diff --git a/patches/fs-dcache-resched-chill-only-if-we-make-no-progress.patch b/patches/fs-dcache-resched-chill-only-if-we-make-no-progress.patch
new file mode 100644
index 0000000..a59001e
--- /dev/null
+++ b/patches/fs-dcache-resched-chill-only-if-we-make-no-progress.patch
@@ -0,0 +1,72 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 8 Sep 2016 18:33:52 +0200
+Subject: [PATCH] fs/dcache: resched/chill only if we make no progress
+
+Upstream commit 47be61845c77 ("fs/dcache.c: avoid soft-lockup in
+dput()") changed the condition _when_ cpu_relax() / cond_resched() was
+invoked. This change was adapted in -RT into mostly the same thing
+except that if cond_resched() did nothing we had to do cpu_chill() to
+force the task off CPU for a tiny little bit in case the task had RT
+priority and did not want to leave the CPU.
+This change resulted in a performance regression (in my testcase the
+build time on /dev/shm increased from 19min to 24min). The reason is
+that with this change cpu_chill() was invoked even dput() made progress
+(dentry_kill() returned a different dentry) instead only if we were
+trying this operation on the same dentry over and over again.
+
+This patch brings back to the old behavior back to cond_resched() &
+chill if we make no progress. A little improvement is to invoke
+cpu_chill() only if we are a RT task (and avoid the sleep otherwise).
+Otherwise the scheduler should remove us from the CPU if we make no
+progress.
+
+Cc: stable-rt@vger.kernel.org
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+---
+ fs/dcache.c |   19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -40,6 +40,8 @@
+ #include <linux/ratelimit.h>
+ #include <linux/list_lru.h>
+ #include <linux/kasan.h>
++#include <linux/sched/rt.h>
++#include <linux/sched/deadline.h>
+ 
+ #include "internal.h"
+ #include "mount.h"
+@@ -748,6 +750,8 @@ static inline bool fast_dput(struct dent
+  */
+ void dput(struct dentry *dentry)
+ {
++	struct dentry *parent;
++
+ 	if (unlikely(!dentry))
+ 		return;
+ 
+@@ -784,14 +788,17 @@ void dput(struct dentry *dentry)
+ 	return;
+ 
+ kill_it:
+-	dentry = dentry_kill(dentry);
+-	if (dentry) {
++	parent = dentry_kill(dentry);
++	if (parent) {
+ 		int r;
+ 
+-		/* the task with the highest priority won't schedule */
+-		r = cond_resched();
+-		if (!r)
+-			cpu_chill();
++		if (parent == dentry) {
++			/* the task with the highest priority won't schedule */
++			r = cond_resched();
++			if (!r && (rt_task(current) || dl_task(current)))
++				cpu_chill();
++		} else
++			dentry = parent;
+ 		goto repeat;
+ 	}
+ }
diff --git a/patches/localversion.patch b/patches/localversion.patch
index 58842b5..12bd473 100644
--- a/patches/localversion.patch
+++ b/patches/localversion.patch
@@ -10,4 +10,4 @@
 --- /dev/null
 +++ b/localversion-rt
 @@ -0,0 +1 @@
-+-rt11
++-rt12
diff --git a/patches/net-add-a-lock-around-icmp_sk.patch b/patches/net-add-a-lock-around-icmp_sk.patch
new file mode 100644
index 0000000..5734d88
--- /dev/null
+++ b/patches/net-add-a-lock-around-icmp_sk.patch
@@ -0,0 +1,72 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Wed, 31 Aug 2016 17:54:09 +0200
+Subject: [PATCH] net: add a lock around icmp_sk()
+
+It looks like the this_cpu_ptr() access in icmp_sk() is protected with
+local_bh_disable(). To avoid missing serialization in -RT I am adding
+here a local lock. No crash has been observed, this is just precaution.
+
+Cc: stable-rt@vger.kernel.org
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+---
+ net/ipv4/icmp.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -77,6 +77,7 @@
+ #include <linux/string.h>
+ #include <linux/netfilter_ipv4.h>
+ #include <linux/slab.h>
++#include <linux/locallock.h>
+ #include <net/snmp.h>
+ #include <net/ip.h>
+ #include <net/route.h>
+@@ -204,6 +205,8 @@ static const struct icmp_control icmp_po
+  *
+  *	On SMP we have one ICMP socket per-cpu.
+  */
++static DEFINE_LOCAL_IRQ_LOCK(icmp_sk_lock);
++
+ static struct sock *icmp_sk(struct net *net)
+ {
+ 	return *this_cpu_ptr(net->ipv4.icmp_sk);
+@@ -215,12 +218,14 @@ static inline struct sock *icmp_xmit_loc
+ 
+ 	local_bh_disable();
+ 
++	local_lock(icmp_sk_lock);
+ 	sk = icmp_sk(net);
+ 
+ 	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
+ 		/* This can happen if the output path signals a
+ 		 * dst_link_failure() for an outgoing ICMP packet.
+ 		 */
++		local_unlock(icmp_sk_lock);
+ 		local_bh_enable();
+ 		return NULL;
+ 	}
+@@ -230,6 +235,7 @@ static inline struct sock *icmp_xmit_loc
+ static inline void icmp_xmit_unlock(struct sock *sk)
+ {
+ 	spin_unlock_bh(&sk->sk_lock.slock);
++	local_unlock(icmp_sk_lock);
+ }
+ 
+ int sysctl_icmp_msgs_per_sec __read_mostly = 1000;
+@@ -358,6 +364,7 @@ static void icmp_push_reply(struct icmp_
+ 	struct sock *sk;
+ 	struct sk_buff *skb;
+ 
++	local_lock(icmp_sk_lock);
+ 	sk = icmp_sk(dev_net((*rt)->dst.dev));
+ 	if (ip_append_data(sk, fl4, icmp_glue_bits, icmp_param,
+ 			   icmp_param->data_len+icmp_param->head_len,
+@@ -380,6 +387,7 @@ static void icmp_push_reply(struct icmp_
+ 		skb->ip_summed = CHECKSUM_NONE;
+ 		ip_push_pending_frames(sk, fl4);
+ 	}
++	local_unlock(icmp_sk_lock);
+ }
+ 
+ /*
diff --git a/patches/net-add-back-the-missing-serialization-in-ip_send_un.patch b/patches/net-add-back-the-missing-serialization-in-ip_send_un.patch
new file mode 100644
index 0000000..2c83f00
--- /dev/null
+++ b/patches/net-add-back-the-missing-serialization-in-ip_send_un.patch
@@ -0,0 +1,87 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Wed, 31 Aug 2016 17:21:56 +0200
+Subject: [PATCH] net: add back the missing serialization in
+ ip_send_unicast_reply()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some time ago Sami Pietikäinen reported a crash on -RT in
+ip_send_unicast_reply() which was later fixed by Nicholas Mc Guire
+(v3.12.8-rt11). Later (v3.18.8) the code was reworked and I dropped the
+patch. As it turns out it was mistake.
+I have reports that the same crash is possible with a similar backtrace.
+It seems that vanilla protects access to this_cpu_ptr() via
+local_bh_disable(). This does not work the on -RT since we can have
+NET_RX and NET_TX running in parallel on the same CPU.
+This is brings back the old locks.
+
+|Unable to handle kernel NULL pointer dereference at virtual address 00000010
+|PC is at __ip_make_skb+0x198/0x3e8
+|[<c04e39d8>] (__ip_make_skb) from [<c04e3ca8>] (ip_push_pending_frames+0x20/0x40)
+|[<c04e3ca8>] (ip_push_pending_frames) from [<c04e3ff0>] (ip_send_unicast_reply+0x210/0x22c)
+|[<c04e3ff0>] (ip_send_unicast_reply) from [<c04fbb54>] (tcp_v4_send_reset+0x190/0x1c0)
+|[<c04fbb54>] (tcp_v4_send_reset) from [<c04fcc1c>] (tcp_v4_do_rcv+0x22c/0x288)
+|[<c04fcc1c>] (tcp_v4_do_rcv) from [<c0474364>] (release_sock+0xb4/0x150)
+|[<c0474364>] (release_sock) from [<c04ed904>] (tcp_close+0x240/0x454)
+|[<c04ed904>] (tcp_close) from [<c0511408>] (inet_release+0x74/0x7c)
+|[<c0511408>] (inet_release) from [<c0470728>] (sock_release+0x30/0xb0)
+|[<c0470728>] (sock_release) from [<c0470abc>] (sock_close+0x1c/0x24)
+|[<c0470abc>] (sock_close) from [<c0115ec4>] (__fput+0xe8/0x20c)
+|[<c0115ec4>] (__fput) from [<c0116050>] (____fput+0x18/0x1c)
+|[<c0116050>] (____fput) from [<c0058138>] (task_work_run+0xa4/0xb8)
+|[<c0058138>] (task_work_run) from [<c0011478>] (do_work_pending+0xd0/0xe4)
+|[<c0011478>] (do_work_pending) from [<c000e740>] (work_pending+0xc/0x20)
+|Code: e3530001 8a000001 e3a00040 ea000011 (e5973010)
+
+Cc: stable-rt@vger.kernel.org
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+---
+ net/ipv4/tcp_ipv4.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -62,6 +62,7 @@
+ #include <linux/init.h>
+ #include <linux/times.h>
+ #include <linux/slab.h>
++#include <linux/locallock.h>
+ 
+ #include <net/net_namespace.h>
+ #include <net/icmp.h>
+@@ -565,6 +566,7 @@ void tcp_v4_send_check(struct sock *sk,
+ }
+ EXPORT_SYMBOL(tcp_v4_send_check);
+ 
++static DEFINE_LOCAL_IRQ_LOCK(tcp_sk_lock);
+ /*
+  *	This routine will send an RST to the other tcp.
+  *
+@@ -689,10 +691,13 @@ static void tcp_v4_send_reset(const stru
+ 		     offsetof(struct inet_timewait_sock, tw_bound_dev_if));
+ 
+ 	arg.tos = ip_hdr(skb)->tos;
++
++	local_lock(tcp_sk_lock);
+ 	ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+ 			      skb, &TCP_SKB_CB(skb)->header.h4.opt,
+ 			      ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+ 			      &arg, arg.iov[0].iov_len);
++	local_unlock(tcp_sk_lock);
+ 
+ 	TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
+ 	TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
+@@ -774,10 +779,12 @@ static void tcp_v4_send_ack(struct net *
+ 	if (oif)
+ 		arg.bound_dev_if = oif;
+ 	arg.tos = tos;
++	local_lock(tcp_sk_lock);
+ 	ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+ 			      skb, &TCP_SKB_CB(skb)->header.h4.opt,
+ 			      ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+ 			      &arg, arg.iov[0].iov_len);
++	local_unlock(tcp_sk_lock);
+ 
+ 	TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
+ }
diff --git a/patches/ping-sysrq.patch b/patches/ping-sysrq.patch
index 854f85f..f1d81bf 100644
--- a/patches/ping-sysrq.patch
+++ b/patches/ping-sysrq.patch
@@ -60,7 +60,7 @@
  #include <linux/socket.h>
  #include <linux/in.h>
  #include <linux/inet.h>
-@@ -891,6 +892,30 @@ static bool icmp_redirect(struct sk_buff
+@@ -899,6 +900,30 @@ static bool icmp_redirect(struct sk_buff
  }
  
  /*
@@ -91,7 +91,7 @@
   *	Handle ICMP_ECHO ("ping") requests.
   *
   *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
-@@ -917,6 +942,11 @@ static bool icmp_echo(struct sk_buff *sk
+@@ -925,6 +950,11 @@ static bool icmp_echo(struct sk_buff *sk
  		icmp_param.data_len	   = skb->len;
  		icmp_param.head_len	   = sizeof(struct icmphdr);
  		icmp_reply(&icmp_param, skb);
diff --git a/patches/series b/patches/series
index e071b88..84e90a3 100644
--- a/patches/series
+++ b/patches/series
@@ -432,6 +432,7 @@
 
 # FS LIVELOCK PREVENTION
 fs-dcache-use-cpu-chill-in-trylock-loops.patch
+fs-dcache-resched-chill-only-if-we-make-no-progress.patch
 net-use-cpu-chill.patch
 
 # WORKQUEUE more fixes
@@ -458,6 +459,8 @@
 net-move-xmit_recursion-to-per-task-variable-on-RT.patch
 net-provide-a-way-to-delegate-processing-a-softirq-t.patch
 net-dev-always-take-qdisc-s-busylock-in-__dev_xmit_s.patch
+net-add-back-the-missing-serialization-in-ip_send_un.patch
+net-add-a-lock-around-icmp_sk.patch
 
 # NETWORK livelock fix
 net-tx-action-avoid-livelock-on-rt.patch