ipv4: fix redirect handling
[linux-2.6.git] / net / ipv4 / route.c
index 0979e03..b2e9544 100644 (file)
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
+#include <net/atmclip.h>
+#include <net/secure_seq.h>
 
-#define RT_FL_TOS(oldflp) \
-    ((u32)(oldflp->fl4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
+#define RT_FL_TOS(oldflp4) \
+    ((u32)(oldflp4->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
 
 #define IP_MAX_MTU     0xFFF0
 
@@ -131,9 +133,6 @@ static int ip_rt_min_pmtu __read_mostly             = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly      = 256;
 static int rt_chain_length_max __read_mostly   = 20;
 
-static struct delayed_work expires_work;
-static unsigned long expires_ljiffies;
-
 /*
  *     Interface to generic destination cache.
  */
@@ -159,7 +158,7 @@ static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
        u32 *p = NULL;
 
        if (!rt->peer)
-               rt_bind_peer(rt, 1);
+               rt_bind_peer(rt, rt->rt_dst, 1);
 
        peer = rt->peer;
        if (peer) {
@@ -187,6 +186,8 @@ static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
        return p;
 }
 
+static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst, const void *daddr);
+
 static struct dst_ops ipv4_dst_ops = {
        .family =               AF_INET,
        .protocol =             cpu_to_be16(ETH_P_IP),
@@ -201,13 +202,14 @@ static struct dst_ops ipv4_dst_ops = {
        .link_failure =         ipv4_link_failure,
        .update_pmtu =          ip_rt_update_pmtu,
        .local_out =            __ip_local_out,
+       .neigh_lookup =         ipv4_neigh_lookup,
 };
 
 #define ECN_OR_COST(class)     TC_PRIO_##class
 
 const __u8 ip_tos2prio[16] = {
        TC_PRIO_BESTEFFORT,
-       ECN_OR_COST(FILLER),
+       ECN_OR_COST(BESTEFFORT),
        TC_PRIO_BESTEFFORT,
        ECN_OR_COST(BESTEFFORT),
        TC_PRIO_BULK,
@@ -414,7 +416,13 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                           "HHUptod\tSpecDst");
        else {
                struct rtable *r = v;
-               int len;
+               struct neighbour *n;
+               int len, HHUptod;
+
+               rcu_read_lock();
+               n = dst_get_neighbour(&r->dst);
+               HHUptod = (n && (n->nud_state & NUD_CONNECTED)) ? 1 : 0;
+               rcu_read_unlock();
 
                seq_printf(seq, "%s\t%08X\t%08X\t%8X\t%d\t%u\t%d\t"
                              "%08X\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
@@ -427,10 +435,9 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                        dst_metric(&r->dst, RTAX_WINDOW),
                        (int)((dst_metric(&r->dst, RTAX_RTT) >> 3) +
                              dst_metric(&r->dst, RTAX_RTTVAR)),
-                       r->fl.fl4_tos,
-                       r->dst.hh ? atomic_read(&r->dst.hh->hh_refcnt) : -1,
-                       r->dst.hh ? (r->dst.hh->hh_output ==
-                                      dev_queue_xmit) : 0,
+                       r->rt_key_tos,
+                       -1,
+                       HHUptod,
                        r->rt_spec_dst, &len);
 
                seq_printf(seq, "%*s\n", 127 - len, "");
@@ -668,7 +675,7 @@ static inline int rt_fast_clean(struct rtable *rth)
 static inline int rt_valuable(struct rtable *rth)
 {
        return (rth->rt_flags & (RTCF_REDIRECTED | RTCF_NOTIFY)) ||
-               rth->dst.expires;
+               (rth->peer && rth->peer->pmtu_expires);
 }
 
 static int rt_may_expire(struct rtable *rth, unsigned long tmo1, unsigned long tmo2)
@@ -679,13 +686,7 @@ static int rt_may_expire(struct rtable *rth, unsigned long tmo1, unsigned long t
        if (atomic_read(&rth->dst.__refcnt))
                goto out;
 
-       ret = 1;
-       if (rth->dst.expires &&
-           time_after_eq(jiffies, rth->dst.expires))
-               goto out;
-
        age = jiffies - rth->dst.lastuse;
-       ret = 0;
        if ((age <= tmo1 && !rt_fast_clean(rth)) ||
            (age <= tmo2 && rt_valuable(rth)))
                goto out;
@@ -720,22 +721,22 @@ static inline bool rt_caching(const struct net *net)
                net->ipv4.sysctl_rt_cache_rebuild_count;
 }
 
-static inline bool compare_hash_inputs(const struct flowi *fl1,
-                                       const struct flowi *fl2)
+static inline bool compare_hash_inputs(const struct rtable *rt1,
+                                      const struct rtable *rt2)
 {
-       return ((((__force u32)fl1->fl4_dst ^ (__force u32)fl2->fl4_dst) |
-               ((__force u32)fl1->fl4_src ^ (__force u32)fl2->fl4_src) |
-               (fl1->iif ^ fl2->iif)) == 0);
+       return ((((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
+               ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
+               (rt1->rt_route_iif ^ rt2->rt_route_iif)) == 0);
 }
 
-static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
+static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
 {
-       return (((__force u32)fl1->fl4_dst ^ (__force u32)fl2->fl4_dst) |
-               ((__force u32)fl1->fl4_src ^ (__force u32)fl2->fl4_src) |
-               (fl1->mark ^ fl2->mark) |
-               (*(u16 *)&fl1->fl4_tos ^ *(u16 *)&fl2->fl4_tos) |
-               (fl1->oif ^ fl2->oif) |
-               (fl1->iif ^ fl2->iif)) == 0;
+       return (((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
+               ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
+               (rt1->rt_mark ^ rt2->rt_mark) |
+               (rt1->rt_key_tos ^ rt2->rt_key_tos) |
+               (rt1->rt_route_iif ^ rt2->rt_route_iif) |
+               (rt1->rt_oif ^ rt2->rt_oif)) == 0;
 }
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
@@ -822,106 +823,15 @@ static int has_noalias(const struct rtable *head, const struct rtable *rth)
        const struct rtable *aux = head;
 
        while (aux != rth) {
-               if (compare_hash_inputs(&aux->fl, &rth->fl))
+               if (compare_hash_inputs(aux, rth))
                        return 0;
                aux = rcu_dereference_protected(aux->dst.rt_next, 1);
        }
        return ONE;
 }
 
-static void rt_check_expire(void)
-{
-       static unsigned int rover;
-       unsigned int i = rover, goal;
-       struct rtable *rth;
-       struct rtable __rcu **rthp;
-       unsigned long samples = 0;
-       unsigned long sum = 0, sum2 = 0;
-       unsigned long delta;
-       u64 mult;
-
-       delta = jiffies - expires_ljiffies;
-       expires_ljiffies = jiffies;
-       mult = ((u64)delta) << rt_hash_log;
-       if (ip_rt_gc_timeout > 1)
-               do_div(mult, ip_rt_gc_timeout);
-       goal = (unsigned int)mult;
-       if (goal > rt_hash_mask)
-               goal = rt_hash_mask + 1;
-       for (; goal > 0; goal--) {
-               unsigned long tmo = ip_rt_gc_timeout;
-               unsigned long length;
-
-               i = (i + 1) & rt_hash_mask;
-               rthp = &rt_hash_table[i].chain;
-
-               if (need_resched())
-                       cond_resched();
-
-               samples++;
-
-               if (rcu_dereference_raw(*rthp) == NULL)
-                       continue;
-               length = 0;
-               spin_lock_bh(rt_hash_lock_addr(i));
-               while ((rth = rcu_dereference_protected(*rthp,
-                                       lockdep_is_held(rt_hash_lock_addr(i)))) != NULL) {
-                       prefetch(rth->dst.rt_next);
-                       if (rt_is_expired(rth)) {
-                               *rthp = rth->dst.rt_next;
-                               rt_free(rth);
-                               continue;
-                       }
-                       if (rth->dst.expires) {
-                               /* Entry is expired even if it is in use */
-                               if (time_before_eq(jiffies, rth->dst.expires)) {
-nofree:
-                                       tmo >>= 1;
-                                       rthp = &rth->dst.rt_next;
-                                       /*
-                                        * We only count entries on
-                                        * a chain with equal hash inputs once
-                                        * so that entries for different QOS
-                                        * levels, and other non-hash input
-                                        * attributes don't unfairly skew
-                                        * the length computation
-                                        */
-                                       length += has_noalias(rt_hash_table[i].chain, rth);
-                                       continue;
-                               }
-                       } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
-                               goto nofree;
-
-                       /* Cleanup aged off entries. */
-                       *rthp = rth->dst.rt_next;
-                       rt_free(rth);
-               }
-               spin_unlock_bh(rt_hash_lock_addr(i));
-               sum += length;
-               sum2 += length*length;
-       }
-       if (samples) {
-               unsigned long avg = sum / samples;
-               unsigned long sd = int_sqrt(sum2 / samples - avg*avg);
-               rt_chain_length_max = max_t(unsigned long,
-                                       ip_rt_gc_elasticity,
-                                       (avg + 4*sd) >> FRACT_BITS);
-       }
-       rover = i;
-}
-
-/*
- * rt_worker_func() is run in process context.
- * we call rt_check_expire() to scan part of the hash table
- */
-static void rt_worker_func(struct work_struct *work)
-{
-       rt_check_expire();
-       schedule_delayed_work(&expires_work, ip_rt_gc_interval);
-}
-
 /*
- * Pertubation of rt_genid by a small quantity [1..256]
+ * Perturbation of rt_genid by a small quantity [1..256]
  * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
  * many times (2^24) without giving recent rt_genid.
  * Jenkins hash is strong enough that litle changes of rt_genid are OK.
@@ -1068,10 +978,6 @@ static int rt_garbage_collect(struct dst_ops *ops)
                        break;
 
                expire >>= 1;
-#if RT_CACHE_DEBUG >= 2
-               printk(KERN_DEBUG "expire>> %u %d %d %d\n", expire,
-                               dst_entries_get_fast(&ipv4_dst_ops), goal, i);
-#endif
 
                if (dst_entries_get_fast(&ipv4_dst_ops) < ip_rt_max_size)
                        goto out;
@@ -1092,10 +998,6 @@ work_done:
            dst_entries_get_fast(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh ||
            dst_entries_get_slow(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh)
                expire = ip_rt_gc_timeout;
-#if RT_CACHE_DEBUG >= 2
-       printk(KERN_DEBUG "expire++ %u %d %d %d\n", expire,
-                       dst_entries_get_fast(&ipv4_dst_ops), goal, rover);
-#endif
 out:   return 0;
 }
 
@@ -1114,8 +1016,39 @@ static int slow_chain_length(const struct rtable *head)
        return length >> FRACT_BITS;
 }
 
-static int rt_intern_hash(unsigned hash, struct rtable *rt,
-                         struct rtable **rp, struct sk_buff *skb, int ifindex)
+static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst, const void *daddr)
+{
+       struct neigh_table *tbl = &arp_tbl;
+       static const __be32 inaddr_any = 0;
+       struct net_device *dev = dst->dev;
+       const __be32 *pkey = daddr;
+       struct neighbour *n;
+
+#if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
+       if (dev->type == ARPHRD_ATM)
+               tbl = clip_tbl_hook;
+#endif
+       if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
+               pkey = &inaddr_any;
+
+       n = __ipv4_neigh_lookup(tbl, dev, *(__force u32 *)pkey);
+       if (n)
+               return n;
+       return neigh_create(tbl, pkey, dev);
+}
+
+static int rt_bind_neighbour(struct rtable *rt)
+{
+       struct neighbour *n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
+       if (IS_ERR(n))
+               return PTR_ERR(n);
+       dst_set_neighbour(&rt->dst, n);
+
+       return 0;
+}
+
+static struct rtable *rt_intern_hash(unsigned hash, struct rtable *rt,
+                                    struct sk_buff *skb, int ifindex)
 {
        struct rtable   *rth, *cand;
        struct rtable __rcu **rthp, **candp;
@@ -1150,13 +1083,13 @@ restart:
 
                rt->dst.flags |= DST_NOCACHE;
                if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
-                       int err = arp_bind_neighbour(&rt->dst);
+                       int err = rt_bind_neighbour(rt);
                        if (err) {
                                if (net_ratelimit())
                                        printk(KERN_WARNING
                                            "Neighbour table failure & not caching routes.\n");
                                ip_rt_put(rt);
-                               return err;
+                               return ERR_PTR(err);
                        }
                }
 
@@ -1173,7 +1106,7 @@ restart:
                        rt_free(rth);
                        continue;
                }
-               if (compare_keys(&rth->fl, &rt->fl) && compare_netns(rth, rt)) {
+               if (compare_keys(rth, rt) && compare_netns(rth, rt)) {
                        /* Put it first */
                        *rthp = rth->dst.rt_next;
                        /*
@@ -1193,11 +1126,9 @@ restart:
                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
                        rt_drop(rt);
-                       if (rp)
-                               *rp = rth;
-                       else
+                       if (skb)
                                skb_dst_set(skb, &rth->dst);
-                       return 0;
+                       return rth;
                }
 
                if (!atomic_read(&rth->dst.__refcnt)) {
@@ -1238,7 +1169,7 @@ restart:
                        rt_emergency_hash_rebuild(net);
                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
-                       hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
+                       hash = rt_hash(rt->rt_key_dst, rt->rt_key_src,
                                        ifindex, rt_genid(net));
                        goto restart;
                }
@@ -1248,13 +1179,13 @@ restart:
           route or unicast forwarding path.
         */
        if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
-               int err = arp_bind_neighbour(&rt->dst);
+               int err = rt_bind_neighbour(rt);
                if (err) {
                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
                        if (err != -ENOBUFS) {
                                rt_drop(rt);
-                               return err;
+                               return ERR_PTR(err);
                        }
 
                        /* Neighbour tables are full and nothing
@@ -1275,25 +1206,15 @@ restart:
                        if (net_ratelimit())
                                printk(KERN_WARNING "ipv4: Neighbour table overflow.\n");
                        rt_drop(rt);
-                       return -ENOBUFS;
+                       return ERR_PTR(-ENOBUFS);
                }
        }
 
        rt->dst.rt_next = rt_hash_table[hash].chain;
 
-#if RT_CACHE_DEBUG >= 2
-       if (rt->dst.rt_next) {
-               struct rtable *trt;
-               printk(KERN_DEBUG "rt_cache @%02x: %pI4",
-                      hash, &rt->rt_dst);
-               for (trt = rt->dst.rt_next; trt; trt = trt->dst.rt_next)
-                       printk(" . %pI4", &trt->rt_dst);
-               printk("\n");
-       }
-#endif
        /*
         * Since lookup is lockfree, we must make sure
-        * previous writes to rt are comitted to memory
+        * previous writes to rt are committed to memory
         * before making rt visible to other CPUS.
         */
        rcu_assign_pointer(rt_hash_table[hash].chain, rt);
@@ -1301,11 +1222,9 @@ restart:
        spin_unlock_bh(rt_hash_lock_addr(hash));
 
 skip_hashing:
-       if (rp)
-               *rp = rt;
-       else
+       if (skb)
                skb_dst_set(skb, &rt->dst);
-       return 0;
+       return rt;
 }
 
 static atomic_t __rt_peer_genid = ATOMIC_INIT(0);
@@ -1315,11 +1234,11 @@ static u32 rt_peer_genid(void)
        return atomic_read(&__rt_peer_genid);
 }
 
-void rt_bind_peer(struct rtable *rt, int create)
+void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
 {
        struct inet_peer *peer;
 
-       peer = inet_getpeer_v4(rt->rt_dst, create);
+       peer = inet_getpeer_v4(daddr, create);
 
        if (peer && cmpxchg(&rt->peer, NULL, peer) != NULL)
                inet_putpeer(peer);
@@ -1353,7 +1272,7 @@ void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
 
        if (rt) {
                if (rt->peer == NULL)
-                       rt_bind_peer(rt, 1);
+                       rt_bind_peer(rt, rt->rt_dst, 1);
 
                /* If peer is attached to destination, it is never detached,
                   so that we need not to grab a lock to dereference it.
@@ -1390,17 +1309,43 @@ static void rt_del(unsigned hash, struct rtable *rt)
        spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
+static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
+{
+       struct rtable *rt = (struct rtable *) dst;
+       __be32 orig_gw = rt->rt_gateway;
+       struct neighbour *n, *old_n;
+
+       dst_confirm(&rt->dst);
+
+       rt->rt_gateway = peer->redirect_learned.a4;
+
+       n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
+       if (IS_ERR(n))
+               return PTR_ERR(n);
+       old_n = xchg(&rt->dst._neighbour, n);
+       if (old_n)
+               neigh_release(old_n);
+       if (!n || !(n->nud_state & NUD_VALID)) {
+               if (n)
+                       neigh_event_send(n, NULL);
+               rt->rt_gateway = orig_gw;
+               return -EAGAIN;
+       } else {
+               rt->rt_flags |= RTCF_REDIRECTED;
+               call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
+       }
+       return 0;
+}
+
 /* called in rcu_read_lock() section */
 void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                    __be32 saddr, struct net_device *dev)
 {
-       int i, k;
+       int s, i;
        struct in_device *in_dev = __in_dev_get_rcu(dev);
-       struct rtable *rth;
-       struct rtable __rcu **rthp;
-       __be32  skeys[2] = { saddr, 0 };
-       int  ikeys[2] = { dev->ifindex, 0 };
-       struct netevent_redirect netevent;
+       __be32 skeys[2] = { saddr, 0 };
+       int    ikeys[2] = { dev->ifindex, 0 };
+       struct inet_peer *peer;
        struct net *net;
 
        if (!in_dev)
@@ -1412,9 +1357,6 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
            ipv4_is_zeronet(new_gw))
                goto reject_redirect;
 
-       if (!rt_caching(net))
-               goto reject_redirect;
-
        if (!IN_DEV_SHARED_MEDIA(in_dev)) {
                if (!inet_addr_onlink(in_dev, new_gw, old_gw))
                        goto reject_redirect;
@@ -1425,92 +1367,42 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                        goto reject_redirect;
        }
 
-       for (i = 0; i < 2; i++) {
-               for (k = 0; k < 2; k++) {
-                       unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
-                                               rt_genid(net));
+       for (s = 0; s < 2; s++) {
+               for (i = 0; i < 2; i++) {
+                       unsigned int hash;
+                       struct rtable __rcu **rthp;
+                       struct rtable *rt;
+
+                       hash = rt_hash(daddr, skeys[s], ikeys[i], rt_genid(net));
 
                        rthp = &rt_hash_table[hash].chain;
 
-                       while ((rth = rcu_dereference(*rthp)) != NULL) {
-                               struct rtable *rt;
-
-                               if (rth->fl.fl4_dst != daddr ||
-                                   rth->fl.fl4_src != skeys[i] ||
-                                   rth->fl.oif != ikeys[k] ||
-                                   rt_is_input_route(rth) ||
-                                   rt_is_expired(rth) ||
-                                   !net_eq(dev_net(rth->dst.dev), net)) {
-                                       rthp = &rth->dst.rt_next;
+                       while ((rt = rcu_dereference(*rthp)) != NULL) {
+                               rthp = &rt->dst.rt_next;
+
+                               if (rt->rt_key_dst != daddr ||
+                                   rt->rt_key_src != skeys[s] ||
+                                   rt->rt_oif != ikeys[i] ||
+                                   rt_is_input_route(rt) ||
+                                   rt_is_expired(rt) ||
+                                   !net_eq(dev_net(rt->dst.dev), net) ||
+                                   rt->dst.error ||
+                                   rt->dst.dev != dev ||
+                                   rt->rt_gateway != old_gw)
                                        continue;
-                               }
 
-                               if (rth->rt_dst != daddr ||
-                                   rth->rt_src != saddr ||
-                                   rth->dst.error ||
-                                   rth->rt_gateway != old_gw ||
-                                   rth->dst.dev != dev)
-                                       break;
+                               if (!rt->peer)
+                                       rt_bind_peer(rt, rt->rt_dst, 1);
 
-                               dst_hold(&rth->dst);
-
-                               rt = dst_alloc(&ipv4_dst_ops);
-                               if (rt == NULL) {
-                                       ip_rt_put(rth);
-                                       return;
-                               }
-
-                               /* Copy all the information. */
-                               *rt = *rth;
-                               rt->dst.__use           = 1;
-                               atomic_set(&rt->dst.__refcnt, 1);
-                               rt->dst.child           = NULL;
-                               if (rt->dst.dev)
-                                       dev_hold(rt->dst.dev);
-                               rt->dst.obsolete        = -1;
-                               rt->dst.lastuse = jiffies;
-                               rt->dst.path            = &rt->dst;
-                               rt->dst.neighbour       = NULL;
-                               rt->dst.hh              = NULL;
-#ifdef CONFIG_XFRM
-                               rt->dst.xfrm            = NULL;
-#endif
-                               rt->rt_genid            = rt_genid(net);
-                               rt->rt_flags            |= RTCF_REDIRECTED;
-
-                               /* Gateway is different ... */
-                               rt->rt_gateway          = new_gw;
-
-                               /* Redirect received -> path was valid */
-                               dst_confirm(&rth->dst);
-
-                               if (rt->peer)
-                                       atomic_inc(&rt->peer->refcnt);
-                               if (rt->fi)
-                                       atomic_inc(&rt->fi->fib_clntref);
-
-                               if (arp_bind_neighbour(&rt->dst) ||
-                                   !(rt->dst.neighbour->nud_state &
-                                           NUD_VALID)) {
-                                       if (rt->dst.neighbour)
-                                               neigh_event_send(rt->dst.neighbour, NULL);
-                                       ip_rt_put(rth);
-                                       rt_drop(rt);
-                                       goto do_next;
+                               peer = rt->peer;
+                               if (peer) {
+                                       if (peer->redirect_learned.a4 != new_gw) {
+                                               peer->redirect_learned.a4 = new_gw;
+                                               atomic_inc(&__rt_peer_genid);
+                                       }
+                                       check_peer_redir(&rt->dst, peer);
                                }
-
-                               netevent.old = &rth->dst;
-                               netevent.new = &rt->dst;
-                               call_netevent_notifiers(NETEVENT_REDIRECT,
-                                                       &netevent);
-
-                               rt_del(hash, rth);
-                               if (!rt_intern_hash(hash, rt, &rt, NULL, rt->fl.oif))
-                                       ip_rt_put(rt);
-                               goto do_next;
                        }
-               do_next:
-                       ;
                }
        }
        return;
@@ -1526,6 +1418,23 @@ reject_redirect:
        ;
 }
 
+static bool peer_pmtu_expired(struct inet_peer *peer)
+{
+       unsigned long orig = ACCESS_ONCE(peer->pmtu_expires);
+
+       return orig &&
+              time_after_eq(jiffies, orig) &&
+              cmpxchg(&peer->pmtu_expires, orig, 0) == orig;
+}
+
+static bool peer_pmtu_cleaned(struct inet_peer *peer)
+{
+       unsigned long orig = ACCESS_ONCE(peer->pmtu_expires);
+
+       return orig &&
+              cmpxchg(&peer->pmtu_expires, orig, 0) == orig;
+}
+
 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
 {
        struct rtable *rt = (struct rtable *)dst;
@@ -1535,18 +1444,14 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
                if (dst->obsolete > 0) {
                        ip_rt_put(rt);
                        ret = NULL;
-               } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-                          (rt->dst.expires &&
-                           time_after_eq(jiffies, rt->dst.expires))) {
-                       unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
-                                               rt->fl.oif,
+               } else if (rt->rt_flags & RTCF_REDIRECTED) {
+                       unsigned hash = rt_hash(rt->rt_key_dst, rt->rt_key_src,
+                                               rt->rt_oif,
                                                rt_genid(dev_net(dst->dev)));
-#if RT_CACHE_DEBUG >= 1
-                       printk(KERN_DEBUG "ipv4_negative_advice: redirect to %pI4/%02x dropped\n",
-                               &rt->rt_dst, rt->fl.fl4_tos);
-#endif
                        rt_del(hash, rt);
                        ret = NULL;
+               } else if (rt->peer && peer_pmtu_expired(rt->peer)) {
+                       dst_metric_set(dst, RTAX_MTU, rt->peer->pmtu_orig);
                }
        }
        return ret;
@@ -1585,7 +1490,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
        rcu_read_unlock();
 
        if (!rt->peer)
-               rt_bind_peer(rt, 1);
+               rt_bind_peer(rt, rt->rt_dst, 1);
        peer = rt->peer;
        if (!peer) {
                icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, rt->rt_gateway);
@@ -1621,7 +1526,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                    peer->rate_tokens == ip_rt_redirect_number &&
                    net_ratelimit())
                        printk(KERN_WARNING "host %pI4/if%d ignores redirects for %pI4 to %pI4.\n",
-                               &rt->rt_src, rt->rt_iif,
+                              &ip_hdr(skb)->saddr, rt->rt_iif,
                                &rt->rt_dst, &rt->rt_gateway);
 #endif
        }
@@ -1636,24 +1541,24 @@ static int ip_error(struct sk_buff *skb)
        int code;
 
        switch (rt->dst.error) {
-               case EINVAL:
-               default:
-                       goto out;
-               case EHOSTUNREACH:
-                       code = ICMP_HOST_UNREACH;
-                       break;
-               case ENETUNREACH:
-                       code = ICMP_NET_UNREACH;
-                       IP_INC_STATS_BH(dev_net(rt->dst.dev),
-                                       IPSTATS_MIB_INNOROUTES);
-                       break;
-               case EACCES:
-                       code = ICMP_PKT_FILTERED;
-                       break;
+       case EINVAL:
+       default:
+               goto out;
+       case EHOSTUNREACH:
+               code = ICMP_HOST_UNREACH;
+               break;
+       case ENETUNREACH:
+               code = ICMP_NET_UNREACH;
+               IP_INC_STATS_BH(dev_net(rt->dst.dev),
+                               IPSTATS_MIB_INNOROUTES);
+               break;
+       case EACCES:
+               code = ICMP_PKT_FILTERED;
+               break;
        }
 
        if (!rt->peer)
-               rt_bind_peer(rt, 1);
+               rt_bind_peer(rt, rt->rt_dst, 1);
        peer = rt->peer;
 
        send = true;
@@ -1693,87 +1598,98 @@ static inline unsigned short guess_mtu(unsigned short old_mtu)
        return 68;
 }
 
-unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
+unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
                                 unsigned short new_mtu,
                                 struct net_device *dev)
 {
-       int i, k;
        unsigned short old_mtu = ntohs(iph->tot_len);
-       struct rtable *rth;
-       int  ikeys[2] = { dev->ifindex, 0 };
-       __be32  skeys[2] = { iph->saddr, 0, };
-       __be32  daddr = iph->daddr;
        unsigned short est_mtu = 0;
+       struct inet_peer *peer;
 
-       for (k = 0; k < 2; k++) {
-               for (i = 0; i < 2; i++) {
-                       unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
-                                               rt_genid(net));
-
-                       rcu_read_lock();
-                       for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
-                            rth = rcu_dereference(rth->dst.rt_next)) {
-                               unsigned short mtu = new_mtu;
-
-                               if (rth->fl.fl4_dst != daddr ||
-                                   rth->fl.fl4_src != skeys[i] ||
-                                   rth->rt_dst != daddr ||
-                                   rth->rt_src != iph->saddr ||
-                                   rth->fl.oif != ikeys[k] ||
-                                   rt_is_input_route(rth) ||
-                                   dst_metric_locked(&rth->dst, RTAX_MTU) ||
-                                   !net_eq(dev_net(rth->dst.dev), net) ||
-                                   rt_is_expired(rth))
-                                       continue;
+       peer = inet_getpeer_v4(iph->daddr, 1);
+       if (peer) {
+               unsigned short mtu = new_mtu;
 
-                               if (new_mtu < 68 || new_mtu >= old_mtu) {
+               if (new_mtu < 68 || new_mtu >= old_mtu) {
+                       /* BSD 4.2 derived systems incorrectly adjust
+                        * tot_len by the IP header length, and report
+                        * a zero MTU in the ICMP message.
+                        */
+                       if (mtu == 0 &&
+                           old_mtu >= 68 + (iph->ihl << 2))
+                               old_mtu -= iph->ihl << 2;
+                       mtu = guess_mtu(old_mtu);
+               }
 
-                                       /* BSD 4.2 compatibility hack :-( */
-                                       if (mtu == 0 &&
-                                           old_mtu >= dst_mtu(&rth->dst) &&
-                                           old_mtu >= 68 + (iph->ihl << 2))
-                                               old_mtu -= iph->ihl << 2;
+               if (mtu < ip_rt_min_pmtu)
+                       mtu = ip_rt_min_pmtu;
+               if (!peer->pmtu_expires || mtu < peer->pmtu_learned) {
+                       unsigned long pmtu_expires;
 
-                                       mtu = guess_mtu(old_mtu);
-                               }
-                               if (mtu <= dst_mtu(&rth->dst)) {
-                                       if (mtu < dst_mtu(&rth->dst)) {
-                                               dst_confirm(&rth->dst);
-                                               if (mtu < ip_rt_min_pmtu) {
-                                                       u32 lock = dst_metric(&rth->dst,
-                                                                             RTAX_LOCK);
-                                                       mtu = ip_rt_min_pmtu;
-                                                       lock |= (1 << RTAX_MTU);
-                                                       dst_metric_set(&rth->dst, RTAX_LOCK,
-                                                                      lock);
-                                               }
-                                               dst_metric_set(&rth->dst, RTAX_MTU, mtu);
-                                               dst_set_expires(&rth->dst,
-                                                       ip_rt_mtu_expires);
-                                       }
-                                       est_mtu = mtu;
-                               }
-                       }
-                       rcu_read_unlock();
+                       pmtu_expires = jiffies + ip_rt_mtu_expires;
+                       if (!pmtu_expires)
+                               pmtu_expires = 1UL;
+
+                       est_mtu = mtu;
+                       peer->pmtu_learned = mtu;
+                       peer->pmtu_expires = pmtu_expires;
+                       atomic_inc(&__rt_peer_genid);
                }
+
+               inet_putpeer(peer);
        }
        return est_mtu ? : new_mtu;
 }
 
+static void check_peer_pmtu(struct dst_entry *dst, struct inet_peer *peer)
+{
+       unsigned long expires = ACCESS_ONCE(peer->pmtu_expires);
+
+       if (!expires)
+               return;
+       if (time_before(jiffies, expires)) {
+               u32 orig_dst_mtu = dst_mtu(dst);
+               if (peer->pmtu_learned < orig_dst_mtu) {
+                       if (!peer->pmtu_orig)
+                               peer->pmtu_orig = dst_metric_raw(dst, RTAX_MTU);
+                       dst_metric_set(dst, RTAX_MTU, peer->pmtu_learned);
+               }
+       } else if (cmpxchg(&peer->pmtu_expires, expires, 0) == expires)
+               dst_metric_set(dst, RTAX_MTU, peer->pmtu_orig);
+}
+
 static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
-       if (dst_mtu(dst) > mtu && mtu >= 68 &&
-           !(dst_metric_locked(dst, RTAX_MTU))) {
-               if (mtu < ip_rt_min_pmtu) {
-                       u32 lock = dst_metric(dst, RTAX_LOCK);
+       struct rtable *rt = (struct rtable *) dst;
+       struct inet_peer *peer;
+
+       dst_confirm(dst);
+
+       if (!rt->peer)
+               rt_bind_peer(rt, rt->rt_dst, 1);
+       peer = rt->peer;
+       if (peer) {
+               unsigned long pmtu_expires = ACCESS_ONCE(peer->pmtu_expires);
+
+               if (mtu < ip_rt_min_pmtu)
                        mtu = ip_rt_min_pmtu;
-                       dst_metric_set(dst, RTAX_LOCK, lock | (1 << RTAX_MTU));
+               if (!pmtu_expires || mtu < peer->pmtu_learned) {
+
+                       pmtu_expires = jiffies + ip_rt_mtu_expires;
+                       if (!pmtu_expires)
+                               pmtu_expires = 1UL;
+
+                       peer->pmtu_learned = mtu;
+                       peer->pmtu_expires = pmtu_expires;
+
+                       atomic_inc(&__rt_peer_genid);
+                       rt->rt_peer_genid = rt_peer_genid();
                }
-               dst_metric_set(dst, RTAX_MTU, mtu);
-               dst_set_expires(dst, ip_rt_mtu_expires);
+               check_peer_pmtu(dst, peer);
        }
 }
 
+
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
        struct rtable *rt = (struct rtable *) dst;
@@ -1781,8 +1697,21 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
        if (rt_is_expired(rt))
                return NULL;
        if (rt->rt_peer_genid != rt_peer_genid()) {
+               struct inet_peer *peer;
+
                if (!rt->peer)
-                       rt_bind_peer(rt, 0);
+                       rt_bind_peer(rt, rt->rt_dst, 0);
+
+               peer = rt->peer;
+               if (peer) {
+                       check_peer_pmtu(dst, peer);
+
+                       if (peer->redirect_learned.a4 &&
+                           peer->redirect_learned.a4 != rt->rt_gateway) {
+                               if (check_peer_redir(dst, peer))
+                                       return NULL;
+                       }
+               }
 
                rt->rt_peer_genid = rt_peer_genid();
        }
@@ -1812,8 +1741,8 @@ static void ipv4_link_failure(struct sk_buff *skb)
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
 
        rt = skb_rtable(skb);
-       if (rt)
-               dst_set_expires(&rt->dst, 0);
+       if (rt && rt->peer && peer_pmtu_cleaned(rt->peer))
+               dst_metric_set(&rt->dst, RTAX_MTU, rt->peer->pmtu_orig);
 }
 
 static int ip_rt_bug(struct sk_buff *skb)
@@ -1822,6 +1751,7 @@ static int ip_rt_bug(struct sk_buff *skb)
                &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
                skb->dev ? skb->dev->name : "?");
        kfree_skb(skb);
+       WARN_ON(1);
        return 0;
 }
 
@@ -1834,17 +1764,30 @@ static int ip_rt_bug(struct sk_buff *skb)
    in IP options!
  */
 
-void ip_rt_get_source(u8 *addr, struct rtable *rt)
+void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
 {
        __be32 src;
-       struct fib_result res;
 
        if (rt_is_output_route(rt))
-               src = rt->rt_src;
+               src = ip_hdr(skb)->saddr;
        else {
+               struct fib_result res;
+               struct flowi4 fl4;
+               struct iphdr *iph;
+
+               iph = ip_hdr(skb);
+
+               memset(&fl4, 0, sizeof(fl4));
+               fl4.daddr = iph->daddr;
+               fl4.saddr = iph->saddr;
+               fl4.flowi4_tos = RT_TOS(iph->tos);
+               fl4.flowi4_oif = rt->dst.dev->ifindex;
+               fl4.flowi4_iif = skb->dev->ifindex;
+               fl4.flowi4_mark = skb->mark;
+
                rcu_read_lock();
-               if (fib_lookup(dev_net(rt->dst.dev), &rt->fl, &res) == 0)
-                       src = FIB_RES_PREFSRC(res);
+               if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res) == 0)
+                       src = FIB_RES_PREFSRC(dev_net(rt->dst.dev), res);
                else
                        src = inet_select_addr(rt->dst.dev, rt->rt_gateway,
                                        RT_SCOPE_UNIVERSE);
@@ -1893,7 +1836,8 @@ static unsigned int ipv4_default_mtu(const struct dst_entry *dst)
        return mtu;
 }
 
-static void rt_init_metrics(struct rtable *rt, struct fib_info *fi)
+static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
+                           struct fib_info *fi)
 {
        struct inet_peer *peer;
        int create = 0;
@@ -1901,16 +1845,23 @@ static void rt_init_metrics(struct rtable *rt, struct fib_info *fi)
        /* If a peer entry exists for this destination, we must hook
         * it up in order to get at cached metrics.
         */
-       if (rt->fl.flags & FLOWI_FLAG_PRECOW_METRICS)
+       if (fl4 && (fl4->flowi4_flags & FLOWI_FLAG_PRECOW_METRICS))
                create = 1;
 
-       rt_bind_peer(rt, create);
-       peer = rt->peer;
+       rt->peer = peer = inet_getpeer_v4(rt->rt_dst, create);
        if (peer) {
+               rt->rt_peer_genid = rt_peer_genid();
                if (inet_metrics_new(peer))
                        memcpy(peer->metrics, fi->fib_metrics,
                               sizeof(u32) * RTAX_MAX);
                dst_init_metrics(&rt->dst, peer->metrics, false);
+
+               check_peer_pmtu(&rt->dst, peer);
+               if (peer->redirect_learned.a4 &&
+                   peer->redirect_learned.a4 != rt->rt_gateway) {
+                       rt->rt_gateway = peer->redirect_learned.a4;
+                       rt->rt_flags |= RTCF_REDIRECTED;
+               }
        } else {
                if (fi->fib_metrics != (u32 *) dst_default_metrics) {
                        rt->fi = fi;
@@ -1920,16 +1871,17 @@ static void rt_init_metrics(struct rtable *rt, struct fib_info *fi)
        }
 }
 
-static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
+static void rt_set_nexthop(struct rtable *rt, const struct flowi4 *fl4,
+                          const struct fib_result *res,
+                          struct fib_info *fi, u16 type, u32 itag)
 {
        struct dst_entry *dst = &rt->dst;
-       struct fib_info *fi = res->fi;
 
        if (fi) {
                if (FIB_RES_GW(*res) &&
                    FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
                        rt->rt_gateway = FIB_RES_GW(*res);
-               rt_init_metrics(rt, fi);
+               rt_init_metrics(rt, fl4, fi);
 #ifdef CONFIG_IP_ROUTE_CLASSID
                dst->tclassid = FIB_RES_NH(*res).nh_tclassid;
 #endif
@@ -1946,7 +1898,15 @@ static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
 #endif
        set_class_tag(rt, itag);
 #endif
-       rt->rt_type = res->type;
+}
+
+static struct rtable *rt_dst_alloc(struct net_device *dev,
+                                  bool nopolicy, bool noxfrm)
+{
+       return dst_alloc(&ipv4_dst_ops, dev, 1, -1,
+                        DST_HOST |
+                        (nopolicy ? DST_NOPOLICY : 0) |
+                        (noxfrm ? DST_NOXFRM : 0));
 }
 
 /* called in rcu_read_lock() section */
@@ -1974,41 +1934,38 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                        goto e_inval;
                spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
        } else {
-               err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                         &itag, 0);
+               err = fib_validate_source(skb, saddr, 0, tos, 0, dev, &spec_dst,
+                                         &itag);
                if (err < 0)
                        goto e_err;
        }
-       rth = dst_alloc(&ipv4_dst_ops);
+       rth = rt_dst_alloc(init_net.loopback_dev,
+                          IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
        if (!rth)
                goto e_nobufs;
 
-       rth->dst.output = ip_rt_bug;
-       rth->dst.obsolete = -1;
-
-       atomic_set(&rth->dst.__refcnt, 1);
-       rth->dst.flags= DST_HOST;
-       if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-               rth->dst.flags |= DST_NOPOLICY;
-       rth->fl.fl4_dst = daddr;
-       rth->rt_dst     = daddr;
-       rth->fl.fl4_tos = tos;
-       rth->fl.mark    = skb->mark;
-       rth->fl.fl4_src = saddr;
-       rth->rt_src     = saddr;
 #ifdef CONFIG_IP_ROUTE_CLASSID
        rth->dst.tclassid = itag;
 #endif
-       rth->rt_iif     =
-       rth->fl.iif     = dev->ifindex;
-       rth->dst.dev    = init_net.loopback_dev;
-       dev_hold(rth->dst.dev);
-       rth->fl.oif     = 0;
-       rth->rt_gateway = daddr;
-       rth->rt_spec_dst= spec_dst;
+       rth->dst.output = ip_rt_bug;
+
+       rth->rt_key_dst = daddr;
+       rth->rt_key_src = saddr;
        rth->rt_genid   = rt_genid(dev_net(dev));
        rth->rt_flags   = RTCF_MULTICAST;
        rth->rt_type    = RTN_MULTICAST;
+       rth->rt_key_tos = tos;
+       rth->rt_dst     = daddr;
+       rth->rt_src     = saddr;
+       rth->rt_route_iif = dev->ifindex;
+       rth->rt_iif     = dev->ifindex;
+       rth->rt_oif     = 0;
+       rth->rt_mark    = skb->mark;
+       rth->rt_gateway = daddr;
+       rth->rt_spec_dst= spec_dst;
+       rth->rt_peer_genid = 0;
+       rth->peer = NULL;
+       rth->fi = NULL;
        if (our) {
                rth->dst.input= ip_local_deliver;
                rth->rt_flags |= RTCF_LOCAL;
@@ -2021,7 +1978,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
        RT_CACHE_STAT_INC(in_slow_mc);
 
        hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
-       return rt_intern_hash(hash, rth, NULL, skb, dev->ifindex);
+       rth = rt_intern_hash(hash, rth, skb, dev->ifindex);
+       return IS_ERR(rth) ? PTR_ERR(rth) : 0;
 
 e_nobufs:
        return -ENOBUFS;
@@ -2064,7 +2022,7 @@ static void ip_handle_martian_source(struct net_device *dev,
 
 /* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
-                          struct fib_result *res,
+                          const struct fib_result *res,
                           struct in_device *in_dev,
                           __be32 daddr, __be32 saddr, u32 tos,
                           struct rtable **result)
@@ -2086,8 +2044,8 @@ static int __mkroute_input(struct sk_buff *skb,
        }
 
 
-       err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(*res),
-                                 in_dev->dev, &spec_dst, &itag, skb->mark);
+       err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
+                                 in_dev->dev, &spec_dst, &itag);
        if (err < 0) {
                ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                         saddr);
@@ -2118,41 +2076,36 @@ static int __mkroute_input(struct sk_buff *skb,
                }
        }
 
-
-       rth = dst_alloc(&ipv4_dst_ops);
+       rth = rt_dst_alloc(out_dev->dev,
+                          IN_DEV_CONF_GET(in_dev, NOPOLICY),
+                          IN_DEV_CONF_GET(out_dev, NOXFRM));
        if (!rth) {
                err = -ENOBUFS;
                goto cleanup;
        }
 
-       atomic_set(&rth->dst.__refcnt, 1);
-       rth->dst.flags= DST_HOST;
-       if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-               rth->dst.flags |= DST_NOPOLICY;
-       if (IN_DEV_CONF_GET(out_dev, NOXFRM))
-               rth->dst.flags |= DST_NOXFRM;
-       rth->fl.fl4_dst = daddr;
+       rth->rt_key_dst = daddr;
+       rth->rt_key_src = saddr;
+       rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
+       rth->rt_flags = flags;
+       rth->rt_type = res->type;
+       rth->rt_key_tos = tos;
        rth->rt_dst     = daddr;
-       rth->fl.fl4_tos = tos;
-       rth->fl.mark    = skb->mark;
-       rth->fl.fl4_src = saddr;
        rth->rt_src     = saddr;
+       rth->rt_route_iif = in_dev->dev->ifindex;
+       rth->rt_iif     = in_dev->dev->ifindex;
+       rth->rt_oif     = 0;
+       rth->rt_mark    = skb->mark;
        rth->rt_gateway = daddr;
-       rth->rt_iif     =
-               rth->fl.iif     = in_dev->dev->ifindex;
-       rth->dst.dev    = (out_dev)->dev;
-       dev_hold(rth->dst.dev);
-       rth->fl.oif     = 0;
        rth->rt_spec_dst= spec_dst;
+       rth->rt_peer_genid = 0;
+       rth->peer = NULL;
+       rth->fi = NULL;
 
-       rth->dst.obsolete = -1;
        rth->dst.input = ip_forward;
        rth->dst.output = ip_output;
-       rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
 
-       rt_set_nexthop(rth, res, itag);
-
-       rth->rt_flags = flags;
+       rt_set_nexthop(rth, NULL, res, res->fi, res->type, itag);
 
        *result = rth;
        err = 0;
@@ -2162,7 +2115,7 @@ static int __mkroute_input(struct sk_buff *skb,
 
 static int ip_mkroute_input(struct sk_buff *skb,
                            struct fib_result *res,
-                           const struct flowi *fl,
+                           const struct flowi4 *fl4,
                            struct in_device *in_dev,
                            __be32 daddr, __be32 saddr, u32 tos)
 {
@@ -2171,8 +2124,8 @@ static int ip_mkroute_input(struct sk_buff *skb,
        unsigned hash;
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-       if (res->fi && res->fi->fib_nhs > 1 && fl->oif == 0)
-               fib_select_multipath(fl, res);
+       if (res->fi && res->fi->fib_nhs > 1)
+               fib_select_multipath(res);
 #endif
 
        /* create a routing cache entry */
@@ -2181,9 +2134,12 @@ static int ip_mkroute_input(struct sk_buff *skb,
                return err;
 
        /* put it into the cache */
-       hash = rt_hash(daddr, saddr, fl->iif,
+       hash = rt_hash(daddr, saddr, fl4->flowi4_iif,
                       rt_genid(dev_net(rth->dst.dev)));
-       return rt_intern_hash(hash, rth, NULL, skb, fl->iif);
+       rth = rt_intern_hash(hash, rth, skb, fl4->flowi4_iif);
+       if (IS_ERR(rth))
+               return PTR_ERR(rth);
+       return 0;
 }
 
 /*
@@ -2202,12 +2158,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 {
        struct fib_result res;
        struct in_device *in_dev = __in_dev_get_rcu(dev);
-       struct flowi fl = { .fl4_dst    = daddr,
-                           .fl4_src    = saddr,
-                           .fl4_tos    = tos,
-                           .fl4_scope  = RT_SCOPE_UNIVERSE,
-                           .mark = skb->mark,
-                           .iif = dev->ifindex };
+       struct flowi4   fl4;
        unsigned        flags = 0;
        u32             itag = 0;
        struct rtable * rth;
@@ -2244,7 +2195,14 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
        /*
         *      Now we are ready to route packet.
         */
-       err = fib_lookup(net, &fl, &res);
+       fl4.flowi4_oif = 0;
+       fl4.flowi4_iif = dev->ifindex;
+       fl4.flowi4_mark = skb->mark;
+       fl4.flowi4_tos = tos;
+       fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+       fl4.daddr = daddr;
+       fl4.saddr = saddr;
+       err = fib_lookup(net, &fl4, &res);
        if (err != 0) {
                if (!IN_DEV_FORWARD(in_dev))
                        goto e_hostunreach;
@@ -2257,9 +2215,9 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                goto brd_input;
 
        if (res.type == RTN_LOCAL) {
-               err = fib_validate_source(saddr, daddr, tos,
+               err = fib_validate_source(skb, saddr, daddr, tos,
                                          net->loopback_dev->ifindex,
-                                         dev, &spec_dst, &itag, skb->mark);
+                                         dev, &spec_dst, &itag);
                if (err < 0)
                        goto martian_source_keep_err;
                if (err)
@@ -2273,7 +2231,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
        if (res.type != RTN_UNICAST)
                goto martian_destination;
 
-       err = ip_mkroute_input(skb, &res, &fl, in_dev, daddr, saddr, tos);
+       err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
 out:   return err;
 
 brd_input:
@@ -2283,8 +2241,8 @@ brd_input:
        if (ipv4_is_zeronet(saddr))
                spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
        else {
-               err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                         &itag, skb->mark);
+               err = fib_validate_source(skb, saddr, 0, tos, 0, dev, &spec_dst,
+                                         &itag);
                if (err < 0)
                        goto martian_source_keep_err;
                if (err)
@@ -2295,43 +2253,47 @@ brd_input:
        RT_CACHE_STAT_INC(in_brd);
 
 local_input:
-       rth = dst_alloc(&ipv4_dst_ops);
+       rth = rt_dst_alloc(net->loopback_dev,
+                          IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
        if (!rth)
                goto e_nobufs;
 
+       rth->dst.input= ip_local_deliver;
        rth->dst.output= ip_rt_bug;
-       rth->dst.obsolete = -1;
-       rth->rt_genid = rt_genid(net);
+#ifdef CONFIG_IP_ROUTE_CLASSID
+       rth->dst.tclassid = itag;
+#endif
 
-       atomic_set(&rth->dst.__refcnt, 1);
-       rth->dst.flags= DST_HOST;
-       if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-               rth->dst.flags |= DST_NOPOLICY;
-       rth->fl.fl4_dst = daddr;
+       rth->rt_key_dst = daddr;
+       rth->rt_key_src = saddr;
+       rth->rt_genid = rt_genid(net);
+       rth->rt_flags   = flags|RTCF_LOCAL;
+       rth->rt_type    = res.type;
+       rth->rt_key_tos = tos;
        rth->rt_dst     = daddr;
-       rth->fl.fl4_tos = tos;
-       rth->fl.mark    = skb->mark;
-       rth->fl.fl4_src = saddr;
        rth->rt_src     = saddr;
 #ifdef CONFIG_IP_ROUTE_CLASSID
        rth->dst.tclassid = itag;
 #endif
-       rth->rt_iif     =
-       rth->fl.iif     = dev->ifindex;
-       rth->dst.dev    = net->loopback_dev;
-       dev_hold(rth->dst.dev);
+       rth->rt_route_iif = dev->ifindex;
+       rth->rt_iif     = dev->ifindex;
+       rth->rt_oif     = 0;
+       rth->rt_mark    = skb->mark;
        rth->rt_gateway = daddr;
        rth->rt_spec_dst= spec_dst;
-       rth->dst.input= ip_local_deliver;
-       rth->rt_flags   = flags|RTCF_LOCAL;
+       rth->rt_peer_genid = 0;
+       rth->peer = NULL;
+       rth->fi = NULL;
        if (res.type == RTN_UNREACHABLE) {
                rth->dst.input= ip_error;
                rth->dst.error= -err;
                rth->rt_flags   &= ~RTCF_LOCAL;
        }
-       rth->rt_type    = res.type;
-       hash = rt_hash(daddr, saddr, fl.iif, rt_genid(net));
-       err = rt_intern_hash(hash, rth, NULL, skb, fl.iif);
+       hash = rt_hash(daddr, saddr, fl4.flowi4_iif, rt_genid(net));
+       rth = rt_intern_hash(hash, rth, skb, fl4.flowi4_iif);
+       err = 0;
+       if (IS_ERR(rth))
+               err = PTR_ERR(rth);
        goto out;
 
 no_route:
@@ -2393,12 +2355,11 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
        for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
             rth = rcu_dereference(rth->dst.rt_next)) {
-               if ((((__force u32)rth->fl.fl4_dst ^ (__force u32)daddr) |
-                    ((__force u32)rth->fl.fl4_src ^ (__force u32)saddr) |
-                    (rth->fl.iif ^ iif) |
-                    rth->fl.oif |
-                    (rth->fl.fl4_tos ^ tos)) == 0 &&
-                   rth->fl.mark == skb->mark &&
+               if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
+                    ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
+                    (rth->rt_route_iif ^ iif) |
+                    (rth->rt_key_tos ^ tos)) == 0 &&
+                   rth->rt_mark == skb->mark &&
                    net_eq(dev_net(rth->dst.dev), net) &&
                    !rt_is_expired(rth)) {
                        if (noref) {
@@ -2431,8 +2392,8 @@ skip_cache:
                struct in_device *in_dev = __in_dev_get_rcu(dev);
 
                if (in_dev) {
-                       int our = ip_check_mc(in_dev, daddr, saddr,
-                                             ip_hdr(skb)->protocol);
+                       int our = ip_check_mc_rcu(in_dev, daddr, saddr,
+                                                 ip_hdr(skb)->protocol);
                        if (our
 #ifdef CONFIG_IP_MROUTE
                                ||
@@ -2456,98 +2417,94 @@ skip_cache:
 EXPORT_SYMBOL(ip_route_input_common);
 
 /* called with rcu_read_lock() */
-static int __mkroute_output(struct rtable **result,
-                           struct fib_result *res,
-                           const struct flowi *fl,
-                           const struct flowi *oldflp,
-                           struct net_device *dev_out,
-                           unsigned flags)
+static struct rtable *__mkroute_output(const struct fib_result *res,
+                                      const struct flowi4 *fl4,
+                                      __be32 orig_daddr, __be32 orig_saddr,
+                                      int orig_oif, struct net_device *dev_out,
+                                      unsigned int flags)
 {
-       struct rtable *rth;
+       struct fib_info *fi = res->fi;
+       u32 tos = RT_FL_TOS(fl4);
        struct in_device *in_dev;
-       u32 tos = RT_FL_TOS(oldflp);
+       u16 type = res->type;
+       struct rtable *rth;
 
-       if (ipv4_is_loopback(fl->fl4_src) && !(dev_out->flags & IFF_LOOPBACK))
-               return -EINVAL;
+       if (ipv4_is_loopback(fl4->saddr) && !(dev_out->flags & IFF_LOOPBACK))
+               return ERR_PTR(-EINVAL);
 
-       if (ipv4_is_lbcast(fl->fl4_dst))
-               res->type = RTN_BROADCAST;
-       else if (ipv4_is_multicast(fl->fl4_dst))
-               res->type = RTN_MULTICAST;
-       else if (ipv4_is_zeronet(fl->fl4_dst))
-               return -EINVAL;
+       if (ipv4_is_lbcast(fl4->daddr))
+               type = RTN_BROADCAST;
+       else if (ipv4_is_multicast(fl4->daddr))
+               type = RTN_MULTICAST;
+       else if (ipv4_is_zeronet(fl4->daddr))
+               return ERR_PTR(-EINVAL);
 
        if (dev_out->flags & IFF_LOOPBACK)
                flags |= RTCF_LOCAL;
 
        in_dev = __in_dev_get_rcu(dev_out);
        if (!in_dev)
-               return -EINVAL;
+               return ERR_PTR(-EINVAL);
 
-       if (res->type == RTN_BROADCAST) {
+       if (type == RTN_BROADCAST) {
                flags |= RTCF_BROADCAST | RTCF_LOCAL;
-               res->fi = NULL;
-       } else if (res->type == RTN_MULTICAST) {
+               fi = NULL;
+       } else if (type == RTN_MULTICAST) {
                flags |= RTCF_MULTICAST | RTCF_LOCAL;
-               if (!ip_check_mc(in_dev, oldflp->fl4_dst, oldflp->fl4_src,
-                                oldflp->proto))
+               if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
+                                    fl4->flowi4_proto))
                        flags &= ~RTCF_LOCAL;
                /* If multicast route do not exist use
                 * default one, but do not gateway in this case.
                 * Yes, it is hack.
                 */
-               if (res->fi && res->prefixlen < 4)
-                       res->fi = NULL;
+               if (fi && res->prefixlen < 4)
+                       fi = NULL;
        }
 
-
-       rth = dst_alloc(&ipv4_dst_ops);
+       rth = rt_dst_alloc(dev_out,
+                          IN_DEV_CONF_GET(in_dev, NOPOLICY),
+                          IN_DEV_CONF_GET(in_dev, NOXFRM));
        if (!rth)
-               return -ENOBUFS;
-
-       atomic_set(&rth->dst.__refcnt, 1);
-       rth->dst.flags= DST_HOST;
-       if (IN_DEV_CONF_GET(in_dev, NOXFRM))
-               rth->dst.flags |= DST_NOXFRM;
-       if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-               rth->dst.flags |= DST_NOPOLICY;
-
-       rth->fl.fl4_dst = oldflp->fl4_dst;
-       rth->fl.fl4_tos = tos;
-       rth->fl.fl4_src = oldflp->fl4_src;
-       rth->fl.oif     = oldflp->oif;
-       rth->fl.mark    = oldflp->mark;
-       rth->rt_dst     = fl->fl4_dst;
-       rth->rt_src     = fl->fl4_src;
-       rth->rt_iif     = oldflp->oif ? : dev_out->ifindex;
-       /* get references to the devices that are to be hold by the routing
-          cache entry */
-       rth->dst.dev    = dev_out;
-       dev_hold(dev_out);
-       rth->rt_gateway = fl->fl4_dst;
-       rth->rt_spec_dst= fl->fl4_src;
-
-       rth->dst.output=ip_output;
-       rth->dst.obsolete = -1;
+               return ERR_PTR(-ENOBUFS);
+
+       rth->dst.output = ip_output;
+
+       rth->rt_key_dst = orig_daddr;
+       rth->rt_key_src = orig_saddr;
        rth->rt_genid = rt_genid(dev_net(dev_out));
+       rth->rt_flags   = flags;
+       rth->rt_type    = type;
+       rth->rt_key_tos = tos;
+       rth->rt_dst     = fl4->daddr;
+       rth->rt_src     = fl4->saddr;
+       rth->rt_route_iif = 0;
+       rth->rt_iif     = orig_oif ? : dev_out->ifindex;
+       rth->rt_oif     = orig_oif;
+       rth->rt_mark    = fl4->flowi4_mark;
+       rth->rt_gateway = fl4->daddr;
+       rth->rt_spec_dst= fl4->saddr;
+       rth->rt_peer_genid = 0;
+       rth->peer = NULL;
+       rth->fi = NULL;
 
        RT_CACHE_STAT_INC(out_slow_tot);
 
        if (flags & RTCF_LOCAL) {
                rth->dst.input = ip_local_deliver;
-               rth->rt_spec_dst = fl->fl4_dst;
+               rth->rt_spec_dst = fl4->daddr;
        }
        if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
-               rth->rt_spec_dst = fl->fl4_src;
+               rth->rt_spec_dst = fl4->saddr;
                if (flags & RTCF_LOCAL &&
                    !(dev_out->flags & IFF_LOOPBACK)) {
                        rth->dst.output = ip_mc_output;
                        RT_CACHE_STAT_INC(out_slow_mc);
                }
 #ifdef CONFIG_IP_MROUTE
-               if (res->type == RTN_MULTICAST) {
+               if (type == RTN_MULTICAST) {
                        if (IN_DEV_MFORWARD(in_dev) &&
-                           !ipv4_is_local_multicast(oldflp->fl4_dst)) {
+                           !ipv4_is_local_multicast(fl4->daddr)) {
                                rth->dst.input = ip_mr_input;
                                rth->dst.output = ip_mc_output;
                        }
@@ -2555,31 +2512,9 @@ static int __mkroute_output(struct rtable **result,
 #endif
        }
 
-       rt_set_nexthop(rth, res, 0);
-
-       rth->rt_flags = flags;
-       *result = rth;
-       return 0;
-}
-
-/* called with rcu_read_lock() */
-static int ip_mkroute_output(struct rtable **rp,
-                            struct fib_result *res,
-                            const struct flowi *fl,
-                            const struct flowi *oldflp,
-                            struct net_device *dev_out,
-                            unsigned flags)
-{
-       struct rtable *rth = NULL;
-       int err = __mkroute_output(&rth, res, fl, oldflp, dev_out, flags);
-       unsigned hash;
-       if (err == 0) {
-               hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src, oldflp->oif,
-                              rt_genid(dev_net(dev_out)));
-               err = rt_intern_hash(hash, rth, rp, NULL, oldflp->oif);
-       }
+       rt_set_nexthop(rth, fl4, res, fi, type, 0);
 
-       return err;
+       return rth;
 }
 
 /*
@@ -2587,34 +2522,37 @@ static int ip_mkroute_output(struct rtable **rp,
  * called with rcu_read_lock();
  */
 
-static int ip_route_output_slow(struct net *net, struct rtable **rp,
-                               const struct flowi *oldflp)
-{
-       u32 tos = RT_FL_TOS(oldflp);
-       struct flowi fl = { .fl4_dst = oldflp->fl4_dst,
-                           .fl4_src = oldflp->fl4_src,
-                           .fl4_tos = tos & IPTOS_RT_MASK,
-                           .fl4_scope = ((tos & RTO_ONLINK) ?
-                                         RT_SCOPE_LINK : RT_SCOPE_UNIVERSE),
-                           .mark = oldflp->mark,
-                           .iif = net->loopback_dev->ifindex,
-                           .oif = oldflp->oif };
-       struct fib_result res;
-       unsigned int flags = 0;
+static struct rtable *ip_route_output_slow(struct net *net, struct flowi4 *fl4)
+{
        struct net_device *dev_out = NULL;
-       int err;
-
+       u32 tos = RT_FL_TOS(fl4);
+       unsigned int flags = 0;
+       struct fib_result res;
+       struct rtable *rth;
+       __be32 orig_daddr;
+       __be32 orig_saddr;
+       int orig_oif;
 
        res.fi          = NULL;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
        res.r           = NULL;
 #endif
 
-       if (oldflp->fl4_src) {
-               err = -EINVAL;
-               if (ipv4_is_multicast(oldflp->fl4_src) ||
-                   ipv4_is_lbcast(oldflp->fl4_src) ||
-                   ipv4_is_zeronet(oldflp->fl4_src))
+       orig_daddr = fl4->daddr;
+       orig_saddr = fl4->saddr;
+       orig_oif = fl4->flowi4_oif;
+
+       fl4->flowi4_iif = net->loopback_dev->ifindex;
+       fl4->flowi4_tos = tos & IPTOS_RT_MASK;
+       fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
+                        RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
+
+       rcu_read_lock();
+       if (fl4->saddr) {
+               rth = ERR_PTR(-EINVAL);
+               if (ipv4_is_multicast(fl4->saddr) ||
+                   ipv4_is_lbcast(fl4->saddr) ||
+                   ipv4_is_zeronet(fl4->saddr))
                        goto out;
 
                /* I removed check for oif == dev_out->oif here.
@@ -2625,11 +2563,11 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                      of another iface. --ANK
                 */
 
-               if (oldflp->oif == 0 &&
-                   (ipv4_is_multicast(oldflp->fl4_dst) ||
-                    ipv4_is_lbcast(oldflp->fl4_dst))) {
+               if (fl4->flowi4_oif == 0 &&
+                   (ipv4_is_multicast(fl4->daddr) ||
+                    ipv4_is_lbcast(fl4->daddr))) {
                        /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
-                       dev_out = __ip_dev_find(net, oldflp->fl4_src, false);
+                       dev_out = __ip_dev_find(net, fl4->saddr, false);
                        if (dev_out == NULL)
                                goto out;
 
@@ -2648,60 +2586,60 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                           Luckily, this hack is good workaround.
                         */
 
-                       fl.oif = dev_out->ifindex;
+                       fl4->flowi4_oif = dev_out->ifindex;
                        goto make_route;
                }
 
-               if (!(oldflp->flags & FLOWI_FLAG_ANYSRC)) {
+               if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
                        /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
-                       if (!__ip_dev_find(net, oldflp->fl4_src, false))
+                       if (!__ip_dev_find(net, fl4->saddr, false))
                                goto out;
                }
        }
 
 
-       if (oldflp->oif) {
-               dev_out = dev_get_by_index_rcu(net, oldflp->oif);
-               err = -ENODEV;
+       if (fl4->flowi4_oif) {
+               dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
+               rth = ERR_PTR(-ENODEV);
                if (dev_out == NULL)
                        goto out;
 
                /* RACE: Check return value of inet_select_addr instead. */
                if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
-                       err = -ENETUNREACH;
+                       rth = ERR_PTR(-ENETUNREACH);
                        goto out;
                }
-               if (ipv4_is_local_multicast(oldflp->fl4_dst) ||
-                   ipv4_is_lbcast(oldflp->fl4_dst)) {
-                       if (!fl.fl4_src)
-                               fl.fl4_src = inet_select_addr(dev_out, 0,
+               if (ipv4_is_local_multicast(fl4->daddr) ||
+                   ipv4_is_lbcast(fl4->daddr)) {
+                       if (!fl4->saddr)
+                               fl4->saddr = inet_select_addr(dev_out, 0,
                                                              RT_SCOPE_LINK);
                        goto make_route;
                }
-               if (!fl.fl4_src) {
-                       if (ipv4_is_multicast(oldflp->fl4_dst))
-                               fl.fl4_src = inet_select_addr(dev_out, 0,
-                                                             fl.fl4_scope);
-                       else if (!oldflp->fl4_dst)
-                               fl.fl4_src = inet_select_addr(dev_out, 0,
+               if (fl4->saddr) {
+                       if (ipv4_is_multicast(fl4->daddr))
+                               fl4->saddr = inet_select_addr(dev_out, 0,
+                                                             fl4->flowi4_scope);
+                       else if (!fl4->daddr)
+                               fl4->saddr = inet_select_addr(dev_out, 0,
                                                              RT_SCOPE_HOST);
                }
        }
 
-       if (!fl.fl4_dst) {
-               fl.fl4_dst = fl.fl4_src;
-               if (!fl.fl4_dst)
-                       fl.fl4_dst = fl.fl4_src = htonl(INADDR_LOOPBACK);
+       if (!fl4->daddr) {
+               fl4->daddr = fl4->saddr;
+               if (!fl4->daddr)
+                       fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
                dev_out = net->loopback_dev;
-               fl.oif = net->loopback_dev->ifindex;
+               fl4->flowi4_oif = net->loopback_dev->ifindex;
                res.type = RTN_LOCAL;
                flags |= RTCF_LOCAL;
                goto make_route;
        }
 
-       if (fib_lookup(net, &fl, &res)) {
+       if (fib_lookup(net, fl4, &res)) {
                res.fi = NULL;
-               if (oldflp->oif) {
+               if (fl4->flowi4_oif) {
                        /* Apparently, routing tables are wrong. Assume,
                           that the destination is on link.
 
@@ -2720,90 +2658,100 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                           likely IPv6, but we do not.
                         */
 
-                       if (fl.fl4_src == 0)
-                               fl.fl4_src = inet_select_addr(dev_out, 0,
+                       if (fl4->saddr == 0)
+                               fl4->saddr = inet_select_addr(dev_out, 0,
                                                              RT_SCOPE_LINK);
                        res.type = RTN_UNICAST;
                        goto make_route;
                }
-               err = -ENETUNREACH;
+               rth = ERR_PTR(-ENETUNREACH);
                goto out;
        }
 
        if (res.type == RTN_LOCAL) {
-               if (!fl.fl4_src) {
+               if (!fl4->saddr) {
                        if (res.fi->fib_prefsrc)
-                               fl.fl4_src = res.fi->fib_prefsrc;
+                               fl4->saddr = res.fi->fib_prefsrc;
                        else
-                               fl.fl4_src = fl.fl4_dst;
+                               fl4->saddr = fl4->daddr;
                }
                dev_out = net->loopback_dev;
-               fl.oif = dev_out->ifindex;
+               fl4->flowi4_oif = dev_out->ifindex;
                res.fi = NULL;
                flags |= RTCF_LOCAL;
                goto make_route;
        }
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-       if (res.fi->fib_nhs > 1 && fl.oif == 0)
-               fib_select_multipath(&fl, &res);
+       if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
+               fib_select_multipath(&res);
        else
 #endif
-       if (!res.prefixlen && res.type == RTN_UNICAST && !fl.oif)
+       if (!res.prefixlen &&
+           res.table->tb_num_default > 1 &&
+           res.type == RTN_UNICAST && !fl4->flowi4_oif)
                fib_select_default(&res);
 
-       if (!fl.fl4_src)
-               fl.fl4_src = FIB_RES_PREFSRC(res);
+       if (!fl4->saddr)
+               fl4->saddr = FIB_RES_PREFSRC(net, res);
 
        dev_out = FIB_RES_DEV(res);
-       fl.oif = dev_out->ifindex;
+       fl4->flowi4_oif = dev_out->ifindex;
 
 
 make_route:
-       err = ip_mkroute_output(rp, &res, &fl, oldflp, dev_out, flags);
+       rth = __mkroute_output(&res, fl4, orig_daddr, orig_saddr, orig_oif,
+                              dev_out, flags);
+       if (!IS_ERR(rth)) {
+               unsigned int hash;
 
-out:   return err;
+               hash = rt_hash(orig_daddr, orig_saddr, orig_oif,
+                              rt_genid(dev_net(dev_out)));
+               rth = rt_intern_hash(hash, rth, NULL, orig_oif);
+       }
+
+out:
+       rcu_read_unlock();
+       return rth;
 }
 
-int __ip_route_output_key(struct net *net, struct rtable **rp,
-                         const struct flowi *flp)
+struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *flp4)
 {
-       unsigned int hash;
-       int res;
        struct rtable *rth;
+       unsigned int hash;
 
        if (!rt_caching(net))
                goto slow_output;
 
-       hash = rt_hash(flp->fl4_dst, flp->fl4_src, flp->oif, rt_genid(net));
+       hash = rt_hash(flp4->daddr, flp4->saddr, flp4->flowi4_oif, rt_genid(net));
 
        rcu_read_lock_bh();
        for (rth = rcu_dereference_bh(rt_hash_table[hash].chain); rth;
                rth = rcu_dereference_bh(rth->dst.rt_next)) {
-               if (rth->fl.fl4_dst == flp->fl4_dst &&
-                   rth->fl.fl4_src == flp->fl4_src &&
+               if (rth->rt_key_dst == flp4->daddr &&
+                   rth->rt_key_src == flp4->saddr &&
                    rt_is_output_route(rth) &&
-                   rth->fl.oif == flp->oif &&
-                   rth->fl.mark == flp->mark &&
-                   !((rth->fl.fl4_tos ^ flp->fl4_tos) &
+                   rth->rt_oif == flp4->flowi4_oif &&
+                   rth->rt_mark == flp4->flowi4_mark &&
+                   !((rth->rt_key_tos ^ flp4->flowi4_tos) &
                            (IPTOS_RT_MASK | RTO_ONLINK)) &&
                    net_eq(dev_net(rth->dst.dev), net) &&
                    !rt_is_expired(rth)) {
                        dst_use(&rth->dst, jiffies);
                        RT_CACHE_STAT_INC(out_hit);
                        rcu_read_unlock_bh();
-                       *rp = rth;
-                       return 0;
+                       if (!flp4->saddr)
+                               flp4->saddr = rth->rt_src;
+                       if (!flp4->daddr)
+                               flp4->daddr = rth->rt_dst;
+                       return rth;
                }
                RT_CACHE_STAT_INC(out_hlist_search);
        }
        rcu_read_unlock_bh();
 
 slow_output:
-       rcu_read_lock();
-       res = ip_route_output_slow(net, rp, flp);
-       rcu_read_unlock();
-       return res;
+       return ip_route_output_slow(net, flp4);
 }
 EXPORT_SYMBOL_GPL(__ip_route_output_key);
 
@@ -2821,26 +2769,32 @@ static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
 
+static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
+                                         unsigned long old)
+{
+       return NULL;
+}
+
 static struct dst_ops ipv4_dst_blackhole_ops = {
        .family                 =       AF_INET,
        .protocol               =       cpu_to_be16(ETH_P_IP),
        .destroy                =       ipv4_dst_destroy,
        .check                  =       ipv4_blackhole_dst_check,
        .default_mtu            =       ipv4_blackhole_default_mtu,
+       .default_advmss         =       ipv4_default_advmss,
        .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
+       .cow_metrics            =       ipv4_rt_blackhole_cow_metrics,
+       .neigh_lookup           =       ipv4_neigh_lookup,
 };
 
-
-static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi *flp)
+struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-       struct rtable *ort = *rp;
-       struct rtable *rt = (struct rtable *)
-               dst_alloc(&ipv4_dst_blackhole_ops);
+       struct rtable *rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, 0, 0);
+       struct rtable *ort = (struct rtable *) dst_orig;
 
        if (rt) {
                struct dst_entry *new = &rt->dst;
 
-               atomic_set(&new->__refcnt, 1);
                new->__use = 1;
                new->input = dst_discard;
                new->output = dst_discard;
@@ -2850,14 +2804,19 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
                if (new->dev)
                        dev_hold(new->dev);
 
-               rt->fl = ort->fl;
+               rt->rt_key_dst = ort->rt_key_dst;
+               rt->rt_key_src = ort->rt_key_src;
+               rt->rt_key_tos = ort->rt_key_tos;
+               rt->rt_route_iif = ort->rt_route_iif;
+               rt->rt_iif = ort->rt_iif;
+               rt->rt_oif = ort->rt_oif;
+               rt->rt_mark = ort->rt_mark;
 
                rt->rt_genid = rt_genid(net);
                rt->rt_flags = ort->rt_flags;
                rt->rt_type = ort->rt_type;
                rt->rt_dst = ort->rt_dst;
                rt->rt_src = ort->rt_src;
-               rt->rt_iif = ort->rt_iif;
                rt->rt_gateway = ort->rt_gateway;
                rt->rt_spec_dst = ort->rt_spec_dst;
                rt->peer = ort->peer;
@@ -2870,42 +2829,28 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
                dst_free(new);
        }
 
-       dst_release(&(*rp)->dst);
-       *rp = rt;
-       return rt ? 0 : -ENOMEM;
+       dst_release(dst_orig);
+
+       return rt ? &rt->dst : ERR_PTR(-ENOMEM);
 }
 
-int ip_route_output_flow(struct net *net, struct rtable **rp, struct flowi *flp,
-                        struct sock *sk, int flags)
+struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
+                                   struct sock *sk)
 {
-       int err;
-
-       if ((err = __ip_route_output_key(net, rp, flp)) != 0)
-               return err;
+       struct rtable *rt = __ip_route_output_key(net, flp4);
 
-       if (flp->proto) {
-               if (!flp->fl4_src)
-                       flp->fl4_src = (*rp)->rt_src;
-               if (!flp->fl4_dst)
-                       flp->fl4_dst = (*rp)->rt_dst;
-               err = __xfrm_lookup(net, (struct dst_entry **)rp, flp, sk,
-                                   flags ? XFRM_LOOKUP_WAIT : 0);
-               if (err == -EREMOTE)
-                       err = ipv4_dst_blackhole(net, rp, flp);
+       if (IS_ERR(rt))
+               return rt;
 
-               return err;
-       }
+       if (flp4->flowi4_proto)
+               rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
+                                                  flowi4_to_flowi(flp4),
+                                                  sk, 0);
 
-       return 0;
+       return rt;
 }
 EXPORT_SYMBOL_GPL(ip_route_output_flow);
 
-int ip_route_output_key(struct net *net, struct rtable **rp, struct flowi *flp)
-{
-       return ip_route_output_flow(net, rp, flp, NULL, 0);
-}
-EXPORT_SYMBOL(ip_route_output_key);
-
 static int rt_fill_info(struct net *net,
                        struct sk_buff *skb, u32 pid, u32 seq, int event,
                        int nowait, unsigned int flags)
@@ -2913,7 +2858,8 @@ static int rt_fill_info(struct net *net,
        struct rtable *rt = skb_rtable(skb);
        struct rtmsg *r;
        struct nlmsghdr *nlh;
-       long expires;
+       long expires = 0;
+       const struct inet_peer *peer = rt->peer;
        u32 id = 0, ts = 0, tsage = 0, error;
 
        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*r), flags);
@@ -2924,7 +2870,7 @@ static int rt_fill_info(struct net *net,
        r->rtm_family    = AF_INET;
        r->rtm_dst_len  = 32;
        r->rtm_src_len  = 0;
-       r->rtm_tos      = rt->fl.fl4_tos;
+       r->rtm_tos      = rt->rt_key_tos;
        r->rtm_table    = RT_TABLE_MAIN;
        NLA_PUT_U32(skb, RTA_TABLE, RT_TABLE_MAIN);
        r->rtm_type     = rt->rt_type;
@@ -2936,9 +2882,9 @@ static int rt_fill_info(struct net *net,
 
        NLA_PUT_BE32(skb, RTA_DST, rt->rt_dst);
 
-       if (rt->fl.fl4_src) {
+       if (rt->rt_key_src) {
                r->rtm_src_len = 32;
-               NLA_PUT_BE32(skb, RTA_SRC, rt->fl.fl4_src);
+               NLA_PUT_BE32(skb, RTA_SRC, rt->rt_key_src);
        }
        if (rt->dst.dev)
                NLA_PUT_U32(skb, RTA_OIF, rt->dst.dev->ifindex);
@@ -2948,7 +2894,7 @@ static int rt_fill_info(struct net *net,
 #endif
        if (rt_is_input_route(rt))
                NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_spec_dst);
-       else if (rt->rt_src != rt->fl.fl4_src)
+       else if (rt->rt_src != rt->rt_key_src)
                NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_src);
 
        if (rt->rt_dst != rt->rt_gateway)
@@ -2957,18 +2903,20 @@ static int rt_fill_info(struct net *net,
        if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                goto nla_put_failure;
 
-       if (rt->fl.mark)
-               NLA_PUT_BE32(skb, RTA_MARK, rt->fl.mark);
+       if (rt->rt_mark)
+               NLA_PUT_BE32(skb, RTA_MARK, rt->rt_mark);
 
        error = rt->dst.error;
-       expires = rt->dst.expires ? rt->dst.expires - jiffies : 0;
-       if (rt->peer) {
+       if (peer) {
                inet_peer_refcheck(rt->peer);
-               id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
-               if (rt->peer->tcp_ts_stamp) {
-                       ts = rt->peer->tcp_ts;
-                       tsage = get_seconds() - rt->peer->tcp_ts_stamp;
+               id = atomic_read(&peer->ip_id_count) & 0xffff;
+               if (peer->tcp_ts_stamp) {
+                       ts = peer->tcp_ts;
+                       tsage = get_seconds() - peer->tcp_ts_stamp;
                }
+               expires = ACCESS_ONCE(peer->pmtu_expires);
+               if (expires)
+                       expires -= jiffies;
        }
 
        if (rt_is_input_route(rt)) {
@@ -2977,7 +2925,9 @@ static int rt_fill_info(struct net *net,
 
                if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
                    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
-                       int err = ipmr_get_route(net, skb, r, nowait);
+                       int err = ipmr_get_route(net, skb,
+                                                rt->rt_src, rt->rt_dst,
+                                                r, nowait);
                        if (err <= 0) {
                                if (!nowait) {
                                        if (err == 0)
@@ -2991,7 +2941,7 @@ static int rt_fill_info(struct net *net,
                        }
                } else
 #endif
-                       NLA_PUT_U32(skb, RTA_IIF, rt->fl.iif);
+                       NLA_PUT_U32(skb, RTA_IIF, rt->rt_iif);
        }
 
        if (rtnl_put_cacheinfo(skb, &rt->dst, id, ts, tsage,
@@ -3065,14 +3015,18 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                if (err == 0 && rt->dst.error)
                        err = -rt->dst.error;
        } else {
-               struct flowi fl = {
-                       .fl4_dst = dst,
-                       .fl4_src = src,
-                       .fl4_tos = rtm->rtm_tos,
-                       .oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0,
-                       .mark = mark,
+               struct flowi4 fl4 = {
+                       .daddr = dst,
+                       .saddr = src,
+                       .flowi4_tos = rtm->rtm_tos,
+                       .flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0,
+                       .flowi4_mark = mark,
                };
-               err = ip_route_output_key(net, &rt, &fl);
+               rt = ip_route_output_key(net, &fl4);
+
+               err = 0;
+               if (IS_ERR(rt))
+                       err = PTR_ERR(rt);
        }
 
        if (err)
@@ -3355,6 +3309,8 @@ static __net_init int rt_genid_init(struct net *net)
 {
        get_random_bytes(&net->ipv4.rt_genid,
                         sizeof(net->ipv4.rt_genid));
+       get_random_bytes(&net->ipv4.dev_addr_genid,
+                        sizeof(net->ipv4.dev_addr_genid));
        return 0;
 }
 
@@ -3418,21 +3374,13 @@ int __init ip_rt_init(void)
        devinet_init();
        ip_fib_init();
 
-       /* All the timers, started at system startup tend
-          to synchronize. Perturb it a bit.
-        */
-       INIT_DELAYED_WORK_DEFERRABLE(&expires_work, rt_worker_func);
-       expires_ljiffies = jiffies;
-       schedule_delayed_work(&expires_work,
-               net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
-
        if (ip_rt_proc_init())
                printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
        xfrm_init();
        xfrm4_init(ip_rt_max_size);
 #endif
-       rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL);
+       rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL, NULL);
 
 #ifdef CONFIG_SYSCTL
        register_pernet_subsys(&sysctl_route_ops);