Merge branch '10.0-galera' into 10.1

51 files changed, 590 insertions, 380 deletions

diff --git a/.gitignore b/.gitignore
index abf45734d96..acbb8d21372 100644
--- a/.gitignore
+++ b/.gitignore
@@ -120,6 +120,7 @@ scripts/mytop
 scripts/wsrep_sst_common
 scripts/wsrep_sst_mysqldump
 scripts/wsrep_sst_rsync
+scripts/wsrep_sst_rsync_wan
 scripts/wsrep_sst_mariabackup
 scripts/wsrep_sst_xtrabackup
 scripts/wsrep_sst_xtrabackup-v2
diff --git a/include/my_global.h b/include/my_global.h
index 9db032d4024..dcfd607b455 100644
--- a/include/my_global.h
+++ b/include/my_global.h
@@ -600,6 +600,8 @@ typedef SOCKET_SIZE_TYPE size_socket;
 #endif
 #ifndef SOCK_CLOEXEC
 #define SOCK_CLOEXEC    0
+#else
+#define HAVE_SOCK_CLOEXEC
 #endif
 
 /* additional file share flags for win32 */
diff --git a/include/mysql/psi/mysql_socket.h b/include/mysql/psi/mysql_socket.h
index 1dbe8c7eb22..fc0a3ce2eb0 100644
--- a/include/mysql/psi/mysql_socket.h
+++ b/include/mysql/psi/mysql_socket.h
@@ -562,6 +562,12 @@ inline_mysql_socket_socket
       (key, (const my_socket*)&mysql_socket.fd, NULL, 0);
   }
 #endif
+
+  /* SOCK_CLOEXEC isn't always a number - can't preprocessor compare */
+#if defined(HAVE_FCNTL) && defined(FD_CLOEXEC) && !defined(HAVE_SOCK_CLOEXEC)
+  (void) fcntl(mysql_socket.fd, F_SETFD, FD_CLOEXEC);
+#endif
+
   return mysql_socket;
 }
 
diff --git a/mysql-test/r/read_only_innodb.result b/mysql-test/r/read_only_innodb.result
index 58e473ff695..a276e6cbc19 100644
--- a/mysql-test/r/read_only_innodb.result
+++ b/mysql-test/r/read_only_innodb.result
@@ -223,14 +223,6 @@ a	a
 5	10
 DROP TABLE temp1, temp2;
 
-# MDEV-14185 CREATE TEMPORARY TABLE AS SELECT causes error 1290 with read_only and InnoDB.
-
-CREATE TEMPORARY TABLE temp1 ENGINE=INNODB AS SELECT a FROM t1;
-SELECT * FROM temp1;
-a
-1
-DROP TABLE temp1;
-
 # Disconnect and cleanup
 
 SET GLOBAL READ_ONLY = OFF;
diff --git a/mysql-test/suite/galera/disabled.def b/mysql-test/suite/galera/disabled.def
index 513f9ac2c88..397ad22dab8 100644
--- a/mysql-test/suite/galera/disabled.def
+++ b/mysql-test/suite/galera/disabled.def
@@ -27,3 +27,6 @@ galera_ssl_upgrade : MDEV-13549 Galera test failures
 galera.MW-329 : wsrep_local_replays not stable
 galera.MW-328A : have_deadlocks test not stable
 query_cache : MDEV-15805 Test failure on galera.query_cache
+MW-416 : MDEV-13549 Galera test failures
+galera_wan : MDEV-13549 Galera test failures
+MW-388 : MDEV-13549 Galera test failures
diff --git a/mysql-test/suite/galera/galera_2nodes_as_master_slave.cnf b/mysql-test/suite/galera/galera_2nodes_as_master_slave.cnf
deleted file mode 100644
index f68fe524904..00000000000
--- a/mysql-test/suite/galera/galera_2nodes_as_master_slave.cnf
+++ /dev/null
@@ -1,83 +0,0 @@
-
-#
-# Let's understand the topology.
-# * Independent Master with server-id = 1
-# * Galera cluster with 2 nodes: node#1 and node#2 with server-id = 2, 3
-#   node#1 act as slave to Independent Master with server-id = 1
-# * Independent Slave with server-id = 4 replicating from galera node#2
-#
-
-# Use default setting for mysqld processes
-!include include/default_mysqld.cnf
-
-[mysqld]
-log-slave-updates
-log-bin=mysqld-bin
-binlog-format=row
-gtid-mode=on
-enforce-gtid-consistency=true
-
-[mysqld.1]
-server-id=1
-
-[mysqld.2]
-server-id=2
-
-wsrep_provider=@ENV.WSREP_PROVIDER
-wsrep_cluster_address='gcomm://'
-wsrep_provider_options='base_port=@mysqld.2.#galera_port;evs.install_timeout = PT15S; evs.max_install_timeouts=1;'
-
-# enforce read-committed characteristics across the cluster
-wsrep_causal_reads=ON
-wsrep_sync_wait = 15
-
-wsrep_node_address=127.0.0.1
-wsrep_sst_receive_address=127.0.0.2:@mysqld.2.#sst_port
-wsrep_node_incoming_address=127.0.0.1:@mysqld.2.port
-
-# Required for Galera
-innodb_autoinc_lock_mode=2
-
-innodb_flush_log_at_trx_commit=2
-
-[mysqld.3]
-server-id=3
-
-wsrep_provider=@ENV.WSREP_PROVIDER
-wsrep_cluster_address='gcomm://127.0.0.1:@mysqld.2.#galera_port'
-wsrep_provider_options='base_port=@mysqld.3.#galera_port;evs.install_timeout = PT15S; evs.max_install_timeouts = 1;'
-
-# enforce read-committed characteristics across the cluster
-wsrep_causal_reads=ON
-wsrep_sync_wait = 15
-
-wsrep_node_address=127.0.0.1
-wsrep_sst_receive_address=127.0.0.2:@mysqld.3.#sst_port
-wsrep_node_incoming_address=127.0.0.1:@mysqld.3.port
-
-# Required for Galera
-innodb_autoinc_lock_mode=2
-
-innodb_flush_log_at_trx_commit=2
-
-[mysqld.4]
-server-id=4
-
-[ENV]
-NODE_MYPORT_1= @mysqld.1.port
-NODE_MYSOCK_1= @mysqld.1.socket
-
-NODE_MYPORT_2= @mysqld.2.port
-NODE_MYSOCK_2= @mysqld.2.socket
-
-NODE_MYPORT_3= @mysqld.3.port
-NODE_MYSOCK_3= @mysqld.3.socket
-
-NODE_MYPORT_4= @mysqld.4.port
-NODE_MYSOCK_4= @mysqld.4.socket
-
-NODE_GALERAPORT_2= @mysqld.2.#galera_port
-NODE_GALERAPORT_3= @mysqld.3.#galera_port
-
-NODE_SSTPORT_2= @mysqld.2.#sst_port
-NODE_SSTPORT_3= @mysqld.3.#sst_port
diff --git a/mysql-test/suite/galera/galera_2nodes_as_master_with_repl_filter.cnf b/mysql-test/suite/galera/galera_2nodes_as_master_with_repl_filter.cnf
deleted file mode 100644
index d5490280ab2..00000000000
--- a/mysql-test/suite/galera/galera_2nodes_as_master_with_repl_filter.cnf
+++ /dev/null
@@ -1,87 +0,0 @@
-#
-# This .cnf file creates a setup with a 2-node Galera cluster and one stand-alone MySQL server, to be used as a slave
-#
-
-# Use default setting for mysqld processes
-!include include/default_mysqld.cnf
-
-[mysqld]
-default-storage-engine=InnoDB
-
-[mysqld.1]
-server-id=1
-binlog-format=row
-log-bin=mysqld-bin
-log_slave_updates
-gtid-mode=on
-enforce-gtid-consistency=true
-event-scheduler=1
-
-wsrep_provider=@ENV.WSREP_PROVIDER
-wsrep_cluster_address='gcomm://'
-wsrep_provider_options='base_port=@mysqld.1.#galera_port'
-
-# enforce read-committed characteristics across the cluster
-wsrep_causal_reads=ON
-wsrep_sync_wait = 15
-
-wsrep_node_address=127.0.0.1
-wsrep_sst_receive_address=127.0.0.2:@mysqld.1.#sst_port
-wsrep_node_incoming_address=127.0.0.1:@mysqld.1.port
-
-# Required for Galera
-innodb_autoinc_lock_mode=2
-
-innodb_flush_log_at_trx_commit=2
-
-[mysqld.2]
-server-id=2
-binlog-format=row
-log-bin=mysqld-bin
-log_slave_updates
-gtid-mode=on
-enforce-gtid-consistency=true
-event-scheduler=1
-
-wsrep_provider=@ENV.WSREP_PROVIDER
-wsrep_cluster_address='gcomm://127.0.0.1:@mysqld.1.#galera_port'
-wsrep_provider_options='base_port=@mysqld.2.#galera_port'
-
-# enforce read-committed characteristics across the cluster
-wsrep_causal_reads=ON
-wsrep_sync_wait = 15
-
-wsrep_node_address=127.0.0.1
-wsrep_sst_receive_address=127.0.0.2:@mysqld.2.#sst_port
-wsrep_node_incoming_address=127.0.0.1:@mysqld.2.port
-
-# Required for Galera
-innodb_autoinc_lock_mode=2
-
-innodb_flush_log_at_trx_commit=2
-
-[mysqld.3]
-server-id=3
-replicate-ignore-db=test
-replicate-wild-ignore-table=test.%
-log-bin=mysqld-bin
-log_slave_updates
-gtid-mode=on
-enforce-gtid-consistency=true
-event-scheduler=1
-
-[ENV]
-NODE_MYPORT_1= @mysqld.1.port
-NODE_MYSOCK_1= @mysqld.1.socket
-
-NODE_MYPORT_2= @mysqld.2.port
-NODE_MYSOCK_2= @mysqld.2.socket
-
-NODE_MYPORT_3= @mysqld.3.port
-NODE_MYSOCK_3= @mysqld.3.socket
-
-NODE_GALERAPORT_1= @mysqld.1.#galera_port
-NODE_GALERAPORT_2= @mysqld.2.#galera_port
-
-NODE_SSTPORT_1= @mysqld.1.#sst_port
-NODE_SSTPORT_2= @mysqld.2.#sst_port
diff --git a/mysql-test/suite/galera/r/MW-416.result b/mysql-test/suite/galera/r/MW-416.result
new file mode 100644
index 00000000000..05399b213a8
--- /dev/null
+++ b/mysql-test/suite/galera/r/MW-416.result
@@ -0,0 +1,114 @@
+CREATE USER 'userMW416'@'localhost';
+GRANT SELECT, INSERT, UPDATE ON test.* TO 'userMW416'@'localhost';
+SHOW GLOBAL STATUS LIKE 'wsrep_replicated';
+Variable_name	Value
+wsrep_replicated	2
+ALTER DATABASE db CHARACTER SET = utf8;
+ERROR 42000: Access denied for user 'userMW416'@'localhost' to database 'db'
+ALTER EVENT ev1 RENAME TO ev2;
+ERROR 42000: Access denied for user 'userMW416'@'localhost' to database 'test'
+ALTER FUNCTION fun1 COMMENT 'foo';
+ERROR 42000: alter routine command denied to user 'userMW416'@'localhost' for routine 'test.fun1'
+ALTER LOGFILE GROUP lfg ADD UNDOFILE 'file' ENGINE=InnoDB;
+Got one of the listed errors
+ALTER PROCEDURE proc1 COMMENT 'foo';
+Got one of the listed errors
+ALTER SERVER srv OPTIONS (USER 'sally');
+Got one of the listed errors
+ALTER TABLE tbl DROP COLUMN col;
+Got one of the listed errors
+ALTER TABLESPACE tblspc DROP DATAFILE 'file' ENGINE=innodb;
+Got one of the listed errors
+ALTER VIEW vw AS SELECT 1;
+Got one of the listed errors
+CREATE DATABASE db;
+Got one of the listed errors
+CREATE EVENT ev1 ON SCHEDULE AT CURRENT_TIMESTAMP  DO SELECT 1;
+Got one of the listed errors
+CREATE FUNCTION fun1() RETURNS int RETURN(1);
+Got one of the listed errors
+CREATE FUNCTION fun1 RETURNS STRING SONAME 'funlib.so';
+Got one of the listed errors
+CREATE PROCEDURE proc1()  BEGIN END;
+Got one of the listed errors
+CREATE INDEX idx ON tbl(id);
+Got one of the listed errors
+CREATE LOGFILE GROUP lfg ADD UNDOFILE 'undofile' ENGINE innodb;
+Got one of the listed errors
+CREATE SERVER srv FOREIGN DATA WRAPPER 'fdw' OPTIONS (USER 'user');
+Got one of the listed errors
+CREATE TABLE t (i int);
+Got one of the listed errors
+CREATE TABLESPACE tblspc ADD DATAFILE 'file' ENGINE=innodb;
+Got one of the listed errors
+CREATE TRIGGER trg BEFORE UPDATE ON t FOR EACH ROW BEGIN END;
+Got one of the listed errors
+CREATE VIEW vw AS SELECT 1;
+Got one of the listed errors
+DROP DATABASE db;
+Got one of the listed errors
+DROP EVENT ev;
+Got one of the listed errors
+DROP FUNCTION fun1;
+Got one of the listed errors
+DROP INDEX idx ON t0;
+Got one of the listed errors
+DROP LOGFILE GROUP lfg;
+Got one of the listed errors
+DROP PROCEDURE proc1;
+Got one of the listed errors
+DROP SERVEr srv;
+Got one of the listed errors
+DROP TABLE t0;
+Got one of the listed errors
+DROP TABLESPACE tblspc;
+Got one of the listed errors
+DROP TRIGGER trg;
+Got one of the listed errors
+DROP VIEW vw;
+Got one of the listed errors
+RENAME TABLE t0 TO t1;
+Got one of the listed errors
+TRUNCATE TABLE t0;
+Got one of the listed errors
+ALTER USER myuser PASSWORD EXPIRE;
+Got one of the listed errors
+CREATE USER myuser IDENTIFIED BY 'pass';
+Got one of the listed errors
+DROP USER myuser;
+Got one of the listed errors
+GRANT ALL ON *.* TO 'myuser';
+Got one of the listed errors
+RENAME USER myuser TO mariauser;
+Got one of the listed errors
+REVOKE SELECT ON test FROM myuser;
+Got one of the listed errors
+REVOKE ALL, GRANT OPTION FROM myuser;
+Got one of the listed errors
+REVOKE PROXY ON myuser FROM myuser;
+Got one of the listed errors
+ANALYZE TABLE db.tbl;
+Got one of the listed errors
+CHECK TABLE db.tbl;
+Got one of the listed errors
+CHECKSUM TABLE db.tbl;
+Got one of the listed errors
+OPTIMIZE TABLE db.tbl;
+Got one of the listed errors
+REPAIR TABLE db.tbl;
+Got one of the listed errors
+INSTALL PLUGIN plg SONAME 'plg.so';
+Got one of the listed errors
+UNINSTALL PLUGIN plg;
+Got one of the listed errors
+DROP USER 'userMW416'@'localhost';
+SHOW DATABASES;
+Database
+information_schema
+mtr
+mysql
+performance_schema
+test
+SHOW GLOBAL STATUS LIKE 'wsrep_replicated';
+Variable_name	Value
+wsrep_replicated	3
diff --git a/mysql-test/suite/galera/r/galera#500.result b/mysql-test/suite/galera/r/galera#500.result
new file mode 100644
index 00000000000..6a07d0359a4
--- /dev/null
+++ b/mysql-test/suite/galera/r/galera#500.result
@@ -0,0 +1,10 @@
+SET SESSION wsrep_sync_wait = 0;
+SET GLOBAL wsrep_provider_options="gmcast.isolate=2";
+SET SESSION wsrep_sync_wait = 0;
+SHOW STATUS LIKE 'wsrep_cluster_status';
+Variable_name	Value
+wsrep_cluster_status	non-Primary
+SET SESSION wsrep_sync_wait = default;
+SET GLOBAL wsrep_provider_options="pc.bootstrap=1";
+SET SESSION wsrep_on=0;
+CALL mtr.add_suppression("WSREP: exception from gcomm, backend must be restarted: Gcomm backend termination was requested by setting gmcast.isolate=2.");
diff --git a/mysql-test/suite/galera/t/MW-416.test b/mysql-test/suite/galera/t/MW-416.test
new file mode 100644
index 00000000000..df4fa35abc7
--- /dev/null
+++ b/mysql-test/suite/galera/t/MW-416.test
@@ -0,0 +1,134 @@
+--source include/galera_cluster.inc
+--source include/have_innodb.inc
+
+--source include/wait_until_ready.inc
+
+CREATE USER 'userMW416'@'localhost';
+GRANT SELECT, INSERT, UPDATE ON test.* TO 'userMW416'@'localhost';
+
+SHOW GLOBAL STATUS LIKE 'wsrep_replicated';
+
+--connect userMW416, localhost, userMW416,, test, $NODE_MYPORT_1
+--connection userMW416
+
+# DDL
+
+--error 1044
+ALTER DATABASE db CHARACTER SET = utf8;
+--error 1044
+ALTER EVENT ev1 RENAME TO ev2;
+--error 1370
+ALTER FUNCTION fun1 COMMENT 'foo';
+#--error 1044,1227
+#ALTER INSTANCE ROTATE INNODB MASTER KEY;
+--error 1044,1227
+ALTER LOGFILE GROUP lfg ADD UNDOFILE 'file' ENGINE=InnoDB;
+--error 1044,1227,1370
+ALTER PROCEDURE proc1 COMMENT 'foo';
+--error 1044,1227,1370
+ALTER SERVER srv OPTIONS (USER 'sally');
+--error 1044,1142,1227,1370
+ALTER TABLE tbl DROP COLUMN col;
+--error 1044,1227,1370
+ALTER TABLESPACE tblspc DROP DATAFILE 'file' ENGINE=innodb;
+--error 1044,1142,1227,1370
+ALTER VIEW vw AS SELECT 1;
+
+--error 1044,1227,1370
+CREATE DATABASE db;
+--error 1044,1227,1370
+CREATE EVENT ev1 ON SCHEDULE AT CURRENT_TIMESTAMP  DO SELECT 1;
+--error 1044,1227,1370
+CREATE FUNCTION fun1() RETURNS int RETURN(1);
+--error 1044,1227,1370
+CREATE FUNCTION fun1 RETURNS STRING SONAME 'funlib.so';
+--error 1044,1227,1370
+CREATE PROCEDURE proc1()  BEGIN END;
+--error 1044,1142,1227,1370
+CREATE INDEX idx ON tbl(id);
+--error 1044,1142,1227,1370
+CREATE LOGFILE GROUP lfg ADD UNDOFILE 'undofile' ENGINE innodb;
+--error 1044,1142,1227,1370
+CREATE SERVER srv FOREIGN DATA WRAPPER 'fdw' OPTIONS (USER 'user');
+--error 1044,1142,1227,1370
+CREATE TABLE t (i int);
+--error 1044,1142,1227,1370
+CREATE TABLESPACE tblspc ADD DATAFILE 'file' ENGINE=innodb;
+--error 1044,1142,1227,1370
+CREATE TRIGGER trg BEFORE UPDATE ON t FOR EACH ROW BEGIN END;
+--error 1044,1142,1227,1370
+CREATE VIEW vw AS SELECT 1;
+
+
+
+--error 1044,1142,1227,1370
+DROP DATABASE db;
+--error 1044,1142,1227,1370
+DROP EVENT ev;
+--error 1044,1142,1227,1370
+DROP FUNCTION fun1;
+--error 1044,1142,1227,1370
+DROP INDEX idx ON t0;
+--error 1044,1142,1227,1370,1064
+DROP LOGFILE GROUP lfg;
+--error 1044,1142,1227,1370
+DROP PROCEDURE proc1;
+--error 1044,1142,1227,1370
+DROP SERVEr srv;
+--error 1044,1142,1227,1370
+DROP TABLE t0;
+--error 1044,1142,1227,1370,1064
+DROP TABLESPACE tblspc;
+--error 1044,1142,1227,1360,1370
+DROP TRIGGER trg;
+--error 1044,1142,1227,1370
+DROP VIEW vw;
+
+--error 1044,1142,1227,1370
+RENAME TABLE t0 TO t1;
+
+--error 1044,1142,1227,1370
+TRUNCATE TABLE t0;
+
+# DCL
+
+# account management
+--error 1044,1142,1227,1370,1064
+ALTER USER myuser PASSWORD EXPIRE;
+--error 1044,1142,1227,1370
+CREATE USER myuser IDENTIFIED BY 'pass';
+--error 1044,1142,1227,1370
+DROP USER myuser;
+--error 1044,1045,1142,1227,1370
+GRANT ALL ON *.* TO 'myuser';
+--error 1044,1142,1227,1370
+RENAME USER myuser TO mariauser;
+--error 1044,1142,1227,1370
+REVOKE SELECT ON test FROM myuser;
+--error 1044,1142,1227,1370,1698
+REVOKE ALL, GRANT OPTION FROM myuser;
+--error 1044,1142,1227,1370,1698
+REVOKE PROXY ON myuser FROM myuser;
+
+# table maintenance
+--error 1044,1142,1227,1370
+ANALYZE TABLE db.tbl;
+--error 1044,1142,1227,1370
+CHECK TABLE db.tbl;
+--error 1044,1142,1227,1370
+CHECKSUM TABLE db.tbl;
+--error 1044,1142,1227,1370
+OPTIMIZE TABLE db.tbl;
+--error 1044,1142,1227,1370
+REPAIR TABLE db.tbl;
+
+# plugin and user defined functions
+--error 1044,1142,1227,1370
+INSTALL PLUGIN plg SONAME 'plg.so';
+--error 1044,1142,1227,1370
+UNINSTALL PLUGIN plg;
+
+--connection node_1
+DROP USER 'userMW416'@'localhost';
+SHOW DATABASES;
+SHOW GLOBAL STATUS LIKE 'wsrep_replicated';
diff --git a/mysql-test/suite/galera/t/galera#500.test b/mysql-test/suite/galera/t/galera#500.test
new file mode 100644
index 00000000000..3c8490b6907
--- /dev/null
+++ b/mysql-test/suite/galera/t/galera#500.test
@@ -0,0 +1,38 @@
+#
+# The purpose of this test is to verify that if an exception is
+# thrown from gcomm background thread, the provider terminates properly
+# and wsrep_ready becomes 0.
+#
+
+--source include/have_innodb.inc
+--source include/galera_cluster.inc
+--source include/galera_have_debug_sync.inc
+
+# Force node_2 gcomm background thread to terminate via exception.
+--connection node_2
+--let $wsrep_cluster_address = `SELECT @@wsrep_cluster_address`
+# Setting gmcast.isolate=2 will force gcomm background thread to
+# throw exception.
+SET SESSION wsrep_sync_wait = 0;
+SET GLOBAL wsrep_provider_options="gmcast.isolate=2";
+
+# Wait until wsrep_ready becomes 0.
+--let $wait_condition = SELECT VARIABLE_VALUE = 0 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME ='wsrep_ready'
+--source include/wait_condition.inc
+
+# Wait until node_1 ends up in non-prim and rebootstrap the cluster.
+--connection node_1
+SET SESSION wsrep_sync_wait = 0;
+--let $wait_condition = SELECT VARIABLE_VALUE = 1 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME ='wsrep_cluster_size'
+--source include/wait_condition.inc
+SHOW STATUS LIKE 'wsrep_cluster_status';
+SET SESSION wsrep_sync_wait = default;
+SET GLOBAL wsrep_provider_options="pc.bootstrap=1";
+
+# Restart node_2
+--connection node_2
+SET SESSION wsrep_on=0;
+--source include/restart_mysqld.inc
+
+--connection node_2
+CALL mtr.add_suppression("WSREP: exception from gcomm, backend must be restarted: Gcomm backend termination was requested by setting gmcast.isolate=2.");
diff --git a/mysql-test/suite/galera/t/galera_gcache_recover_manytrx.test b/mysql-test/suite/galera/t/galera_gcache_recover_manytrx.test
index 3bfcdc9f117..08165f30f7d 100644
--- a/mysql-test/suite/galera/t/galera_gcache_recover_manytrx.test
+++ b/mysql-test/suite/galera/t/galera_gcache_recover_manytrx.test
@@ -5,6 +5,7 @@
 
 --source include/galera_cluster.inc
 --source include/big_test.inc
+--source include/have_log_bin.inc
 
 SET SESSION wsrep_sync_wait = 0;
 CREATE TABLE t1 (f1 INTEGER PRIMARY KEY AUTO_INCREMENT, f2 LONGBLOB) ENGINE=InnoDB;
@@ -93,6 +94,8 @@ END|
 
 DELIMITER ;|
 
+--let $wsrep_last_committed_before = `SELECT VARIABLE_VALUE FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME = 'wsrep_last_committed'`
+
 --connect node_1_insert_simple, 127.0.0.1, root, , test, $NODE_MYPORT_1
 --connect node_1_insert_multi, 127.0.0.1, root, , test, $NODE_MYPORT_1
 --connect node_1_insert_transaction, 127.0.0.1, root, , test, $NODE_MYPORT_1
@@ -124,6 +127,13 @@ DELIMITER ;|
 
 --connection node_2
 SET SESSION wsrep_sync_wait = 0;
+
+# Make sure that node_2 is not killed while TOIs are applied.
+# Otherwhise we risk that grastate file is marked unsafe, and
+# as a consequence the node cannot rejoin with IST.
+--let $wait_condition = SELECT VARIABLE_VALUE > $wsrep_last_committed_before FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME = 'wsrep_last_committed'
+--source include/wait_condition.inc
+
 --source include/kill_galera.inc
 
 --sleep 10
@@ -172,9 +182,8 @@ SET SESSION wsrep_sync_wait = 0;
 --source include/start_mysqld.inc
 
 --connection node_1
---source include/wait_until_connected_again.inc
---source include/galera_wait_ready.inc
 --let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size';
+--source include/wait_condition.inc
 
 --let $diff_servers = 1 2
 --source include/diff_servers.inc
diff --git a/mysql-test/suite/galera/t/galera_many_tables_pk.test b/mysql-test/suite/galera/t/galera_many_tables_pk.test
index 551307b123f..73c5fc1622c 100644
--- a/mysql-test/suite/galera/t/galera_many_tables_pk.test
+++ b/mysql-test/suite/galera/t/galera_many_tables_pk.test
@@ -16,7 +16,7 @@ if (!`SELECT @@open_files_limit >= 1024`){
 while ($count)
 {
   --disable_query_log
-  --let $ddl_var = `SELECT CONCAT("CREATE TABLE t", $count, " (f1 INTEGER AUTO_INCREMENT PRIMARY KEY) ENGINE=InnoDB")`
+  --let $ddl_var = `SELECT CONCAT("CREATE TABLE t", $count, " (f1 INTEGER PRIMARY KEY) ENGINE=InnoDB")`
   --eval $ddl_var
   --enable_query_log
   --dec $count
@@ -37,7 +37,7 @@ START TRANSACTION;
 while ($count)
 {
   --disable_query_log
-  --let $ddl_var = `SELECT CONCAT("INSERT INTO t", $count, " VALUES (DEFAULT)")`
+  --let $ddl_var = `SELECT CONCAT("INSERT INTO t", $count, " VALUES (1)")`
   --eval $ddl_var
   --enable_query_log
   --dec $count
diff --git a/mysql-test/suite/galera/t/galera_var_dirty_reads.test b/mysql-test/suite/galera/t/galera_var_dirty_reads.test
index 3e2108868af..1f01c4aac07 100644
--- a/mysql-test/suite/galera/t/galera_var_dirty_reads.test
+++ b/mysql-test/suite/galera/t/galera_var_dirty_reads.test
@@ -11,6 +11,11 @@
 --let $node_2=node_2
 --source include/auto_increment_offset_save.inc
 
+# Save original auto_increment_offset values.
+--let $node_1=node_1
+--let $node_2=node_2
+--source include/auto_increment_offset_save.inc
+
 --connection node_2
 --let $wsrep_cluster_address_saved = `SELECT @@global.wsrep_cluster_address`
 
diff --git a/mysql-test/suite/galera_3nodes/r/galera_evs_suspect_timeout.result b/mysql-test/suite/galera_3nodes/r/galera_evs_suspect_timeout.result
index 1464222a079..7e0d282ec7f 100644
--- a/mysql-test/suite/galera_3nodes/r/galera_evs_suspect_timeout.result
+++ b/mysql-test/suite/galera_3nodes/r/galera_evs_suspect_timeout.result
@@ -11,6 +11,7 @@ SET SESSION wsrep_sync_wait = 0;
 SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size';
 VARIABLE_VALUE = 2
 1
+SET SESSION wsrep_sync_wait = DEFAULT;
 SELECT COUNT(*) = 1 FROM t1;
 COUNT(*) = 1
 1
diff --git a/mysql-test/suite/galera_3nodes/t/galera_evs_suspect_timeout.test b/mysql-test/suite/galera_3nodes/t/galera_evs_suspect_timeout.test
index a87f19ac94e..03236a3cb93 100644
--- a/mysql-test/suite/galera_3nodes/t/galera_evs_suspect_timeout.test
+++ b/mysql-test/suite/galera_3nodes/t/galera_evs_suspect_timeout.test
@@ -50,6 +50,7 @@ SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_N
 --enable_query_log
 
 --source include/wait_until_connected_again.inc
+SET SESSION wsrep_sync_wait = DEFAULT;
 SELECT COUNT(*) = 1 FROM t1;
 DROP TABLE t1;
 
diff --git a/mysql-test/suite/innodb/t/innodb_bug27216817.test b/mysql-test/suite/innodb/t/innodb_bug27216817.test
deleted file mode 100644
index a93932b4a04..00000000000
--- a/mysql-test/suite/innodb/t/innodb_bug27216817.test
+++ /dev/null
@@ -1,28 +0,0 @@
-#
-# BUG#27216817: INNODB: FAILING ASSERTION:
-#               PREBUILT->TABLE->N_MYSQL_HANDLES_OPENED == 1
-#
-
-source include/have_innodb.inc;
-create table t1 (a int not null, b int not null) engine=innodb;
-insert t1 values (1,2),(3,4);
-
-lock table t1 write, t1 tr read;
-flush status;
-alter table t1 add primary key (b);
-show status like 'Handler_read_rnd_next';
-unlock tables;
-alter table t1 drop primary key;
-
-lock table t1 write;
-flush status;
-alter table t1 add primary key (b);
-show status like 'Handler_read_rnd_next';
-unlock tables;
-alter table t1 drop primary key;
-
-flush status;
-alter table t1 add primary key (b);
-show status like 'Handler_read_rnd_next';
-
-drop table t1;
diff --git a/mysql-test/suite/wsrep/r/variables.result b/mysql-test/suite/wsrep/r/variables.result
index 62d7f62440f..4ecc1ca3b79 100644
--- a/mysql-test/suite/wsrep/r/variables.result
+++ b/mysql-test/suite/wsrep/r/variables.result
@@ -207,6 +207,13 @@ Threads_connected	1
 SHOW STATUS LIKE 'wsrep_thread_count';
 Variable_name	Value
 wsrep_thread_count	11
+set wsrep_on=0;
+set wsrep_on=1;
+create user test@localhost;
+set auto_increment_increment=10;
+set wsrep_on=0;
+ERROR 42000: Access denied; you need (at least one of) the SUPER privilege(s) for this operation
+drop user test@localhost;
 #
 # MDEV#6411: Setting set @@global.wsrep_sst_auth=NULL causes crash
 #
diff --git a/mysql-test/suite/wsrep/t/variables.test b/mysql-test/suite/wsrep/t/variables.test
index 1769f567848..1315f090d5c 100644
--- a/mysql-test/suite/wsrep/t/variables.test
+++ b/mysql-test/suite/wsrep/t/variables.test
@@ -118,6 +118,20 @@ sleep 3;
 SHOW STATUS LIKE 'threads_connected';
 SHOW STATUS LIKE 'wsrep_thread_count';
 
+#
+# privileges for wsrep_on
+#
+set wsrep_on=0;
+set wsrep_on=1;
+create user test@localhost;
+connect con1,localhost,test;
+set auto_increment_increment=10;
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+set wsrep_on=0;
+disconnect con1;
+connection default;
+drop user test@localhost;
+
 --echo #
 --echo # MDEV#6411: Setting set @@global.wsrep_sst_auth=NULL causes crash
 --echo #
diff --git a/mysql-test/t/read_only_innodb.test b/mysql-test/t/read_only_innodb.test
index a3df1b133c4..f404ba17579 100644
--- a/mysql-test/t/read_only_innodb.test
+++ b/mysql-test/t/read_only_innodb.test
@@ -246,15 +246,6 @@ SELECT * FROM temp1, temp2;
 DROP TABLE temp1, temp2;
 
 --echo
---echo # MDEV-14185 CREATE TEMPORARY TABLE AS SELECT causes error 1290 with read_only and InnoDB.
---echo
-
-CREATE TEMPORARY TABLE temp1 ENGINE=INNODB AS SELECT a FROM t1;
-SELECT * FROM temp1;
-DROP TABLE temp1;
-
-
---echo
 --echo # Disconnect and cleanup
 --echo
 disconnect con1;
diff --git a/mysys/my_symlink.c b/mysys/my_symlink.c
index 06f6a29e4a0..8580fac3595 100644
--- a/mysys/my_symlink.c
+++ b/mysys/my_symlink.c
@@ -244,7 +244,7 @@ const char *my_open_parent_dir_nosymlinks(const char *pathname, int *pdfd)
       return pathname + (s - buf);
     }
 
-    fd = openat(dfd, s, O_NOFOLLOW | O_PATH);
+    fd = openat(dfd, s, O_NOFOLLOW | O_PATH | O_CLOEXEC);
     if (fd < 0)
       goto err;
 
diff --git a/scripts/CMakeLists.txt b/scripts/CMakeLists.txt
index 880458c1517..b994c9f67b5 100644
--- a/scripts/CMakeLists.txt
+++ b/scripts/CMakeLists.txt
@@ -366,6 +366,22 @@ ELSE()
       COMPONENT ${${file}_COMPONENT}
      )
   ENDFOREACH()
+  SET (wsrep_sst_rsync_wan ${CMAKE_CURRENT_BINARY_DIR}/wsrep_sst_rsync_wan)
+  ADD_CUSTOM_COMMAND(
+    OUTPUT ${wsrep_sst_rsync_wan}
+    COMMAND ${CMAKE_COMMAND} ARGS -E create_symlink
+      wsrep_sst_rsync
+      wsrep_sst_rsync_wan
+  )
+  ADD_CUSTOM_TARGET(symlink_wsrep_sst_rsync
+      ALL
+      DEPENDS ${wsrep_sst_rsync_wan}
+  )
+  INSTALL(
+    FILES  ${wsrep_sst_rsync_wan}
+    DESTINATION ${INSTALL_BINDIR}
+    COMPONENT Server
+  )
 
   FOREACH(file ${WSREP_SOURCE})
     CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/${file}.sh
@@ -379,7 +395,6 @@ ELSE()
       COMPONENT ${${file}_COMPONENT}
      )
   ENDFOREACH()
-
 ENDIF()
 
 # Install libgcc as  mylibgcc.a
diff --git a/scripts/wsrep_sst_common.sh b/scripts/wsrep_sst_common.sh
index 47d9021fe55..50264fe560a 100644
--- a/scripts/wsrep_sst_common.sh
+++ b/scripts/wsrep_sst_common.sh
@@ -35,18 +35,25 @@ case "$1" in
         #
         # Break address string into host:port/path parts
         #
-        readonly WSREP_SST_OPT_HOST=${WSREP_SST_OPT_ADDR%%[:/]*}
-        if [ ${WSREP_SST_OPT_HOST:0:1} = '[' ]
-        then
-            # IPv6 notation
-            readonly WSREP_SST_OPT_HOST_UNESCAPED=${WSREP_SST_OPT_HOST:1:-1}
-        else
-            readonly WSREP_SST_OPT_HOST_UNESCAPED=${WSREP_SST_OPT_HOST}
-        fi
-        readonly WSREP_SST_OPT_ADDR_PORT=$(echo $WSREP_SST_OPT_ADDR | \
-                cut -d ']' -f 2 | cut -s -d ':' -f 2 | cut -d '/' -f 1)
+        case "${WSREP_SST_OPT_ADDR}" in
+        \[*)
+            # IPv6
+            addr_no_bracket=${WSREP_SST_OPT_ADDR#\[}
+            readonly WSREP_SST_OPT_HOST_UNESCAPED=${addr_no_bracket%%\]*}
+            readonly WSREP_SST_OPT_HOST="[${WSREP_SST_OPT_HOST_UNESCAPED}]"
+            remain=${WSREP_SST_OPT_ADDR#*\]}
+            remain=${remain#*:}
+            ;;
+        *)
+            readonly WSREP_SST_OPT_HOST=${WSREP_SST_OPT_ADDR%%[:/]*}
+            readonly WSREP_SST_OPT_HOST_UNESCAPED=$WSREP_SST_OPT_HOST
+            remain=${WSREP_SST_OPT_ADDR#*:}
+            ;;
+        esac
+        readonly WSREP_SST_OPT_ADDR_PORT=${remain%%/*}
+        remain=${remain#*/}
+        readonly WSREP_SST_OPT_MODULE=${remain%%/*}
         readonly WSREP_SST_OPT_PATH=${WSREP_SST_OPT_ADDR#*/}
-        readonly WSREP_SST_OPT_MODULE=${WSREP_SST_OPT_PATH%%/*}
         remain=${WSREP_SST_OPT_PATH#*/}
         readonly WSREP_SST_OPT_LSN=${remain%%/*}
         remain=${remain#*/}
@@ -126,10 +133,10 @@ done
 readonly WSREP_SST_OPT_BYPASS
 readonly WSREP_SST_OPT_BINLOG
 
-if [ -n "${WSREP_SST_OPT_ADDR:-}" ]; then
+if [ -n "${WSREP_SST_OPT_ADDR_PORT:-}" ]; then
   if [ -n "${WSREP_SST_OPT_PORT:-}" ]; then
-    if [ -n "$WSREP_SST_OPT_ADDR_PORT" -a "$WSREP_SST_OPT_PORT" != "$WSREP_SST_OPT_ADDR_PORT" ]; then
-      wsrep_log_error "port in --port=$WSREP_SST_OPT_PORT differs from port in --address=$WSREP_SST_OPT_ADDR"
+    if [ "$WSREP_SST_OPT_PORT" != "$WSREP_SST_OPT_ADDR_PORT" ]; then
+      echo "WSREP_SST: [ERROR] port in --port=$WSREP_SST_OPT_PORT differs from port in --address=$WSREP_SST_OPT_ADDR" >&2
       exit 2
     fi
   else
diff --git a/scripts/wsrep_sst_mysqldump.sh b/scripts/wsrep_sst_mysqldump.sh
index 46edefd4829..fe49279a680 100644
--- a/scripts/wsrep_sst_mysqldump.sh
+++ b/scripts/wsrep_sst_mysqldump.sh
@@ -131,7 +131,7 @@ SET_GTID_BINLOG_STATE=""
 SQL_LOG_BIN_OFF=""
 
 # Safety check
-if echo $SERVER_VERSION | grep '^10.1' > /dev/null
+if [ ${SERVER_VERSION%%.*} != '5' ]
 then
   # If binary logging is enabled on the joiner node, we need to copy donor's
   # gtid_binlog_state to joiner. In order to do that, a RESET MASTER must be
diff --git a/sql/events.cc b/sql/events.cc
index cb81e98a254..b7b263971b3 100644
--- a/sql/events.cc
+++ b/sql/events.cc
@@ -462,8 +462,7 @@ Events::update_event(THD *thd, Event_parse_data *parse_data,
 
   if (check_access(thd, EVENT_ACL, parse_data->dbname.str, NULL, NULL, 0, 0))
     DBUG_RETURN(TRUE);
-
-  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL)
+  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
 
   if (lock_object_name(thd, MDL_key::EVENT,
                        parse_data->dbname.str, parse_data->name.str))
@@ -592,8 +591,7 @@ Events::drop_event(THD *thd, LEX_STRING dbname, LEX_STRING name, bool if_exists)
 
   if (check_access(thd, EVENT_ACL, dbname.str, NULL, NULL, 0, 0))
     DBUG_RETURN(TRUE);
-
-  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL)
+  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
 
   /*
     Turn off row binlogging of this statement and use statement-based so
@@ -619,7 +617,7 @@ Events::drop_event(THD *thd, LEX_STRING dbname, LEX_STRING name, bool if_exists)
 #ifdef WITH_WSREP
 error:
   DBUG_RETURN(TRUE);
-#endif
+#endif /* WITH_WSREP */
 }
 
 
diff --git a/sql/handler.cc b/sql/handler.cc
index 87f0926ad9a..1027a8b102d 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -4377,6 +4377,7 @@ handler::ha_create_partitioning_metadata(const char *name,
   DBUG_ASSERT(m_lock_type == F_UNLCK ||
               (!old_name && strcmp(name, table_share->path.str)));
 
+
   return create_partitioning_metadata(name, old_name, action_flag);
 }
 
@@ -6168,6 +6169,12 @@ void ha_fake_trx_id(THD *thd)
     DBUG_VOID_RETURN;
   }
 
+  if (thd->wsrep_ws_handle.trx_id != WSREP_UNDEFINED_TRX_ID)
+  {
+    WSREP_DEBUG("fake trx id skipped: %lu", thd->wsrep_ws_handle.trx_id);
+    DBUG_VOID_RETURN;
+  }
+
   /* Try statement transaction if standard one is not set. */
   THD_TRANS *trans= (thd->transaction.all.ha_list) ?  &thd->transaction.all :
     &thd->transaction.stmt;
diff --git a/sql/log.cc b/sql/log.cc
index 29f8c5639cf..bcfaf5174da 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -2576,7 +2576,7 @@ bool MYSQL_LOG::open(
   File file= -1;
   my_off_t seek_offset;
   bool is_fifo = false;
-  int open_flags= O_CREAT | O_BINARY;
+  int open_flags= O_CREAT | O_BINARY | O_CLOEXEC;
   DBUG_ENTER("MYSQL_LOG::open");
   DBUG_PRINT("enter", ("log_type: %d", (int) log_type_arg));
 
@@ -3296,7 +3296,7 @@ bool MYSQL_BIN_LOG::open_index_file(const char *index_file_name_arg,
             ".index", opt);
   if ((index_file_nr= mysql_file_open(m_key_file_log_index,
                                       index_file_name,
-                                      O_RDWR | O_CREAT | O_BINARY,
+                                      O_RDWR | O_CREAT | O_BINARY | O_CLOEXEC,
                                       MYF(MY_WME))) < 0 ||
        mysql_file_sync(index_file_nr, MYF(MY_WME)) ||
        init_io_cache(&index_file, index_file_nr,
@@ -8967,14 +8967,14 @@ int TC_LOG_MMAP::open(const char *opt_name)
   tc_log_page_size= my_getpagesize();
 
   fn_format(logname,opt_name,mysql_data_home,"",MY_UNPACK_FILENAME);
-  if ((fd= mysql_file_open(key_file_tclog, logname, O_RDWR, MYF(0))) < 0)
+  if ((fd= mysql_file_open(key_file_tclog, logname, O_RDWR | O_CLOEXEC, MYF(0))) < 0)
   {
     if (my_errno != ENOENT)
       goto err;
     if (using_heuristic_recover())
       return 1;
     if ((fd= mysql_file_create(key_file_tclog, logname, CREATE_MODE,
-                               O_RDWR, MYF(MY_WME))) < 0)
+                               O_RDWR | O_CLOEXEC, MYF(MY_WME))) < 0)
       goto err;
     inited=1;
     file_length= opt_tc_log_size;
diff --git a/sql/log_event.cc b/sql/log_event.cc
index a5fafbd8297..e70d97c54c0 100644
--- a/sql/log_event.cc
+++ b/sql/log_event.cc
@@ -4415,22 +4415,6 @@ int Query_log_event::do_apply_event(rpl_group_info *rgi,
       else
         thd->variables.collation_database= thd->db_charset;
 
-      {
-        const CHARSET_INFO *cs= thd->charset();
-        /*
-          We cannot ask for parsing a statement using a character set
-          without state_maps (parser internal data).
-        */
-        if (!cs->state_map)
-        {
-          rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
-                      ER_THD(thd, ER_SLAVE_FATAL_ERROR),
-                      "character_set cannot be parsed");
-          thd->is_slave_error= true;
-          goto end;
-        }
-      }
-
       /*
         Record any GTID in the same transaction, so slave state is
         transactionally consistent.
diff --git a/sql/slave.cc b/sql/slave.cc
index ed679dfdf80..6fe6de6872a 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -5128,7 +5128,7 @@ err_during_init:
   */
   if (WSREP_ON && wsrep_node_dropped && wsrep_restart_slave)
   {
-    if (wsrep_ready)
+    if (wsrep_ready_get())
     {
       WSREP_INFO("Slave error due to node temporarily non-primary"
                  "SQL slave will continue");
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 0ced84791a0..fb3604b899b 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -2940,6 +2940,7 @@ public:
     query_id_t first_query_id;
   } binlog_evt_union;
 
+  mysql_cond_t              COND_wsrep_thd;
   /**
     Internal parser state.
     Note that since the parser is not re-entrant, we keep only one parser
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index 634ddb32b71..e103c3b390c 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -4383,12 +4383,44 @@ bool select_create::send_eof()
   */
   if (!table->s->tmp_table)
   {
+#ifdef WITH_WSREP
+    if (WSREP_ON)
+    {
+      /*
+         append table level exclusive key for CTAS
+      */
+      wsrep_key_arr_t key_arr= {0, 0};
+      wsrep_prepare_keys_for_isolation(thd,
+                                       create_table->db,
+                                       create_table->table_name,
+                                       table_list,
+                                       &key_arr);
+      int rcode = wsrep->append_key(
+                                wsrep,
+                                &thd->wsrep_ws_handle,
+                                key_arr.keys, //&wkey,
+                                key_arr.keys_len,
+                                WSREP_KEY_EXCLUSIVE,
+                                false);
+      wsrep_keys_free(&key_arr);
+      if (rcode) {
+        DBUG_PRINT("wsrep", ("row key failed: %d", rcode));
+        WSREP_ERROR("Appending table key for CTAS failed: %s, %d",
+                    (wsrep_thd_query(thd)) ?
+                    wsrep_thd_query(thd) : "void", rcode);
+        return true;
+      }
+      /* If commit fails, we should be able to reset the OK status. */
+      thd->get_stmt_da()->set_overwrite_status(TRUE);
+    }
+#endif /* WITH_WSREP */
     trans_commit_stmt(thd);
     if (!(thd->variables.option_bits & OPTION_GTID_BEGIN))
       trans_commit_implicit(thd);
 #ifdef WITH_WSREP
     if (WSREP_ON)
     {
+      thd->get_stmt_da()->set_overwrite_status(FALSE);
       mysql_mutex_lock(&thd->LOCK_thd_data);
       if (thd->wsrep_conflict_state != NO_CONFLICT)
       {
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index be7408af77d..b2b2bfb5a27 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -2915,6 +2915,7 @@ mysql_execute_command(THD *thd)
   {
     WSREP_SYNC_WAIT(thd, WSREP_SYNC_WAIT_BEFORE_SHOW);
     execute_show_status(thd, all_tables);
+
     break;
   }
   case SQLCOM_SHOW_EXPLAIN:
@@ -3961,7 +3962,7 @@ end_with_restore_list:
   case SQLCOM_INSERT_SELECT:
   {
     WSREP_SYNC_WAIT(thd, WSREP_SYNC_WAIT_BEFORE_INSERT_REPLACE);
-    select_result *sel_result;
+    select_insert *sel_result;
     bool explain= MY_TEST(lex->describe);
     DBUG_ASSERT(first_table == all_tables && first_table != 0);
     if (WSREP_CLIENT(thd) &&
diff --git a/sql/sql_plugin.cc b/sql/sql_plugin.cc
index 46ffc074ca7..7e4be9aed16 100644
--- a/sql/sql_plugin.cc
+++ b/sql/sql_plugin.cc
@@ -2120,6 +2120,7 @@ bool mysql_install_plugin(THD *thd, const LEX_STRING *name,
   tables.init_one_table("mysql", 5, "plugin", 6, "plugin", TL_WRITE);
   if (!opt_noacl && check_table_access(thd, INSERT_ACL, &tables, FALSE, 1, FALSE))
     DBUG_RETURN(TRUE);
+  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
 
   WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL)
 
@@ -2155,6 +2156,7 @@ bool mysql_install_plugin(THD *thd, const LEX_STRING *name,
 
     See also mysql_uninstall_plugin() and initialize_audit_plugin()
   */
+
   mysql_audit_acquire_plugins(thd, event_class_mask);
 
   mysql_mutex_lock(&LOCK_plugin);
@@ -2263,6 +2265,7 @@ bool mysql_uninstall_plugin(THD *thd, const LEX_STRING *name,
 
   if (!opt_noacl && check_table_access(thd, DELETE_ACL, &tables, FALSE, 1, FALSE))
     DBUG_RETURN(TRUE);
+  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
 
   WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL)
 
diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc
index bbcc75718a3..d9999e2aab7 100644
--- a/sql/sql_trigger.cc
+++ b/sql/sql_trigger.cc
@@ -442,7 +442,6 @@ bool mysql_create_or_drop_trigger(THD *thd, TABLE_LIST *tables, bool create)
     my_error(ER_BINLOG_CREATE_ROUTINE_NEED_SUPER, MYF(0));
     DBUG_RETURN(TRUE);
   }
-  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL)
 
   if (!create)
   {
@@ -504,6 +503,7 @@ bool mysql_create_or_drop_trigger(THD *thd, TABLE_LIST *tables, bool create)
     if (err_status)
       goto end;
   }
+  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
 
   /* We should have only one table in table list. */
   DBUG_ASSERT(tables->next_global == 0);
diff --git a/sql/sql_view.cc b/sql/sql_view.cc
index 6d7a8e1cc9d..6bd6b6a7b63 100644
--- a/sql/sql_view.cc
+++ b/sql/sql_view.cc
@@ -428,8 +428,7 @@ bool mysql_create_view(THD *thd, TABLE_LIST *views,
 
   lex->link_first_table_back(view, link_to_local);
   view->open_type= OT_BASE_ONLY;
-
-  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL)
+  WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
 
   /*
     ignore lock specs for CREATE statement
@@ -692,15 +691,15 @@ bool mysql_create_view(THD *thd, TABLE_LIST *views,
   lex->link_first_table_back(view, link_to_local);
   DBUG_RETURN(0);
 
+#ifdef WITH_WSREP
+ error:
+  res= TRUE;
+#endif /* WITH_WSREP */
 err:
   THD_STAGE_INFO(thd, stage_end);
   lex->link_first_table_back(view, link_to_local);
   unit->cleanup();
   DBUG_RETURN(res || thd->is_error());
-#ifdef WITH_WSREP
- error:
-  DBUG_RETURN(true);
-#endif /* WITH_WSREP */
 }
 
 
diff --git a/sql/wsrep_hton.cc b/sql/wsrep_hton.cc
index 1e95cd4d282..e5c754a9d41 100644
--- a/sql/wsrep_hton.cc
+++ b/sql/wsrep_hton.cc
@@ -117,7 +117,7 @@ void wsrep_post_commit(THD* thd, bool all)
 
   switch (thd->wsrep_exec_mode)
   {
-  case LOCAL_COMMIT:
+    case LOCAL_COMMIT:
     {
       DBUG_ASSERT(thd->wsrep_trx_meta.gtid.seqno != WSREP_SEQNO_UNDEFINED);
       if (wsrep && wsrep->post_commit(wsrep, &thd->wsrep_ws_handle))
@@ -129,18 +129,30 @@ void wsrep_post_commit(THD* thd, bool all)
       wsrep_cleanup_transaction(thd);
       break;
     }
- case LOCAL_STATE:
-   {
-     /*
-       Non-InnoDB statements may have populated events in stmt cache => cleanup
-     */
-     WSREP_DEBUG("cleanup transaction for LOCAL_STATE: %s", thd->query());
-     wsrep_cleanup_transaction(thd);
-     break;
-   }
-  default: break;
+    case LOCAL_STATE:
+    {
+      /* non-InnoDB statements may have populated events in stmt cache
+        => cleanup
+      */
+      WSREP_DEBUG("cleanup transaction for LOCAL_STATE");
+      /*
+        Run post-rollback hook to clean up in the case if
+        some keys were populated for the transaction in provider
+        but during commit time there was no write set to replicate.
+        This may happen when client sets the SAVEPOINT and immediately
+        rolls back to savepoint after first operation.
+      */
+      if (all && thd->wsrep_conflict_state != MUST_REPLAY &&
+          wsrep && wsrep->post_rollback(wsrep, &thd->wsrep_ws_handle))
+      {
+        WSREP_WARN("post_rollback fail: %llu %d",
+		(long long)thd->thread_id, thd->get_stmt_da()->status());
+      }
+      wsrep_cleanup_transaction(thd);
+      break;
+    }
+    default: break;
   }
-
 }
 
 /*
diff --git a/sql/wsrep_mysqld.cc b/sql/wsrep_mysqld.cc
index 08a32f943f5..b127d3a8f00 100644
--- a/sql/wsrep_mysqld.cc
+++ b/sql/wsrep_mysqld.cc
@@ -13,6 +13,7 @@
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02111-1301 USA */
 
+#include <sql_plugin.h> // SHOW_MY_BOOL
 #include <mysqld.h>
 #include <sql_class.h>
 #include <sql_parse.h>
@@ -288,8 +289,7 @@ wsrep_view_handler_cb (void*                    app_ctx,
 
   if (memcmp(&cluster_uuid, &view->state_id.uuid, sizeof(wsrep_uuid_t)))
   {
-    memcpy((wsrep_uuid_t*)&cluster_uuid, &view->state_id.uuid,
-           sizeof(cluster_uuid));
+    memcpy(&cluster_uuid, &view->state_id.uuid, sizeof(cluster_uuid));
 
     wsrep_uuid_print (&cluster_uuid, cluster_uuid_str,
                       sizeof(cluster_uuid_str));
@@ -335,7 +335,7 @@ wsrep_view_handler_cb (void*                    app_ctx,
       // version change
       if (view->proto_ver != wsrep_protocol_version)
       {
-          my_bool wsrep_ready_saved= wsrep_ready;
+          my_bool wsrep_ready_saved= wsrep_ready_get();
           wsrep_ready_set(FALSE);
           WSREP_INFO("closing client connections for "
                      "protocol change %ld -> %d",
@@ -450,16 +450,34 @@ out:
   return WSREP_CB_SUCCESS;
 }
 
-void wsrep_ready_set (my_bool x)
+my_bool wsrep_ready_set (my_bool x)
 {
   WSREP_DEBUG("Setting wsrep_ready to %d", x);
   if (mysql_mutex_lock (&LOCK_wsrep_ready)) abort();
-  if (wsrep_ready != x)
+  my_bool ret= (wsrep_ready != x);
+  if (ret)
   {
     wsrep_ready= x;
     mysql_cond_signal (&COND_wsrep_ready);
   }
   mysql_mutex_unlock (&LOCK_wsrep_ready);
+  return ret;
+}
+
+my_bool wsrep_ready_get (void)
+{
+  if (mysql_mutex_lock (&LOCK_wsrep_ready)) abort();
+  my_bool ret= wsrep_ready;
+  mysql_mutex_unlock (&LOCK_wsrep_ready);
+  return ret;
+}
+
+int wsrep_show_ready(THD *thd, SHOW_VAR *var, char *buff)
+{
+  var->type= SHOW_MY_BOOL;
+  var->value= buff;
+  *((my_bool *)buff)= wsrep_ready_get();
+  return 0;
 }
 
 // Wait until wsrep has reached ready state
@@ -478,17 +496,8 @@ void wsrep_ready_wait ()
 static void wsrep_synced_cb(void* app_ctx)
 {
   WSREP_INFO("Synchronized with group, ready for connections");
-  bool signal_main= false;
-  if (mysql_mutex_lock (&LOCK_wsrep_ready)) abort();
-  if (!wsrep_ready)
-  {
-    wsrep_ready= TRUE;
-    mysql_cond_signal (&COND_wsrep_ready);
-    signal_main= true;
-
-  }
+  my_bool signal_main= wsrep_ready_set(TRUE);
   wsrep_config_state.set(WSREP_MEMBER_SYNCED);
-  mysql_mutex_unlock (&LOCK_wsrep_ready);
 
   if (signal_main)
   {
@@ -960,6 +969,8 @@ bool wsrep_must_sync_wait (THD* thd, uint mask)
 {
   return (thd->variables.wsrep_sync_wait & mask) &&
     thd->variables.wsrep_on &&
+    !(thd->variables.wsrep_dirty_reads &&
+      !is_update_query(thd->lex->sql_command)) &&
     !thd->in_active_multi_stmt_transaction() &&
     thd->wsrep_conflict_state != REPLAYING &&
     thd->wsrep_sync_wait_gtid.seqno == WSREP_SEQNO_UNDEFINED;
@@ -1007,17 +1018,7 @@ bool wsrep_sync_wait (THD* thd, uint mask)
   return false;
 }
 
-/*
- * Helpers to deal with TOI key arrays
- */
-typedef struct wsrep_key_arr
-{
-    wsrep_key_t* keys;
-    size_t       keys_len;
-} wsrep_key_arr_t;
-
-
-static void wsrep_keys_free(wsrep_key_arr_t* key_arr)
+void wsrep_keys_free(wsrep_key_arr_t* key_arr)
 {
     for (size_t i= 0; i < key_arr->keys_len; ++i)
     {
@@ -1082,11 +1083,11 @@ static bool wsrep_prepare_key_for_isolation(const char* db,
 }
 
 /* Prepare key list from db/table and table_list */
-static bool wsrep_prepare_keys_for_isolation(THD*              thd,
-                                             const char*       db,
-                                             const char*       table,
-                                             const TABLE_LIST* table_list,
-                                             wsrep_key_arr_t*  ka)
+bool wsrep_prepare_keys_for_isolation(THD*              thd,
+                                      const char*       db,
+                                      const char*       table,
+                                      const TABLE_LIST* table_list,
+                                      wsrep_key_arr_t*  ka)
 {
   ka->keys= 0;
   ka->keys_len= 0;
@@ -1814,7 +1815,7 @@ wsrep_grant_mdl_exception(MDL_context *requestor_ctx,
     }
     else if (request_thd->lex->sql_command == SQLCOM_DROP_TABLE)
     {
-      WSREP_DEBUG("DROP caused BF abort");
+      WSREP_DEBUG("DROP caused BF abort, conf %d", granted_thd->wsrep_conflict_state);
       ticket->wsrep_report(wsrep_debug);
       mysql_mutex_unlock(&granted_thd->LOCK_thd_data);
       wsrep_abort_thd((void*)request_thd, (void*)granted_thd, 1);
diff --git a/sql/wsrep_mysqld.h b/sql/wsrep_mysqld.h
index 57630ed8284..272e4ac4984 100644
--- a/sql/wsrep_mysqld.h
+++ b/sql/wsrep_mysqld.h
@@ -234,6 +234,7 @@ extern wsrep_seqno_t wsrep_locked_seqno;
 
 #define WSREP_QUERY(thd) (thd->query())
 
+extern my_bool wsrep_ready_get();
 extern void wsrep_ready_wait();
 
 class Ha_trx_info;
@@ -326,6 +327,18 @@ bool wsrep_create_like_table(THD* thd, TABLE_LIST* table,
 bool wsrep_node_is_donor();
 bool wsrep_node_is_synced();
 
+typedef struct wsrep_key_arr
+{
+    wsrep_key_t* keys;
+    size_t       keys_len;
+} wsrep_key_arr_t;
+bool wsrep_prepare_keys_for_isolation(THD*              thd,
+                                      const char*       db,
+                                      const char*       table,
+                                      const TABLE_LIST* table_list,
+                                      wsrep_key_arr_t*  ka);
+void wsrep_keys_free(wsrep_key_arr_t* key_arr);
+
 #else /* WITH_WSREP */
 
 #define WSREP(T)  (0)
@@ -355,6 +368,5 @@ bool wsrep_node_is_synced();
 #define wsrep_thr_init() do {} while(0)
 #define wsrep_thr_deinit() do {} while(0)
 #define wsrep_running_threads (0)
-
 #endif /* WITH_WSREP */
 #endif /* WSREP_MYSQLD_H */
diff --git a/sql/wsrep_priv.h b/sql/wsrep_priv.h
index 119f17c2afc..b00bfda16fa 100644
--- a/sql/wsrep_priv.h
+++ b/sql/wsrep_priv.h
@@ -26,7 +26,7 @@
 #include <pthread.h>
 #include <cstdio>
 
-void    wsrep_ready_set (my_bool x);
+my_bool wsrep_ready_set (my_bool x);
 
 ssize_t wsrep_sst_prepare   (void** msg);
 wsrep_cb_status wsrep_sst_donate_cb (void* app_ctx,
diff --git a/storage/innobase/handler/ha_innodb.cc b/storage/innobase/handler/ha_innodb.cc
index c525c2f0efa..0daa89b6e9a 100644
--- a/storage/innobase/handler/ha_innodb.cc
+++ b/storage/innobase/handler/ha_innodb.cc
@@ -2414,8 +2414,12 @@ innobase_mysql_tmpfile(
 			}
 		}
 #else
+#ifdef F_DUPFD_CLOEXEC
+		fd2 = fcntl(fd, F_DUPFD_CLOEXEC, 0);
+#else
 		fd2 = dup(fd);
 #endif
+#endif
 		if (fd2 < 0) {
 			DBUG_PRINT("error",("Got error %d on dup",fd2));
 			my_errno=errno;
@@ -8435,14 +8439,12 @@ report_error:
 						   user_thd);
 
 #ifdef WITH_WSREP
-	if (!error_result                                &&
-	    wsrep_thd_exec_mode(user_thd) == LOCAL_STATE &&
-	    wsrep_on(user_thd)                           &&
-	    !wsrep_consistency_check(user_thd)           &&
-	    !wsrep_thd_ignore_table(user_thd))
-	{
-		if (wsrep_append_keys(user_thd, false, record, NULL))
-		{
+	if (!error_result
+	    && wsrep_on(user_thd)
+	    && wsrep_thd_exec_mode(user_thd) == LOCAL_STATE
+	    && !wsrep_consistency_check(user_thd)
+	    && !wsrep_thd_ignore_table(user_thd)) {
+		if (wsrep_append_keys(user_thd, false, record, NULL)) {
 			DBUG_PRINT("wsrep", ("row key failed"));
 			error_result = HA_ERR_INTERNAL_ERROR;
 			goto wsrep_error;
@@ -18605,8 +18607,10 @@ wsrep_innobase_kill_one_trx(
 		    thd_get_thread_id(thd),
 		    victim_trx->id);
 
-	WSREP_DEBUG("Aborting query: %s",
-		  (thd && wsrep_thd_query(thd)) ? wsrep_thd_query(thd) : "void");
+	WSREP_DEBUG("Aborting query: %s conf %d trx: %lu",
+		    (thd && wsrep_thd_query(thd)) ? wsrep_thd_query(thd) : "void",
+		    wsrep_thd_conflict_state(thd, FALSE),
+		    wsrep_thd_ws_handle(thd)->trx_id);
 
 	wsrep_thd_LOCK(thd);
         DBUG_EXECUTE_IF("sync.wsrep_after_BF_victim_lock",
@@ -18669,7 +18673,7 @@ wsrep_innobase_kill_one_trx(
 			wsrep_t *wsrep= get_wsrep();
 			rcode = wsrep->abort_pre_commit(
 				wsrep, bf_seqno,
-				(wsrep_trx_id_t)victim_trx->id
+				(wsrep_trx_id_t)wsrep_thd_ws_handle(thd)->trx_id
 			);
 
 			switch (rcode) {
@@ -18792,12 +18796,14 @@ wsrep_abort_transaction(
 	my_bool signal)
 {
 	DBUG_ENTER("wsrep_innobase_abort_thd");
-	trx_t* victim_trx = thd_to_trx(victim_thd);
-	trx_t* bf_trx     = (bf_thd) ? thd_to_trx(bf_thd) : NULL;
+	
+	trx_t* victim_trx	= thd_to_trx(victim_thd);
+	trx_t* bf_trx		= (bf_thd) ? thd_to_trx(bf_thd) : NULL;
 
-	WSREP_DEBUG("abort transaction: BF: %s victim: %s",
-		    wsrep_thd_query(bf_thd),
-		    wsrep_thd_query(victim_thd));
+	WSREP_DEBUG("abort transaction: BF: %s victim: %s victim conf: %d",
+			wsrep_thd_query(bf_thd),
+			wsrep_thd_query(victim_thd),
+			wsrep_thd_conflict_state(victim_thd, FALSE));
 
 	if (victim_trx) {
 		lock_mutex_enter();
@@ -18824,29 +18830,27 @@ wsrep_abort_transaction(
 static int innobase_wsrep_set_checkpoint(handlerton* hton, const XID* xid)
 {
 	DBUG_ASSERT(hton == innodb_hton_ptr);
-        if (wsrep_is_wsrep_xid(xid)) {
-                mtr_t mtr;
-                mtr_start(&mtr);
-                trx_sysf_t* sys_header = trx_sysf_get(&mtr);
-                trx_sys_update_wsrep_checkpoint(xid, sys_header, &mtr);
-                mtr_commit(&mtr);
-                innobase_flush_logs(hton);
-                return 0;
-        } else {
-                return 1;
-        }
+	if (wsrep_is_wsrep_xid(xid)) {
+		mtr_t mtr;
+		mtr_start(&mtr);
+		trx_sysf_t* sys_header = trx_sysf_get(&mtr);
+		trx_sys_update_wsrep_checkpoint(xid, sys_header, &mtr);
+		mtr_commit(&mtr);
+		innobase_flush_logs(hton);
+		return 0;
+	} else {
+		return 1;
+	}
 }
 
 static int innobase_wsrep_get_checkpoint(handlerton* hton, XID* xid)
 {
 	DBUG_ASSERT(hton == innodb_hton_ptr);
-        trx_sys_read_wsrep_checkpoint(xid);
-        return 0;
+	trx_sys_read_wsrep_checkpoint(xid);
+	return 0;
 }
 
-static void
-wsrep_fake_trx_id(
-/*==================*/
+static void wsrep_fake_trx_id(
 	handlerton	*hton,
 	THD		*thd)	/*!< in: user thread handle */
 {
diff --git a/storage/innobase/os/os0file.cc b/storage/innobase/os/os0file.cc
index 1e2985b4204..5aa9b6040f8 100644
--- a/storage/innobase/os/os0file.cc
+++ b/storage/innobase/os/os0file.cc
@@ -1422,7 +1422,7 @@ os_file_create_simple_func(
 	}
 
 	do {
-		file = ::open(name, create_flag, os_innodb_umask);
+		file = ::open(name, create_flag | O_CLOEXEC, os_innodb_umask);
 
 		if (file == -1) {
 			*success = FALSE;
@@ -1605,7 +1605,7 @@ os_file_create_simple_no_error_handling_func(
 		return(file);
 	}
 
-	file = open(name, create_flag, os_innodb_umask);
+	file = ::open(name, create_flag | O_CLOEXEC, os_innodb_umask);
 
 	*success = file != -1;
 
@@ -1970,7 +1970,7 @@ os_file_create_func(
 #endif /* O_SYNC */
 
 	do {
-		file = open(name, create_flag, os_innodb_umask);
+		file = ::open(name, create_flag | O_CLOEXEC, os_innodb_umask);
 
 		if (file == -1) {
 			const char*	operation;
@@ -3455,7 +3455,7 @@ os_file_get_status(
 
 		access = !srv_read_only_mode ? O_RDWR : O_RDONLY;
 
-		fh = ::open(path, access, os_innodb_umask);
+		fh = ::open(path, access | O_CLOEXEC, os_innodb_umask);
 
 		if (fh == -1) {
 			stat_info->rw_perm = false;
diff --git a/storage/maria/ma_control_file.c b/storage/maria/ma_control_file.c
index b46cf7e1765..f037589db29 100644
--- a/storage/maria/ma_control_file.c
+++ b/storage/maria/ma_control_file.c
@@ -273,7 +273,7 @@ CONTROL_FILE_ERROR ma_control_file_open(my_bool create_if_missing,
     " file is probably in use by another process";
   uint new_cf_create_time_size, new_cf_changeable_size, new_block_size;
   my_off_t file_size;
-  int open_flags= O_BINARY | /*O_DIRECT |*/ O_RDWR;
+  int open_flags= O_BINARY | /*O_DIRECT |*/ O_RDWR | O_CLOEXEC;
   int error= CONTROL_FILE_UNKNOWN_ERROR;
   DBUG_ENTER("ma_control_file_open");
 
diff --git a/storage/maria/ma_loghandler.c b/storage/maria/ma_loghandler.c
index 129770249aa..aa7ff9da7f2 100644
--- a/storage/maria/ma_loghandler.c
+++ b/storage/maria/ma_loghandler.c
@@ -935,7 +935,7 @@ static File create_logfile_by_number_no_cache(uint32 file_no)
   /* TODO: add O_DIRECT to open flags (when buffer is aligned) */
   if ((file= mysql_file_create(key_file_translog,
                                translog_filename_by_fileno(file_no, path),
-                               0, O_BINARY | O_RDWR, MYF(MY_WME))) < 0)
+                               0, O_BINARY | O_RDWR | O_CLOEXEC, MYF(MY_WME))) < 0)
   {
     DBUG_PRINT("error", ("Error %d during creating file '%s'", errno, path));
     translog_stop_writing();
@@ -973,7 +973,7 @@ static File open_logfile_by_number_no_cache(uint32 file_no)
   /* TODO: use mysql_file_create() */
   if ((file= mysql_file_open(key_file_translog,
                              translog_filename_by_fileno(file_no, path),
-                             log_descriptor.open_flags,
+                             log_descriptor.open_flags | O_CLOEXEC,
                              MYF(MY_WME))) < 0)
   {
     DBUG_PRINT("error", ("Error %d during opening file '%s'", errno, path));
@@ -3243,7 +3243,7 @@ static my_bool translog_get_last_page_addr(TRANSLOG_ADDRESS *addr,
     File fd;
     if ((fd= mysql_file_open(key_file_translog,
                              translog_filename_by_fileno(file_no, path),
-                             O_RDONLY, (no_errors ? MYF(0) : MYF(MY_WME)))) < 0)
+                             O_RDONLY | O_CLOEXEC, (no_errors ? MYF(0) : MYF(MY_WME)))) < 0)
     {
       my_errno= errno;
       DBUG_PRINT("error", ("Error %d during opening file #%d",
diff --git a/storage/maria/ma_open.c b/storage/maria/ma_open.c
index 27a85142f6b..598f76a6472 100644
--- a/storage/maria/ma_open.c
+++ b/storage/maria/ma_open.c
@@ -334,13 +334,13 @@ MARIA_HA *maria_open(const char *name, int mode, uint open_flags)
                     });
     DEBUG_SYNC_C("mi_open_kfile");
     if ((kfile=mysql_file_open(key_file_kfile, name_buff,
-                               (open_mode=O_RDWR) | O_SHARE | O_NOFOLLOW,
+                               (open_mode=O_RDWR) | O_SHARE | O_NOFOLLOW | O_CLOEXEC,
                                MYF(MY_NOSYMLINKS))) < 0)
     {
       if ((errno != EROFS && errno != EACCES) ||
 	  mode != O_RDONLY ||
 	  (kfile=mysql_file_open(key_file_kfile, name_buff,
-                                 (open_mode=O_RDONLY) | O_SHARE | O_NOFOLLOW,
+                                 (open_mode=O_RDONLY) | O_SHARE | O_NOFOLLOW | O_CLOEXEC,
                                  MYF(MY_NOSYMLINKS))) < 0)
 	goto err;
     }
@@ -1942,7 +1942,7 @@ int _ma_open_datafile(MARIA_HA *info, MARIA_SHARE *share)
   DEBUG_SYNC_C("mi_open_datafile");
   info->dfile.file= share->bitmap.file.file=
     mysql_file_open(key_file_dfile, share->data_file_name.str,
-                    share->mode | O_SHARE, MYF(flags));
+                    share->mode | O_SHARE | O_CLOEXEC, MYF(flags));
   return info->dfile.file >= 0 ? 0 : 1;
 }
 
@@ -1956,7 +1956,7 @@ int _ma_open_keyfile(MARIA_SHARE *share)
   mysql_mutex_lock(&share->intern_lock);
   share->kfile.file= mysql_file_open(key_file_kfile,
                                      share->unique_file_name.str,
-                                     share->mode | O_SHARE | O_NOFOLLOW,
+                                     share->mode | O_SHARE | O_NOFOLLOW | O_CLOEXEC,
                              MYF(MY_WME | MY_NOSYMLINKS));
   mysql_mutex_unlock(&share->intern_lock);
   return (share->kfile.file < 0);
diff --git a/storage/myisam/mi_open.c b/storage/myisam/mi_open.c
index a82f2b9e8c1..e692f31b2b4 100644
--- a/storage/myisam/mi_open.c
+++ b/storage/myisam/mi_open.c
@@ -139,13 +139,13 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
 
     DEBUG_SYNC_C("mi_open_kfile");
     if ((kfile= mysql_file_open(mi_key_file_kfile, name_buff,
-                                (open_mode= O_RDWR) | O_SHARE | O_NOFOLLOW,
+                                (open_mode= O_RDWR) | O_SHARE | O_NOFOLLOW | O_CLOEXEC,
                                 MYF(MY_NOSYMLINKS))) < 0)
     {
       if ((errno != EROFS && errno != EACCES) ||
 	  mode != O_RDONLY ||
           (kfile= mysql_file_open(mi_key_file_kfile, name_buff,
-                                  (open_mode= O_RDONLY) | O_SHARE| O_NOFOLLOW,
+                                  (open_mode= O_RDONLY) | O_SHARE| O_NOFOLLOW | O_CLOEXEC,
                                   MYF(MY_NOSYMLINKS))) < 0)
 	goto err;
     }
@@ -1273,7 +1273,7 @@ int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share)
   myf flags= MY_WME | (share->mode & O_NOFOLLOW ? MY_NOSYMLINKS: 0);
   DEBUG_SYNC_C("mi_open_datafile");
   info->dfile= mysql_file_open(mi_key_file_dfile, share->data_file_name,
-                               share->mode | O_SHARE, MYF(flags));
+                               share->mode | O_SHARE | O_CLOEXEC, MYF(flags));
   return info->dfile >= 0 ? 0 : 1;
 }
 
@@ -1282,7 +1282,7 @@ int mi_open_keyfile(MYISAM_SHARE *share)
 {
   if ((share->kfile= mysql_file_open(mi_key_file_kfile,
                                      share->unique_file_name,
-                                     share->mode | O_SHARE | O_NOFOLLOW,
+                                     share->mode | O_SHARE | O_NOFOLLOW | O_CLOEXEC,
                                      MYF(MY_NOSYMLINKS | MY_WME))) < 0)
     return 1;
   return 0;
diff --git a/storage/xtradb/handler/ha_innodb.cc b/storage/xtradb/handler/ha_innodb.cc
index d642f9c0a06..a7d06617696 100644
--- a/storage/xtradb/handler/ha_innodb.cc
+++ b/storage/xtradb/handler/ha_innodb.cc
@@ -2738,8 +2738,12 @@ innobase_mysql_tmpfile(
 			}
 		}
 #else
+#ifdef F_DUPFD_CLOEXEC
+		fd2 = fcntl(fd, F_DUPFD_CLOEXEC, 0);
+#else
 		fd2 = dup(fd);
 #endif
+#endif
 		if (fd2 < 0) {
 			DBUG_PRINT("error",("Got error %d on dup",fd2));
 			my_errno=errno;
@@ -9021,14 +9025,12 @@ report_error:
 						   user_thd);
 
 #ifdef WITH_WSREP
-	if (!error_result                                &&
-	    wsrep_thd_exec_mode(user_thd) == LOCAL_STATE &&
-	    wsrep_on(user_thd)                           &&
-	    !wsrep_consistency_check(user_thd)           &&
-	    !wsrep_thd_ignore_table(user_thd))
-	{
-		if (wsrep_append_keys(user_thd, false, record, NULL))
-		{
+	if (!error_result
+	    && wsrep_on(user_thd)
+ 	    && wsrep_thd_exec_mode(user_thd) == LOCAL_STATE
+	    && !wsrep_consistency_check(user_thd)
+	    && !wsrep_thd_ignore_table(user_thd)) {
+		if (wsrep_append_keys(user_thd, false, record, NULL)) {
 			DBUG_PRINT("wsrep", ("row key failed"));
 			error_result = HA_ERR_INTERNAL_ERROR;
 			goto wsrep_error;
diff --git a/storage/xtradb/os/os0file.cc b/storage/xtradb/os/os0file.cc
index fd1ba289d05..2e172a7524c 100644
--- a/storage/xtradb/os/os0file.cc
+++ b/storage/xtradb/os/os0file.cc
@@ -1509,7 +1509,7 @@ os_file_create_simple_func(
 	}
 
 	do {
-		file = ::open(name, create_flag, os_innodb_umask);
+		file = ::open(name, create_flag | O_CLOEXEC, os_innodb_umask);
 
 		if (file == -1) {
 			*success = FALSE;
@@ -1731,7 +1731,7 @@ os_file_create_simple_no_error_handling_func(
 		return(file);
 	}
 
-	file = open(name, create_flag, os_innodb_umask);
+	file = ::open(name, create_flag | O_CLOEXEC , os_innodb_umask);
 
 	*success = file != -1;
 
@@ -2146,7 +2146,7 @@ os_file_create_func(
 #endif /* O_SYNC */
 
 	do {
-		file = open(name, create_flag, os_innodb_umask);
+		file = ::open(name, create_flag | O_CLOEXEC, os_innodb_umask);
 
 		if (file == -1) {
 			const char*	operation;
@@ -3736,7 +3736,7 @@ os_file_get_status(
 
 		access = !srv_read_only_mode ? O_RDWR : O_RDONLY;
 
-		fh = ::open(path, access, os_innodb_umask);
+		fh = ::open(path, access | O_CLOEXEC, os_innodb_umask);
 
 		if (fh == -1) {
 			stat_info->rw_perm = false;
@@ -4165,7 +4165,7 @@ os_aio_native_aio_supported(void)
 
 		strcpy(name + dirnamelen, "ib_logfile0");
 
-		fd = ::open(name, O_RDONLY);
+		fd = ::open(name, O_RDONLY | O_CLOEXEC);
 
 		if (fd == -1) {
 
diff --git a/support-files/mysql.server.sh b/support-files/mysql.server.sh
index c9ea270a781..a60ec248cec 100644
--- a/support-files/mysql.server.sh
+++ b/support-files/mysql.server.sh
@@ -25,7 +25,6 @@
 # Description: MariaDB is a very fast and reliable SQL database engine.
 ### END INIT INFO
 
-# If you install MariaDB on some other places than @prefix@, then you
 # have to do one of the following things for this script to work:
 #
 # - Run this script from within the MariaDB installation directory
diff --git a/support-files/policy/selinux/mariadb-server.fc b/support-files/policy/selinux/mariadb-server.fc
index 1a69ecc2c40..409f72923aa 100644
--- a/support-files/policy/selinux/mariadb-server.fc
+++ b/support-files/policy/selinux/mariadb-server.fc
@@ -1,4 +1,4 @@
-# This SELinux file contexts (.fc) file has been copied under BSD License from
+# This SELinux file contexts (.fc) file has been copied under New BSD License from
 # Percona XtraDB Cluster.
 
 /etc/init\.d/rc\.d/mysql -- gen_context(system_u:object_r:mysqld_initrc_exec_t,s0)
diff --git a/support-files/policy/selinux/mariadb-server.te b/support-files/policy/selinux/mariadb-server.te
index 34d79326b10..45ef40f4153 100644
--- a/support-files/policy/selinux/mariadb-server.te
+++ b/support-files/policy/selinux/mariadb-server.te
@@ -1,4 +1,4 @@
-# This SELinux type enforcement (.te) file has been copied under BSD License
+# This SELinux type enforcement (.te) file has been copied under New BSD License
 # from Percona XtraDB Cluster, along with some additions.
 
 module mariadb-server 1.0;
diff --git a/support-files/wsrep.cnf.sh b/support-files/wsrep.cnf.sh
index a5390855ca1..51ce3dca2dd 100644
--- a/support-files/wsrep.cnf.sh
+++ b/support-files/wsrep.cnf.sh
@@ -30,6 +30,9 @@ bind-address=0.0.0.0
 ## WSREP options
 ##
 
+# Enable wsrep
+wsrep_on=1
+
 # Full path to wsrep provider library or 'none'
 wsrep_provider=none