diff -urp v2.6.39/linux/include/linux/rtnetlink.h linux/include/linux/rtnetlink.h
--- v2.6.39/linux/include/linux/rtnetlink.h	2011-05-15 10:19:17.000000000 +0300
+++ linux/include/linux/rtnetlink.h	2011-05-15 10:22:06.423246508 +0300
@@ -312,6 +312,8 @@ struct rtnexthop {
 #define RTNH_F_DEAD		1	/* Nexthop is dead (used by multipath)	*/
 #define RTNH_F_PERVASIVE	2	/* Do recursive gateway lookup	*/
 #define RTNH_F_ONLINK		4	/* Gateway is forced on link	*/
+#define RTNH_F_SUSPECT		8	/* We don't know the real state	*/
+#define RTNH_F_BADSTATE		(RTNH_F_DEAD | RTNH_F_SUSPECT)
 
 /* Macros to handle hexthops */
 
diff -urp v2.6.39/linux/include/net/ip_fib.h linux/include/net/ip_fib.h
--- v2.6.39/linux/include/net/ip_fib.h	2011-05-15 10:19:17.000000000 +0300
+++ linux/include/net/ip_fib.h	2011-05-15 10:22:06.424245658 +0300
@@ -222,6 +222,8 @@ extern int fib_lookup(struct net *n, str
 extern struct fib_table *fib_new_table(struct net *net, u32 id);
 extern struct fib_table *fib_get_table(struct net *net, u32 id);
 
+extern int fib_result_table(struct fib_result *res);
+
 #endif /* CONFIG_IP_MULTIPLE_TABLES */
 
 /* Exported by fib_frontend.c */
@@ -230,7 +232,8 @@ extern void		ip_fib_init(void);
 extern int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
 			       struct net_device *dev, __be32 *spec_dst,
 			       u32 *itag, u32 mark);
-extern void fib_select_default(struct fib_result *res);
+extern void fib_select_default(const struct flowi4 *flp,
+			       struct fib_result *res);
 
 /* Exported by fib_semantics.c */
 extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
@@ -238,7 +241,8 @@ extern int fib_sync_down_dev(struct net_
 extern int fib_sync_down_addr(struct net *net, __be32 local);
 extern void fib_update_nh_saddrs(struct net_device *dev);
 extern int fib_sync_up(struct net_device *dev);
-extern void fib_select_multipath(struct fib_result *res);
+extern void fib_select_multipath(const struct flowi4 *flp,
+				 struct fib_result *res);
 
 /* Exported by fib_trie.c */
 extern void fib_trie_init(void);
diff -urp v2.6.39/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c
--- v2.6.39/linux/net/ipv4/fib_frontend.c	2011-05-15 10:19:17.000000000 +0300
+++ linux/net/ipv4/fib_frontend.c	2011-05-15 10:22:06.425246657 +0300
@@ -47,6 +47,8 @@
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
 
+#define FIB_RES_TABLE(r) (RT_TABLE_MAIN)
+
 static int __net_init fib4_rules_init(struct net *net)
 {
 	struct fib_table *local_table, *main_table;
@@ -71,6 +73,8 @@ fail:
 }
 #else
 
+#define FIB_RES_TABLE(r) (fib_result_table(r))
+
 struct fib_table *fib_new_table(struct net *net, u32 id)
 {
 	struct fib_table *tb;
@@ -195,6 +199,9 @@ int fib_validate_source(__be32 src, __be
 	struct in_device *in_dev;
 	struct flowi4 fl4;
 	struct fib_result res;
+	int table;
+	unsigned char prefixlen;
+	unsigned char scope;
 	int no_addr, rpf, accept_local;
 	bool dev_match;
 	int ret;
@@ -251,17 +258,24 @@ int fib_validate_source(__be32 src, __be
 	}
 	if (no_addr)
 		goto last_resort;
-	if (rpf == 1)
-		goto e_rpf;
+	table = FIB_RES_TABLE(&res);
+	prefixlen = res.prefixlen;
+	scope = res.scope;
 	fl4.flowi4_oif = dev->ifindex;
 
 	ret = 0;
 	if (fib_lookup(net, &fl4, &res) == 0) {
-		if (res.type == RTN_UNICAST) {
+		if (res.type == RTN_UNICAST &&
+		    ((table == FIB_RES_TABLE(&res) &&
+		      res.prefixlen >= prefixlen && res.scope >= scope) ||
+		     !rpf)) {
 			*spec_dst = FIB_RES_PREFSRC(net, res);
 			ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;
+			return ret;
 		}
 	}
+	if (rpf == 1)
+		goto e_rpf;
 	return ret;
 
 last_resort:
diff -urp v2.6.39/linux/net/ipv4/fib_lookup.h linux/net/ipv4/fib_lookup.h
--- v2.6.39/linux/net/ipv4/fib_lookup.h	2011-05-15 10:19:17.000000000 +0300
+++ linux/net/ipv4/fib_lookup.h	2011-05-15 10:22:06.426246262 +0300
@@ -8,6 +8,7 @@
 struct fib_alias {
 	struct list_head	fa_list;
 	struct fib_info		*fa_info;
+	int			fa_last_dflt;
 	u8			fa_tos;
 	u8			fa_type;
 	u8			fa_state;
@@ -38,7 +39,8 @@ extern struct fib_alias *fib_find_alias(
 					u8 tos, u32 prio);
 extern int fib_detect_death(struct fib_info *fi, int order,
 			    struct fib_info **last_resort,
-			    int *last_idx, int dflt);
+			    int *last_idx, int *dflt, int *last_nhsel,
+			    const struct flowi4 *flp);
 
 static inline void fib_result_assign(struct fib_result *res,
 				     struct fib_info *fi)
diff -urp v2.6.39/linux/net/ipv4/fib_rules.c linux/net/ipv4/fib_rules.c
--- v2.6.39/linux/net/ipv4/fib_rules.c	2011-05-15 10:19:17.000000000 +0300
+++ linux/net/ipv4/fib_rules.c	2011-05-15 10:22:06.427246675 +0300
@@ -53,6 +53,11 @@ u32 fib_rules_tclass(const struct fib_re
 }
 #endif
 
+int fib_result_table(struct fib_result *res)
+{
+	return res->r->table;
+}
+
 int fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
 {
 	struct fib_lookup_arg arg = {
diff -urp v2.6.39/linux/net/ipv4/fib_semantics.c linux/net/ipv4/fib_semantics.c
--- v2.6.39/linux/net/ipv4/fib_semantics.c	2011-05-15 10:19:17.000000000 +0300
+++ linux/net/ipv4/fib_semantics.c	2011-05-15 10:22:06.429246223 +0300
@@ -201,7 +201,7 @@ static inline int nh_comp(const struct f
 #ifdef CONFIG_IP_ROUTE_CLASSID
 		    nh->nh_tclassid != onh->nh_tclassid ||
 #endif
-		    ((nh->nh_flags ^ onh->nh_flags) & ~RTNH_F_DEAD))
+		    ((nh->nh_flags ^ onh->nh_flags) & ~RTNH_F_BADSTATE))
 			return -1;
 		onh++;
 	} endfor_nexthops(fi);
@@ -253,7 +253,7 @@ static struct fib_info *fib_find_info(co
 		    nfi->fib_priority == fi->fib_priority &&
 		    memcmp(nfi->fib_metrics, fi->fib_metrics,
 			   sizeof(u32) * RTAX_MAX) == 0 &&
-		    ((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_F_DEAD) == 0 &&
+		    ((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_F_BADSTATE) == 0 &&
 		    (nfi->fib_nhs == 0 || nh_comp(fi, nfi) == 0))
 			return fi;
 	}
@@ -364,26 +364,67 @@ struct fib_alias *fib_find_alias(struct 
 }
 
 int fib_detect_death(struct fib_info *fi, int order,
-		     struct fib_info **last_resort, int *last_idx, int dflt)
+		     struct fib_info **last_resort, int *last_idx, int *dflt,
+		     int *last_nhsel, const struct flowi4 *flp)
 {
 	struct neighbour *n;
-	int state = NUD_NONE;
+	int nhsel;
+	int state;
+	struct fib_nh * nh;
+	__be32 dst;
+	int flag, dead = 1;
+
+	/* change_nexthops(fi) { */
+	for (nhsel = 0, nh = fi->fib_nh; nhsel < fi->fib_nhs; nh++, nhsel++) {
+		if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
+			continue;
+		if (nh->nh_flags & RTNH_F_DEAD)
+			continue;
 
-	n = neigh_lookup(&arp_tbl, &fi->fib_nh[0].nh_gw, fi->fib_dev);
-	if (n) {
-		state = n->nud_state;
-		neigh_release(n);
-	}
-	if (state == NUD_REACHABLE)
-		return 0;
-	if ((state & NUD_VALID) && order != dflt)
-		return 0;
-	if ((state & NUD_VALID) ||
-	    (*last_idx < 0 && order > dflt)) {
-		*last_resort = fi;
-		*last_idx = order;
+		flag = 0;
+		if (nh->nh_dev->flags & IFF_NOARP) {
+			dead = 0;
+			goto setfl;
+		}
+
+		dst = nh->nh_gw;
+		if (!nh->nh_gw || nh->nh_scope != RT_SCOPE_LINK)
+			dst = flp->daddr;
+
+		state = NUD_NONE;
+		n = neigh_lookup(&arp_tbl, &dst, nh->nh_dev);
+		if (n) {
+			state = n->nud_state;
+			neigh_release(n);
+		}
+		if (state == NUD_REACHABLE ||
+		    ((state & NUD_VALID) && order != *dflt)) {
+			dead = 0;
+			goto setfl;
+		}
+		if (!(state & NUD_VALID))
+			flag = 1;
+		if (!dead)
+			goto setfl;
+		if ((state & NUD_VALID) ||
+		    (*last_idx < 0 && order >= *dflt)) {
+			*last_resort = fi;
+			*last_idx = order;
+			*last_nhsel = nhsel;
+		}
+
+		setfl:
+
+		read_lock_bh(&fib_nhflags_lock);
+		if (flag)
+			nh->nh_flags |= RTNH_F_SUSPECT;
+		else
+			nh->nh_flags &= ~RTNH_F_SUSPECT;
+		read_unlock_bh(&fib_nhflags_lock);
 	}
-	return 1;
+	/* } endfor_nexthops(fi) */
+
+	return dead;
 }
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -1082,12 +1123,12 @@ int fib_sync_down_dev(struct net_device 
 }
 
 /* Must be invoked inside of an RCU protected region.  */
-void fib_select_default(struct fib_result *res)
+void fib_select_default(const struct flowi4 *flp, struct fib_result *res)
 {
 	struct fib_info *fi = NULL, *last_resort = NULL;
 	struct list_head *fa_head = res->fa_head;
-	struct fib_table *tb = res->table;
-	int order = -1, last_idx = -1;
+	int order = -1, last_idx = -1, last_dflt = -2, last_nhsel = 0;
+	struct fib_alias *first_fa = NULL;
 	struct fib_alias *fa;
 
 	list_for_each_entry_rcu(fa, fa_head, fa_list) {
@@ -1097,21 +1138,21 @@ void fib_select_default(struct fib_resul
 		    fa->fa_type != RTN_UNICAST)
 			continue;
 
+		if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
+			continue;
 		if (next_fi->fib_priority > res->fi->fib_priority)
 			break;
-		if (!next_fi->fib_nh[0].nh_gw ||
-		    next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
-			continue;
 
 		fib_alias_accessed(fa);
 
-		if (fi == NULL) {
-			if (next_fi != res->fi)
-				break;
-		} else if (!fib_detect_death(fi, order, &last_resort,
-					     &last_idx, tb->tb_default)) {
+		if (!first_fa) {
+			last_dflt = fa->fa_last_dflt;
+			first_fa = fa;
+		}
+		if (fi && !fib_detect_death(fi, order, &last_resort,
+		    &last_idx, &last_dflt, &last_nhsel, flp)) {
 			fib_result_assign(res, fi);
-			tb->tb_default = order;
+			first_fa->fa_last_dflt = order;
 			goto out;
 		}
 		fi = next_fi;
@@ -1119,20 +1160,32 @@ void fib_select_default(struct fib_resul
 	}
 
 	if (order <= 0 || fi == NULL) {
-		tb->tb_default = -1;
+		if (fi && fi->fib_nhs > 1 &&
+		    fib_detect_death(fi, order, &last_resort, &last_idx,
+				     &last_dflt, &last_nhsel, flp) &&
+		    last_resort == fi) {
+			read_lock_bh(&fib_nhflags_lock);
+			fi->fib_nh[last_nhsel].nh_flags &= ~RTNH_F_SUSPECT;
+			read_unlock_bh(&fib_nhflags_lock);
+		}
+		if (first_fa) first_fa->fa_last_dflt = -1;
 		goto out;
 	}
 
 	if (!fib_detect_death(fi, order, &last_resort, &last_idx,
-				tb->tb_default)) {
+				&last_dflt, &last_nhsel, flp)) {
 		fib_result_assign(res, fi);
-		tb->tb_default = order;
+		first_fa->fa_last_dflt = order;
 		goto out;
 	}
 
-	if (last_idx >= 0)
+	if (last_idx >= 0) {
 		fib_result_assign(res, last_resort);
-	tb->tb_default = last_idx;
+		read_lock_bh(&fib_nhflags_lock);
+		last_resort->fib_nh[last_nhsel].nh_flags &= ~RTNH_F_SUSPECT;
+		read_unlock_bh(&fib_nhflags_lock);
+		first_fa->fa_last_dflt = last_idx;
+	}
 out:
 	return;
 }
@@ -1201,27 +1254,45 @@ int fib_sync_up(struct net_device *dev)
  * The algorithm is suboptimal, but it provides really
  * fair weighted route distribution.
  */
-void fib_select_multipath(struct fib_result *res)
+void fib_select_multipath(const struct flowi4 *flp, struct fib_result *res)
 {
 	struct fib_info *fi = res->fi;
-	int w;
+	int w, alive;
 
 	spin_lock_bh(&fib_multipath_lock);
+	if (flp->flowi4_oif) {
+		int sel = -1;
+		w = -1;
+		change_nexthops(fi) {
+			if (flp->flowi4_oif != nexthop_nh->nh_oif)
+				continue;
+			if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE)) {
+				if (nexthop_nh->nh_power > w) {
+					w = nexthop_nh->nh_power;
+					sel = nhsel;
+				}
+			}
+		} endfor_nexthops(fi);
+		if (sel >= 0) {
+			spin_unlock_bh(&fib_multipath_lock);
+			res->nh_sel = sel;
+			return;
+		}
+		goto last_resort;
+	}
+
+repeat:
 	if (fi->fib_power <= 0) {
 		int power = 0;
 		change_nexthops(fi) {
-			if (!(nexthop_nh->nh_flags & RTNH_F_DEAD)) {
+			if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE)) {
 				power += nexthop_nh->nh_weight;
 				nexthop_nh->nh_power = nexthop_nh->nh_weight;
 			}
 		} endfor_nexthops(fi);
 		fi->fib_power = power;
-		if (power <= 0) {
-			spin_unlock_bh(&fib_multipath_lock);
-			/* Race condition: route has just become dead. */
-			res->nh_sel = 0;
-			return;
-		}
+		if (power <= 0)
+			goto last_resort;
 	}
 
 
@@ -1231,8 +1302,9 @@ void fib_select_multipath(struct fib_res
 
 	w = jiffies % fi->fib_power;
 
+	alive = 0;
 	change_nexthops(fi) {
-		if (!(nexthop_nh->nh_flags & RTNH_F_DEAD) &&
+		if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE) &&
 		    nexthop_nh->nh_power) {
 			w -= nexthop_nh->nh_power;
 			if (w <= 0) {
@@ -1242,11 +1314,26 @@ void fib_select_multipath(struct fib_res
 				spin_unlock_bh(&fib_multipath_lock);
 				return;
 			}
+			alive = 1;
+		}
+	} endfor_nexthops(fi);
+	if (alive) {
+		fi->fib_power = 0;
+		goto repeat;
+	}
+
+last_resort:
+	for_nexthops(fi) {
+		if (!(nh->nh_flags & RTNH_F_DEAD)) {
+			if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
+				continue;
+			spin_unlock_bh(&fib_multipath_lock);
+			res->nh_sel = nhsel;
+			return;
 		}
 	} endfor_nexthops(fi);
 
 	/* Race condition: route has just become dead. */
-	res->nh_sel = 0;
 	spin_unlock_bh(&fib_multipath_lock);
 }
 #endif
diff -urp v2.6.39/linux/net/ipv4/fib_trie.c linux/net/ipv4/fib_trie.c
--- v2.6.39/linux/net/ipv4/fib_trie.c	2011-05-15 10:19:17.000000000 +0300
+++ linux/net/ipv4/fib_trie.c	2011-05-15 10:22:06.431245128 +0300
@@ -1269,6 +1269,7 @@ int fib_table_insert(struct fib_table *t
 			fi_drop = fa->fa_info;
 			new_fa->fa_tos = fa->fa_tos;
 			new_fa->fa_info = fi;
+			new_fa->fa_last_dflt = -1;
 			new_fa->fa_type = cfg->fc_type;
 			state = fa->fa_state;
 			new_fa->fa_state = state & ~FA_S_ACCESSED;
@@ -1307,6 +1308,7 @@ int fib_table_insert(struct fib_table *t
 	new_fa->fa_tos = tos;
 	new_fa->fa_type = cfg->fc_type;
 	new_fa->fa_state = 0;
+	new_fa->fa_last_dflt = -1;
 	/*
 	 * Insert new entry to the list.
 	 */
diff -urp v2.6.39/linux/net/ipv4/route.c linux/net/ipv4/route.c
--- v2.6.39/linux/net/ipv4/route.c	2011-05-15 10:19:17.000000000 +0300
+++ linux/net/ipv4/route.c	2011-05-15 10:22:25.793246883 +0300
@@ -2050,6 +2050,7 @@ static int __mkroute_input(struct sk_buf
 
 static int ip_mkroute_input(struct sk_buff *skb,
 			    struct fib_result *res,
+			    struct net *net,
 			    const struct flowi4 *fl4,
 			    struct in_device *in_dev,
 			    __be32 daddr, __be32 saddr, u32 tos)
@@ -2058,9 +2059,10 @@ static int ip_mkroute_input(struct sk_bu
 	int err;
 	unsigned hash;
 
+	fib_select_default(fl4, res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
 	if (res->fi && res->fi->fib_nhs > 1)
-		fib_select_multipath(res);
+		fib_select_multipath(fl4, res);
 #endif
 
 	/* create a routing cache entry */
@@ -2166,7 +2168,7 @@ static int ip_route_input_slow(struct sk
 	if (res.type != RTN_UNICAST)
 		goto martian_destination;
 
-	err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
+	err = ip_mkroute_input(skb, &res, net, &fl4, in_dev, daddr, saddr, tos);
 out:	return err;
 
 brd_input:
@@ -2610,13 +2612,12 @@ static struct rtable *ip_route_output_sl
 		goto make_route;
 	}
 
+	if (res.type == RTN_UNICAST)
+		fib_select_default(&fl4, &res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-	if (res.fi->fib_nhs > 1 && fl4.flowi4_oif == 0)
-		fib_select_multipath(&res);
-	else
+	if (res.fi->fib_nhs > 1)
+		fib_select_multipath(&fl4, &res);
 #endif
-	if (!res.prefixlen && res.type == RTN_UNICAST && !fl4.flowi4_oif)
-		fib_select_default(&res);
 
 	if (!fl4.saddr)
 		fl4.saddr = FIB_RES_PREFSRC(net, res);
