rt = ax25_route;
+	ax25_route *s, *t, *ax25_rt = ax25_route_list;
 	
 	while (ax25_rt != NULL) {
 		s       = ax25_rt;
 		ax25_rt = ax25_rt->next;
 
 		if (s->dev == dev) {
-			if (ax25_route == s) {
-				ax25_route = s->next;
+			if (ax25_route_list == s) {
+				ax25_route_list = s->next;
 				if (s->digipeat != NULL)
-					kfree_s((void *)s->digipeat, sizeof(ax25_digi));
-				kfree_s((void *)s, (sizeof *s));
+					kfree_s(s->digipeat, sizeof(ax25_digi));
+				kfree_s(s, sizeof(ax25_route));
 			} else {
-				for (t = ax25_route; t != NULL; t = t->next) {
+				for (t = ax25_route_list; t != NULL; t = t->next) {
 					if (t->next == s) {
 						t->next = s->next;
 						if (s->digipeat != NULL)
-							kfree_s((void *)s->digipeat, sizeof(ax25_digi));
-						kfree_s((void *)s, sizeof(*s));
+							kfree_s(s->digipeat, sizeof(ax25_digi));
+						kfree_s(s, sizeof(ax25_route));
 						break;
 					}
-				}				
+				}
 			}
 		}
 	}
@@ -130,10 +119,10 @@ void ax25_rt_device_down(struct device *dev)
 int ax25_rt_ioctl(unsigned int cmd, void *arg)
 {
 	unsigned long flags;
-	struct ax25_route *s, *t, *ax25_rt;
+	ax25_route *s, *t, *ax25_rt;
 	struct ax25_routes_struct route;
 	struct ax25_route_opt_struct rt_option;
-	struct device *dev;
+	ax25_dev *ax25_dev;
 	int i, err;
 
 	switch (cmd) {
@@ -141,12 +130,12 @@ int ax25_rt_ioctl(unsigned int cmd, void *arg)
 			if ((err = verify_area(VERIFY_READ, arg, sizeof(route))) != 0)
 				return err;		
 			copy_from_user(&route, arg, sizeof(route));
-			if ((dev = ax25rtr_get_dev(&route.port_addr)) == NULL)
+			if ((ax25_dev = ax25_addr_ax25dev(&route.port_addr)) == NULL)
 				return -EINVAL;
 			if (route.digi_count > AX25_MAX_DIGIS)
 				return -EINVAL;
-			for (ax25_rt = ax25_route; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
-				if (ax25cmp(&ax25_rt->callsign, &route.dest_addr) == 0 && ax25_rt->dev == dev) {
+			for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
+				if (ax25cmp(&ax25_rt->callsign, &route.dest_addr) == 0 && ax25_rt->dev == ax25_dev->dev) {
 					if (ax25_rt->digipeat != NULL) {
 						kfree_s(ax25_rt->digipeat, sizeof(ax25_digi));
 						ax25_rt->digipeat = NULL;
@@ -154,7 +143,7 @@ int ax25_rt_ioctl(unsigned int cmd, void *arg)
 					if (route.digi_count != 0) {
 						if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL)
 							return -ENOMEM;
-						ax25_rt->digipeat->lastrepeat = 0;
+						ax25_rt->digipeat->lastrepeat = -1;
 						ax25_rt->digipeat->ndigi      = route.digi_count;
 						for (i = 0; i < route.digi_count; i++) {
 							ax25_rt->digipeat->repeated[i] = 0;
@@ -164,28 +153,27 @@ int ax25_rt_ioctl(unsigned int cmd, void *arg)
 					return 0;
 				}
 			}
-			if ((ax25_rt = (struct ax25_route *)kmalloc(sizeof(struct ax25_route), GFP_ATOMIC)) == NULL)
+			if ((ax25_rt = kmalloc(sizeof(ax25_route), GFP_ATOMIC)) == NULL)
 				return -ENOMEM;
 			ax25_rt->callsign     = route.dest_addr;
-			ax25_rt->dev          = dev;
+			ax25_rt->dev          = ax25_dev->dev;
 			ax25_rt->digipeat     = NULL;
 			ax25_rt->ip_mode      = ' ';
 			if (route.digi_count != 0) {
 				if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
-					kfree_s(ax25_rt, sizeof(struct ax25_route));
+					kfree_s(ax25_rt, sizeof(ax25_route));
 					return -ENOMEM;
 				}
-				ax25_rt->digipeat->lastrepeat = 0;
+				ax25_rt->digipeat->lastrepeat = -1;
 				ax25_rt->digipeat->ndigi      = route.digi_count;
 				for (i = 0; i < route.digi_count; i++) {
 					ax25_rt->digipeat->repeated[i] = 0;
 					ax25_rt->digipeat->calls[i]    = route.digi_addr[i];
 				}
 			}
-			save_flags(flags);
-			cli();
-			ax25_rt->next = ax25_route;
-			ax25_route    = ax25_rt;
+			save_flags(flags); cli();
+			ax25_rt->next   = ax25_route_list;
+			ax25_route_list = ax25_rt;
 			restore_flags(flags);
 			break;
 
@@ -193,25 +181,25 @@ int ax25_rt_ioctl(unsigned int cmd, void *arg)
 			if ((err = verify_area(VERIFY_READ, arg, sizeof(route))) != 0)
 				return err;
 			copy_from_user(&route, arg, sizeof(route));
-			if ((dev = ax25rtr_get_dev(&route.port_addr)) == NULL)
+			if ((ax25_dev = ax25_addr_ax25dev(&route.port_addr)) == NULL)
 				return -EINVAL;
-			ax25_rt = ax25_route;
+			ax25_rt = ax25_route_list;
 			while (ax25_rt != NULL) {
 				s       = ax25_rt;
 				ax25_rt = ax25_rt->next;
-				if (s->dev == dev && ax25cmp(&route.dest_addr, &s->callsign) == 0) {
-					if (ax25_route == s) {
-						ax25_route = s->next;
+				if (s->dev == ax25_dev->dev && ax25cmp(&route.dest_addr, &s->callsign) == 0) {
+					if (ax25_route_list == s) {
+						ax25_route_list = s->next;
 						if (s->digipeat != NULL)
-							kfree_s((void *)s->digipeat, sizeof(ax25_digi));
-						kfree_s((void *)s, (sizeof *s));
+							kfree_s(s->digipeat, sizeof(ax25_digi));
+						kfree_s(s, sizeof(ax25_route));
 					} else {
-						for (t = ax25_route; t != NULL; t = t->next) {
+						for (t = ax25_route_list; t != NULL; t = t->next) {
 							if (t->next == s) {
 								t->next = s->next;
 								if (s->digipeat != NULL)
-									kfree_s((void *)s->digipeat, sizeof(ax25_digi));
-								kfree_s((void *)s, sizeof(*s));
+									kfree_s(s->digipeat, sizeof(ax25_digi));
+								kfree_s(s, sizeof(ax25_route));
 								break;
 							}
 						}				
@@ -224,10 +212,10 @@ int ax25_rt_ioctl(unsigned int cmd, void *arg)
 			if ((err = verify_area(VERIFY_READ, arg, sizeof(rt_option))) != 0)
 				return err;
 			copy_from_user(&rt_option, arg, sizeof(rt_option));
-			if ((dev = ax25rtr_get_dev(&rt_option.port_addr)) == NULL)
+			if ((ax25_dev = ax25_addr_ax25dev(&rt_option.port_addr)) == NULL)
 				return -EINVAL;
-			for (ax25_rt = ax25_route; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
-				if (ax25_rt->dev == dev && ax25cmp(&rt_option.dest_addr, &ax25_rt->callsign) == 0) {
+			for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
+				if (ax25_rt->dev == ax25_dev->dev && ax25cmp(&rt_option.dest_addr, &ax25_rt->callsign) == 0) {
 					switch (rt_option.cmd) {
 						case AX25_SET_RT_IPMODE:
 							switch (rt_option.arg) {
@@ -256,7 +244,7 @@ int ax25_rt_ioctl(unsigned int cmd, void *arg)
 
 int ax25_rt_get_info(char *buffer, char **start, off_t offset, int length, int dummy)
 {
-	struct ax25_route *ax25_rt;
+	ax25_route *ax25_rt;
 	int len     = 0;
 	off_t pos   = 0;
 	off_t begin = 0;
@@ -267,7 +255,7 @@ int ax25_rt_get_info(char *buffer, char **start, off_t offset, int length, int d
 
 	len += sprintf(buffer, "callsign  dev  mode digipeaters\n");
 
-	for (ax25_rt = ax25_route; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
+	for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
 		if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0)
 			callsign = "default";
 		else
@@ -287,20 +275,20 @@ int ax25_rt_get_info(char *buffer, char **start, off_t offset, int length, int d
 				len += sprintf(buffer + len, "    *");
 				break;
 		}
-		
+
 		if (ax25_rt->digipeat != NULL)
 			for (i = 0; i < ax25_rt->digipeat->ndigi; i++)
 				len += sprintf(buffer + len, " %s", ax2asc(&ax25_rt->digipeat->calls[i]));
-		
+
 		len += sprintf(buffer + len, "\n");
-				
+
 		pos = begin + len;
 
 		if (pos < offset) {
 			len   = 0;
 			begin = pos;
 		}
-		
+
 		if (pos > offset + length)
 			break;
 	}
@@ -315,55 +303,20 @@ int ax25_rt_get_info(char *buffer, char **start, off_t offset, int length, int d
 	return len;
 } 
 
-int ax25_cs_get_info(char *buffer, char **start, off_t offset, int length, int dummy)
-{
-	ax25_uid_assoc *pt;
-	int len     = 0;
-	off_t pos   = 0;
-	off_t begin = 0;
-
-	cli();
-
-	len += sprintf(buffer, "Policy: %d\n", ax25_uid_policy);
-
-	for (pt = ax25_uid_list; pt != NULL; pt = pt->next) {
-		len += sprintf(buffer + len, "%6d %s\n", pt->uid, ax2asc(&pt->call));
-
-		pos = begin + len;
-
-		if (pos < offset) {
-			len = 0;
-			begin = pos;
-		}
-
-		if (pos > offset + length)
-			break;
-	}
-
-	sti();
-
-	*start = buffer + (offset - begin);
-	len   -= offset - begin;
-
-	if (len > length) len = length;
-
-	return len;
-}
-
 /*
  *	Find AX.25 route
  */
-static struct ax25_route *ax25_find_route(ax25_address *addr, struct device *dev)
+static ax25_route *ax25_find_route(ax25_address *addr, struct device *dev)
 {
-	struct ax25_route *ax25_spe_rt = NULL;
-	struct ax25_route *ax25_def_rt = NULL;
-	struct ax25_route *ax25_rt;
-	
+	ax25_route *ax25_spe_rt = NULL;
+	ax25_route *ax25_def_rt = NULL;
+	ax25_route *ax25_rt;
+
 	/*
 	 *	Bind to the physical interface we heard them on, or the default
 	 *	route if none is found;
 	 */
-	for (ax25_rt = ax25_route; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
+	for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
 		if (dev == NULL) {
 			if (ax25cmp(&ax25_rt->callsign, addr) == 0 && ax25_rt->dev != NULL)
 				ax25_spe_rt = ax25_rt;
@@ -379,7 +332,7 @@ static struct ax25_route *ax25_find_route(ax25_address *addr, struct device *dev
 
 	if (ax25_spe_rt != NULL)
 		return ax25_spe_rt;
-		
+
 	return ax25_def_rt;
 }
 
@@ -391,12 +344,12 @@ static struct ax25_route *ax25_find_route(ax25_address *addr, struct device *dev
 static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
 {
 	int k;
-	
+
 	for (k = 0; k < digipeat->ndigi; k++) {
 		if (ax25cmp(addr, &digipeat->calls[k]) == 0)
 			break;
 	}
-	
+
 	digipeat->ndigi = k;
 }
  
@@ -406,18 +359,19 @@ static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
  */
 int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 {
-	struct ax25_route *ax25_rt;
+	ax25_route *ax25_rt;
 	ax25_address *call;
 
 	if ((ax25_rt = ax25_find_route(addr, NULL)) == NULL)
 		return -EHOSTUNREACH;
-		
-	ax25->device = ax25_rt->dev;
+
+	if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL)
+		return -EHOSTUNREACH;
 
 	if ((call = ax25_findbyuid(current->euid)) == NULL) {
 		if (ax25_uid_policy && !suser())
 			return -EPERM;
-		call = (ax25_address *)ax25->device->dev_addr;
+		call = (ax25_address *)ax25->ax25_dev->dev->dev_addr;
 	}
 
 	ax25->source_addr = *call;
@@ -441,25 +395,27 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
  */
 void ax25_rt_build_path(ax25_cb *ax25, ax25_address *addr, struct device *dev)
 {
-	struct ax25_route *ax25_rt;
-	
+	ax25_route *ax25_rt;
+
 	if ((ax25_rt = ax25_find_route(addr, dev)) == NULL)
 		return;
-	
+
 	if (ax25_rt->digipeat == NULL)
 		return;
 
 	if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL)
 		return;
 
-	ax25->device    = ax25_rt->dev;
+	if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL)
+		return;
+
 	*ax25->digipeat = *ax25_rt->digipeat;
 	ax25_adjust_path(addr, ax25->digipeat);
 }
 
 void ax25_dg_build_path(struct sk_buff *skb, ax25_address *addr, struct device *dev)
 {
-	struct ax25_route *ax25_rt;
+	ax25_route *ax25_rt;
 	ax25_digi digipeat;
 	ax25_address src, dest;
 	unsigned char *bp;
@@ -472,24 +428,24 @@ void ax25_dg_build_path(struct sk_buff *skb, ax25_address *addr, struct device *
 
 	if (ax25_rt->digipeat == NULL)
 		return;
-		
+
 	digipeat = *ax25_rt->digipeat;
-	
+
 	ax25_adjust_path(addr, &digipeat);
 
 	len = ax25_rt->digipeat->ndigi * AX25_ADDR_LEN;
-		
+
 	if (skb_headroom(skb) < len) {
 		printk(KERN_CRIT "ax25_dg_build_path: not enough headroom for digis in skb\n");
 		return;
 	}
-	
-	memcpy(&dest, skb->data    , AX25_ADDR_LEN);
+
+	memcpy(&dest, skb->data + 0, AX25_ADDR_LEN);
 	memcpy(&src,  skb->data + 7, AX25_ADDR_LEN);
 
 	bp = skb_push(skb, len);
 
-	build_ax25_addr(bp, &src, &dest, ax25_rt->digipeat, C_COMMAND, MODULUS);
+	ax25_addr_build(bp, &src, &dest, ax25_rt->digipeat, AX25_COMMAND, AX25_MODULUS);
 }
 
 /*
@@ -497,99 +453,24 @@ void ax25_dg_build_path(struct sk_buff *skb, ax25_address *addr, struct device *
  */
 char ax25_ip_mode_get(ax25_address *callsign, struct device *dev)
 {
-	struct ax25_route *ax25_rt;
+	ax25_route *ax25_rt;
 
-	for (ax25_rt = ax25_route; ax25_rt != NULL; ax25_rt = ax25_rt->next)
+	for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next)
 		if (ax25cmp(&ax25_rt->callsign, callsign) == 0 && ax25_rt->dev == dev)
 			return ax25_rt->ip_mode;
 
 	return ' ';
 }
 
-/*
- *	Wow, a bit of data hiding. Is this C++ or what ?
- */
-int ax25_dev_get_value(struct device *dev, int valueno)
-{
-	int i;
-
-	for (i = 0; i < AX25_MAX_DEVICES; i++)
-		if (ax25_device[i].dev != NULL && ax25_device[i].dev == dev)
-			return ax25_device[i].values[valueno];
-	
-	printk(KERN_WARNING "ax25_dev_get_value called with invalid device\n");
-
-	return 0;
-}
-
-/*
- *	This is called when an interface is brought up. These are
- *	reasonable defaults.
- */
-void ax25_dev_device_up(struct device *dev)
-{
-	struct ax25_dev *ax25_dev = NULL;
-	int i;
-	
-	for (i = 0; i < AX25_MAX_DEVICES; i++) {
-		if (ax25_device[i].dev == NULL) {
-			ax25_dev = ax25_device + i;
-			break;
-		}
-	}
-
-	if (ax25_dev == NULL) {
-		printk(KERN_ERR "ax25_dev_device_up cannot find free AX.25 device\n");
-		return;
-	}
-
-	ax25_unregister_sysctl();
-
-	sprintf(ax25_dev->name, "%s.parms", dev->name);
-
-	ax25_dev->dev = dev;
-
-	ax25_dev->values[AX25_VALUES_IPDEFMODE] = AX25_DEF_IPDEFMODE;
-	ax25_dev->values[AX25_VALUES_AXDEFMODE] = AX25_DEF_AXDEFMODE;
-	ax25_dev->values[AX25_VALUES_TEXT]      = AX25_DEF_TEXT;
-	ax25_dev->values[AX25_VALUES_BACKOFF]   = AX25_DEF_BACKOFF;
-	ax25_dev->values[AX25_VALUES_CONMODE]   = AX25_DEF_CONMODE;
-	ax25_dev->values[AX25_VALUES_WINDOW]    = AX25_DEF_WINDOW;
-	ax25_dev->values[AX25_VALUES_EWINDOW]   = AX25_DEF_EWINDOW;
-	ax25_dev->values[AX25_VALUES_T1]        = AX25_DEF_T1;
-	ax25_dev->values[AX25_VALUES_T2]        = AX25_DEF_T2;
-	ax25_dev->values[AX25_VALUES_T3]        = AX25_DEF_T3;
-	ax25_dev->values[AX25_VALUES_IDLE]	= AX25_DEF_IDLE;
-	ax25_dev->values[AX25_VALUES_N2]        = AX25_DEF_N2;
-	ax25_dev->values[AX25_VALUES_DIGI]      = AX25_DEF_DIGI;
-	ax25_dev->values[AX25_VALUES_PACLEN]	= AX25_DEF_PACLEN;
-	ax25_dev->values[AX25_VALUES_MAXQUEUE]	= AX25_DEF_MAXQUEUE;
-
-	ax25_register_sysctl();
-}
-
-void ax25_dev_device_down(struct device *dev)
-{
-	int i;
-
-	ax25_unregister_sysctl();
-
-	for (i = 0; i < AX25_MAX_DEVICES; i++)
-		if (ax25_device[i].dev != NULL && ax25_device[i].dev == dev)
-			ax25_device[i].dev = NULL;
-
-	ax25_register_sysctl();
-}
-      
 #ifdef MODULE
 
 /*
- *    Free all memory associated with routing and device structures.
+ *	Free all memory associated with routing structures.
  */
 void ax25_rt_free(void)
 {
-	struct ax25_route *s, *ax25_rt = ax25_route;
-  
+	ax25_route *s, *ax25_rt = ax25_route_list;
+
 	while (ax25_rt != NULL) {
 		s       = ax25_rt;
 		ax25_rt = ax25_rt->next;
@@ -597,11 +478,10 @@ void ax25_rt_free(void)
 		if (s->digipeat != NULL)
 			kfree_s(s->digipeat, sizeof(ax25_digi));
 
-		kfree_s(s, sizeof(struct ax25_route));
+		kfree_s(s, sizeof(ax25_route));
 	}
 }
 
 #endif
 
 #endif
-            
diff --git a/net/ax25/ax25_std_in.c b/net/ax25/ax25_std_in.c
new file mode 100644
index 000000000..c4b8914d4
--- /dev/null
+++ b/net/ax25/ax25_std_in.c
@@ -0,0 +1,542 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	Most of this code is based on the SDL diagrams published in the 7th
+ *	ARRL Computer Networking Conference papers. The diagrams have mistakes
+ *	in them, but are mostly correct. Before you modify the code could you
+ *	read the SDL diagrams as the code is not obvious and probably very
+ *	easy to break;
+ *
+ *	History
+ *	AX.25 028a	Jonathan(G4KLX)	New state machine based on SDL diagrams.
+ *	AX.25 028b	Jonathan(G4KLX) Extracted AX25 control block from
+ *					the sock structure.
+ *	AX.25 029	Alan(GW4PTS)	Switched to KA9Q constant names.
+ *			Jonathan(G4KLX)	Added IP mode registration.
+ *	AX.25 030	Jonathan(G4KLX)	Added AX.25 fragment reception.
+ *					Upgraded state machine for SABME.
+ *					Added arbitrary protocol id support.
+ *	AX.25 031	Joerg(DL1BKE)	Added DAMA support
+ *			HaJo(DD8NE)	Added Idle Disc Timer T5
+ *			Joerg(DL1BKE)   Renamed it to "IDLE" with a slightly
+ *					different behaviour. Fixed defrag
+ *					routine (I hope)
+ *	AX.25 032	Darryl(G7LED)	AX.25 segmentation fixed.
+ *	AX.25 033	Jonathan(G4KLX)	Remove auto-router.
+ *					Modularisation changes.
+ *	AX.25 035	Hans(PE1AYX)	Fixed interface to IP layer.
+ *	AX.25 036	Jonathan(G4KLX)	Cloned from ax25_in.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <net/ip.h>			/* For ip_rcv */
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+/*
+ *	State machine for state 1, Awaiting Connection State.
+ *	The handling of the timer(s) is in file ax25_std_timer.c.
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_std_state1_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int pf, int type)
+{
+	switch (frametype) {
+		case AX25_SABM:
+			ax25->modulus = AX25_MODULUS;
+			ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_SABME:
+			ax25->modulus = AX25_EMODULUS;
+			ax25->window  = ax25->ax25_dev->values[AX25_VALUES_EWINDOW];
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_DISC:
+			ax25_send_control(ax25, AX25_DM, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_UA:
+			if (pf) {
+				ax25_calculate_rtt(ax25);
+				ax25->t1timer = 0;
+				ax25->t3timer = ax25->t3;
+				ax25->idletimer = ax25->idle;
+				ax25->vs      = 0;
+				ax25->va      = 0;
+				ax25->vr      = 0;
+				ax25->state   = AX25_STATE_3;
+				ax25->n2count = 0;
+				if (ax25->sk != NULL) {
+					ax25->sk->state = TCP_ESTABLISHED;
+					/* For WAIT_SABM connections we will produce an accept ready socket here */
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+				}
+			}
+			break;
+
+		case AX25_DM:
+			if (pf) {
+				if (ax25->modulus == AX25_MODULUS) {
+					ax25_clear_queues(ax25);
+					ax25->state = AX25_STATE_0;
+					if (ax25->sk != NULL) {
+						ax25->sk->state     = TCP_CLOSE;
+						ax25->sk->err       = ECONNREFUSED;
+						ax25->sk->shutdown |= SEND_SHUTDOWN;
+						if (!ax25->sk->dead)
+							ax25->sk->state_change(ax25->sk);
+						ax25->sk->dead      = 1;
+					}
+				} else {
+					ax25->modulus = AX25_MODULUS;
+					ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+				}
+			}
+			break;
+
+		default:
+			break;
+	}
+
+	return 0;
+}
+
+/*
+ *	State machine for state 2, Awaiting Release State.
+ *	The handling of the timer(s) is in file ax25_std_timer.c
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_std_state2_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int pf, int type)
+{
+	switch (frametype) {
+		case AX25_SABM:
+		case AX25_SABME:
+			ax25_send_control(ax25, AX25_DM, pf, AX25_RESPONSE);
+			break;
+
+		case AX25_DISC:
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->state = AX25_STATE_0;
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = 0;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_DM:
+		case AX25_UA:
+			if (pf) {
+				ax25->state = AX25_STATE_0;
+				if (ax25->sk != NULL) {
+					ax25->sk->state     = TCP_CLOSE;
+					ax25->sk->err       = 0;
+					ax25->sk->shutdown |= SEND_SHUTDOWN;
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+					ax25->sk->dead      = 1;
+				}
+			}
+			break;
+
+		case AX25_I:
+		case AX25_REJ:
+		case AX25_RNR:
+		case AX25_RR:
+			if (pf) ax25_send_control(ax25, AX25_DM, AX25_POLLON, AX25_RESPONSE);
+			break;
+
+		default:
+			break;
+	}
+
+	return 0;
+}
+
+/*
+ *	State machine for state 3, Connected State.
+ *	The handling of the timer(s) is in file ax25_std_timer.c
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_std_state3_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int ns, int nr, int pf, int type)
+{
+	int queued = 0;
+
+	switch (frametype) {
+		case AX25_SABM:
+		case AX25_SABME:
+			if (frametype == AX25_SABM) {
+				ax25->modulus = AX25_MODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+			} else {
+				ax25->modulus = AX25_EMODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_EWINDOW];
+			}
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->condition = 0x00;
+			ax25->t1timer   = 0;
+			ax25->t3timer   = ax25->t3;
+			ax25->idletimer = ax25->idle;
+			ax25->vs        = 0;
+			ax25->va        = 0;
+			ax25->vr        = 0;
+			ax25_requeue_frames(ax25);
+			break;
+
+		case AX25_DISC:
+			ax25_clear_queues(ax25);
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = 0;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_DM:
+			ax25_clear_queues(ax25);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = ECONNRESET;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_RR:
+		case AX25_RNR:
+			if (frametype == AX25_RR)
+				ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			else
+				ax25->condition |= AX25_COND_PEER_RX_BUSY;
+			if (type == AX25_COMMAND && pf)
+				ax25_std_enquiry_response(ax25);
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_check_iframes_acked(ax25, nr);
+			} else {
+				ax25_std_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_REJ:
+			ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			if (type == AX25_COMMAND && pf)
+				ax25_std_enquiry_response(ax25);
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_frames_acked(ax25, nr);
+				ax25_calculate_rtt(ax25);
+				ax25->t1timer = 0;
+				ax25->t3timer = ax25->t3;
+				ax25_requeue_frames(ax25);
+			} else {
+				ax25_std_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_I:
+			if (!ax25_validate_nr(ax25, nr)) {
+				ax25_std_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+				break;
+			}
+			if (ax25->condition & AX25_COND_PEER_RX_BUSY) {
+				ax25_frames_acked(ax25, nr);
+			} else {
+				ax25_check_iframes_acked(ax25, nr);
+			}
+			if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+				if (pf) ax25_std_enquiry_response(ax25);
+				break;
+			}
+			if (ns == ax25->vr) {
+				ax25->vr = (ax25->vr + 1) % ax25->modulus;
+				queued = ax25_rx_iframe(ax25, skb);
+				if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+					ax25->vr = ns;	/* ax25->vr - 1 */
+					if (pf) ax25_std_enquiry_response(ax25);
+					break;
+				}
+				ax25->condition &= ~AX25_COND_REJECT;
+				if (pf) {
+					ax25_std_enquiry_response(ax25);
+				} else {
+					if (!(ax25->condition & AX25_COND_ACK_PENDING)) {
+						ax25->t2timer = ax25->t2;
+						ax25->condition |= AX25_COND_ACK_PENDING;
+					}
+				}
+			} else {
+				if (ax25->condition & AX25_COND_REJECT) {
+					if (pf) ax25_std_enquiry_response(ax25);
+				} else {
+					ax25->condition |= AX25_COND_REJECT;
+					ax25_send_control(ax25, AX25_REJ, pf, AX25_RESPONSE);
+					ax25->condition &= ~AX25_COND_ACK_PENDING;
+				}
+			}
+			break;
+
+		case AX25_FRMR:
+		case AX25_ILLEGAL:
+			ax25_std_establish_data_link(ax25);
+			ax25->state = AX25_STATE_1;
+			break;
+
+		default:
+			break;
+	}
+
+	return queued;
+}
+
+/*
+ *	State machine for state 4, Timer Recovery State.
+ *	The handling of the timer(s) is in file ax25_std_timer.c
+ *	Handling of state 0 and connection release is in ax25.c.
+ */
+static int ax25_std_state4_machine(ax25_cb *ax25, struct sk_buff *skb, int frametype, int ns, int nr, int pf, int type)
+{
+	int queued = 0;
+
+	switch (frametype) {
+		case AX25_SABM:
+		case AX25_SABME:
+			if (frametype == AX25_SABM) {
+				ax25->modulus = AX25_MODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+			} else {
+				ax25->modulus = AX25_EMODULUS;
+				ax25->window  = ax25->ax25_dev->values[AX25_VALUES_EWINDOW];
+			}
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->condition = 0x00;
+			ax25->t1timer   = 0;
+			ax25->t3timer   = ax25->t3;
+			ax25->idletimer = ax25->idle;
+			ax25->vs        = 0;
+			ax25->va        = 0;
+			ax25->vr        = 0;
+			ax25->state     = AX25_STATE_3;
+			ax25->n2count   = 0;
+			ax25_requeue_frames(ax25);
+			break;
+
+		case AX25_DISC:
+			ax25_clear_queues(ax25);
+			ax25_send_control(ax25, AX25_UA, pf, AX25_RESPONSE);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = 0;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_DM:
+			ax25_clear_queues(ax25);
+			ax25->t3timer = 0;
+			ax25->state   = AX25_STATE_0;
+			if (ax25->sk != NULL) {
+				ax25->sk->state     = TCP_CLOSE;
+				ax25->sk->err       = ECONNRESET;
+				ax25->sk->shutdown |= SEND_SHUTDOWN;
+				if (!ax25->sk->dead)
+					ax25->sk->state_change(ax25->sk);
+				ax25->sk->dead      = 1;
+			}
+			break;
+
+		case AX25_RR:
+		case AX25_RNR:
+			if (frametype == AX25_RR)
+				ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			else
+				ax25->condition |= AX25_COND_PEER_RX_BUSY;
+			if (type == AX25_RESPONSE && pf) {
+				ax25->t1timer = 0;
+				if (ax25_validate_nr(ax25, nr)) {
+					ax25_frames_acked(ax25, nr);
+					if (ax25->vs == ax25->va) {
+						ax25->t3timer = ax25->t3;
+						ax25->n2count = 0;
+						ax25->state   = AX25_STATE_3;
+					} else {
+						ax25_requeue_frames(ax25);
+					}
+				} else {
+					ax25_std_nr_error_recovery(ax25);
+					ax25->state = AX25_STATE_1;
+				}
+				break;
+			}
+			if (type == AX25_COMMAND && pf)
+				ax25_std_enquiry_response(ax25);
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_frames_acked(ax25, nr);
+			} else {
+				ax25_std_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_REJ:
+			ax25->condition &= ~AX25_COND_PEER_RX_BUSY;
+			if (pf && type == AX25_RESPONSE) {
+				ax25->t1timer = 0;
+				if (ax25_validate_nr(ax25, nr)) {
+					ax25_frames_acked(ax25, nr);
+					if (ax25->vs == ax25->va) {
+						ax25->t3timer = ax25->t3;
+						ax25->n2count = 0;
+						ax25->state   = AX25_STATE_3;
+					} else {
+						ax25_requeue_frames(ax25);
+					}
+				} else {
+					ax25_std_nr_error_recovery(ax25);
+					ax25->state = AX25_STATE_1;
+				}
+				break;
+			}
+			if (type == AX25_COMMAND && pf)
+				ax25_std_enquiry_response(ax25);
+			if (ax25_validate_nr(ax25, nr)) {
+				ax25_frames_acked(ax25, nr);
+				ax25_requeue_frames(ax25);
+			} else {
+				ax25_std_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+			}
+			break;
+
+		case AX25_I:
+			if (!ax25_validate_nr(ax25, nr)) {
+				ax25_std_nr_error_recovery(ax25);
+				ax25->state = AX25_STATE_1;
+				break;
+			}
+			ax25_frames_acked(ax25, nr);
+			if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+				if (pf) ax25_std_enquiry_response(ax25);
+				break;
+			}
+			if (ns == ax25->vr) {
+				ax25->vr = (ax25->vr + 1) % ax25->modulus;
+				queued = ax25_rx_iframe(ax25, skb);
+				if (ax25->condition & AX25_COND_OWN_RX_BUSY) {
+					ax25->vr = ns;	/* ax25->vr - 1 */
+					if (pf) ax25_std_enquiry_response(ax25);
+					break;
+				}
+				ax25->condition &= ~AX25_COND_REJECT;
+				if (pf) {
+					ax25_std_enquiry_response(ax25);
+				} else {
+					if (!(ax25->condition & AX25_COND_ACK_PENDING)) {
+						ax25->t2timer = ax25->t2;
+						ax25->condition |= AX25_COND_ACK_PENDING;
+					}
+				}
+			} else {
+				if (ax25->condition & AX25_COND_REJECT) {
+					if (pf) ax25_std_enquiry_response(ax25);
+				} else {
+					ax25->condition |= AX25_COND_REJECT;
+					ax25_send_control(ax25, AX25_REJ, pf, AX25_RESPONSE);
+					ax25->condition &= ~AX25_COND_ACK_PENDING;
+				}
+			}
+			break;
+
+		case AX25_FRMR:
+		case AX25_ILLEGAL:
+			ax25_std_establish_data_link(ax25);
+			ax25->state = AX25_STATE_1;
+			break;
+
+		default:
+			break;
+	}
+
+	return queued;
+}
+
+/*
+ *	Higher level upcall for a LAPB frame
+ */
+int ax25_std_frame_in(ax25_cb *ax25, struct sk_buff *skb, int type)
+{
+	int queued = 0, frametype, ns, nr, pf;
+
+	frametype = ax25_decode(ax25, skb, &ns, &nr, &pf);
+
+	switch (ax25->state) {
+		case AX25_STATE_1:
+			queued = ax25_std_state1_machine(ax25, skb, frametype, pf, type);
+			break;
+		case AX25_STATE_2:
+			queued = ax25_std_state2_machine(ax25, skb, frametype, pf, type);
+			break;
+		case AX25_STATE_3:
+			queued = ax25_std_state3_machine(ax25, skb, frametype, ns, nr, pf, type);
+			break;
+		case AX25_STATE_4:
+			queued = ax25_std_state4_machine(ax25, skb, frametype, ns, nr, pf, type);
+			break;
+	}
+
+	return queued;
+}
+
+#endif
diff --git a/net/ax25/ax25_std_subr.c b/net/ax25/ax25_std_subr.c
new file mode 100644
index 000000000..46688e3c0
--- /dev/null
+++ b/net/ax25/ax25_std_subr.c
@@ -0,0 +1,105 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	Most of this code is based on the SDL diagrams published in the 7th
+ *	ARRL Computer Networking Conference papers. The diagrams have mistakes
+ *	in them, but are mostly correct. Before you modify the code could you
+ *	read the SDL diagrams as the code is not obvious and probably very
+ *	easy to break;
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Split from ax25_out.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+/*
+ * The following routines are taken from page 170 of the 7th ARRL Computer
+ * Networking Conference paper, as is the whole state machine.
+ */
+
+void ax25_std_nr_error_recovery(ax25_cb *ax25)
+{
+	ax25_std_establish_data_link(ax25);
+}
+
+void ax25_std_establish_data_link(ax25_cb *ax25)
+{
+	ax25->condition = 0x00;
+	ax25->n2count   = 0;
+
+	if (ax25->modulus == AX25_MODULUS)
+		ax25_send_control(ax25, AX25_SABM, AX25_POLLON, AX25_COMMAND);
+	else
+		ax25_send_control(ax25, AX25_SABME, AX25_POLLON, AX25_COMMAND);
+
+	ax25->t3timer = 0;
+	ax25->t2timer = 0;
+	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+}
+
+void ax25_std_transmit_enquiry(ax25_cb *ax25)
+{
+	if (ax25->condition & AX25_COND_OWN_RX_BUSY)
+		ax25_send_control(ax25, AX25_RNR, AX25_POLLON, AX25_COMMAND);
+	else
+		ax25_send_control(ax25, AX25_RR, AX25_POLLON, AX25_COMMAND);
+
+	ax25->condition &= ~AX25_COND_ACK_PENDING;
+
+	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+}
+ 	
+void ax25_std_enquiry_response(ax25_cb *ax25)
+{
+	if (ax25->condition & AX25_COND_OWN_RX_BUSY)
+		ax25_send_control(ax25, AX25_RNR, AX25_POLLON, AX25_RESPONSE);
+	else
+		ax25_send_control(ax25, AX25_RR, AX25_POLLON, AX25_RESPONSE);
+
+	ax25->condition &= ~AX25_COND_ACK_PENDING;
+}
+
+void ax25_std_timeout_response(ax25_cb *ax25)
+{
+	if (ax25->condition & AX25_COND_OWN_RX_BUSY)
+		ax25_send_control(ax25, AX25_RNR, AX25_POLLOFF, AX25_RESPONSE);
+	else
+		ax25_send_control(ax25, AX25_RR, AX25_POLLOFF, AX25_RESPONSE);
+
+	ax25->condition &= ~AX25_COND_ACK_PENDING;
+}
+
+#endif
diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
new file mode 100644
index 000000000..5f73caf7b
--- /dev/null
+++ b/net/ax25/ax25_std_timer.c
@@ -0,0 +1,218 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
+ *	releases, misbehave and/or generally screw up. It might even work. 
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	History
+ *	AX.25 028a	Jonathan(G4KLX)	New state machine based on SDL diagrams.
+ *	AX.25 028b	Jonathan(G4KLX)	Extracted AX25 control block from the
+ *					sock structure.
+ *	AX.25 029	Alan(GW4PTS)	Switched to KA9Q constant names.
+ *	AX.25 031	Joerg(DL1BKE)	Added DAMA support
+ *	AX.25 032	Joerg(DL1BKE)	Fixed DAMA timeout bug
+ *	AX.25 033	Jonathan(G4KLX)	Modularisation functions.
+ *	AX.25 035	Frederic(F1OAT)	Support for pseudo-digipeating.
+ *	AX.25 036	Jonathan(G4KLX)	Split from ax25_timer.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+
+void ax25_std_timer(ax25_cb *ax25)
+{
+	switch (ax25->state) {
+		case AX25_STATE_0:
+			/* Magic here: If we listen() and a new link dies before it
+			   is accepted() it isn't 'dead' so doesn't get removed. */
+			if (ax25->sk == NULL || ax25->sk->destroy || (ax25->sk->state == TCP_LISTEN && ax25->sk->dead)) {
+				del_timer(&ax25->timer);
+				ax25_destroy_socket(ax25);
+				return;
+			}
+			break;
+
+		case AX25_STATE_3:
+		case AX25_STATE_4:
+			/*
+			 * Check the state of the receive buffer.
+			 */
+			if (ax25->sk != NULL) {
+				if (atomic_read(&ax25->sk->rmem_alloc) < (ax25->sk->rcvbuf / 2) &&
+				    (ax25->condition & AX25_COND_OWN_RX_BUSY)) {
+					ax25->condition &= ~AX25_COND_OWN_RX_BUSY;
+					ax25->condition &= ~AX25_COND_ACK_PENDING;
+					ax25_send_control(ax25, AX25_RR, AX25_POLLOFF, AX25_RESPONSE);
+					break;
+				}
+			}
+			/*
+			 * Check for frames to transmit.
+			 */
+			ax25_kick(ax25);
+			break;
+
+		default:
+			break;
+	}
+
+	if (ax25->t2timer > 0 && --ax25->t2timer == 0) {
+		if (ax25->state == AX25_STATE_3 || ax25->state == AX25_STATE_4) {
+			if (ax25->condition & AX25_COND_ACK_PENDING) {
+				ax25->condition &= ~AX25_COND_ACK_PENDING;
+				ax25_std_timeout_response(ax25);
+			}
+		}
+	}
+
+	if (ax25->t3timer > 0 && --ax25->t3timer == 0) {
+		if (ax25->state == AX25_STATE_3) {
+			ax25->n2count = 0;
+			ax25_std_transmit_enquiry(ax25);
+			ax25->state   = AX25_STATE_4;
+		}
+		ax25->t3timer = ax25->t3;
+	}
+
+	if (ax25->idletimer > 0 && --ax25->idletimer == 0) {
+		/* dl1bke 960228: close the connection when IDLE expires */
+		/* 		  similar to DAMA T3 timeout but with    */
+		/* 		  a "clean" disconnect of the connection */
+
+		ax25_clear_queues(ax25);
+
+		ax25->n2count = 0;
+		ax25->t3timer = 0;
+		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+		ax25->state   = AX25_STATE_2;
+		ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+
+		if (ax25->sk != NULL) {
+			ax25->sk->state     = TCP_CLOSE;
+			ax25->sk->err       = 0;
+			ax25->sk->shutdown |= SEND_SHUTDOWN;
+			if (!ax25->sk->dead)
+				ax25->sk->state_change(ax25->sk);
+			ax25->sk->dead      = 1;
+			ax25->sk->destroy   = 1;
+		}
+	}
+
+	if (ax25->t1timer == 0 || --ax25->t1timer > 0) {
+		ax25_set_timer(ax25);
+		return;
+	}
+
+	switch (ax25->state) {
+		case AX25_STATE_1: 
+			if (ax25->n2count == ax25->n2) {
+				if (ax25->modulus == AX25_MODULUS) {
+					ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+					ax25_clear_queues(ax25);
+					ax25->state = AX25_STATE_0;
+					if (ax25->sk != NULL) {
+						ax25->sk->state     = TCP_CLOSE;
+						ax25->sk->err       = ETIMEDOUT;
+						ax25->sk->shutdown |= SEND_SHUTDOWN;
+						if (!ax25->sk->dead)
+							ax25->sk->state_change(ax25->sk);
+						ax25->sk->dead      = 1;
+					}
+				} else {
+					ax25->modulus = AX25_MODULUS;
+					ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
+					ax25->n2count = 0;
+					ax25_send_control(ax25, AX25_SABM, AX25_POLLON, AX25_COMMAND);
+				}
+			} else {
+				ax25->n2count++;
+				if (ax25->modulus == AX25_MODULUS)
+					ax25_send_control(ax25, AX25_SABM, AX25_POLLON, AX25_COMMAND);
+				else
+					ax25_send_control(ax25, AX25_SABME, AX25_POLLON, AX25_COMMAND);
+			}
+			break;
+
+		case AX25_STATE_2:
+			if (ax25->n2count == ax25->n2) {
+				ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+				ax25_clear_queues(ax25);
+				ax25->state = AX25_STATE_0;
+				ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+
+				if (ax25->sk != NULL) {
+					ax25->sk->state     = TCP_CLOSE;
+					ax25->sk->err       = ETIMEDOUT;
+					ax25->sk->shutdown |= SEND_SHUTDOWN;
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+					ax25->sk->dead      = 1;
+				}
+			} else {
+				ax25->n2count++;
+				ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
+			}
+			break;
+
+		case AX25_STATE_3: 
+			ax25->n2count = 1;
+			ax25_std_transmit_enquiry(ax25);
+			ax25->state   = AX25_STATE_4;
+			break;
+
+		case AX25_STATE_4:
+			if (ax25->n2count == ax25->n2) {
+				ax25_link_failed(&ax25->dest_addr, ax25->ax25_dev->dev);
+				ax25_clear_queues(ax25);
+				ax25_send_control(ax25, AX25_DM, AX25_POLLON, AX25_RESPONSE);
+				ax25->state = AX25_STATE_0;
+				if (ax25->sk != NULL) {
+					SOCK_DEBUG(ax25->sk, "AX.25 link Failure\n");
+					ax25->sk->state     = TCP_CLOSE;
+					ax25->sk->err       = ETIMEDOUT;
+					ax25->sk->shutdown |= SEND_SHUTDOWN;
+					if (!ax25->sk->dead)
+						ax25->sk->state_change(ax25->sk);
+					ax25->sk->dead      = 1;
+				}
+			} else {
+				ax25->n2count++;
+				ax25_std_transmit_enquiry(ax25);
+			}
+			break;
+	}
+
+	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
+
+	ax25_set_timer(ax25);
+}
+
+#endif
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 071043d1e..59e464c1c 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -1,10 +1,10 @@
 /*
- *	AX.25 release 033
+ *	AX.25 release 036
  *
  *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
  *	releases, misbehave and/or generally screw up. It might even work. 
  *
- *	This code REQUIRES 1.3.61 or higher/ NET3.029
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
  *
  *	This module:
  *		This module is free software; you can redistribute it and/or
@@ -32,6 +32,7 @@
  *			Joerg(DL1BKE)	Found the real bug in ax25.h, sri.
  *	AX.25 032	Joerg(DL1BKE)	Added ax25_queue_length to count the number of
  *					enqueued buffers of a socket..
+ *	AX.25 035	Frederic(F1OAT)	Support for pseudo-digipeating.
  */
 
 #include <linux/config.h>
@@ -64,23 +65,17 @@ void ax25_clear_queues(ax25_cb *ax25)
 {
 	struct sk_buff *skb;
 
-	while ((skb = skb_dequeue(&ax25->write_queue)) != NULL) {
-		skb->free = 1;
+	while ((skb = skb_dequeue(&ax25->write_queue)) != NULL)
 		kfree_skb(skb, FREE_WRITE);
-	}
 
-	while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
-		skb->free = 1;
+	while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL)
 		kfree_skb(skb, FREE_WRITE);
-	}
 
-	while ((skb = skb_dequeue(&ax25->reseq_queue)) != NULL) {
+	while ((skb = skb_dequeue(&ax25->reseq_queue)) != NULL)
 		kfree_skb(skb, FREE_READ);
-	}
 
-	while ((skb = skb_dequeue(&ax25->frag_queue)) != NULL) {
+	while ((skb = skb_dequeue(&ax25->frag_queue)) != NULL)
 		kfree_skb(skb, FREE_READ);
-	}
 }
 
 /*
@@ -98,19 +93,12 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
 	if (ax25->va != nr) {
 		while (skb_peek(&ax25->ack_queue) != NULL && ax25->va != nr) {
 		        skb = skb_dequeue(&ax25->ack_queue);
-			skb->free = 1;
 			kfree_skb(skb, FREE_WRITE);
 			ax25->va = (ax25->va + 1) % ax25->modulus;
-			if (ax25->dama_slave)
-				ax25->n2count = 0;
 		}
 	}
 }
 
-/* Maybe this should be your ax25_invoke_retransmission(), which appears
- * to be used but not do anything.  ax25_invoke_retransmission() used to
- * be in AX 0.29, but has now gone in 0.30.
- */
 void ax25_requeue_frames(ax25_cb *ax25)
 {
         struct sk_buff *skb, *skb_prev = NULL;
@@ -141,7 +129,7 @@ int ax25_validate_nr(ax25_cb *ax25, unsigned short nr)
 		if (nr == vc) return 1;
 		vc = (vc + 1) % ax25->modulus;
 	}
-	
+
 	if (nr == ax25->vs) return 1;
 
 	return 0;
@@ -154,41 +142,41 @@ int ax25_validate_nr(ax25_cb *ax25, unsigned short nr)
 int ax25_decode(ax25_cb *ax25, struct sk_buff *skb, int *ns, int *nr, int *pf)
 {
 	unsigned char *frame;
-	int frametype = ILLEGAL;
+	int frametype = AX25_ILLEGAL;
 
 	frame = skb->data;
 	*ns = *nr = *pf = 0;
 
-	if (ax25->modulus == MODULUS) {
-		if ((frame[0] & S) == 0) {
-			frametype = I;			/* I frame - carries NR/NS/PF */
+	if (ax25->modulus == AX25_MODULUS) {
+		if ((frame[0] & AX25_S) == 0) {
+			frametype = AX25_I;			/* I frame - carries NR/NS/PF */
 			*ns = (frame[0] >> 1) & 0x07;
 			*nr = (frame[0] >> 5) & 0x07;
-			*pf = frame[0] & PF;
-		} else if ((frame[0] & U) == 1) { 	/* S frame - take out PF/NR */
+			*pf = frame[0] & AX25_PF;
+		} else if ((frame[0] & AX25_U) == 1) { 	/* S frame - take out PF/NR */
 			frametype = frame[0] & 0x0F;
 			*nr = (frame[0] >> 5) & 0x07;
-			*pf = frame[0] & PF;
-		} else if ((frame[0] & U) == 3) { 	/* U frame - take out PF */
-			frametype = frame[0] & ~PF;
-			*pf = frame[0] & PF;
+			*pf = frame[0] & AX25_PF;
+		} else if ((frame[0] & AX25_U) == 3) { 	/* U frame - take out PF */
+			frametype = frame[0] & ~AX25_PF;
+			*pf = frame[0] & AX25_PF;
 		}
 		skb_pull(skb, 1);
 	} else {
-		if ((frame[0] & S) == 0) {
-			frametype = I;			/* I frame - carries NR/NS/PF */
+		if ((frame[0] & AX25_S) == 0) {
+			frametype = AX25_I;			/* I frame - carries NR/NS/PF */
 			*ns = (frame[0] >> 1) & 0x7F;
 			*nr = (frame[1] >> 1) & 0x7F;
-			*pf = frame[1] & EPF;
+			*pf = frame[1] & AX25_EPF;
 			skb_pull(skb, 2);
-		} else if ((frame[0] & U) == 1) { 	/* S frame - take out PF/NR */
+		} else if ((frame[0] & AX25_U) == 1) { 	/* S frame - take out PF/NR */
 			frametype = frame[0] & 0x0F;
 			*nr = (frame[1] >> 1) & 0x7F;
-			*pf = frame[1] & EPF;
+			*pf = frame[1] & AX25_EPF;
 			skb_pull(skb, 2);
-		} else if ((frame[0] & U) == 3) { 	/* U frame - take out PF */
-			frametype = frame[0] & ~PF;
-			*pf = frame[0] & PF;
+		} else if ((frame[0] & AX25_U) == 3) { 	/* U frame - take out PF */
+			frametype = frame[0] & ~AX25_PF;
+			*pf = frame[0] & AX25_PF;
 			skb_pull(skb, 1);
 		}
 	}
@@ -205,43 +193,32 @@ void ax25_send_control(ax25_cb *ax25, int frametype, int poll_bit, int type)
 {
 	struct sk_buff *skb;
 	unsigned char  *dptr;
-	struct device *dev;
-	
-	if ((dev = ax25->device) == NULL)
-		return;	/* Route died */
 
-	if ((skb = alloc_skb(AX25_BPQ_HEADER_LEN + size_ax25_addr(ax25->digipeat) + 2, GFP_ATOMIC)) == NULL)
+	if ((skb = alloc_skb(AX25_BPQ_HEADER_LEN + ax25_addr_size(ax25->digipeat) + 2, GFP_ATOMIC)) == NULL)
 		return;
 
-	skb_reserve(skb, AX25_BPQ_HEADER_LEN + size_ax25_addr(ax25->digipeat));
-
-	if (ax25->sk != NULL) {
-		skb->sk = ax25->sk;
-		atomic_add(skb->truesize, &ax25->sk->wmem_alloc);
-	}
+	skb_reserve(skb, AX25_BPQ_HEADER_LEN + ax25_addr_size(ax25->digipeat));
 
 	/* Assume a response - address structure for DTE */
-	if (ax25->modulus == MODULUS) {
+	if (ax25->modulus == AX25_MODULUS) {
 		dptr = skb_put(skb, 1);
 		*dptr = frametype;
-		*dptr |= (poll_bit) ? PF : 0;
-		if ((frametype & U) == S)		/* S frames carry NR */
+		*dptr |= (poll_bit) ? AX25_PF : 0;
+		if ((frametype & AX25_U) == AX25_S)		/* S frames carry NR */
 			*dptr |= (ax25->vr << 5);
 	} else {
-		if ((frametype & U) == U) {
+		if ((frametype & AX25_U) == AX25_U) {
 			dptr = skb_put(skb, 1);
 			*dptr = frametype;
-			*dptr |= (poll_bit) ? PF : 0;
+			*dptr |= (poll_bit) ? AX25_PF : 0;
 		} else {
 			dptr = skb_put(skb, 2);
 			dptr[0] = frametype;
 			dptr[1] = (ax25->vr << 1);
-			dptr[1] |= (poll_bit) ? EPF : 0;
+			dptr[1] |= (poll_bit) ? AX25_EPF : 0;
 		}
 	}
 
-	skb->free = 1;
-
 	ax25_transmit_buffer(ax25, skb, type);
 }
 
@@ -259,29 +236,27 @@ void ax25_return_dm(struct device *dev, ax25_address *src, ax25_address *dest, a
 	if (dev == NULL)
 		return;
 
-	if ((skb = alloc_skb(AX25_BPQ_HEADER_LEN + size_ax25_addr(digi) + 1, GFP_ATOMIC)) == NULL)
+	if ((skb = alloc_skb(AX25_BPQ_HEADER_LEN + ax25_addr_size(digi) + 1, GFP_ATOMIC)) == NULL)
 		return;	/* Next SABM will get DM'd */
 
-	skb_reserve(skb, AX25_BPQ_HEADER_LEN + size_ax25_addr(digi));
+	skb_reserve(skb, AX25_BPQ_HEADER_LEN + ax25_addr_size(digi));
 
 	ax25_digi_invert(digi, &retdigi);
 
 	dptr = skb_put(skb, 1);
-	skb->sk = NULL;
 
-	*dptr = DM | PF;
+	*dptr = AX25_DM | AX25_PF;
 
 	/*
 	 *	Do the address ourselves
 	 */
+	dptr  = skb_push(skb, ax25_addr_size(digi));
+	dptr += ax25_addr_build(dptr, dest, src, &retdigi, AX25_RESPONSE, AX25_MODULUS);
 
-	dptr  = skb_push(skb, size_ax25_addr(digi));
-	dptr += build_ax25_addr(dptr, dest, src, &retdigi, C_RESPONSE, MODULUS);
+	skb->dev      = dev;
+	skb->priority = SOPRI_NORMAL;
 
-	skb->arp  = 1;
-	skb->free = 1;
-
-	ax25_queue_xmit(skb, dev, SOPRI_NORMAL);
+	ax25_queue_xmit(skb);
 }
 
 /*
@@ -291,11 +266,19 @@ unsigned short ax25_calculate_t1(ax25_cb *ax25)
 {
 	int n, t = 2;
 
-	if (ax25->backoff) {
-		for (n = 0; n < ax25->n2count; n++)
-			t *= 2;
+	switch (ax25->backoff) {
+		case 0:
+			break;
+
+		case 1:
+			t += 2 * ax25->n2count;
+			break;
 
-		if (t > 8) t = 8;
+		case 2:
+			for (n = 0; n < ax25->n2count; n++)
+				t *= 2;
+			if (t > 8) t = 8;
+			break;
 	}
 
 	return t * ax25->rtt;
@@ -309,266 +292,11 @@ void ax25_calculate_rtt(ax25_cb *ax25)
 	if (ax25->t1timer > 0 && ax25->n2count == 0)
 		ax25->rtt = (9 * ax25->rtt + ax25->t1 - ax25->t1timer) / 10;
 
-#ifdef	AX25_T1CLAMPLO
-	/* Don't go below one tenth of a second */
-	if (ax25->rtt < (AX25_T1CLAMPLO))
-		ax25->rtt = (AX25_T1CLAMPLO);
-#else	/* Failsafe - some people might have sub 1/10th RTTs :-) **/
-	if (ax25->rtt == 0)
-		ax25->rtt = PR_SLOWHZ;
-#endif
-#ifdef	AX25_T1CLAMPHI
-	/* OR above clamped seconds **/
-	if (ax25->rtt > (AX25_T1CLAMPHI))
-		ax25->rtt = (AX25_T1CLAMPHI);
-#endif
-}
-
-/*
- *	Digipeated address processing
- */
- 
-
-/*
- *	Given an AX.25 address pull of to, from, digi list, command/response and the start of data
- *
- */
-unsigned char *ax25_parse_addr(unsigned char *buf, int len, ax25_address *src, ax25_address *dest, ax25_digi *digi, int *flags, int *dama)
-{
-	int d = 0;
-	
-	if (len < 14) return NULL;
-		
-	if (flags != NULL) {
-		*flags = 0;
-	
-		if (buf[6] & LAPB_C) {
-			*flags = C_COMMAND;
-		}
-		if (buf[13] & LAPB_C) {
-			*flags = C_RESPONSE;
-		}
-	}
-		
-	if (dama != NULL) 
-		*dama = ~buf[13] & DAMA_FLAG;
-		
-	/* Copy to, from */
-	if (dest != NULL) 
-		memcpy(dest, buf + 0, AX25_ADDR_LEN);
-	if (src != NULL)  
-		memcpy(src,  buf + 7, AX25_ADDR_LEN);
-	buf += 2 * AX25_ADDR_LEN;
-	len -= 2 * AX25_ADDR_LEN;
-	digi->lastrepeat = -1;
-	digi->ndigi      = 0;
-	
-	while (!(buf[-1] & LAPB_E)) {
-		if (d >= AX25_MAX_DIGIS)  return NULL;	/* Max of 6 digis */
-		if (len < 7) return NULL;	/* Short packet */
-
-		if (digi != NULL) {
-			memcpy(&digi->calls[d], buf, AX25_ADDR_LEN);
-			digi->ndigi = d + 1;
-			if (buf[6] & AX25_REPEATED) {
-				digi->repeated[d] = 1;
-				digi->lastrepeat  = d;
-			} else {
-				digi->repeated[d] = 0;
-			}
-		}
-
-		buf += AX25_ADDR_LEN;
-		len -= AX25_ADDR_LEN;
-		d++;
-	}
-
-	return buf;
-}
-
-/*
- *	Assemble an AX.25 header from the bits
- */
-int build_ax25_addr(unsigned char *buf, ax25_address *src, ax25_address *dest, ax25_digi *d, int flag, int modulus)
-{
-	int len = 0;
-	int ct  = 0;
-
-	memcpy(buf, dest, AX25_ADDR_LEN);
-	buf[6] &= ~(LAPB_E | LAPB_C);
-	buf[6] |= SSSID_SPARE;
-
-	if (flag == C_COMMAND) buf[6] |= LAPB_C;
-
-	buf += AX25_ADDR_LEN;
-	len += AX25_ADDR_LEN;
-
-	memcpy(buf, src, AX25_ADDR_LEN);
-	buf[6] &= ~(LAPB_E | LAPB_C);
-	buf[6] &= ~SSSID_SPARE;
-
-	if (modulus == MODULUS) {
-		buf[6] |= SSSID_SPARE;
-	} else {
-		buf[6] |= ESSID_SPARE;
-	}
-
-	if (flag == C_RESPONSE) buf[6] |= LAPB_C;
-
-	/*
-	 *	Fast path the normal digiless path
-	 */
-	if (d == NULL || d->ndigi == 0) {
-		buf[6] |= LAPB_E;
-		return 2 * AX25_ADDR_LEN;
-	}	
-	
-	buf += AX25_ADDR_LEN;
-	len += AX25_ADDR_LEN;
-	
-	while (ct < d->ndigi) {
-		memcpy(buf, &d->calls[ct], AX25_ADDR_LEN);
-		if (d->repeated[ct])
-			buf[6] |= AX25_REPEATED;
-		else
-			buf[6] &= ~AX25_REPEATED;
-		buf[6] &= ~LAPB_E;
-		buf[6] |= SSSID_SPARE;
-
-		buf += AX25_ADDR_LEN;
-		len += AX25_ADDR_LEN;
-		ct++;
-	}
-
-	buf[-1] |= LAPB_E;
-	
-	return len;
-}
-
-int size_ax25_addr(ax25_digi *dp)
-{
-	if (dp == NULL)
-		return 2 * AX25_ADDR_LEN;
-
-	return AX25_ADDR_LEN * (2 + dp->ndigi);
-}
-	
-/* 
- *	Reverse Digipeat List. May not pass both parameters as same struct
- */	
-void ax25_digi_invert(ax25_digi *in, ax25_digi *out)
-{
-	int ct = 0;
-	
-	/* Invert the digipeaters */
-	
-	while (ct < in->ndigi) {
-		out->calls[ct]    = in->calls[in->ndigi - ct - 1];
-		out->repeated[ct] = 0;
-		ct++;
-	}
-	
-	/* Copy ndigis */
-	out->ndigi = in->ndigi;
-
-	/* Finish off */
-	out->lastrepeat = 0;
-}
-
-/*
- *	count the number of buffers on a list belonging to the same
- *	socket as skb
- */
-
-static int ax25_list_length(struct sk_buff_head *list, struct sk_buff *skb)
-{
-	int count = 0;
-	long flags;
-	struct sk_buff *skbq;
-
-	save_flags(flags);
-	cli();
-
-	if (list == NULL) {
-		restore_flags(flags);
-                return 0;
-        }
-
-	for (skbq = list->next; skbq != (struct sk_buff *)list; skbq = skbq->next)
-		if (skb->sk == skbq->sk)
-			count++;
+	if (ax25->rtt < AX25_T1CLAMPLO)
+		ax25->rtt = AX25_T1CLAMPLO;
 
-        restore_flags(flags);
-        return count;
-}
-
-/*
- *	count the number of buffers of one socket on the write/ack-queue
- */
-
-int ax25_queue_length(ax25_cb *ax25, struct sk_buff *skb)
-{
-	return ax25_list_length(&ax25->write_queue, skb) + ax25_list_length(&ax25->ack_queue, skb);
-}
-
-/*
- *	:::FIXME:::
- *	This is ****NOT**** the right approach. Not all drivers do kiss. We
- *	need a driver level request to switch duplex mode, that does either
- *	SCC changing, PI config or KISS as required.
- *
- *	Not to mention this request isn't currently reliable.
- */
- 
-void ax25_kiss_cmd(ax25_cb *ax25, unsigned char cmd, unsigned char param)
-{
-	struct sk_buff *skb;
-	unsigned char *p;
-
-	if (ax25->device == NULL)
-		return;
-
-	if ((skb = alloc_skb(2, GFP_ATOMIC)) == NULL)
-		return;
-
-	skb->free = 1;
-	skb->arp = 1;
-
-	if (ax25->sk != NULL) {
-		skb->sk = ax25->sk;
-		atomic_add(skb->truesize, &ax25->sk->wmem_alloc);
-	}
-
-	skb->protocol = htons(ETH_P_AX25);
-
-	p = skb_put(skb, 2);
-
-	*p++=cmd;
-	*p  =param;
-
-	dev_queue_xmit(skb, ax25->device, SOPRI_NORMAL);
-}
-
-void ax25_dama_on(ax25_cb *ax25)
-{
-	if (ax25_dev_is_dama_slave(ax25->device) == 0) {
-		if (ax25->sk != NULL && ax25->sk->debug)
-			printk("ax25_dama_on: DAMA on\n");
-		ax25_kiss_cmd(ax25, 5, 1);
-	}
-}
-
-void ax25_dama_off(ax25_cb *ax25)
-{
-	if (ax25->dama_slave == 0)
-		return;
-
-	ax25->dama_slave = 0;
-	if (ax25_dev_is_dama_slave(ax25->device) == 0) {
-		if (ax25->sk != NULL && ax25->sk->debug)
-			printk("ax25_dama_off: DAMA off\n");
-		ax25_kiss_cmd(ax25, 5, 0);
-	}
+	if (ax25->rtt > AX25_T1CLAMPHI)
+		ax25->rtt = AX25_T1CLAMPHI;
 }
 
 #endif
diff --git a/net/ax25/ax25_timer.c b/net/ax25/ax25_timer.c
index f6ce6e00b..a99a02b4a 100644
--- a/net/ax25/ax25_timer.c
+++ b/net/ax25/ax25_timer.c
@@ -1,10 +1,10 @@
 /*
- *	AX.25 release 033
+ *	AX.25 release 036
  *
  *	This is ALPHA test software. This code may break your machine, randomly fail to work with new 
  *	releases, misbehave and/or generally screw up. It might even work. 
  *
- *	This code REQUIRES 1.2.1 or higher/ NET3.029
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
  *
  *	This module:
  *		This module is free software; you can redistribute it and/or
@@ -20,6 +20,10 @@
  *	AX.25 031	Joerg(DL1BKE)	Added DAMA support
  *	AX.25 032	Joerg(DL1BKE)	Fixed DAMA timeout bug
  *	AX.25 033	Jonathan(G4KLX)	Modularisation functions.
+ *	AX.25 035	Frederic(F1OAT)	Support for pseudo-digipeating.
+ *	AX.25 036	Jonathan(G4KLX)	Split Standard and DAMA code into seperate files.
+ *			Joerg(DL1BKE)	Fixed DAMA Slave. We are *required* to start with
+ *					standard AX.25 mode.
  */
 
 #include <linux/config.h>
@@ -48,37 +52,20 @@
 static void ax25_timer(unsigned long);
 
 /*
- *	Linux set/reset timer routines
+ *	Linux set timer
  */
 void ax25_set_timer(ax25_cb *ax25)
 {
 	unsigned long flags;	
 
-	save_flags(flags);
-	cli();
+	save_flags(flags); cli();
 	del_timer(&ax25->timer);
 	restore_flags(flags);
 
-	ax25->timer.next     = ax25->timer.prev = NULL;	
 	ax25->timer.data     = (unsigned long)ax25;
 	ax25->timer.function = &ax25_timer;
+	ax25->timer.expires  = jiffies + (HZ / 10);
 
-	ax25->timer.expires = jiffies + 10;
-	add_timer(&ax25->timer);
-}
-
-static void ax25_reset_timer(ax25_cb *ax25)
-{
-	unsigned long flags;
-	
-	save_flags(flags);
-	cli();
-	del_timer(&ax25->timer);
-	restore_flags(flags);
-
-	ax25->timer.data     = (unsigned long)ax25;
-	ax25->timer.function = &ax25_timer;
-	ax25->timer.expires  = jiffies + 10;
 	add_timer(&ax25->timer);
 }
 
@@ -92,456 +79,21 @@ static void ax25_timer(unsigned long param)
 {
 	ax25_cb *ax25 = (ax25_cb *)param;
 
-	switch (ax25->state) {
-		case AX25_STATE_0:
-			/* Magic here: If we listen() and a new link dies before it
-			   is accepted() it isn't 'dead' so doesn't get removed. */
-			if (ax25->sk == NULL || ax25->sk->destroy || (ax25->sk->state == TCP_LISTEN && ax25->sk->dead)) {
-				del_timer(&ax25->timer);
-				ax25_destroy_socket(ax25);
-				return;
-			}
-			break;
-
-		case AX25_STATE_3:
-		case AX25_STATE_4:
-			/*
-			 * Check the state of the receive buffer.
-			 */
-			if (ax25->sk != NULL) {
-				if (ax25->sk->rmem_alloc < (ax25->sk->rcvbuf / 2) && (ax25->condition & OWN_RX_BUSY_CONDITION)) {
-					ax25->condition &= ~OWN_RX_BUSY_CONDITION;
-					if (!ax25->dama_slave)
-						ax25_send_control(ax25, RR, POLLOFF, C_RESPONSE);
-					ax25->condition &= ~ACK_PENDING_CONDITION;
-					break;
-				}
-			}
-			/*
-			 * Check for frames to transmit.
-			 */
-			if (!ax25->dama_slave)
-				ax25_kick(ax25);
-			break;
-
-		default:
-			break;
-	}
-
-	if (ax25->t2timer > 0 && --ax25->t2timer == 0) {
-		if (ax25->state == AX25_STATE_3 || ax25->state == AX25_STATE_4) {
-			if (ax25->condition & ACK_PENDING_CONDITION) {
-				ax25->condition &= ~ACK_PENDING_CONDITION;
-				if (!ax25->dama_slave)
-					ax25_timeout_response(ax25);
-			}
-		}
-	}
-
-	if (ax25->t3timer > 0 && --ax25->t3timer == 0) {
-		/* dl1bke 960114: T3 expires and we are in DAMA mode:  */
-		/*                send a DISC and abort the connection */
-		if (ax25->dama_slave) {
-			ax25_link_failed(&ax25->dest_addr, ax25->device);
-			ax25_clear_queues(ax25);
-			ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-				
-			ax25->state = AX25_STATE_0;
-			if (ax25->sk != NULL) {
-				if (ax25->sk->debug)
-					printk(KERN_DEBUG "AX.25 T3 Timeout\n");
-				ax25->sk->state     = TCP_CLOSE;
-				ax25->sk->err       = ETIMEDOUT;
-				ax25->sk->shutdown |= SEND_SHUTDOWN;
-				if (!ax25->sk->dead)
-					ax25->sk->state_change(ax25->sk);
-				ax25->sk->dead      = 1;
-			}
-
-			ax25_reset_timer(ax25);
-			return;
-		}
-		
-		if (ax25->state == AX25_STATE_3) {
-			ax25->n2count = 0;
-			ax25_transmit_enquiry(ax25);
-			ax25->state   = AX25_STATE_4;
-		}
-		ax25->t3timer = ax25->t3;
-	}
-	
-	if (ax25->idletimer > 0 && --ax25->idletimer == 0) {
-		/* dl1bke 960228: close the connection when IDLE expires */
-		/* 		  similar to DAMA T3 timeout but with    */
-		/* 		  a "clean" disconnect of the connection */
-
-		ax25_clear_queues(ax25);
-
-		ax25->n2count = 0;
-		if (!ax25->dama_slave) {
-			ax25->t3timer = 0;
-			ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-		} else {
-			ax25->t3timer = ax25->t3;
-		}
-		
-		/* state 1 or 2 should not happen, but... */
-		
-		if (ax25->state == AX25_STATE_1 || ax25->state == AX25_STATE_2)
-			ax25->state = AX25_STATE_0;
-		else
-			ax25->state = AX25_STATE_2;
-
-		ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
-
-		if (ax25->sk != NULL) {
-			ax25->sk->state     = TCP_CLOSE;
-			ax25->sk->err       = 0;
-			ax25->sk->shutdown |= SEND_SHUTDOWN;
-			if (!ax25->sk->dead)
-				ax25->sk->state_change(ax25->sk);
-			ax25->sk->dead      = 1;
-			ax25->sk->destroy   = 1;
-		}
-	}
-		                                                                                                                                                                                                                                                                                                                                        
-	/* dl1bke 960114: DAMA T1 timeouts are handled in ax25_dama_slave_transmit */
-	/* 		  nevertheless we have to re-enqueue the timer struct...   */
-	
-	if (ax25->t1timer == 0 || --ax25->t1timer > 0) {
-		ax25_reset_timer(ax25);
-		return;
-	}
-
-	if (!ax25_dev_is_dama_slave(ax25->device)) {
-		if (ax25->dama_slave)
-			ax25->dama_slave = 0;
-		ax25_t1_timeout(ax25);
-	}
-}
-
-
-/* dl1bke 960114: The DAMA protocol requires to send data and SABM/DISC
- *                within the poll of any connected channel. Remember 
- *                that we are not allowed to send anything unless we
- *                get polled by the Master.
- *                
- *                Thus we'll have to do parts of our T1 handling in
- *                ax25_enquiry_response().
- */
-void ax25_t1_timeout(ax25_cb * ax25)
-{	
-	switch (ax25->state) {
-		case AX25_STATE_1: 
-			if (ax25->n2count == ax25->n2) {
-				if (ax25->modulus == MODULUS) {
-					ax25_link_failed(&ax25->dest_addr, ax25->device);
-					ax25_clear_queues(ax25);
-					ax25->state = AX25_STATE_0;
-					if (ax25->sk != NULL) {
-						ax25->sk->state     = TCP_CLOSE;
-						ax25->sk->err       = ETIMEDOUT;
-						ax25->sk->shutdown |= SEND_SHUTDOWN;
-						if (!ax25->sk->dead)
-							ax25->sk->state_change(ax25->sk);
-						ax25->sk->dead      = 1;
-					}
-				} else {
-					ax25->modulus = MODULUS;
-					ax25->window  = ax25_dev_get_value(ax25->device, AX25_VALUES_WINDOW);
-					ax25->n2count = 0;
-					ax25_send_control(ax25, SABM, ax25_dev_is_dama_slave(ax25->device)? POLLOFF : POLLON, C_COMMAND);
-				}
-			} else {
-				ax25->n2count++;
-				if (ax25->modulus == MODULUS) {
-					ax25_send_control(ax25, SABM, ax25_dev_is_dama_slave(ax25->device)? POLLOFF : POLLON, C_COMMAND);
-				} else {
-					ax25_send_control(ax25, SABME, ax25_dev_is_dama_slave(ax25->device)? POLLOFF : POLLON, C_COMMAND);
-				}
-			}
-			break;
-
-		case AX25_STATE_2:
-			if (ax25->n2count == ax25->n2) {
-				ax25_link_failed(&ax25->dest_addr, ax25->device);
-				ax25_clear_queues(ax25);
-				ax25->state = AX25_STATE_0;
-				ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-				
-				if (ax25->sk != NULL) {
-					ax25->sk->state     = TCP_CLOSE;
-					ax25->sk->err       = ETIMEDOUT;
-					ax25->sk->shutdown |= SEND_SHUTDOWN;
-					if (!ax25->sk->dead)
-						ax25->sk->state_change(ax25->sk);
-					ax25->sk->dead      = 1;
-				}
-			} else {
-				ax25->n2count++;
-				if (!ax25_dev_is_dama_slave(ax25->device))
-					ax25_send_control(ax25, DISC, POLLON, C_COMMAND);
-			}
+	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
+		case AX25_PROTO_STD_SIMPLEX:
+		case AX25_PROTO_STD_DUPLEX:
+			ax25_std_timer(ax25);
 			break;
 
-		case AX25_STATE_3: 
-			ax25->n2count = 1;
-			if (!ax25->dama_slave)
-				ax25_transmit_enquiry(ax25);
-			ax25->state   = AX25_STATE_4;
+#ifdef CONFIG_AX25_DAMA_SLAVE
+		case AX25_PROTO_DAMA_SLAVE:
+			if (ax25->ax25_dev->dama.slave)
+				ax25_ds_timer(ax25);
+			else
+				ax25_std_timer(ax25);
 			break;
-
-		case AX25_STATE_4:
-			if (ax25->n2count == ax25->n2) {
-				ax25_link_failed(&ax25->dest_addr, ax25->device);
-				ax25_clear_queues(ax25);
-				ax25_send_control(ax25, DM, POLLON, C_RESPONSE);
-				ax25->state = AX25_STATE_0;
-				if (ax25->sk != NULL) {
-					if (ax25->sk->debug)
-						printk(KERN_DEBUG "AX.25 link Failure\n");
-					ax25->sk->state     = TCP_CLOSE;
-					ax25->sk->err       = ETIMEDOUT;
-					ax25->sk->shutdown |= SEND_SHUTDOWN;
-					if (!ax25->sk->dead)
-						ax25->sk->state_change(ax25->sk);
-					ax25->sk->dead      = 1;
-				}
-			} else {
-				ax25->n2count++;
-				if (!ax25->dama_slave)
-					ax25_transmit_enquiry(ax25);
-			}
-			break;
-	}
-
-	ax25->t1timer = ax25->t1 = ax25_calculate_t1(ax25);
-
-	ax25_set_timer(ax25);
-}
-
-/************************************************************************/
-/*	Module support functions follow.				*/
-/************************************************************************/
-
-static struct protocol_struct {
-	struct protocol_struct *next;
-	unsigned int pid;
-	int (*func)(struct sk_buff *, ax25_cb *);
-} *protocol_list = NULL;
-
-static struct linkfail_struct {
-	struct linkfail_struct *next;
-	void (*func)(ax25_address *, struct device *);
-} *linkfail_list = NULL;
-
-static struct listen_struct {
-	struct listen_struct *next;
-	ax25_address  callsign;
-	struct device *dev;
-} *listen_list = NULL;
-
-int ax25_protocol_register(unsigned int pid, int (*func)(struct sk_buff *, ax25_cb *))
-{
-	struct protocol_struct *protocol;
-	unsigned long flags;
-
-	if (pid == AX25_P_TEXT || pid == AX25_P_SEGMENT)
-		return 0;
-#ifdef CONFIG_INET
-	if (pid == AX25_P_IP || pid == AX25_P_ARP)
-		return 0;
 #endif
-	if ((protocol = (struct protocol_struct *)kmalloc(sizeof(*protocol), GFP_ATOMIC)) == NULL)
-		return 0;
-
-	protocol->pid  = pid;
-	protocol->func = func;
-	
-	save_flags(flags);
-	cli();
-	
-	protocol->next = protocol_list;
-	protocol_list  = protocol;
-	
-	restore_flags(flags);
-
-	return 1;
-}
-
-void ax25_protocol_release(unsigned int pid)
-{
-	struct protocol_struct *s, *protocol = protocol_list;
-	unsigned long flags;
-
-	if (protocol == NULL)
-		return;
-
-	save_flags(flags);
-	cli();
-
-	if (protocol->pid == pid) {
-		protocol_list = protocol->next;
-		restore_flags(flags);
-		kfree_s(protocol, sizeof(struct protocol_struct));
-		return;
-	}
-
-	while (protocol != NULL && protocol->next != NULL) {
-		if (protocol->next->pid == pid) {
-			s = protocol->next;
-			protocol->next = protocol->next->next;
-			restore_flags(flags);
-			kfree_s(s, sizeof(struct protocol_struct));
-			return;
-		}
-		
-		protocol = protocol->next;
 	}
-	
-	restore_flags(flags);
-}
-
-int ax25_linkfail_register(void (*func)(ax25_address *, struct device *))
-{
-	struct linkfail_struct *linkfail;
-	unsigned long flags;
-
-	if ((linkfail = (struct linkfail_struct *)kmalloc(sizeof(*linkfail), GFP_ATOMIC)) == NULL)
-		return 0;
-
-	linkfail->func = func;
-	
-	save_flags(flags);
-	cli();
-	
-	linkfail->next = linkfail_list;
-	linkfail_list  = linkfail;
-	
-	restore_flags(flags);
-
-	return 1;
-}
-
-void ax25_linkfail_release(void (*func)(ax25_address *, struct device *))
-{
-	struct linkfail_struct *s, *linkfail = linkfail_list;
-	unsigned long flags;
-
-	if (linkfail == NULL)
-		return;
-
-	save_flags(flags);
-	cli();
-
-	if (linkfail->func == func) {
-		linkfail_list = linkfail->next;
-		restore_flags(flags);
-		kfree_s(linkfail, sizeof(struct linkfail_struct));
-		return;
-	}
-
-	while (linkfail != NULL && linkfail->next != NULL) {
-		if (linkfail->next->func == func) {
-			s = linkfail->next;
-			linkfail->next = linkfail->next->next;
-			restore_flags(flags);
-			kfree_s(s, sizeof(struct linkfail_struct));
-			return;
-		}
-		
-		linkfail = linkfail->next;
-	}
-	
-	restore_flags(flags);
-}
-
-int ax25_listen_register(ax25_address *callsign, struct device *dev)
-{
-	struct listen_struct *listen;
-	unsigned long flags;
-
-	if (ax25_listen_mine(callsign, dev))
-		return 0;
-
-	if ((listen = (struct listen_struct *)kmalloc(sizeof(*listen), GFP_ATOMIC)) == NULL)
-		return 0;
-
-	listen->callsign = *callsign;
-	listen->dev      = dev;
-	
-	save_flags(flags);
-	cli();
-	
-	listen->next = listen_list;
-	listen_list  = listen;
-	
-	restore_flags(flags);
-
-	return 1;
-}
-
-void ax25_listen_release(ax25_address *callsign, struct device *dev)
-{
-	struct listen_struct *s, *listen = listen_list;
-	unsigned long flags;
-
-	if (listen == NULL)
-		return;
-
-	save_flags(flags);
-	cli();
-
-	if (ax25cmp(&listen->callsign, callsign) == 0 && listen->dev == dev) {
-		listen_list = listen->next;
-		restore_flags(flags);
-		kfree_s(listen, sizeof(struct listen_struct));
-		return;
-	}
-
-	while (listen != NULL && listen->next != NULL) {
-		if (ax25cmp(&listen->next->callsign, callsign) == 0 && listen->next->dev == dev) {
-			s = listen->next;
-			listen->next = listen->next->next;
-			restore_flags(flags);
-			kfree_s(s, sizeof(struct listen_struct));
-			return;
-		}
-		
-		listen = listen->next;
-	}
-	
-	restore_flags(flags);
-}
-
-int (*ax25_protocol_function(unsigned int pid))(struct sk_buff *, ax25_cb *)
-{
-	struct protocol_struct *protocol;
-
-	for (protocol = protocol_list; protocol != NULL; protocol = protocol->next)
-		if (protocol->pid == pid)
-			return protocol->func;
-
-	return NULL;
-}
-
-int ax25_listen_mine(ax25_address *callsign, struct device *dev)
-{
-	struct listen_struct *listen;
-
-	for (listen = listen_list; listen != NULL; listen = listen->next)
-		if (ax25cmp(&listen->callsign, callsign) == 0 && (listen->dev == dev || listen->dev == NULL))
-			return 1;
-
-	return 0;
-}
-
-void ax25_link_failed(ax25_address *callsign, struct device *dev)
-{
-	struct linkfail_struct *linkfail;
-	
-	for (linkfail = linkfail_list; linkfail != NULL; linkfail = linkfail->next)
-		(linkfail->func)(callsign, dev);
 }
 
 #endif
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
new file mode 100644
index 000000000..3325f5056
--- /dev/null
+++ b/net/ax25/ax25_uid.c
@@ -0,0 +1,189 @@
+/*
+ *	AX.25 release 036
+ *
+ *	This is ALPHA test software. This code may break your machine, randomly fail to work with new
+ *	releases, misbehave and/or generally screw up. It might even work.
+ *
+ *	This code REQUIRES 2.1.15 or higher/ NET3.038
+ *
+ *	This module:
+ *		This module is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ *	History
+ *	AX.25 036	Jonathan(G4KLX)	Split from af_ax25.c.
+ */
+
+#include <linux/config.h>
+#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/sockios.h>
+#include <linux/net.h>
+#include <net/ax25.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <linux/fcntl.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/notifier.h>
+#include <linux/proc_fs.h>
+#include <linux/stat.h>
+#include <linux/firewall.h>
+#include <linux/sysctl.h>
+#include <net/ip.h>
+#include <net/arp.h>
+
+/*
+ *	Callsign/UID mapper. This is in kernel space for security on multi-amateur machines.
+ */
+
+static ax25_uid_assoc *ax25_uid_list = NULL;
+
+int ax25_uid_policy = 0;
+
+ax25_address *ax25_findbyuid(uid_t uid)
+{
+	ax25_uid_assoc *ax25_uid;
+
+	for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+		if (ax25_uid->uid == uid)
+			return &ax25_uid->call;
+	}
+
+	return NULL;
+}
+
+int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
+{
+	ax25_uid_assoc *s, *ax25_uid;
+	unsigned long flags;
+
+	switch (cmd) {
+		case SIOCAX25GETUID:
+			for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+				if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
+					return ax25_uid->uid;
+			}
+			return -ENOENT;
+
+		case SIOCAX25ADDUID:
+			if (!suser())
+				return -EPERM;
+			if (ax25_findbyuid(sax->sax25_uid))
+				return -EEXIST;
+			if (sax->sax25_uid == 0)
+				return -EINVAL;
+			if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
+				return -ENOMEM;
+			ax25_uid->uid  = sax->sax25_uid;
+			ax25_uid->call = sax->sax25_call;
+			save_flags(flags); cli();
+			ax25_uid->next = ax25_uid_list;
+			ax25_uid_list  = ax25_uid;
+			restore_flags(flags);
+			return 0;
+
+		case SIOCAX25DELUID:
+			if (!suser())
+				return -EPERM;
+			for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+				if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
+					break;
+			}
+			if (ax25_uid == NULL)
+				return -ENOENT;
+			save_flags(flags); cli();
+			if ((s = ax25_uid_list) == ax25_uid) {
+				ax25_uid_list = s->next;
+				restore_flags(flags);
+				kfree_s(ax25_uid, sizeof(ax25_uid_assoc));
+				return 0;
+			}
+			while (s != NULL && s->next != NULL) {
+				if (s->next == ax25_uid) {
+					s->next = ax25_uid->next;
+					restore_flags(flags);
+					kfree_s(ax25_uid, sizeof(ax25_uid_assoc));
+					return 0;
+				}
+				s = s->next;
+			}
+			restore_flags(flags);
+			return -ENOENT;
+
+		default:
+			return -EINVAL;
+	}
+
+	return -EINVAL;	/*NOTREACHED */
+}
+
+int ax25_uid_get_info(char *buffer, char **start, off_t offset, int length, int dummy)
+{
+	ax25_uid_assoc *pt;
+	int len     = 0;
+	off_t pos   = 0;
+	off_t begin = 0;
+
+	cli();
+
+	len += sprintf(buffer, "Policy: %d\n", ax25_uid_policy);
+
+	for (pt = ax25_uid_list; pt != NULL; pt = pt->next) {
+		len += sprintf(buffer + len, "%6d %s\n", pt->uid, ax2asc(&pt->call));
+
+		pos = begin + len;
+
+		if (pos < offset) {
+			len = 0;
+			begin = pos;
+		}
+
+		if (pos > offset + length)
+			break;
+	}
+
+	sti();
+
+	*start = buffer + (offset - begin);
+	len   -= offset - begin;
+
+	if (len > length) len = length;
+
+	return len;
+}
+
+#ifdef MODULE
+
+/*
+ *	Free all memory associated with UID/Callsign structures.
+ */
+void ax25_uid_free(void)
+{
+	ax25_uid_assoc *s, *ax25_uid = ax25_uid_list;
+
+	while (ax25_uid != NULL) {
+		s        = ax25_uid;
+		ax25_uid = ax25_uid->next;
+
+		kfree_s(s, sizeof(ax25_uid_assoc));
+	}
+}
+
+#endif
+
+#endif
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index 302d210f8..02b7fa484 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -7,19 +7,31 @@
 
 #include <linux/mm.h>
 #include <linux/sysctl.h>
+#include <linux/config.h>
 #include <net/ax25.h>
 
-static int min_ax25[] = {0, 0, 0, 0, 0, 1,  1,              1,              1,
-	               0,                 0,  1,   1,  1, 0x00};
-static int max_ax25[] = {1, 1, 1, 1, 1, 7, 63, 30 * PR_SLOWHZ, 20 * PR_SLOWHZ,
-	3600 * PR_SLOWHZ, 65535 * PR_SLOWHZ, 31, 512, 20, 0x03};
+static int min_ipdefmode[] = {0},	max_ipdefmode[] = {1};
+static int min_axdefmode[] = {0},	max_axdefmode[] = {1};
+static int min_backoff[] = {0},		max_backoff[] = {2};
+static int min_conmode[] = {0},		max_conmode[] = {2};
+static int min_window[] = {1},		max_window[] = {7};
+static int min_ewindow[] = {1},		max_ewindow[] = {63};
+static int min_t1[] = {1},		max_t1[] = {30 * AX25_SLOWHZ};
+static int min_t2[] = {1},		max_t2[] = {20 * AX25_SLOWHZ};
+static int min_t3[] = {0},		max_t3[] = {3600 * AX25_SLOWHZ};
+static int min_idle[] = {0},		max_idle[] = {65535 * AX25_SLOWHZ};
+static int min_n2[] = {1},		max_n2[] = {31};
+static int min_paclen[] = {1},		max_paclen[] = {512};
+static int min_proto[] = {0},		max_proto[] = {3};
+static int min_ds_timeout[] = {0},	max_ds_timeout[] = {65535 * AX25_SLOWHZ};
 
 static struct ctl_table_header *ax25_table_header;
 
-static ctl_table ax25_table[AX25_MAX_DEVICES + 1];
+static ctl_table *ax25_table = NULL;
+static int ax25_table_size   = 0;
 
 static ctl_table ax25_dir_table[] = {
-	{NET_AX25, "ax25", NULL, 0, 0555, ax25_table},
+	{NET_AX25, "ax25", NULL, 0, 0555, NULL},
 	{0}
 };
 
@@ -28,33 +40,118 @@ static ctl_table ax25_root_table[] = {
 	{0}
 };
 
+static const ctl_table ax25_param_table[] = {
+	{NET_AX25_IP_DEFAULT_MODE, "ip_default_mode",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_ipdefmode, &max_ipdefmode},
+	{NET_AX25_DEFAULT_MODE, "ax25_default_mode",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_axdefmode, &max_axdefmode},
+	{NET_AX25_BACKOFF_TYPE, "backoff_type",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_backoff, &max_backoff},
+	{NET_AX25_CONNECT_MODE, "connect_mode",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_conmode, &max_conmode},
+	{NET_AX25_STANDARD_WINDOW, "standard_window_size",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_window, &max_window},
+	{NET_AX25_EXTENDED_WINDOW, "extended_window_size",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_ewindow, &max_ewindow},
+	{NET_AX25_T1_TIMEOUT, "t1_timeout",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_t1, &max_t1},
+	{NET_AX25_T2_TIMEOUT, "t2_timeout",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_t2, &max_t2},
+	{NET_AX25_T3_TIMEOUT, "t3_timeout",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_t3, &max_t3},
+	{NET_AX25_IDLE_TIMEOUT, "idle_timeout",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_idle, &max_idle},
+	{NET_AX25_N2, "maximum_retry_count",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_n2, &max_n2},
+	{NET_AX25_PACLEN, "maximum_packet_length",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_paclen, &max_paclen},
+	{NET_AX25_PROTOCOL, "protocol",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_proto, &max_proto},
+	{NET_AX25_DAMA_SLAVE_TIMEOUT, "dama_slave_timeout",
+	 NULL, sizeof(int), 0644, NULL,
+	 &proc_dointvec_minmax, &sysctl_intvec, NULL,
+	 &min_ds_timeout, &max_ds_timeout},
+	{0}	/* that's all, folks! */
+};
+
 void ax25_register_sysctl(void)
 {
-	int i, n;
-
-	memset(ax25_table, 0x00, (AX25_MAX_DEVICES + 1) * sizeof(ctl_table));
-
-	for (n = 0, i = 0; i < AX25_MAX_DEVICES; i++) {
-		if (ax25_device[i].dev != NULL) {
-			ax25_table[n].ctl_name     = n + 1;
-			ax25_table[n].procname     = ax25_device[i].name;
-			ax25_table[n].data         = &ax25_device[i].values;
-			ax25_table[n].maxlen       = AX25_MAX_VALUES * sizeof(int);
-			ax25_table[n].mode         = 0644;
-			ax25_table[n].child        = NULL;
-			ax25_table[n].proc_handler = &proc_dointvec_minmax;
-			ax25_table[n].strategy     = &sysctl_intvec;
-			ax25_table[n].de           = NULL;
-			ax25_table[n].extra1       = &min_ax25;
-			ax25_table[n].extra2       = &max_ax25;
-			n++;
-		}
+	ax25_dev *ax25_dev;
+	int n, k;
+
+	for (ax25_table_size = sizeof(ctl_table), ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
+		ax25_table_size += sizeof(ctl_table);
+
+	if ((ax25_table = kmalloc(ax25_table_size, GFP_ATOMIC)) == NULL)
+		return;
+
+	memset(ax25_table, 0x00, ax25_table_size);
+
+	for (n = 0, ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) {
+		ax25_table[n].ctl_name     = n + 1;
+		ax25_table[n].procname     = ax25_dev->dev->name;
+		ax25_table[n].data         = NULL;
+		ax25_table[n].maxlen       = 0;
+		ax25_table[n].mode         = 0555;
+		ax25_table[n].child        = ax25_dev->systable;
+		ax25_table[n].proc_handler = NULL;
+
+		memcpy(ax25_dev->systable, ax25_param_table, sizeof(ax25_dev->systable));
+		
+#ifndef CONFIG_AX25_DAMA_SLAVE
+		/* 
+		 * We do not wish to have a representation of this parameter
+		 * in /proc/sys/ when configured *not* to include the
+		 * AX.25 DAMA slave code, do we?
+		 */
+
+		ax25_dev->systable[AX25_VALUES_DS_TIMEOUT].procname = NULL;
+#endif
+
+		ax25_dev->systable[AX25_MAX_VALUES].ctl_name = 0;	/* just in case... */
+
+		for (k = 0; k < AX25_MAX_VALUES; k++)
+			ax25_dev->systable[k].data = &ax25_dev->values[k];
+
+		n++;
 	}
 
+	ax25_dir_table[0].child = ax25_table;
+
 	ax25_table_header = register_sysctl_table(ax25_root_table, 1);
 }
 
 void ax25_unregister_sysctl(void)
 {
 	unregister_sysctl_table(ax25_table_header);
+
+	kfree_s(ax25_table, ax25_table_size);
+
+	ax25_dir_table[0].child = NULL;
 }