Merge branch 'notsystemd/postmove' into notsystemd/master

# Conflicts: # src/grp-journal/systemd-journald/Makefile # src/grp-login/systemd-logind/Makefile # src/grp-machine/grp-import/systemd-export/Makefile # src/grp-machine/grp-import/systemd-import/Makefile # src/grp-machine/grp-import/systemd-pull/Makefile # src/grp-machine/systemd-machined/Makefile # src/grp-network/libnetworkd-core/Makefile # src/grp-resolve/libbasic-dns/Makefile # src/grp-resolve/systemd-resolved/Makefile # src/grp-utils/systemd-path/Makefile # src/libshared/src/Makefile # src/libsystemd-network/include/systemd-network/sd-ndisc.h # src/libsystemd/Makefile # src/libsystemd/src/test.mk # src/libudev/Makefile # src/systemd-dbus1-generator/Makefile # src/systemd-nspawn/nspawn.c Signed-off-by: Luke Shumaker <lukeshu@sbcglobal.net>
author: Luke Shumaker <lukeshu@sbcglobal.net> 2016-09-14 18:33:57 -0400
committer: Luke Shumaker <lukeshu@sbcglobal.net> 2016-09-14 18:33:57 -0400
commit: 3c72c8d3ee67388336aca58c5afa3fb93a9c24c0 (patch)
tree: d072df7fee0f5906fad88c08398b2fe887cbc064 /src
parent: e51613a3291342c6006edda8783755fb8994fd75 (diff)
parent: 6ba6ca19507add38549e07058c57489a8cd98cd1 (diff)
536 files changed, 21962 insertions, 8425 deletions
diff --git a/src/Makefile b/src/Makefile
index 4c89439154..77e29b6c40 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -50,7 +50,6 @@ nested.subdirs += systemd-cgls
 nested.subdirs += systemd-cgroups-agent
 nested.subdirs += systemd-cgtop
 nested.subdirs += systemd-cryptsetup
-nested.subdirs += systemd-dbus1-generator
 nested.subdirs += systemd-debug-generator
 nested.subdirs += systemd-getty-generator
 nested.subdirs += systemd-gpt-auto-generator
diff --git a/src/busctl/Makefile b/src/busctl/Makefile
index e7ef92824c..bb41d82b85 100644
--- a/src/busctl/Makefile
+++ b/src/busctl/Makefile
@@ -32,6 +32,6 @@ busctl_SOURCES = \
 	src/libsystemd/sd-bus/busctl-introspect.h
 
 busctl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/busctl/busctl.c b/src/busctl/busctl.c
index 9e7d2159ed..9e3644728d 100644
--- a/src/busctl/busctl.c
+++ b/src/busctl/busctl.c
@@ -1988,7 +1988,7 @@ static int busctl_main(sd_bus *bus, int argc, char *argv[]) {
 }
 
 int main(int argc, char *argv[]) {
-        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
+        sd_bus *bus = NULL;
         int r;
 
         log_parse_environment();
@@ -2079,6 +2079,7 @@ int main(int argc, char *argv[]) {
         r = busctl_main(bus, argc, argv);
 
 finish:
+        sd_bus_flush_close_unref(bus);
         pager_close();
 
         strv_free(arg_matches);
diff --git a/src/busctl/busctl.xml b/src/busctl/busctl.xml
index b71a174634..052a33097f 100644
--- a/src/busctl/busctl.xml
+++ b/src/busctl/busctl.xml
@@ -119,8 +119,10 @@
           <term><option>--match=<replaceable>MATCH</replaceable></option></term>
 
           <listitem><para>When showing messages being exchanged, show only the
-          subset matching <replaceable>MATCH</replaceable>.</para></listitem>
-          <!-- TODO: link to sd_bus_add_match when it is written? -->
+          subset matching <replaceable>MATCH</replaceable>.
+          See
+          <citerefentry><refentrytitle>sd_bus_add_match</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+          </para></listitem>
       </varlistentry>
 
       <varlistentry>
diff --git a/src/grp-boot/bootctl/Makefile b/src/grp-boot/bootctl/Makefile
index a983e32a9f..5533e677a1 100644
--- a/src/grp-boot/bootctl/Makefile
+++ b/src/grp-boot/bootctl/Makefile
@@ -38,7 +38,7 @@ bootctl_CFLAGS = \
 	$(BLKID_CFLAGS)
 
 bootctl_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(BLKID_LIBS)
 
 bin_PROGRAMS += \
diff --git a/src/grp-boot/bootctl/bootctl.c b/src/grp-boot/bootctl/bootctl.c
index 3ea43e0624..19c5d1417f 100644
--- a/src/grp-boot/bootctl/bootctl.c
+++ b/src/grp-boot/bootctl/bootctl.c
@@ -101,7 +101,7 @@ static int verify_esp(const char *p, uint32_t *part, uint64_t *pstart, uint64_t
         errno = 0;
         r = blkid_do_safeprobe(b);
         if (r == -2) {
-                log_error("File system \"%s\" is ambigious.", p);
+                log_error("File system \"%s\" is ambiguous.", p);
                 return -ENODEV;
         } else if (r == 1) {
                 log_error("File system \"%s\" does not contain a label.", p);
@@ -288,7 +288,7 @@ static int status_binaries(const char *esp_path, sd_id128_t partition) {
         else if (r < 0)
                 return r;
 
-        r = enumerate_binaries(esp_path, "EFI/Boot", "boot");
+        r = enumerate_binaries(esp_path, "EFI/BOOT", "boot");
         if (r == 0)
                 log_error("No default/fallback boot loader installed in ESP.");
         else if (r < 0)
@@ -311,7 +311,7 @@ static int print_efi_option(uint16_t id, bool in_order) {
                 return r;
 
         /* print only configured entries with partition information */
-        if (!path || sd_id128_equal(partition, SD_ID128_NULL))
+        if (!path || sd_id128_is_null(partition))
                 return 0;
 
         efi_tilt_backslashes(path);
@@ -548,7 +548,7 @@ static int mkdir_one(const char *prefix, const char *suffix) {
 static const char *efi_subdirs[] = {
         "EFI",
         "EFI/systemd",
-        "EFI/Boot",
+        "EFI/BOOT",
         "loader",
         "loader/entries"
 };
@@ -579,7 +579,7 @@ static int copy_one_file(const char *esp_path, const char *name, bool force) {
                 char *v;
 
                 /* Create the EFI default boot loader name (specified for removable devices) */
-                v = strjoina(esp_path, "/EFI/Boot/BOOT", name + strlen("systemd-boot"));
+                v = strjoina(esp_path, "/EFI/BOOT/BOOT", name + strlen("systemd-boot"));
                 strupper(strrchr(v, '/') + 1);
 
                 k = copy_file(p, v, force);
@@ -781,7 +781,7 @@ static int remove_boot_efi(const char *esp_path) {
         struct dirent *de;
         int r, c = 0;
 
-        p = strjoina(esp_path, "/EFI/Boot");
+        p = strjoina(esp_path, "/EFI/BOOT");
         d = opendir(p);
         if (!d) {
                 if (errno == ENOENT)
@@ -797,7 +797,7 @@ static int remove_boot_efi(const char *esp_path) {
                 if (!endswith_no_case(de->d_name, ".efi"))
                         continue;
 
-                if (!startswith_no_case(de->d_name, "Boot"))
+                if (!startswith_no_case(de->d_name, "boot"))
                         continue;
 
                 fd = openat(dirfd(d), de->d_name, O_RDONLY|O_CLOEXEC);
@@ -1072,7 +1072,7 @@ static int bootctl_main(int argc, char*argv[]) {
 
                         printf("Loader:\n");
                         printf("      Product: %s\n", strna(loader));
-                        if (!sd_id128_equal(loader_part_uuid, SD_ID128_NULL))
+                        if (!sd_id128_is_null(loader_part_uuid))
                                 printf("    Partition: /dev/disk/by-partuuid/%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x\n",
                                        SD_ID128_FORMAT_VAL(loader_part_uuid));
                         else
diff --git a/src/grp-boot/bootctl/bootctl.xml b/src/grp-boot/bootctl/bootctl.xml
index ebd58750d3..6e835c037f 100644
--- a/src/grp-boot/bootctl/bootctl.xml
+++ b/src/grp-boot/bootctl/bootctl.xml
@@ -74,14 +74,14 @@
     <para><command>bootctl update</command> updates all installed
     versions of systemd-boot, if the current version is newer than the
     version installed in the EFI system partition. This also includes
-    the EFI default/fallback loader at /EFI/Boot/boot*.efi. A
+    the EFI default/fallback loader at /EFI/BOOT/BOOT*.EFI. A
     systemd-boot entry in the EFI boot variables is created if there
     is no current entry. The created entry will be added to the end of
     the boot order list.</para>
 
     <para><command>bootctl install</command> installs systemd-boot into
     the EFI system partition. A copy of systemd-boot will be stored as
-    the EFI default/fallback loader at /EFI/Boot/boot*.efi. A systemd-boot
+    the EFI default/fallback loader at /EFI/BOOT/BOOT*.EFI. A systemd-boot
     entry in the EFI boot variables is created and added to the top
     of the boot order list.</para>
 
diff --git a/src/grp-boot/kernel-install/90-loaderentry.install b/src/grp-boot/kernel-install/90-loaderentry.install
index 6e94e12f94..af9f0f9ccd 100644
--- a/src/grp-boot/kernel-install/90-loaderentry.install
+++ b/src/grp-boot/kernel-install/90-loaderentry.install
@@ -16,7 +16,8 @@ if ! [[ $MACHINE_ID ]]; then
 fi
 
 BOOT_DIR="/$MACHINE_ID/$KERNEL_VERSION"
-LOADER_ENTRY="/boot/loader/entries/$MACHINE_ID-$KERNEL_VERSION.conf"
+BOOT_ROOT=${BOOT_DIR_ABS%$BOOT_DIR}
+LOADER_ENTRY="$BOOT_ROOT/loader/entries/$MACHINE_ID-$KERNEL_VERSION.conf"
 
 if [[ $COMMAND == remove ]]; then
     exec rm -f "$LOADER_ENTRY"
diff --git a/src/grp-boot/kernel-install/kernel-install b/src/grp-boot/kernel-install/kernel-install
index 3ae1d77e33..1159dc384d 100644
--- a/src/grp-boot/kernel-install/kernel-install
+++ b/src/grp-boot/kernel-install/kernel-install
@@ -86,7 +86,15 @@ if [[ ! $COMMAND ]] || [[ ! $KERNEL_VERSION ]]; then
     exit 1
 fi
 
-BOOT_DIR_ABS="/boot/$MACHINE_ID/$KERNEL_VERSION"
+if [[ -d /boot/loader/entries ]] || [[ -d /boot/$MACHINE_ID ]]; then
+    BOOT_DIR_ABS="/boot/$MACHINE_ID/$KERNEL_VERSION"
+elif [[ -d /boot/efi/loader/entries ]] || [[ -d /boot/efi/$MACHINE_ID ]] \
+         || mountpoint -q /boot/efi; then
+    BOOT_DIR_ABS="/boot/efi/$MACHINE_ID/$KERNEL_VERSION"
+else
+    BOOT_DIR_ABS="/boot/$MACHINE_ID/$KERNEL_VERSION"
+fi
+
 ret=0
 
 readarray -t PLUGINS < <(
diff --git a/src/grp-boot/systemd-boot/console.c b/src/grp-boot/systemd-boot/console.c
index c436f8b476..2b797c9a5f 100644
--- a/src/grp-boot/systemd-boot/console.c
+++ b/src/grp-boot/systemd-boot/console.c
@@ -93,12 +93,8 @@ EFI_STATUS console_key_read(UINT64 *key, BOOLEAN wait) {
         }
 
         /* wait until key is pressed */
-        if (wait) {
-                if (TextInputEx)
-                        uefi_call_wrapper(BS->WaitForEvent, 3, 1, &TextInputEx->WaitForKeyEx, &index);
-                else
-                        uefi_call_wrapper(BS->WaitForEvent, 3, 1, &ST->ConIn->WaitForKey, &index);
-        }
+        if (wait)
+                uefi_call_wrapper(BS->WaitForEvent, 3, 1, &ST->ConIn->WaitForKey, &index);
 
         if (TextInputEx) {
                 EFI_KEY_DATA keydata;
diff --git a/src/grp-boot/systemd-boot/test-efi-create-disk.sh b/src/grp-boot/systemd-boot/test-efi-create-disk.sh
index 56dd09abd7..cd4699dc18 100755
--- a/src/grp-boot/systemd-boot/test-efi-create-disk.sh
+++ b/src/grp-boot/systemd-boot/test-efi-create-disk.sh
@@ -11,8 +11,8 @@ mkfs.vfat -F32 ${LOOP}p1
 mkdir -p mnt
 mount ${LOOP}p1 mnt
 
-mkdir -p mnt/EFI/{Boot,systemd}
-cp systemd-bootx64.efi mnt/EFI/Boot/bootx64.efi
+mkdir -p mnt/EFI/{BOOT,systemd}
+cp systemd-bootx64.efi mnt/EFI/BOOT/BOOTX64.efi
 
 [ -e /boot/shellx64.efi ] && cp /boot/shellx64.efi mnt/
 
diff --git a/src/grp-coredump/coredumpctl/Makefile b/src/grp-coredump/coredumpctl/Makefile
index 47a4397fa4..25a0ee29f2 100644
--- a/src/grp-coredump/coredumpctl/Makefile
+++ b/src/grp-coredump/coredumpctl/Makefile
@@ -27,7 +27,7 @@ coredumpctl_SOURCES = \
 	src/coredump/coredumpctl.c
 
 coredumpctl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 bin_PROGRAMS += \
 	coredumpctl
diff --git a/src/grp-coredump/systemd-coredump/Makefile b/src/grp-coredump/systemd-coredump/Makefile
index 108186488c..f294760802 100644
--- a/src/grp-coredump/systemd-coredump/Makefile
+++ b/src/grp-coredump/systemd-coredump/Makefile
@@ -29,8 +29,13 @@ systemd_coredump_SOURCES = \
 	src/coredump/coredump-vacuum.c \
 	src/coredump/coredump-vacuum.h
 
+systemd_coredump_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(ACL_CFLAGS)
+
 systemd_coredump_LDADD = \
-	libshared.la
+	libsystemd-shared.la \
+	$(ACL_LIBS)
 
 ifneq ($(HAVE_ELFUTILS),)
 systemd_coredump_SOURCES += \
@@ -65,7 +70,7 @@ test_coredump_vacuum_SOURCES = \
 	src/coredump/coredump-vacuum.h
 
 test_coredump_vacuum_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 nodist_sysctl_DATA = \
 	sysctl.d/50-coredump.conf
diff --git a/src/grp-coredump/systemd-coredump/coredump.c b/src/grp-coredump/systemd-coredump/coredump.c
index b1da8eaba4..dd05326ce0 100644
--- a/src/grp-coredump/systemd-coredump/coredump.c
+++ b/src/grp-coredump/systemd-coredump/coredump.c
@@ -158,10 +158,8 @@ static int fix_acl(int fd, uid_t uid) {
 
         if (acl_create_entry(&acl, &entry) < 0 ||
             acl_set_tag_type(entry, ACL_USER) < 0 ||
-            acl_set_qualifier(entry, &uid) < 0) {
-                log_error_errno(errno, "Failed to patch ACL: %m");
-                return -errno;
-        }
+            acl_set_qualifier(entry, &uid) < 0)
+                return log_error_errno(errno, "Failed to patch ACL: %m");
 
         if (acl_get_permset(entry, &permset) < 0 ||
             acl_add_perm(permset, ACL_READ) < 0)
@@ -757,7 +755,6 @@ static int process_socket(int fd) {
 
                 iovec[n_iovec].iov_len = l;
                 iovec[n_iovec].iov_base = malloc(l + 1);
-
                 if (!iovec[n_iovec].iov_base) {
                         r = log_oom();
                         goto finish;
@@ -812,7 +809,7 @@ static int process_socket(int fd) {
                 goto finish;
         }
 
-        /* Make sure we we got all data we really need */
+        /* Make sure we got all data we really need */
         assert(context[CONTEXT_PID]);
         assert(context[CONTEXT_UID]);
         assert(context[CONTEXT_GID]);
@@ -853,12 +850,42 @@ static int send_iovec(const struct iovec iovec[], size_t n_iovec, int input_fd)
                 return log_error_errno(errno, "Failed to connect to coredump service: %m");
 
         for (i = 0; i < n_iovec; i++) {
-                ssize_t n;
-                assert(iovec[i].iov_len > 0);
+                struct msghdr mh = {
+                        .msg_iov = (struct iovec*) iovec + i,
+                        .msg_iovlen = 1,
+                };
+                struct iovec copy[2];
+
+                for (;;) {
+                        if (sendmsg(fd, &mh, MSG_NOSIGNAL) >= 0)
+                                break;
+
+                        if (errno == EMSGSIZE && mh.msg_iov[0].iov_len > 0) {
+                                /* This field didn't fit? That's a pity. Given that this is just metadata,
+                                 * let's truncate the field at half, and try again. We append three dots, in
+                                 * order to show that this is truncated. */
+
+                                if (mh.msg_iov != copy) {
+                                        /* We don't want to modify the caller's iovec, hence let's create our
+                                         * own array, consisting of two new iovecs, where the first is a
+                                         * (truncated) copy of what we want to send, and the second one
+                                         * contains the trailing dots. */
+                                        copy[0] = iovec[i];
+                                        copy[1] = (struct iovec) {
+                                                .iov_base = (char[]) { '.', '.', '.' },
+                                                .iov_len = 3,
+                                        };
+
+                                        mh.msg_iov = copy;
+                                        mh.msg_iovlen = 2;
+                                }
+
+                                copy[0].iov_len /= 2; /* halve it, and try again */
+                                continue;
+                        }
 
-                n = send(fd, iovec[i].iov_base, iovec[i].iov_len, MSG_NOSIGNAL);
-                if (n < 0)
                         return log_error_errno(errno, "Failed to send coredump datagram: %m");
+                }
         }
 
         r = send_one_fd(fd, input_fd, 0);
@@ -868,7 +895,7 @@ static int send_iovec(const struct iovec iovec[], size_t n_iovec, int input_fd)
         return 0;
 }
 
-static int process_journald_crash(const char *context[], int input_fd) {
+static int process_special_crash(const char *context[], int input_fd) {
         _cleanup_close_ int coredump_fd = -1, coredump_node_fd = -1;
         _cleanup_free_ char *filename = NULL;
         uint64_t coredump_size;
@@ -877,7 +904,7 @@ static int process_journald_crash(const char *context[], int input_fd) {
         assert(context);
         assert(input_fd >= 0);
 
-        /* If we are journald, we cut things short, don't write to the journal, but still create a coredump. */
+        /* If we are pid1 or journald, we cut things short, don't write to the journal, but still create a coredump. */
 
         if (arg_storage != COREDUMP_STORAGE_NONE)
                 arg_storage = COREDUMP_STORAGE_EXTERNAL;
@@ -890,7 +917,8 @@ static int process_journald_crash(const char *context[], int input_fd) {
         if (r < 0)
                 return r;
 
-        log_info("Detected coredump of the journal daemon itself, diverted to %s.", filename);
+        log_notice("Detected coredump of the journal daemon or PID 1, diverted to %s.", filename);
+
         return 0;
 }
 
@@ -950,9 +978,17 @@ static int process_kernel(int argc, char* argv[]) {
 
         if (cg_pid_get_unit(pid, &t) >= 0) {
 
-                if (streq(t, SPECIAL_JOURNALD_SERVICE)) {
+                /* If this is PID 1 disable coredump collection, we'll unlikely be able to process it later on. */
+                if (streq(t, SPECIAL_INIT_SCOPE)) {
+                        log_notice("Due to PID 1 having crashed coredump collection will now be turned off.");
+                        (void) write_string_file("/proc/sys/kernel/core_pattern", "|/bin/false", 0);
+                }
+
+                /* Let's avoid dead-locks when processing journald and init crashes, as socket activation and logging
+                 * are unlikely to work then. */
+                if (STR_IN_SET(t, SPECIAL_JOURNALD_SERVICE, SPECIAL_INIT_SCOPE)) {
                         free(t);
-                        return process_journald_crash(context, STDIN_FILENO);
+                        return process_special_crash(context, STDIN_FILENO);
                 }
 
                 core_unit = strjoina("COREDUMP_UNIT=", t);
diff --git a/src/grp-hostname/hostnamectl/Makefile b/src/grp-hostname/hostnamectl/Makefile
index f43d717260..a36d616a5c 100644
--- a/src/grp-hostname/hostnamectl/Makefile
+++ b/src/grp-hostname/hostnamectl/Makefile
@@ -29,7 +29,7 @@ hostnamectl_SOURCES = \
 	src/hostname/hostnamectl.c
 
 hostnamectl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 bin_PROGRAMS += \
 	hostnamectl
diff --git a/src/grp-hostname/systemd-hostnamed/Makefile b/src/grp-hostname/systemd-hostnamed/Makefile
index 171bce55a4..2408c1c47f 100644
--- a/src/grp-hostname/systemd-hostnamed/Makefile
+++ b/src/grp-hostname/systemd-hostnamed/Makefile
@@ -28,7 +28,7 @@ systemd_hostnamed_SOURCES = \
 	src/hostname/hostnamed.c
 
 systemd_hostnamed_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootlibexec_PROGRAMS += \
 	systemd-hostnamed
diff --git a/src/grp-hostname/systemd-hostnamed/hostnamed.c b/src/grp-hostname/systemd-hostnamed/hostnamed.c
index 22eabc469b..366adbb282 100644
--- a/src/grp-hostname/systemd-hostnamed/hostnamed.c
+++ b/src/grp-hostname/systemd-hostnamed/hostnamed.c
@@ -479,8 +479,7 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
         if (r < 0)
                 return r;
 
-        if (isempty(name))
-                name = NULL;
+        name = empty_to_null(name);
 
         if (streq_ptr(name, c->data[PROP_STATIC_HOSTNAME]))
                 return sd_bus_reply_method_return(m, NULL);
@@ -499,9 +498,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        if (isempty(name)) {
+        if (isempty(name))
                 c->data[PROP_STATIC_HOSTNAME] = mfree(c->data[PROP_STATIC_HOSTNAME]);
-        } else {
+        else {
                 char *h;
 
                 if (!hostname_is_valid(name, false))
@@ -546,8 +545,7 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
         if (r < 0)
                 return r;
 
-        if (isempty(name))
-                name = NULL;
+        name = empty_to_null(name);
 
         if (streq_ptr(name, c->data[prop]))
                 return sd_bus_reply_method_return(m, NULL);
@@ -570,9 +568,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        if (isempty(name)) {
+        if (isempty(name))
                 c->data[prop] = mfree(c->data[prop]);
-        } else {
+        else {
                 char *h;
 
                 /* The icon name might ultimately be used as file
diff --git a/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in b/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
index b7079e4a7c..0b03a589ea 100644
--- a/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
+++ b/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
@@ -20,3 +20,5 @@ PrivateDevices=yes
 PrivateNetwork=yes
 ProtectSystem=yes
 ProtectHome=yes
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
diff --git a/src/grp-initprogs/grp-sleep/systemd-hibernate-resume-generator/Makefile b/src/grp-initprogs/grp-sleep/systemd-hibernate-resume-generator/Makefile
index 8c0eba2b1a..32e944c61d 100644
--- a/src/grp-initprogs/grp-sleep/systemd-hibernate-resume-generator/Makefile
+++ b/src/grp-initprogs/grp-sleep/systemd-hibernate-resume-generator/Makefile
@@ -31,7 +31,7 @@ systemd_hibernate_resume_generator_SOURCES = \
 	src/hibernate-resume/hibernate-resume-generator.c
 
 systemd_hibernate_resume_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 endif # ENABLE_HIBERNATE
 
diff --git a/src/grp-initprogs/grp-sleep/systemd-hibernate-resume/Makefile b/src/grp-initprogs/grp-sleep/systemd-hibernate-resume/Makefile
index 3b41b82e4b..95f44744a2 100644
--- a/src/grp-initprogs/grp-sleep/systemd-hibernate-resume/Makefile
+++ b/src/grp-initprogs/grp-sleep/systemd-hibernate-resume/Makefile
@@ -32,7 +32,7 @@ systemd_hibernate_resume_SOURCES = \
 	src/hibernate-resume/hibernate-resume.c
 
 systemd_hibernate_resume_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 nodist_systemunit_DATA += \
 	units/systemd-hibernate-resume@.service
diff --git a/src/grp-initprogs/grp-sleep/systemd-sleep/Makefile b/src/grp-initprogs/grp-sleep/systemd-sleep/Makefile
index 161d4ebd50..2c94aaf4a9 100644
--- a/src/grp-initprogs/grp-sleep/systemd-sleep/Makefile
+++ b/src/grp-initprogs/grp-sleep/systemd-sleep/Makefile
@@ -28,7 +28,7 @@ systemd_sleep_SOURCES = \
 	src/sleep/sleep.c
 
 systemd_sleep_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 ifneq ($(ENABLE_HIBERNATE),)
 
diff --git a/src/grp-initprogs/systemd-backlight/Makefile b/src/grp-initprogs/systemd-backlight/Makefile
index cf55ac4db9..4a79889681 100644
--- a/src/grp-initprogs/systemd-backlight/Makefile
+++ b/src/grp-initprogs/systemd-backlight/Makefile
@@ -34,7 +34,7 @@ systemd_backlight_SOURCES = \
 	src/backlight/backlight.c
 
 systemd_backlight_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 endif # ENABLE_BACKLIGHT
 
 EXTRA_DIST += \
diff --git a/src/grp-initprogs/systemd-binfmt/Makefile b/src/grp-initprogs/systemd-binfmt/Makefile
index 3e5c1ac270..d9e032d16d 100644
--- a/src/grp-initprogs/systemd-binfmt/Makefile
+++ b/src/grp-initprogs/systemd-binfmt/Makefile
@@ -28,7 +28,7 @@ systemd_binfmt_SOURCES = \
 	src/binfmt/binfmt.c
 
 systemd_binfmt_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootlibexec_PROGRAMS += \
 	systemd-binfmt
diff --git a/src/grp-initprogs/systemd-detect-virt/Makefile b/src/grp-initprogs/systemd-detect-virt/Makefile
index 7b9b9f667b..7158be148a 100644
--- a/src/grp-initprogs/systemd-detect-virt/Makefile
+++ b/src/grp-initprogs/systemd-detect-virt/Makefile
@@ -28,7 +28,7 @@ systemd_detect_virt_SOURCES = \
 	src/detect-virt/detect-virt.c
 
 systemd_detect_virt_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 INSTALL_EXEC_HOOKS += \
 	systemd-detect-virt-install-hook
diff --git a/src/grp-initprogs/systemd-firstboot/Makefile b/src/grp-initprogs/systemd-firstboot/Makefile
index b94b344bb9..20ea125a52 100644
--- a/src/grp-initprogs/systemd-firstboot/Makefile
+++ b/src/grp-initprogs/systemd-firstboot/Makefile
@@ -28,7 +28,7 @@ systemd_firstboot_SOURCES = \
 	src/firstboot/firstboot.c
 
 systemd_firstboot_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	-lcrypt
 
 rootbin_PROGRAMS += \
diff --git a/src/grp-initprogs/systemd-firstboot/firstboot.c b/src/grp-initprogs/systemd-firstboot/firstboot.c
index d2059a943f..7308e108e8 100644
--- a/src/grp-initprogs/systemd-firstboot/firstboot.c
+++ b/src/grp-initprogs/systemd-firstboot/firstboot.c
@@ -427,7 +427,7 @@ static int process_machine_id(void) {
         if (laccess(etc_machine_id, F_OK) >= 0)
                 return 0;
 
-        if (sd_id128_equal(arg_machine_id, SD_ID128_NULL))
+        if (sd_id128_is_null(arg_machine_id))
                 return 0;
 
         mkdir_parents(etc_machine_id, 0755);
diff --git a/src/grp-initprogs/systemd-fsck/Makefile b/src/grp-initprogs/systemd-fsck/Makefile
index f29fba4d20..8a223a7f70 100644
--- a/src/grp-initprogs/systemd-fsck/Makefile
+++ b/src/grp-initprogs/systemd-fsck/Makefile
@@ -28,6 +28,6 @@ systemd_fsck_SOURCES = \
 	src/fsck/fsck.c
 
 systemd_fsck_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-initprogs/systemd-modules-load/Makefile b/src/grp-initprogs/systemd-modules-load/Makefile
index 8503fb32a2..9ed48c3ce4 100644
--- a/src/grp-initprogs/systemd-modules-load/Makefile
+++ b/src/grp-initprogs/systemd-modules-load/Makefile
@@ -32,7 +32,7 @@ systemd_modules_load_CFLAGS = \
 	$(KMOD_CFLAGS)
 
 systemd_modules_load_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(KMOD_LIBS)
 
 rootlibexec_PROGRAMS += \
diff --git a/src/grp-initprogs/systemd-quotacheck/Makefile b/src/grp-initprogs/systemd-quotacheck/Makefile
index 076d33a587..83580b4c66 100644
--- a/src/grp-initprogs/systemd-quotacheck/Makefile
+++ b/src/grp-initprogs/systemd-quotacheck/Makefile
@@ -34,7 +34,7 @@ systemd_quotacheck_SOURCES = \
 	src/quotacheck/quotacheck.c
 
 systemd_quotacheck_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 endif # ENABLE_QUOTACHECK
 
 EXTRA_DIST += \
diff --git a/src/grp-initprogs/systemd-random-seed/Makefile b/src/grp-initprogs/systemd-random-seed/Makefile
index 489a8ab007..ecc82206cb 100644
--- a/src/grp-initprogs/systemd-random-seed/Makefile
+++ b/src/grp-initprogs/systemd-random-seed/Makefile
@@ -34,7 +34,7 @@ systemd_random_seed_SOURCES = \
 	src/random-seed/random-seed.c
 
 systemd_random_seed_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 SYSINIT_TARGET_WANTS += \
 	systemd-random-seed.service
diff --git a/src/grp-initprogs/systemd-rfkill/Makefile b/src/grp-initprogs/systemd-rfkill/Makefile
index 2b4430b712..32fb516b52 100644
--- a/src/grp-initprogs/systemd-rfkill/Makefile
+++ b/src/grp-initprogs/systemd-rfkill/Makefile
@@ -37,7 +37,7 @@ systemd_rfkill_SOURCES = \
 	src/rfkill/rfkill.c
 
 systemd_rfkill_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 endif # ENABLE_RFKILL
 
 EXTRA_DIST += \
diff --git a/src/grp-initprogs/systemd-sysctl/50-default.sysctl b/src/grp-initprogs/systemd-sysctl/50-default.sysctl
index def151bb84..f08f32e849 100644
--- a/src/grp-initprogs/systemd-sysctl/50-default.sysctl
+++ b/src/grp-initprogs/systemd-sysctl/50-default.sysctl
@@ -5,7 +5,7 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-# See sysctl.d(5) and core(5) for for documentation.
+# See sysctl.d(5) and core(5) for documentation.
 
 # To override settings in this file, create a local file in /etc
 # (e.g. /etc/sysctl.d/90-override.conf), and put any assignments
diff --git a/src/grp-initprogs/systemd-sysctl/Makefile b/src/grp-initprogs/systemd-sysctl/Makefile
index 3af80e7bef..3fe12fd460 100644
--- a/src/grp-initprogs/systemd-sysctl/Makefile
+++ b/src/grp-initprogs/systemd-sysctl/Makefile
@@ -28,6 +28,6 @@ systemd_sysctl_SOURCES = \
 	src/sysctl/sysctl.c
 
 systemd_sysctl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-initprogs/systemd-sysusers/Makefile b/src/grp-initprogs/systemd-sysusers/Makefile
index 9339b9fd8b..0c37e0e5c2 100644
--- a/src/grp-initprogs/systemd-sysusers/Makefile
+++ b/src/grp-initprogs/systemd-sysusers/Makefile
@@ -28,7 +28,7 @@ systemd_sysusers_SOURCES = \
 	src/sysusers/sysusers.c
 
 systemd_sysusers_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootbin_PROGRAMS += \
 	systemd-sysusers
diff --git a/src/grp-initprogs/systemd-sysusers/sysusers.c b/src/grp-initprogs/systemd-sysusers/sysusers.c
index a71d777720..55ff36410d 100644
--- a/src/grp-initprogs/systemd-sysusers/sysusers.c
+++ b/src/grp-initprogs/systemd-sysusers/sysusers.c
@@ -1418,7 +1418,7 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) {
         }
 
         if (!IN_SET(action[0], ADD_USER, ADD_GROUP, ADD_MEMBER, ADD_RANGE)) {
-                log_error("[%s:%u] Unknown command command type '%c'.", fname, line, action[0]);
+                log_error("[%s:%u] Unknown command type '%c'.", fname, line, action[0]);
                 return -EBADMSG;
         }
 
diff --git a/src/grp-initprogs/systemd-tmpfiles/Makefile b/src/grp-initprogs/systemd-tmpfiles/Makefile
index de085fa334..e71280f226 100644
--- a/src/grp-initprogs/systemd-tmpfiles/Makefile
+++ b/src/grp-initprogs/systemd-tmpfiles/Makefile
@@ -27,8 +27,13 @@ ifneq ($(ENABLE_TMPFILES),)
 systemd_tmpfiles_SOURCES = \
 	src/tmpfiles/tmpfiles.c
 
+systemd_tmpfiles_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(ACL_CFLAGS)
+
 systemd_tmpfiles_LDADD = \
-	libshared.la
+	libsystemd-shared.la \
+	$(ACL_LIBS)
 
 rootbin_PROGRAMS += \
 	systemd-tmpfiles
diff --git a/src/grp-initprogs/systemd-tmpfiles/tmpfiles.c b/src/grp-initprogs/systemd-tmpfiles/tmpfiles.c
index f865b9cc3e..73f578572f 100644
--- a/src/grp-initprogs/systemd-tmpfiles/tmpfiles.c
+++ b/src/grp-initprogs/systemd-tmpfiles/tmpfiles.c
@@ -867,7 +867,7 @@ static int parse_attribute_from_arg(Item *item) {
                 { 'a', FS_APPEND_FL },       /* writes to file may only append */
                 { 'c', FS_COMPR_FL },        /* Compress file */
                 { 'd', FS_NODUMP_FL },       /* do not dump file */
-                { 'e', FS_EXTENT_FL },       /* Top of directory hierarchies*/
+                { 'e', FS_EXTENT_FL },       /* Extents */
                 { 'i', FS_IMMUTABLE_FL },    /* Immutable file */
                 { 'j', FS_JOURNAL_DATA_FL }, /* Reserved for ext3 */
                 { 's', FS_SECRM_FL },        /* Secure deletion */
@@ -1576,13 +1576,12 @@ static int clean_item_instance(Item *i, const char* instance) {
 
         d = opendir_nomod(instance);
         if (!d) {
-                if (errno == ENOENT || errno == ENOTDIR) {
+                if (IN_SET(errno, ENOENT, ENOTDIR)) {
                         log_debug_errno(errno, "Directory \"%s\": %m", instance);
                         return 0;
                 }
 
-                log_error_errno(errno, "Failed to open directory %s: %m", instance);
-                return -errno;
+                return log_error_errno(errno, "Failed to open directory %s: %m", instance);
         }
 
         if (fstat(dirfd(d), &s) < 0)
diff --git a/src/grp-initprogs/systemd-update-done/Makefile b/src/grp-initprogs/systemd-update-done/Makefile
index 90cb440874..258828924a 100644
--- a/src/grp-initprogs/systemd-update-done/Makefile
+++ b/src/grp-initprogs/systemd-update-done/Makefile
@@ -29,6 +29,6 @@ systemd_update_done_SOURCES = \
 	src/update-done/update-done.c
 
 systemd_update_done_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-initprogs/systemd-update-utmp/Makefile b/src/grp-initprogs/systemd-update-utmp/Makefile
index 0107808281..516af17a22 100644
--- a/src/grp-initprogs/systemd-update-utmp/Makefile
+++ b/src/grp-initprogs/systemd-update-utmp/Makefile
@@ -36,7 +36,7 @@ systemd_update_utmp_CFLAGS = \
 	$(AUDIT_CFLAGS)
 
 systemd_update_utmp_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(AUDIT_LIBS)
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-initprogs/systemd-user-sessions/Makefile b/src/grp-initprogs/systemd-user-sessions/Makefile
index 66fa3b7059..91c84e46fe 100644
--- a/src/grp-initprogs/systemd-user-sessions/Makefile
+++ b/src/grp-initprogs/systemd-user-sessions/Makefile
@@ -29,7 +29,7 @@ systemd_user_sessions_SOURCES = \
 	src/user-sessions/user-sessions.c
 
 systemd_user_sessions_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootlibexec_PROGRAMS += \
 	systemd-user-sessions
diff --git a/src/grp-initprogs/systemd-vconsole-setup/Makefile b/src/grp-initprogs/systemd-vconsole-setup/Makefile
index 99b369967e..5a93ae780b 100644
--- a/src/grp-initprogs/systemd-vconsole-setup/Makefile
+++ b/src/grp-initprogs/systemd-vconsole-setup/Makefile
@@ -28,7 +28,7 @@ systemd_vconsole_setup_SOURCES = \
 	src/vconsole/vconsole-setup.c
 
 systemd_vconsole_setup_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootlibexec_PROGRAMS += \
 	systemd-vconsole-setup
diff --git a/src/grp-journal/Makefile b/src/grp-journal/Makefile
index 764ab80758..4e1aaf7925 100644
--- a/src/grp-journal/Makefile
+++ b/src/grp-journal/Makefile
@@ -94,7 +94,7 @@ test_catalog_SOURCES = \
 
 test_catalog_CPPFLAGS = \
 	$(AM_CPPFLAGS) \
-	-DCATALOG_DIR=\"$(abs_top_srcdir)/catalog\"
+	-DCATALOG_DIR=\"$(abs_top_builddir)/catalog\"
 
 test_catalog_LDADD = \
 	libjournal-core.la
@@ -103,13 +103,18 @@ test_compress_SOURCES = \
 	src/journal/test-compress.c
 
 test_compress_LDADD = \
-	libshared.la
+	libsystemd-shared.la
+
+ifneq ($(HAVE_LZ4),)
+test_compress_LDADD += \
+	-llz4
+endif
 
 test_compress_benchmark_SOURCES = \
 	src/journal/test-compress-benchmark.c
 
 test_compress_benchmark_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_audit_type_SOURCES = \
 	src/journal/test-audit-type.c
diff --git a/src/grp-journal/catalog/.gitignore b/src/grp-journal/catalog/.gitignore
new file mode 100644
index 0000000000..ff695342e3
--- /dev/null
+++ b/src/grp-journal/catalog/.gitignore
@@ -0,0 +1 @@
+*.catalog
diff --git a/src/grp-journal/catalog/systemd.be.catalog b/src/grp-journal/catalog/systemd.be.catalog.in
index 051f49492f..5b237f0558 100644
--- a/src/grp-journal/catalog/systemd.be.catalog
+++ b/src/grp-journal/catalog/systemd.be.catalog.in
@@ -1,7 +1,7 @@
 #  This file is part of systemd.
 #
 #  Copyright 2012 Lennart Poettering
-#  Copyright 2015 Viktar Vaŭčkievič
+#  Copyright 2015, 2016 Viktar Vaŭčkievič
 #
 #  systemd is free software; you can redistribute it and/or modify it
 #  under the terms of the GNU Lesser General Public License as published by
@@ -19,7 +19,6 @@
 # Message catalog for systemd's own messages
 # Belarusian translation
 
-# The catalog format is documented on
 # Фармат каталога апісаны на старонцы
 # http://www.freedesktop.org/wiki/Software/systemd/catalog
 
@@ -28,7 +27,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Сэрвіс журналявання запусціўся
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Працэс сістэмнага журналявання запусціўся, адкрыў файлы для
 запісу і гатовы апрацоўваць запыты.
@@ -36,14 +35,30 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Сэрвіс журналявання спыніўся
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Працэс сістэмнага журналявання спыніўся і закрыў усе файлы.
 
+-- ec387f577b844b8fa948f33cad9a75e6
+Subject: Дыскавае месца, занятае часопісам
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+@JOURNAL_NAME@ (@JOURNAL_PATH@) цяпер займае @CURRENT_USE_PRETTY@.
+Максімальна дазволены памер складае @MAX_USE_PRETTY@.
+Пакідаем вольнымі не меньш за @DISK_KEEP_FREE_PRETTY@ (даступна на дыску
+@DISK_AVAILABLE_PRETTY@).
+Такім чынам, ліміт складае @LIMIT_PRETTY@, з якіх @AVAILABLE_PRETTY@
+даступна.
+
+Ліміты на памер наладжваецца з дапамогай SystemMaxUse=, SystemKeepFree=,
+SystemMaxFileSize=, RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize= у
+файле /etc/systemd/journald.conf. Глядзіце journald.conf(5) для дэталей.
+
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Паведамленні з сэрвісу адкінуты
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Сэрвіс адправіў занадта штат паведамленняў за кароткі прамежак часу.
@@ -52,14 +67,14 @@ Documentation: man:journald.conf(5)
 Майце на ўвазе, што былі адкінуты паведамлення толькі гэтага сэрвісу.
 Паведамленні іншых сэрвісаў засталіся.
 
-Мяжа, пасля якой паведамленні будуць адкінуты, наладжваецца з
-дапамогай RateLimitIntervalSec= і RateLimitBurst= у файле
-/etc/systemd/journald.conf. Глядзіце journald.conf(5) для дэталей.
+Мяжа, пасля якой паведамленні будуць адкінуты, наладжваецца з дапамогай
+RateLimitIntervalSec= і RateLimitBurst= у файле /etc/systemd/journald.conf.
+Глядзіце journald.conf(5) для дэталей.
 
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Паведамленні страчаны
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Паведамленні ядра былі страчаны, так як сістэма журналявання не паспела
 іх апрацаваць.
@@ -67,7 +82,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Працэс @COREDUMP_PID@ (@COREDUMP_COMM@) скінуў дамп памяці
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Працэс @COREDUMP_PID@ (@COREDUMP_COMM@) разбіўся і скінуў дамп памяці.
@@ -78,7 +93,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Новая сесія № @SESSION_ID@ створана для карыстальніка @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Новая сесія з № @SESSION_ID@ створана для карыстальніка @USER_ID@.
@@ -88,7 +103,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Сесія № @SESSION_ID@ спынена
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Сесія № @SESSION_ID@ спынена.
@@ -96,7 +111,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Даступна новае працоўнае месца № @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Новае працоўнае месца № @SEAT_ID@ наладжана і даступна для выкарыстання.
@@ -104,7 +119,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Працоўнае месца № @SEAT_ID@ выдалена
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Працоўнае месца № @SEAT_ID@ выдалена і больш не даступна.
@@ -112,21 +127,21 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Час зменены
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Сістэмны гадзіннік зменены на @REALTIME@ мікрасекунд ад 1 студзеня 1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Часавы пояс зменены на @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Сістэмны часавы пояс зменены на @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Запуск сістэмы завяршыўся
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Усе сістэмныя сэрвісы, неабходныя для загрузкі сістэмы, паспяхова
 запусціліся. Майце на ўвазе, што гэта не значыць, што машына нічога не
@@ -141,21 +156,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Сістэма перайшла ў стан сну @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Цяпер сістэма перайшла у стан сну @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Сістэма выйшла са стана сну @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Цяпер сістэма выйшла са стана сну @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Сістэма завяршае работу
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Пачаўся працэс выключэння сістэмы.
 Спыняюцца ўсе сістэмныя сэрвісы і дэмантуюцца файлавыя сістэмы.
@@ -163,14 +178,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Юніт @UNIT@ запускаецца
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Пачаўся працэс запуску юніта @UNIT@.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Юніт @UNIT@ запусціўся
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Працэс запуску юніта @UNIT@ завершаны.
 
@@ -179,21 +194,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Юніт @UNIT@ спыняецца
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Пачаўся працэс спынення юніта @UNIT@.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Юніт @UNIT@ спынены
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Працэс спынення юніта @UNIT@ завершаны.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Збой юніта @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Збой юніта @UNIT@.
 
@@ -202,14 +217,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: Юніт @UNIT@ перачытвае сваю канфігурацыю
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Юніт @UNIT@ пачаў перачытваць сваю канфігурацыю.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Юніт @UNIT@ перачытаў сваю канфігурацыю
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Юніт @UNIT@ перачытаў сваю канфігурацыю.
 
@@ -218,7 +233,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Працэс @EXECUTABLE@ не можа быць выкананы
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Працэс @EXECUTABLE@ не можа быць выкананы ў выніку збою.
 
@@ -227,7 +242,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Sibject: Адно ці больш паведамленняў не былі накіраваны ў syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Адно ці больш паведамленняў не былі накіраваны ў syslog сэрвіс, які
 выконваецца паралельна з journald. Звычайна гэта значыць, што
@@ -237,17 +252,17 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Кропка мантавання не пустая
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
-Каталог @WHERE@ указаны як кропка мантавання (другое поле ў /etc/fstab
-ці Where= поле ў файле юніта systemd) і не пусты. Гэта не перашкаджае
-мантаванню, але існуючыя ў ім файлы будуць недаступны. Для доступу да
-іх, калі ласка, змантуйце гэтую файлавую сістэму ў іншае месца.
+Каталог @WHERE@ указаны як кропка мантавання (другое поле ў /etc/fstab ці
+Where= поле ў файле юніта systemd) і не пусты. Гэта не перашкаджае
+мантаванню, але існуючыя ў ім файлы будуць недаступны. Для доступу да іх,
+калі ласка, змантуйце гэтую файлавую сістэму ў іншае месца.
 
 -- 24d8d4452573402496068381a6312df2
 Subject: Віртуальная машына або кантэйнер запусціўся
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Віртуальная машына @NAME@ з лідарам № @LEADER@ запусцілася і
 гатова для выкарыстання.
@@ -255,6 +270,44 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Віртуальная машына або кантэйнер спынены
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Віртуальная машына @NAME@ з лідарам № @LEADER@ спынена.
+
+-- 36db2dfa5a9045e1bd4af5f93e1cf057
+Subject: Механізм DNSSEC адключаны, бо сервер не падтымлівае яго
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:systemd-resolved.service(8) resolved.conf(5)
+
+Сэрвіс вызначэння імён (systemd-resolved.service) вызначыў, што DNS-сервер
+не падтрымлівае механізм DNSSEC. У выніку праверка DNSSEC была адключана.
+
+Гэтая падзея ўзнікае калі наладжаны DNSSEC=allow-downgrade
+у файле resolved.conf і DNS-сервер не падтрымлівае механізм DNSSEC.
+Звярніце ўвагу, што рэжым allow-downgrade дазваляе правесці атаку
+«DNSSEC downgrade», у ходзе якой зламыснік можа адключыць праверку DNSSEC
+шляхам падстаноўкі падробленых DNSSEC-адказаў у камунікацыйны канал.
+
+Гэта падзея можа быць прыкметай таго, што DNS-сервер сапраўды несумяшчальны
+з DNSSEC або што зламысніку паспяхова атрымалася правесці атаку па
+адключэнню DNSSEC.
+
+-- 1675d7f172174098b1108bf8c7dc8f5d
+Subject: Збой пры праверцы DNSSEC
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:systemd-resolved.service(8)
+
+DNS-запыт або рэсурсны запіс не прайшоў праверку DNSSEC.
+Як правіла, гэта паказвае на знешняе ўздзеянне на канал сувязі.
+
+-- 4d4408cfd0d144859184d1e65d7c8a65
+Subject: Давераны ключ DNSSEC быў ануляваны
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:systemd-resolved.service(8)
+
+Давераны ключ DNSSEC быў ануляваны. Неабходна наладзіць новы давераны ключ
+або абнавіць аперацыйную сістэму, каб атрымаць абноўлены давераны ключ
+DNSSEC.
diff --git a/src/grp-journal/catalog/systemd.be@latin.catalog b/src/grp-journal/catalog/systemd.be@latin.catalog.in
index 6ab361aafb..fc9f7cad16 100644
--- a/src/grp-journal/catalog/systemd.be@latin.catalog
+++ b/src/grp-journal/catalog/systemd.be@latin.catalog.in
@@ -1,7 +1,7 @@
 #  This file is part of systemd.
 #
 #  Copyright 2012 Lennart Poettering
-#  Copyright 2015 Viktar Vaŭčkievič
+#  Copyright 2015, 2016 Viktar Vaŭčkievič
 #
 #  systemd is free software; you can redistribute it and/or modify it
 #  under the terms of the GNU Lesser General Public License as published by
@@ -19,7 +19,6 @@
 # Message catalog for systemd's own messages
 # Belarusian Latin translation
 
-# The catalog format is documented on
 # Farmat kataloha apisany na staroncy
 # http://www.freedesktop.org/wiki/Software/systemd/catalog
 
@@ -28,7 +27,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Servis žurnaliavannia zapusciŭsia
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Praces sistemnaha žurnaliavannia zapusciŭsia, adkryŭ fajly dlia
 zapisu i hatovy apracoŭvać zapyty.
@@ -36,14 +35,31 @@ zapisu i hatovy apracoŭvać zapyty.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Servis žurnaliavannia spyniŭsia
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Praces sistemnaha žurnaliavannia spyniŭsia i zakryŭ usie fajly.
 
+-- ec387f577b844b8fa948f33cad9a75e6
+Subject: dyskavaje miesca, zaniataje časopisam
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+@JOURNAL_NAME@ (@JOURNAL_PATH@) ciapier zajmaje @CURRENT_USE_PRETTY@.
+Maksimaĺna dazvolieny pamier skladaje @MAX_USE_PRETTY@.
+Pakidajem voĺnymi nie mieńš za @DISK_KEEP_FREE_PRETTY@ (dastupna na dysku
+@DISK_AVAILABLE_PRETTY@).
+Takim čynam, limit skladaje @LIMIT_PRETTY@, z jakich @AVAILABLE_PRETTY@
+dastupna.
+
+Limity na pamier naladžvaiecca z dapamohaj SystemMaxUse=, SystemKeepFree=,
+SystemMaxFileSize=, RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize= u
+fajlie /etc/systemd/journald.conf. Hliadzicie journald.conf(5) dlia
+detaliej.
+
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Paviedamlienni z servisu adkinuty
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Servis adpraviŭ zanadta štat paviedamlienniaŭ za karotki pramiežak času.
@@ -52,22 +68,22 @@ Servis adpraviŭ zanadta štat paviedamlienniaŭ za karotki pramiežak času.
 Majcie na ŭvazie, što byli adkinuty paviedamliennia toĺki hetaha servisu.
 Paviedamlienni inšych servisaŭ zastalisia.
 
-Miaža, paslia jakoj paviedamlienni buduć adkinuty, naladžvajecca z
-dapamohaj RateLimitIntervalSec= i RateLimitBurst= u fajlie
-/etc/systemd/journald.conf. Hliadzicie journald.conf(5) dlia detaliej.
+Miaža, paslia jakoj paviedamlienni buduć adkinuty, naladžvajecca z dapamohaj
+RateLimitIntervalSec= i RateLimitBurst= u fajlie /etc/systemd/journald.conf.
+Hliadzicie journald.conf(5) dlia detaliej.
 
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Paviedamlienni stračany
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
-Paviedamlienni jadra byli stračany, tak jak sistema žurnaliavannia nie paspiela
-ich apracavać.
+Paviedamlienni jadra byli stračany, tak jak sistema žurnaliavannia nie
+paspiela ich apracavać.
 
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Praces @COREDUMP_PID@ (@COREDUMP_COMM@) skinuŭ damp pamiaci
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Praces @COREDUMP_PID@ (@COREDUMP_COMM@) razbiŭsia i skinuŭ damp pamiaci.
@@ -78,7 +94,7 @@ Rekamiendujecca paviedamić ab hetym raspracoŭnikam.
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Novaja siesija № @SESSION_ID@ stvorana dlia karystaĺnika @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Novaja siesija z № @SESSION_ID@ stvorana dlia karystaĺnika @USER_ID@.
@@ -88,7 +104,7 @@ Lidar hetaj siesii pad № @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Siesija № @SESSION_ID@ spyniena
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Siesija № @SESSION_ID@ spyniena.
@@ -96,15 +112,16 @@ Siesija № @SESSION_ID@ spyniena.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Dastupna novaje pracoŭnaje miesca № @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
-Novaje pracoŭnaje miesca № @SEAT_ID@ naladžana i dastupna dlia vykarystannia.
+Novaje pracoŭnaje miesca № @SEAT_ID@ naladžana i dastupna dlia
+vykarystannia.
 
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Pracoŭnaje miesca № @SEAT_ID@ vydaliena
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Pracoŭnaje miesca № @SEAT_ID@ vydaliena i boĺš nie dastupna.
@@ -112,21 +129,22 @@ Pracoŭnaje miesca № @SEAT_ID@ vydaliena i boĺš nie dastupna.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Čas zmienieny
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
-Sistemny hadzinnik zmienieny na @REALTIME@ mikrasiekund ad 1 studzienia 1970.
+Sistemny hadzinnik zmienieny na @REALTIME@ mikrasiekund ad 1 studzienia
+1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Časavy pojas zmienieny na @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Sistemny časavy pojas zmienieny na @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Zapusk sistemy zaviaršyŭsia
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Usie sistemnyja servisy, nieabchodnyja dlia zahruzki sistemy, paspiachova
 zapuscilisia. Majcie na ŭvazie, što heta nie značyć, što mašyna ničoha nie
@@ -141,21 +159,21 @@ Na zapusk sistemnych servisaŭ spatrebilasia @USERSPACE_USEC@ mikrasiekund.
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Sistema pierajšla ŭ stan snu @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Ciapier sistema pierajšla u stan snu @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Sistema vyjšla sa stana snu @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Ciapier sistema vyjšla sa stana snu @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Sistema zaviaršaje rabotu
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Pačaŭsia praces vykliučennia sistemy.
 Spyniajucca ŭsie sistemnyja servisy i demantujucca fajlavyja sistemy.
@@ -163,14 +181,14 @@ Spyniajucca ŭsie sistemnyja servisy i demantujucca fajlavyja sistemy.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Junit @UNIT@ zapuskajecca
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Pačaŭsia praces zapusku junita @UNIT@.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Junit @UNIT@ zapusciŭsia
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Praces zapusku junita @UNIT@ zavieršany.
 
@@ -179,21 +197,21 @@ Vynik: @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Junit @UNIT@ spyniajecca
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Pačaŭsia praces spyniennia junita @UNIT@.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Junit @UNIT@ spynieny
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Praces spyniennia junita @UNIT@ zavieršany.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Zboj junita @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Zboj junita @UNIT@.
 
@@ -202,14 +220,14 @@ Vynik: @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: Junit @UNIT@ pieračytvaje svaju kanfihuracyju
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Junit @UNIT@ pačaŭ pieračytvać svaju kanfihuracyju.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Junit @UNIT@ pieračytaŭ svaju kanfihuracyju
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Junit @UNIT@ pieračytaŭ svaju kanfihuracyju.
 
@@ -218,7 +236,7 @@ Vynik: @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Praces @EXECUTABLE@ nie moža być vykanany
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Praces @EXECUTABLE@ nie moža być vykanany ŭ vyniku zboju.
 
@@ -227,7 +245,7 @@ Jon viarnuŭ pamylku numar @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Sibject: Adno ci boĺš paviedamlienniaŭ nie byli nakiravany ŭ syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Adno ci boĺš paviedamlienniaŭ nie byli nakiravany ŭ syslog servis, jaki
 vykonvajecca paralieĺna z journald. Zvyčajna heta značyć, što
@@ -237,7 +255,7 @@ chutkasciu.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Kropka mantavannia nie pustaja
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Kataloh @WHERE@ ukazany jak kropka mantavannia (druhoje polie ŭ /etc/fstab
 ci Where= polie ŭ fajlie junita systemd) i nie pusty. Heta nie pieraškadžaje
@@ -247,7 +265,7 @@ ich, kali laska, zmantujcie hetuju fajlavuju sistemu ŭ inšaje miesca.
 -- 24d8d4452573402496068381a6312df2
 Subject: Virtuaĺnaja mašyna abo kantejnier zapusciŭsia
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Virtuaĺnaja mašyna @NAME@ z lidaram № @LEADER@ zapuscilasia i
 hatova dlia vykarystannia.
@@ -255,6 +273,46 @@ hatova dlia vykarystannia.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Virtuaĺnaja mašyna abo kantejnier spynieny
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Virtuaĺnaja mašyna @NAME@ z lidaram № @LEADER@ spyniena.
+
+-- 36db2dfa5a9045e1bd4af5f93e1cf057
+Subject: Miechanizm DNSSEC adkliučany, bo siervier nie padtrymlivaje jaho
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:systemd-resolved.service(8) resolved.conf(5)
+
+Servis vyznačennia imion (systemd-resolved.service) vyznačyŭ, što
+DNS-siervier nie padtrymlivaje miechanizm DNSSEC. U vyniku pravierka DNSSEC
+byla adkliučana.
+
+Hetaja padzieja ŭznikaje kali naladžany DNSSEC=allow-downgrade
+u fajlie resolved.conf i DNS-siervier nie padtrymlivaje miechanizm DNSSEC.
+Zviarnicie ŭvahu, što režym allow-downgrade dazvaliaje praviesci ataku
+«DNSSEC downgrade», u chodzie jakoj zlamysnik moža adkliučyć pravierku
+DNSSEC šliacham padstanoŭki padroblienych DNSSEC-adkazaŭ u kamunikacyjny
+kanal.
+
+Heta padzieja moža być prykmietaj taho, što DNS-siervier sapraŭdy
+niesumiaščaĺny z DNSSEC abo što zlamysniku paspiachova atrymalasia praviesci
+ataku pa adkliučenniu DNSSEC.
+
+-- 1675d7f172174098b1108bf8c7dc8f5d
+Subject: Zboj pry praviercy DNSSEC
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:systemd-resolved.service(8)
+
+DNS-zapyt abo resursny zapis nie prajšoŭ pravierku DNSSEC.
+Jak pravila, heta pakazvaje na zniešniaje ŭzdziejannie na kanal suviazi.
+
+-- 4d4408cfd0d144859184d1e65d7c8a65
+Subject: Davierany kliuč DNSSEC byŭ anuliavany
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:systemd-resolved.service(8)
+
+Davierany kliuč DNSSEC byŭ anuliavany. Nieabchodna naladzić novy davierany
+kliuč abo abnavić apieracyjnuju sistemu, kab atrymać abnoŭlieny davierany
+kliuč DNSSEC.
diff --git a/src/grp-journal/catalog/systemd.bg.catalog b/src/grp-journal/catalog/systemd.bg.catalog.in
index 30246c0bbe..76b0ce8f17 100644
--- a/src/grp-journal/catalog/systemd.bg.catalog
+++ b/src/grp-journal/catalog/systemd.bg.catalog.in
@@ -26,7 +26,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Журналният процес е пуснат
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Журналният процес на системата е стартирал, отворил е журналните файлове
 за запис и може да приема заявки.
@@ -34,7 +34,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Журналният процес е спрян
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Журналният процес на системата е спрян, затворени са всички отворени
 журнални файлове.
@@ -42,7 +42,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- ec387f577b844b8fa948f33cad9a75e6
 Subject: Пространството върху диска заето от журналните файлове
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @JOURNAL_NAME@ (@JOURNAL_PATH@) в момента заема @CURRENT_USE_PRETTY@.
 Максималният зададен размер е @MAX_USE_PRETTY@.
@@ -58,7 +58,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Съобщенията от някоя услуга не са допуснати
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Някоя услуга генерира прекалено много съобщения за кратък период.
@@ -74,7 +74,7 @@ Documentation: man:journald.conf(5)
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Пропуснати журнални съобщения
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Някои от съобщенията на ядрото може и да са пропуснати, защото системата не
 смогваше да ги обработи достатъчно бързо.
@@ -82,7 +82,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Процес № @COREDUMP_PID@ (@COREDUMP_COMM@) запази освободената памет
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Процес № @COREDUMP_PID@ (@COREDUMP_COMM@) заби, представянето му в паметта
@@ -94,7 +94,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Създадена е нова сесия № @SESSION_ID@ за потребителя „@USER_ID@“
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 За потребителя „@USER_ID@“ е създадена нова сесия № @SESSION_ID@.
@@ -104,7 +104,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Сесия № @SESSION_ID@ приключи
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Сесия № @SESSION_ID@ приключи работа.
@@ -112,7 +112,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Налично е ново работно място № @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Новото работно място № @SEAT_ID@ е настроено и готово за работа.
@@ -120,7 +120,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Работното място № @SEAT_ID@ е премахнато
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Работното място № @SEAT_ID@ вече не е налично.
@@ -128,7 +128,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Смяна на системното време
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Часовникът на системата е сверен да сочи @REALTIME@ микросекунди след
 1 януари 1970.
@@ -136,14 +136,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Смяна на часовия пояс да е „@TIMEZONE@“
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Часовият пояс на системата е сменен на „@TIMEZONE@“.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Стартирането на системата завърши
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Успешно са стартирали всички услуги, които са посочени за задействане при
 стартиране на системата. Това не означава, че системата бездейства, защото
@@ -159,21 +159,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Системата е приспана на ниво „@SLEEP@“
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системата премина в състояние на приспиване „@SLEEP@“.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Системата се събуди след приспиване на ниво„@SLEEP@“
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системата се събуди от състояние на приспиване „@SLEEP@“.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Започна процедура на спиране на системата
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Започна процедурата на Systemd за спиране на системата. Всички процеси и
 услуги се спират, всички файлови системи се демонтират.
@@ -181,14 +181,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Модул „@UNIT@“ се стартира
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Модулът „@UNIT@“ се стартира в момента
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Модул „@UNIT@“ вече е стартиран
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Стартирането на модул „@UNIT@“ завърши.
 
@@ -197,21 +197,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Модул „@UNIT@“ се спира
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Модулът „@UNIT@“ се спира в момента.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Модул „@UNIT@“ вече е спрян
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Спирането на модул „@UNIT@“ завърши.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Модулът „@UNIT@“ не успя да стартира
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Модулът „@UNIT@“ не успя да стартира.
 
@@ -220,14 +220,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: Модулът „@UNIT@“ започна презареждане на настройките си
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Модулът „@UNIT@“ започна презареждане на настройките си.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Модулът „@UNIT@“ завърши презареждането на настройките си
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Модулът „@UNIT@“ завърши презареждането на настройките си.
 
@@ -236,7 +236,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Програмата „@EXECUTABLE@“ не успя да се стартира
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Програмата „@EXECUTABLE@“ не успя да се стартира.
 
@@ -245,7 +245,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Поне едно съобщение не бе препратено към syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Поне едно съобщение не бе препратено към журналната услуга syslog, която
 работи успоредно с journald.
@@ -256,7 +256,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Точката за монтиране не е празна
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Директорията „@WHERE@“ не е празна.
 
@@ -271,7 +271,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 24d8d4452573402496068381a6312df2
 Subject: Стартирана е виртуална машина или контейнер
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Виртуалната машина „@NAME@“ с идентификатор на водещия процес @LEADER@
 е стартирана и готова за работа.
@@ -279,7 +279,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Спряна е виртуална машина или контейнер
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Виртуалната машина „@NAME@“ с идентификатор на водещия процес @LEADER@
 е спряна.
@@ -287,7 +287,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 36db2dfa5a9045e1bd4af5f93e1cf057
 Subject: Режимът DNSSEC е изключен, защото сървърът не го поддържа
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 
 Локалната услуга за имена (systemd-resolved.service) установи, че
@@ -306,7 +306,7 @@ Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 -- 1675d7f172174098b1108bf8c7dc8f5d
 Subject: Неуспешна проверка на DNSSEC
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Заявка или запис в DNS не издържа проверка с DNSSEC.
@@ -316,7 +316,7 @@ Documentation: man:systemd-resolved.service(8)
 -- 4d4408cfd0d144859184d1e65d7c8a65
 Subject: Анулирана доверена котва в DNSSEC
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Анулирана е доверена котва за DNSSEC и трябва да настроите нова.
diff --git a/src/grp-journal/catalog/systemd.catalog b/src/grp-journal/catalog/systemd.catalog.in
index 90929bca6d..8de8597fe9 100644
--- a/src/grp-journal/catalog/systemd.catalog
+++ b/src/grp-journal/catalog/systemd.catalog.in
@@ -25,7 +25,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: The journal has been started
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The system journal process has started up, opened the journal
 files for writing and is now ready to process requests.
@@ -33,7 +33,7 @@ files for writing and is now ready to process requests.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: The journal has been stopped
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The system journal process has shut down and closed all currently
 active journal files.
@@ -41,7 +41,7 @@ active journal files.
 -- ec387f577b844b8fa948f33cad9a75e6
 Subject: Disk space used by the journal
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @JOURNAL_NAME@ (@JOURNAL_PATH@) is currently using @CURRENT_USE_PRETTY@.
 Maximum allowed usage is set to @MAX_USE_PRETTY@.
@@ -56,7 +56,7 @@ RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize= settings in
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Messages from a service have been suppressed
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 A service has logged too many messages within a time period. Messages
@@ -72,7 +72,7 @@ with RateLimitIntervalSec= and RateLimitBurst= in
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Journal messages have been missed
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Kernel messages have been lost as the journal system has been unable
 to process them quickly enough.
@@ -80,7 +80,7 @@ to process them quickly enough.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Process @COREDUMP_PID@ (@COREDUMP_COMM@) dumped core
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Process @COREDUMP_PID@ (@COREDUMP_COMM@) crashed and dumped core.
@@ -91,7 +91,7 @@ should be reported to its vendor as a bug.
 -- fc2e22bc6ee647b6b90729ab34a250b1 de
 Subject: Speicherabbild für Prozess @COREDUMP_PID@ (@COREDUMP_COMM) generiert
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Prozess @COREDUMP_PID@ (@COREDUMP_COMM@) ist abgebrochen worden und
@@ -103,7 +103,7 @@ als Fehler dem jeweiligen Hersteller gemeldet werden.
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: A new session @SESSION_ID@ has been created for user @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 A new session with the ID @SESSION_ID@ has been created for the user @USER_ID@.
@@ -113,7 +113,7 @@ The leading process of the session is @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Session @SESSION_ID@ has been terminated
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 A session with the ID @SESSION_ID@ has been terminated.
@@ -121,7 +121,7 @@ A session with the ID @SESSION_ID@ has been terminated.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: A new seat @SEAT_ID@ is now available
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 A new seat @SEAT_ID@ has been configured and is now available.
@@ -129,7 +129,7 @@ A new seat @SEAT_ID@ has been configured and is now available.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Seat @SEAT_ID@ has now been removed
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 A seat @SEAT_ID@ has been removed and is no longer available.
@@ -137,28 +137,28 @@ A seat @SEAT_ID@ has been removed and is no longer available.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Time change
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The system clock has been changed to @REALTIME@ microseconds after January 1st, 1970.
 
 -- c7a787079b354eaaa9e77b371893cd27 de
 Subject: Zeitänderung
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Die System-Zeit wurde geändert auf @REALTIME@ Mikrosekunden nach dem 1. Januar 1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Time zone change to @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The system timezone has been changed to @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: System start-up is now complete
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 All system services necessary queued for starting at boot have been
 successfully started. Note that this does not mean that the machine is
@@ -173,21 +173,21 @@ Userspace start-up required @USERSPACE_USEC@ microseconds.
 -- 6bbd95ee977941e497c48be27c254128
 Subject: System sleep state @SLEEP@ entered
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The system has now entered the @SLEEP@ sleep state.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: System sleep state @SLEEP@ left
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The system has now left the @SLEEP@ sleep state.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: System shutdown initiated
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemd shutdown has been initiated. The shutdown has now begun and
 all system services are terminated and all file systems unmounted.
@@ -195,14 +195,14 @@ all system services are terminated and all file systems unmounted.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Unit @UNIT@ has begun start-up
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has begun starting up.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Unit @UNIT@ has finished start-up
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has finished starting up.
 
@@ -211,21 +211,21 @@ The start-up result is @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Unit @UNIT@ has begun shutting down
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has begun shutting down.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Unit @UNIT@ has finished shutting down
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has finished shutting down.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Unit @UNIT@ has failed
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has failed.
 
@@ -234,14 +234,14 @@ The result is @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: Unit @UNIT@ has begun reloading its configuration
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has begun reloading its configuration
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Unit @UNIT@ has finished reloading its configuration
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Unit @UNIT@ has finished reloading its configuration
 
@@ -250,7 +250,7 @@ The result is @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Process @EXECUTABLE@ could not be executed
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The process @EXECUTABLE@ could not be executed and failed.
 
@@ -259,7 +259,7 @@ The error number returned by this process is @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: One or more messages could not be forwarded to syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 One or more messages could not be forwarded to the syslog service
 running side-by-side with journald. This usually indicates that the
@@ -269,7 +269,7 @@ messages queued.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Mount point is not empty
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The directory @WHERE@ is specified as the mount point (second field in
 /etc/fstab or Where= field in systemd unit file) and is not empty.
@@ -281,7 +281,7 @@ location.
 -- 24d8d4452573402496068381a6312df2
 Subject: A virtual machine or container has been started
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The virtual machine @NAME@ with its leader PID @LEADER@ has been
 started is now ready to use.
@@ -289,7 +289,7 @@ started is now ready to use.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: A virtual machine or container has been terminated
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 The virtual machine @NAME@ with its leader PID @LEADER@ has been
 shut down.
@@ -297,7 +297,7 @@ shut down.
 -- 36db2dfa5a9045e1bd4af5f93e1cf057
 Subject: DNSSEC mode has been turned off, as server doesn't support it
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 
 The resolver service (systemd-resolved.service) has detected that the
@@ -317,7 +317,7 @@ attack.
 -- 1675d7f172174098b1108bf8c7dc8f5d
 Subject: DNSSEC validation failed
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 A DNS query or resource record set failed DNSSEC validation. This is usually
@@ -326,7 +326,7 @@ indication that the communication channel used was tampered with.
 -- 4d4408cfd0d144859184d1e65d7c8a65
 Subject: A DNSSEC trust anchor has been revoked
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 A DNSSEC trust anchor has been revoked. A new trust anchor has to be
diff --git a/src/grp-journal/catalog/systemd.da.catalog b/src/grp-journal/catalog/systemd.da.catalog.in
index 093e8139da..bc7d94476f 100644
--- a/src/grp-journal/catalog/systemd.da.catalog
+++ b/src/grp-journal/catalog/systemd.da.catalog.in
@@ -26,7 +26,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Journalen er blevet startet
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 System-journal processen har startet op, åbnet journal filerne for
 tilskrivning og er nu klar til at modtage anmodninger.
@@ -34,7 +34,7 @@ tilskrivning og er nu klar til at modtage anmodninger.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Journalen er blevet stoppet
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 System-journal processen er stoppet og har lukket alle aktive journal
 filer.
@@ -42,7 +42,7 @@ filer.
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Beskeder fra en service er blevet undertrykt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 En service har logget for mange beskeder inden for en given tidsperiode.
@@ -58,7 +58,7 @@ med RateLimitIntervalSec= og RateLimitBurst= i
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Journal beskeder er gået tabt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Kernel beskeder er gået tabt da journal systemet ikke har været i stand
 til at håndtere dem hurtigt nok.
@@ -66,7 +66,7 @@ til at håndtere dem hurtigt nok.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Fejl-fil genereret for process @COREDUMP_PID@ (@COREDUMP_COMM@)
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Process @COREDUMP_PID@ (@COREDUMP_COMM@) har lukket ned og genereret en
@@ -78,7 +78,7 @@ og burde blive reporteret som en bug til folkene bag
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: En ny session @SESSION_ID@ er blevet lavet for bruger @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 En ny session med ID @SESSION_ID@ er blevet lavet for brugeren @USER_ID@.
@@ -88,7 +88,7 @@ Den ledende process for sessionen er @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Session @SESSION_ID@ er blevet lukket ned
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 En session med ID @SESSION_ID@ er blevet lukket ned.
@@ -96,7 +96,7 @@ En session med ID @SESSION_ID@ er blevet lukket ned.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: En ny arbejdsstation $SEAT_ID@ er nu tilgængelig
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 En ny arbejdsstation @SEAT_ID@ er blevet konfigureret og er nu tilgængelig.
@@ -104,7 +104,7 @@ En ny arbejdsstation @SEAT_ID@ er blevet konfigureret og er nu tilgængelig.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Arbejdsstation @SEAT_ID@ er nu blevet fjernet
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 En arbejdsstation @SEAT_ID@ er blevet fjernet og er ikke længere tilgængelig.
@@ -112,21 +112,21 @@ En arbejdsstation @SEAT_ID@ er blevet fjernet og er ikke længere tilgængelig.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Tidsændring
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemtiden er blevet ændret til @REALTIME@ mikrosekunder efter d. 1. Januar 1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Tidszoneændring til @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Tidszonen for systemet er blevet ændret til @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Opstart af systemet er nu fuldført
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Alle system services i kø til at køre ved opstart, er blevet startet
 med success. Bemærk at dette ikke betyder at maskinen er i dvale, da
@@ -141,21 +141,21 @@ Opstart af userspace tog @USERSPACE_USEC@ mikrosekunder.
 -- 6bbd95ee977941e497c48be27c254128
 Subject: System slumretilstand @SLEEP@ trådt i kraft
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 System er nu gået i @SLEEP@ slumretilstand.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: System slumretilstand @SLEEP@ forladt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemet har nu forladt @SLEEP@ slumretilstand.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Systemnedlukning påbegyndt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemnedlukning er blevet påbegyndt. Nedlukningen er nu begyndt og
 alle system services er blevet afbrudt og alle filsystemer afmonteret.
@@ -163,14 +163,14 @@ alle system services er blevet afbrudt og alle filsystemer afmonteret.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Enhed @UNIT@ har påbegyndt opstart
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ er begyndt at starte op.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Enhed @UNIT har færdiggjort opstart
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ er færdig med at starte op.
 
@@ -179,21 +179,21 @@ Resultat for opstart er @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Enhed @UNIT@ har påbegyndt nedlukning
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ har påbegyndt nedlukning.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Enhed @UNIT@ har færdiggjort nedlukning
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ har færdiggjort nedlukning.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Enhed @UNIT@ har fejlet
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ har fejlet.
 
@@ -202,14 +202,14 @@ Resultatet er @RESULT@
 -- d34d037fff1847e6ae669a370e694725
 Subject: Enhed @UNIT@ har påbegyndt genindlæsning af sin konfiguration
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ er begyndt at genindlæse sin konfiguration
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Enhed @UNIT@ har færdiggjort genindlæsning af sin konfiguration
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Enhed @UNIT@ er færdig med at genindlæse sin konfiguration
 
@@ -218,7 +218,7 @@ Resultatet er: @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Process @EXECUTABLE@ kunne ikke eksekveres
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Processen @EXECUTABLE@ kunne ikke eksekveres og fejlede.
 
@@ -227,7 +227,7 @@ Processens returnerede fejlkode er @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Èn eller flere beskeder kunne ikke videresendes til syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Èn eller flere beskeder kunne ikke videresendes til syslog servicen
 der kører side-om-side med journald. Dette indikerer typisk at syslog
@@ -236,7 +236,7 @@ implementationen ikke har kunnet følge med mængden af ventende beskeder.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Monteringspunkt er ikke tomt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Folderen @WHERE@ er specificeret som monteringspunkt (andet felt i
 /etc/fstab eller Where= feltet i systemd enhedsfil) men er ikke tom.
@@ -247,7 +247,7 @@ underlæggende filsystem til en anden lokation.
 -- 24d8d4452573402496068381a6312df2
 Subject: En virtuel maskine eller container er blevet startet
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Den virtuelle maskine @NAME@ med dens leder PID @LEADER@ er blevet
 startet og er klar til brug.
@@ -255,7 +255,7 @@ startet og er klar til brug.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: En virtuel maskine eller container er blevet afbrudt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Den virtuelle maskine @NAME@ med dens leder PID @LEADER@ er blevet
 nedlukket.
diff --git a/src/grp-journal/catalog/systemd.fr.catalog b/src/grp-journal/catalog/systemd.fr.catalog.in
index 0cea629c31..573b288e74 100644
--- a/src/grp-journal/catalog/systemd.fr.catalog
+++ b/src/grp-journal/catalog/systemd.fr.catalog.in
@@ -25,7 +25,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Le journal a été démarré
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le processus du journal système a démarré, ouvert ses fichiers en écriture
 et est prêt à traiter les requêtes.
@@ -33,7 +33,7 @@ et est prêt à traiter les requêtes.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Le journal a été arrêté
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le processus du journal système a été arrêté et tous ses fichiers actifs
 ont été fermés.
@@ -41,7 +41,7 @@ ont été fermés.
 -- ec387f577b844b8fa948f33cad9a75e6
 Subject: Espace disque utilisé par le journal
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 @JOURNAL_NAME@ (@JOURNAL_PATH@) utilise actuellement @CURRENT_USE_PRETTY@.
@@ -60,7 +60,7 @@ Voir journald.conf(5) pour plus de détails.
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Des messages d'un service ont été supprimés
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Un service a essayé d'enregistrer un trop grand nombre de messages sur un
@@ -76,7 +76,7 @@ paramètres RateLimitIntervalSec= et RateLimitBurst= dans le fichier
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Des messages du journal ont été manqués
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Des messages du noyau ont été manqués car le journal système n'a pas été
 capable de les traiter suffisamment vite.
@@ -84,7 +84,7 @@ capable de les traiter suffisamment vite.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Le processus @COREDUMP_PID@ (@COREDUMP_COMM@) a généré un fichier « core »
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Le processus @COREDUMP_PID@ (@COREDUMP_COMM@) a planté et généré un fichier « core ».
@@ -95,7 +95,7 @@ incriminé, et cela devrait être notifié à son concepteur comme un défaut (b
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Une nouvelle session @SESSION_ID@ a été créée pour l'utilisateur @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Une nouvelle session a été créée pour l'utilisateur @USER_ID@ avec
@@ -106,7 +106,7 @@ Le processus maître de la session est @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: La session @SESSION_ID@ s'est terminée
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 La session d'identifiant (ID) @SESSION_ID@ s'est terminée.
@@ -114,7 +114,7 @@ La session d'identifiant (ID) @SESSION_ID@ s'est terminée.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Un nouveau poste (seat) @SEAT_ID@ est disponible
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Un nouveau poste (seat) @SEAT_ID@ a été configuré et est maintenant
@@ -123,7 +123,7 @@ disponible.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Le poste (seat) @SEAT_ID@ a été retiré
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Le poste (seat) @SEAT_ID@ a été retiré et n'est plus disponible.
@@ -131,7 +131,7 @@ Le poste (seat) @SEAT_ID@ a été retiré et n'est plus disponible.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Changement d'heure
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'horloge système a été modifiée et positionnée à @REALTIME@ microsecondes
 après le 1er janvier 1970.
@@ -139,14 +139,14 @@ après le 1er janvier 1970.
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Fuseau horaire modifié en @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le fuseau horaire du système a été modifié et positionné à @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Le démarrage du système est terminé
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Tous les services nécessaires au démarrage du système ont été lancés avec
 succès. Notez que cela ne signifie pas que le système est maintenant au
@@ -162,21 +162,21 @@ Le chargement de l'espace utilisateur a nécessité @USERSPACE_USEC@ microsecond
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Le système entre dans l'état de repos (sleep state) @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le système est maintenant à l'état de repos (sleep state) @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Le système sorti de l'état de repos (sleep state) @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le système est maintenant sorti de l'état de repos (sleep state) @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Arrêt du système amorcé
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'arrêt du système a été amorcé. L'arrêt a maintenant commencé, tous les
 services du système sont terminés et tous les systèmes de fichiers sont
@@ -185,49 +185,49 @@ démontés.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: L'unité (unit) @UNIT@ a commencé à démarrer
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a commencé à démarrer.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: L'unité (unit) @UNIT@ a terminé son démarrage
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a terminé son démarrage, avec le résultat @RESULT@.
 
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: L'unité (unit) @UNIT@ a commencé à s'arrêter
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a commencé à s'arrêter.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: L'unité (unit) @UNIT@ a terminé son arrêt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a terminé son arrêt.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: L'unité (unit) @UNIT@ a échoué
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a échoué, avec le résultat @RESULT@.
 
 -- d34d037fff1847e6ae669a370e694725
 Subject: L'unité (unit) @UNIT@ a commencé à recharger sa configuration
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a commencé à recharger sa configuration.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: L'unité (unit) @UNIT@ a terminé de recharger configuration
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unité (unit) @UNIT@ a terminé de recharger configuration,
 avec le résultat @RESULT@.
@@ -235,7 +235,7 @@ avec le résultat @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Le processus @EXECUTABLE@ n'a pas pu être exécuté
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le processus @EXECUTABLE@ n'a pas pu être exécuté, et a donc échoué.
 
@@ -244,7 +244,7 @@ Le code d'erreur renvoyé est @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Un ou plusieurs messages n'ont pas pu être transmis à syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Un ou plusieurs messages n'ont pas pu être transmis au service syslog
 s'exécutant conjointement avec journald. Cela indique généralement que
@@ -254,7 +254,7 @@ la cadence du flux de messages.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Le point de montage n'est pas vide
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Le répertoire @WHERE@ est spécifié comme point de montage (second champ du
 fichier /etc/fstab, ou champ Where= dans une unité (unit) systemd) et n'est
@@ -267,7 +267,7 @@ fichiers sous-jacent à un autre emplacement.
 -- 24d8d4452573402496068381a6312df2
 Subject: Une machine virtuelle ou un conteneur (container) a été démarré
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 La machine virtuelle @NAME@ a été démarrée avec le PID maître @LEADER@,
 et est maintenant prête à l'emploi.
@@ -275,14 +275,14 @@ et est maintenant prête à l'emploi.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Une machine virtuelle ou un conteneur (container) a été arrêté
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 La machine virtuelle @NAME@ avec le PID maître @LEADER@ a été arrêtée.
 
 -- 36db2dfa5a9045e1bd4af5f93e1cf057
 Subject: Le mode DNSSEC a été désactivé, car il n'est pas supporté par le serveur
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 
 Le service de résolution (systemd-resolved.service) a détecté que le serveur
@@ -302,7 +302,7 @@ DNSSEC, ou qu'un attaquant a peut-être conduit une telle attaque avec succès.
 -- 1675d7f172174098b1108bf8c7dc8f5d
 Subject: La validation DNSSEC a échoué
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Une requête ou une ressource DNS n'a pas passé la validation DNSSEC.
@@ -312,7 +312,7 @@ altéré.
 -- 4d4408cfd0d144859184d1e65d7c8a65
 Subject: Une ancre de confiance DNSSEC a été révoquée
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Une ancre de confiance DNSSEC a été révoquée. Une nouvelle ancre de
diff --git a/src/grp-journal/catalog/systemd.hr.catalog b/src/grp-journal/catalog/systemd.hr.catalog.in
index 350988dd87..7502aed741 100644
--- a/src/grp-journal/catalog/systemd.hr.catalog
+++ b/src/grp-journal/catalog/systemd.hr.catalog.in
@@ -26,7 +26,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: journal je pokrenut
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Journal proces sustava se pokrenuo, otvorio je journal
  datoteke za upis i spreman je za obradu zahtjeva.
@@ -34,7 +34,7 @@ Journal proces sustava se pokrenuo, otvorio je journal
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: journal je zaustavljen
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Journal proces sustava je isključio i zatvorio sve trenutno
 aktivne journal datoteke.
@@ -42,7 +42,7 @@ aktivne journal datoteke.
 -- ec387f577b844b8fa948f33cad9a75e6
 Subject: Diskovni prostor koji koristi journal
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @JOURNAL_NAME@ (@JOURNAL_PATH@) trenutno koristi @CURRENT_USE_PRETTY@.
 Najveća dopuštena upotreba je postavljena na @MAX_USE_PRETTY@.
@@ -57,7 +57,7 @@ RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize= settings u
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Poruka iz usluge je potisnuta
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Usluga je prijavila previše poruka u određenom vremenskom razdoblju. Poruke
@@ -73,7 +73,7 @@ sa RateLimitIntervalSec= i RateLimitBurst= u
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Journal poruka je propuštena
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Kernel poruka je izgubljena zato jer ih journal sustav nije mogao
 dovoljno brzo obraditi.
@@ -81,7 +81,7 @@ dovoljno brzo obraditi.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Proces @COREDUMP_PID@ (@COREDUMP_COMM@) je izbacio jezgru
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Proces @COREDUMP_PID@ (@COREDUMP_COMM@) se srušio i izbacio jezgru.
@@ -92,7 +92,7 @@ trebalo bi se prijaviti razvijatelju kao greška.
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Nova sesija @SESSION_ID@ je stvorena za korisnika @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Nova sesija sa ID @SESSION_ID@ je stvorena za korisnika @USER_ID@.
@@ -102,7 +102,7 @@ Glavni proces sesije je @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Sesija @SESSION_ID@ je prekinuta
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Sesija sa ID @SESSION_ID@ je prekinuta.
@@ -110,7 +110,7 @@ Sesija sa ID @SESSION_ID@ je prekinuta.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Novo sjedište @SEAT_ID@ je sada dostupno
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Novo sjedište @SEAT_ID@ je podešeno i sada je dostupno.
@@ -118,7 +118,7 @@ Novo sjedište @SEAT_ID@ je podešeno i sada je dostupno.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Sjedište @SEAT_ID@ je sada uklonjeno
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Sjedište @SEAT_ID@ je uklonjeno i više nije dostupno.
@@ -126,21 +126,21 @@ Sjedište @SEAT_ID@ je uklonjeno i više nije dostupno.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Vrijeme promjene
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Sat sustava je promijenjen na @REALTIME@ microsekundi nakon 1. Siječnja, 1970 godine.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Vremenska zona je promijenjena u @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Vremenska zona je promijenjena u @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Pokretanje sustava je sada završeno
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Sve usluge sustava koje su zadane za pokretanje pri pokretanju sustava
 su uspješno pokrenute. Zapamtite da ovo ne znači da sada računalo
@@ -155,21 +155,21 @@ Pokretanje prostora korisnika zahtijeva @USERSPACE_USEC@ mikrosekundi.
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Pokrenuto je stanje spavanja @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Sustav je sada pokrenuo stanje spavanja @SLEEP@
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Završeno je stanje spavanja @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Sustav je sada završio stanje spavanja @SLEEP@
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Pokrenuto je isključivanje sustava
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Pokrenuto je isključivanje sustava. Isključivanje je sada pokrenuto,
 sve usluge sustava su prekinute i svi datotečni sustavi su odmontirani.
@@ -177,14 +177,14 @@ sve usluge sustava su prekinute i svi datotečni sustavi su odmontirani.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Jedinica @UNIT@ je započela pokretanje
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ je započela pokretanje.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Jedinica @UNIT@ je završila pokretanje
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ je završila pokretanje.
 
@@ -193,21 +193,21 @@ Rezultat pokretanja je @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Jedinica @UNIT@ je započela isključivanje
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ je započela isključivanje.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Jedinica @UNIT@ je završila isključivanje
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ je završila isključivanje.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Jedinica @UNIT@ nije uspjela
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ nije uspjela.
 
@@ -216,14 +216,14 @@ Rezultat je @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: Jedinica @UNIT@ je započela ponovno učitavati podešavanja
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ je započela ponovno učitavati podešavanja
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Jedinica @UNIT@ je završila ponovno učitavati podešavanja
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedinica @UNIT@ je završila ponovno učitavati podešavanja
 
@@ -232,7 +232,7 @@ Rezultat je @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Proces @EXECUTABLE@ se ne može pokrenuti
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Proces @EXECUTABLE@ se ne može pokrenuti i nije uspio.
 
@@ -241,7 +241,7 @@ Broj greške vraćen ovim procesom je @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Jedna ili više poruka se ne mogu proslijediti u dnevnik sustava
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jedna ili više poruka se ne mogu proslijediti u dnevnik sustava, usluge
 su pokrenute istovremeno s journalom. Ovo uobičajeno označava da
@@ -251,7 +251,7 @@ zahtjeva poruka.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Točka montiranja nije prazna
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Direktorij @WHERE@ je određen za točku montiranja (drugi redak u
 /etc/fstab ili Where= redak u datoteci systemd jedinice) i nije prazan.
@@ -262,7 +262,7 @@ ručno montirajte osnovni datotečni sustav na drugu lokaciju.
 -- 24d8d4452573402496068381a6312df2
 Subject: Virtualni stroj ili spremnik su pokrenuti
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Virtualni stroj @NAME@ sa vodećim @LEADER@ PID-om je
 pokrenut i spreman je za korištenje.
@@ -270,7 +270,7 @@ pokrenut i spreman je za korištenje.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Virtualni stroj ili spremnik su isključeni
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Virtualni stroj @NAME@ sa vodećim PID-om @LEADER@ je
 isključen.
@@ -278,7 +278,7 @@ isključen.
 -- 36db2dfa5a9045e1bd4af5f93e1cf057
 Subject: DNSSEC način je isključen, jer ga poslužitelj ne podržava
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 
 Usluga razrješavanja (systemd-resolved.service) je otkrila da
@@ -297,7 +297,7 @@ DNSSEC ili da je napadač uspješno izvršio takav napad.
 -- 1675d7f172174098b1108bf8c7dc8f5d
 Subject: DNSSEC provjera neuspješna
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 DNS zahtjev ili snimak resursa nije prošao DNSSEC provjeru. To uobičajeno
@@ -306,7 +306,7 @@ označava da je komunikacijski kanal mijenjan.
 -- 4d4408cfd0d144859184d1e65d7c8a65
 Subject: DNSSEC pouzdano sidro je opozvano
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 A DNSSEC trust anchor has been revoked. A new trust anchor has to be
diff --git a/src/grp-journal/catalog/systemd.hu.catalog b/src/grp-journal/catalog/systemd.hu.catalog.in
index 68e8c2572e..f538b7f958 100644
--- a/src/grp-journal/catalog/systemd.hu.catalog
+++ b/src/grp-journal/catalog/systemd.hu.catalog.in
@@ -26,7 +26,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: A napló elindult
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A rendszernapló folyamat elindult, megnyitotta írásra a naplófájlokat,
 és most készen áll kérések feldolgozására.
@@ -34,21 +34,21 @@ A rendszernapló folyamat elindult, megnyitotta írásra a naplófájlokat,
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: A napló leállt
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A rendszernapló folyamat leállt, és bezárt minden jelenleg aktív naplófájlt.
 
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Egy szolgáltatás üzenetei elnémítva
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
-Egy szolgáltatás túl sok üzenetet naplózott adott idő alatt. A 
+Egy szolgáltatás túl sok üzenetet naplózott adott idő alatt. A
 szolgáltatástól származó üzenetek eldobásra kerültek.
 
 Ne feledje, hogy csak a kérdéses szolgáltatás üzenetei kerültek eldobásra,
- más szolgáltatások üzeneteit ez nem befolyásolja. 
+ más szolgáltatások üzeneteit ez nem befolyásolja.
 
 Az üzenetek eldobását vezérlő korlátok az /etc/systemd/journald.conf
 RateLimitIntervalSec= és RateLimitBurst= beállításaival adhatók meg.
@@ -57,7 +57,7 @@ Részletekért lásd a journald.conf(5) man oldalt.
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Naplóüzenetek vesztek el
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Kernelüzenetek vesztek el, mert a naplózó rendszer nem tudta elég gyorsan
 feldolgozni azokat.
@@ -65,19 +65,19 @@ feldolgozni azokat.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Egy folyamat összeomlott: @COREDUMP_PID@ (@COREDUMP_COMM@)
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Ez a folyamat: @COREDUMP_PID@ (@COREDUMP_COMM@) összeomlott, és core fájlt
  írt ki.
 
-Ez általában programozási hibát jelez az összeomló programban, és 
+Ez általában programozási hibát jelez az összeomló programban, és
 a szállítója felé kell bejelenteni.
 
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Új munkamenet (@SESSION_ID@) létrehozva, felhasználója: @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Létrejött egy új munkamenet @SESSION_ID@ azonosítóval ezen felhasználóhoz:
@@ -88,7 +88,7 @@ A munkamenet vezető folyamata: @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Munkamenet (@SESSION_ID@) befejezve
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 A következő azonosítójú munkamenet befejeződött: @SESSION_ID@.
@@ -96,7 +96,7 @@ A következő azonosítójú munkamenet befejeződött: @SESSION_ID@.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Elérhető egy új munkaállomás: @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Beállításra kerül és használható egy új munkaállomás: @SEAT_ID@.
@@ -104,7 +104,7 @@ Beállításra kerül és használható egy új munkaállomás: @SEAT_ID@.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: A munkaállomás eltávolítva: @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 A munkaállomás el lett távolítva, és már nem érhető el: @SEAT_ID@
@@ -112,25 +112,25 @@ A munkaállomás el lett távolítva, és már nem érhető el: @SEAT_ID@
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Időmódosítás
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A rendszeróra beállítva @REALTIME@ ezredmásodpercre 1970. január 1. után.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Időzóna-módosítás erre: @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A rendszer időzónája módosítva lett erre: @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: A rendszer indítása kész
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
-A rendszerindításkor szükséges indításhoz sorba állított összes 
-rendszerszolgáltatás elindult. Ne feledje, hogy ez nem jelenti, hogy a 
-gép üresjáratban van, mivel egyes szolgáltatások még az indítás 
+A rendszerindításkor szükséges indításhoz sorba állított összes
+rendszerszolgáltatás elindult. Ne feledje, hogy ez nem jelenti, hogy a
+gép üresjáratban van, mivel egyes szolgáltatások még az indítás
 befejezésével lehetnek elfoglalva.
 
 A kernel indítása @KERNEL_USEC@ ezredmásodpercet igényelt.
@@ -142,21 +142,21 @@ A felhasználói programok indítása @USERSPACE_USEC@ ezredmásodpercet igénye
 -- 6bbd95ee977941e497c48be27c254128
 Subject: A rendszer „@SLEEP@” alvási állapotba lépett
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A rendszer belépett ebbe az alvási állapotba: @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: A rendszer „@SLEEP@” alvási állapotból kilépett
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A rendszer kilépett ebből az alvási állapotból: @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Rendszer leállítása kezdeményezve
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A systemd leállítása kezdeményezve. A leállítás megkezdődött, minden
 rendszerszolgáltatás befejeződik, minden fájlrendszer leválasztásra kerül.
@@ -164,14 +164,14 @@ rendszerszolgáltatás befejeződik, minden fájlrendszer leválasztásra kerül
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: A(z) @UNIT@ egység indítása megkezdődött
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység megkezdte az indulást.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: A(z) @UNIT@ egység befejezte az indulást
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység befejezte az indulást
 
@@ -180,21 +180,21 @@ Az indítás eredménye: @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: A(z) @UNIT@ egység megkezdte a leállást
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység megkezdte a leállást.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: A(z) @UNIT@ egység befejezte a leállást
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység befejezte a leállást.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: A(z) @UNIT@ egység hibát jelzett
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység hibát jelzett.
 
@@ -203,14 +203,14 @@ Az eredmény: @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: A(z) @UNIT@ egység megkezdte a beállításainak újratöltését
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység megkezdte a beállításainak újratöltését.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: A(z) @UNIT@ egység befejezte a beállításainak újratöltését
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @UNIT@ egység befejezte a beállításainak újratöltését.
 
@@ -219,7 +219,7 @@ Az eredmény: @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: A folyamat végrehajtása sikertelen: @EXECUTABLE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A folyamat végrehajtása sikertelen volt, és hibát jelzett: @EXECUTABLE@.
 
@@ -228,7 +228,7 @@ A folyamat által visszaadott hibaszám: @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Legalább egy üzenet nem továbbítható a rendszernaplónak
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Legalább egy üzenet nem volt továbbítható a journald-vel párhuzamosan futó
 syslog szolgáltatásnak. Ez általában azt jelenti, hogy a syslog
@@ -238,25 +238,25 @@ megvalósítás nem volt képes lépést tartani a sorba állított
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: A csatolási pont nem üres
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A csatolási pontként megadott @WHERE@ könyvtár (második mező az /etc/fstab
 fájlban, vagy a Where= sor a systemd egységfájlban) nem üres. Ez nem
 akadályozza meg a csatolást, de a könyvtárban már meglévő fájlok
 elérhetetlenné válnak. A fájlok láthatóvá tételéhez csatolja
-az azokat tartalmazó fájlrendszert egy másodlagos helyre. 
+az azokat tartalmazó fájlrendszert egy másodlagos helyre.
 
 -- 24d8d4452573402496068381a6312df2
 Subject: Egy virtuális gép vagy konténer elindult
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
-A(z) @NAME@ nevű virtuális gép (vezető PID: @LEADER@) elindult, és 
+A(z) @NAME@ nevű virtuális gép (vezető PID: @LEADER@) elindult, és
 használatra kész.
 
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Egy virtuális gép vagy konténer befejeződött
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A(z) @NAME@ nevű virtuális gép (vezető PID: @LEADER@) leállt.
diff --git a/src/grp-journal/catalog/systemd.it.catalog b/src/grp-journal/catalog/systemd.it.catalog.in
index b6fca48221..86e44a604d 100644
--- a/src/grp-journal/catalog/systemd.it.catalog
+++ b/src/grp-journal/catalog/systemd.it.catalog.in
@@ -20,7 +20,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Il registro è stato avviato
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Il processo relativo al registro di sistema è stato avviato, ha aperto i
 file in scrittura ed è ora pronto a gestire richieste.
@@ -28,7 +28,7 @@ file in scrittura ed è ora pronto a gestire richieste.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Il registro è stato terminato
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Il processo relativo al registro di sistema è stato terminato e ha chiuso
 tutti i file attivi.
@@ -36,7 +36,7 @@ tutti i file attivi.
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: I messaggi di un servizio sono stati soppressi
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Un servizio ha registrato troppi messaggi in un dato periodo di tempo.
@@ -52,7 +52,7 @@ con RateLimitIntervalSec= e RateLimitBurst= in
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: I messaggi di un servizio sono stati perduti
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 I messaggi del kernel sono stati perduti perché, il registro di sistema
 non è stato in grado di gestirli abbastanza velocemente.
@@ -60,7 +60,7 @@ non è stato in grado di gestirli abbastanza velocemente.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Il processo @COREDUMP_PID@ (@COREDUMP_COMM@) ha generato un dump.
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Il processo @COREDUMP_PID@ (@COREDUMP_COMM@) si è bloccato generando un dump.
@@ -71,7 +71,7 @@ dovrebbe essere segnalato al vendor come un bug.
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: La nuova sessione @SESSION_ID@ è stata creata per l'utente @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Una nuova sessione con ID @SESSION_ID@ è stata creata per l'utente @USER_ID@.
@@ -81,7 +81,7 @@ Il processo primario della sessione è @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: La sessione @SESSION_ID@ è terminata
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 La sessione con ID @SESSION_ID@ è terminata.
@@ -89,7 +89,7 @@ La sessione con ID @SESSION_ID@ è terminata.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: La nuova postazione @SEAT_ID@ è ora disponibile
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 La nuova postazione @SEAT_ID@ è stata configurata ed è ora disponibile.
@@ -97,7 +97,7 @@ La nuova postazione @SEAT_ID@ è stata configurata ed è ora disponibile.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: La postazione @SEAT_ID@ è stata rimossa
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 La postazione @SEAT_ID@ è stata rimossa e non è più disponibile.
@@ -105,21 +105,21 @@ La postazione @SEAT_ID@ è stata rimossa e non è più disponibile.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Cambio d'orario
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'orologio di sistema è cambiato in @REALTIME@ microsecondi dal 1 gennaio, 1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Il fuso orario è cambiato in @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Il fuso orario di sistema è cambiato in @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Avvio del sistema completato.
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Tutti i servizi di sistema richiesti per la fase di avvio sono stati eseguiti
 con successo. Nota che la macchina potrebbe non essere ancora pronta in quanto
@@ -134,21 +134,21 @@ L'avvio dello userspace ha richiesto @USERSPACE_USEC@ microsecondi.
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Il sistema è entrato in fase di pausa @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Il sistema è entrato nello stato di pausa @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Il sistema è uscito dalla fase di pausa @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Il sistema è uscito dallo stato di pausa @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Il sistema è in fase di spegnimento
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemd è in fase di spegnimento. Tutti i servizi di sistema
 saranno terminati e tutti i file systems smontati.
@@ -156,14 +156,14 @@ saranno terminati e tutti i file systems smontati.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: L'unità @UNIT@ inizia la fase di avvio
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ ha iniziato la fase di avvio.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: L'unità @UNIT@ termina la fase di avvio
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ ha terminato la fase di avvio.
 
@@ -172,21 +172,21 @@ La fase di avvio è @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: L'unità @UNIT@ inizia la fase di spegnimento
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ ha iniziato la fase di spegnimento.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: L'unità @UNIT@ termina la fase di spegnimento
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ ha terminato la fase di spegnimento.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: L'unità @UNIT@ è fallita
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ è fallita.
 
@@ -195,14 +195,14 @@ Il risultato è @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: L'unità @UNIT@ inizia a caricare la propria configurazione
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ è iniziata ricaricando la propria configurazione
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: L'unità @UNIT@ termina il caricamento della propria configurazione
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 L'unità @UNIT@ è terminata ricaricando la propria configurazione
 
@@ -211,7 +211,7 @@ Il risultato è @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Il processo @EXECUTABLE@ non può essere eseguito
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Il processo @EXECUTABLE@ non può essere eseguito e termina.
 
@@ -220,7 +220,7 @@ Il numero di errore restituito durante l'esecuzione del processo è @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Uno o più messaggi non possono essere inoltrati a syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Uno o più messaggi non possono essere inviati al servizio syslog
 eseguito in parallelo a journald. Questo di solito capita perché,
@@ -230,7 +230,7 @@ velocità dei messaggi accodati.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Il punto di montaggio non è vuoto
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 La directory @WHERE@ è specificata come punto di montaggio (secondo campo
 in /etc/fstab o nel campo Where= del file unità di systemd) e non è vuoto.
@@ -241,7 +241,7 @@ di montare manualmente il file system indicato in una posizione secondaria.
 -- 24d8d4452573402496068381a6312df2
 Subject: Avviata macchina virtuale o container
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 La macchina virtuale @NAME@ con PID primario @LEADER@ è stata
 avviata ed è pronta all'uso.
@@ -249,6 +249,6 @@ avviata ed è pronta all'uso.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Terminata macchina virtuale o container
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 La macchina virtuale @NAME@ con PID primario @LEADER@ è stata spenta.
diff --git a/src/grp-journal/catalog/systemd.ko.catalog b/src/grp-journal/catalog/systemd.ko.catalog.in
index 2fc6b60b1b..8a053254ee 100644
--- a/src/grp-journal/catalog/systemd.ko.catalog
+++ b/src/grp-journal/catalog/systemd.ko.catalog.in
@@ -29,7 +29,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: 저널 시작
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 시스템 저널 프로세스를 시작했고 기록목적으로 저널 파일을 열었으며,
 프로세스 요청을 기다리고 있습니다.
@@ -37,7 +37,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: 저널 멈춤
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 시스템 저널 프로세스를 껐고 현재 활성화 중인 저널 파일을 모두
 닫았습니다.
@@ -45,7 +45,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: 서비스의 메시지를 거절함
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 일정 시간동안 서비스에서 너무 많은 메시지를 기록했습니다.
@@ -61,7 +61,7 @@ RateLimitIntervalSec= 변수와 RateLimitBurst= 변수로 설정합니다.
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: 저널 메시지 놓침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 저널 시스템에서 커널 메시지를 충분히 빠르게 처리할 수 없어 커널
  메시지를 잃었습니다.
@@ -69,7 +69,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: 프로세스 @COREDUMP_PID@번 코어 덤프(@COREDUMP_COMM@) 생성함
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 프로세스 @COREDUMP_PID@번 (@COREDUMP_COMM@)이 비정상적으로 끝나
@@ -81,7 +81,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: @USER_ID@ 사용자의 새 @SESSION_ID@ 세션 만듦
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 @USER_ID@ 사용자의 새 @SESSION_ID@ 세션을 만들었습니다.
@@ -91,7 +91,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: @SESSION_ID@ 세션 마침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 @SESSION_ID@ 세션을 끝냈습니다.
@@ -99,7 +99,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: 새 @SEAT_ID@ 시트 사용할 수 있음
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 새 @SEAT_ID@ 시트를 설정했고 사용할 수 있습니다.
@@ -107,7 +107,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: @SEAT_ID@ 시트 제거함
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 @SEAT_ID@ 시트를 제거했으며 더이상 사용할 수 없습니다.
@@ -115,7 +115,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: 시간 바꿈
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 시스템 시계를 1970년 1월 1일 이후로 @REALTIME@ 마이크로초 지난 값으로
 설정했습니다.
@@ -123,14 +123,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: @TIMEZONE@ 시간대로 시간대 바꿈
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 시스템 시간대를 @TIMEZONE@ 시간대로 바꾸었습니다.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: 시스템 시동 마침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 부팅 과정에 시작하려고 준비한 모든 시스템 서비스를 성공적으로
  시작했습니다. 머신이 서비스처럼 대기중이라는 의미는 아니며
@@ -145,21 +145,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 6bbd95ee977941e497c48be27c254128
 Subject: @SLEEP@ 대기 상태 진입
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @SLEEP@ 대기 상태로 진입했습니다.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: @SLEEP@ 대기 상태 마침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @SLEEP@ 대기 상태를 마쳤습니다.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: 컴퓨터 끄기 시작
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 컴퓨터 끄기 동작을 시작했습니다. 모든 시스템 동작을 멈추고
 모든 파일 시스템의 마운트를 해제합니다.
@@ -167,14 +167,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: @UNIT@ 유닛 시작
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛을 시작했습니다.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: @UNIT@ 유닛 시동 마침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛 시동을 마쳤습니다.
 
@@ -183,21 +183,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: @UNIT@ 유닛 끝내기 동작 시작
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛 끝내기 동작을 시작했습니다.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: @UNIT@ 유닛 끝내기 동작 마침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛 끝내기 동작을 마쳤습니다.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: @UNIT@ 유닛 동작 실패
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛 동작에 실패했습니다.
 
@@ -206,14 +206,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: @UNIT@ 유닛 설정 다시 읽기 시작
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛의 설정 다시 읽기를 시작했습니다
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: @UNIT@ 유닛 설정 다시 읽기 완료
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 유닛의 설정 다시 읽기 동작을 끝냈습니다.
 
@@ -222,7 +222,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: @EXECUTABLE@ 프로세스 시작할 수 없음
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @EXECUTABLE@ 프로세스를 시작할 수 없어 실행에 실패했습니다.
 
@@ -231,7 +231,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: 하나 이상의 메시지를 syslog에 전달할 수 없음
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 journald 서비스와 동시에 실행중인 syslog 서비스에 하나 이상의 메시지를
 전달할 수 없습니다. 보통 순차적으로 오는 메시지의 속도를 syslog 구현체가
@@ -240,7 +240,7 @@ journald 서비스와 동시에 실행중인 syslog 서비스에 하나 이상�
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: 마운트 지점 비어있지 않음
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @WHERE@ 디렉터리를 마운트 지점으로 지정했으며 (/etc/fstab 파일의
  두번째 필드 또는 systemd 유닛 파일의 Where= 필드) 비어있지 않습니다.
@@ -251,7 +251,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 24d8d4452573402496068381a6312df2
 Subject: 가상 머신 또는 컨테이너 시작
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @LEADER@ 프로세스 ID로 동작하는 @NAME@ 가상 머신을 시작했으며,
 이제부터 사용할 수 있습니다.
@@ -259,6 +259,6 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 58432bd3bace477cb514b56381b8a758
 Subject: 가상 머신 또는 컨테이너 마침
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @LEADER@ 프로세스 ID로 동작하는 @NAME@ 가상 머신을 껐습니다.
diff --git a/src/grp-journal/catalog/systemd.pl.catalog b/src/grp-journal/catalog/systemd.pl.catalog.in
index d8059e93cd..33c2122974 100644
--- a/src/grp-journal/catalog/systemd.pl.catalog
+++ b/src/grp-journal/catalog/systemd.pl.catalog.in
@@ -27,7 +27,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Uruchomiono dziennik
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemowy proces dziennika został uruchomiony, otworzył pliki dziennika do
 zapisu i jest gotowy do przetwarzania żądań.
@@ -35,7 +35,7 @@ zapisu i jest gotowy do przetwarzania żądań.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Zatrzymano dziennik
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemowy proces dziennika został wyłączony i zamknął wszystkie obecnie
 aktywne pliki dziennika.
@@ -43,7 +43,7 @@ aktywne pliki dziennika.
 -- ec387f577b844b8fa948f33cad9a75e6
 Subject: Miejsce na dysku używane przez dziennik
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @JOURNAL_NAME@ (@JOURNAL_PATH@) obecnie używa @CURRENT_USE_PRETTY@.
 Maksymalnie może używać @MAX_USE_PRETTY@.
@@ -59,7 +59,7 @@ informacji.
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Ograniczono komunikaty z usługi
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Usługa zapisała za dużo komunikatów w określonym czasie. Komunikaty z usługi
@@ -75,7 +75,7 @@ za pomocą opcji RateLimitIntervalSec= i RateLimitBurst= w pliku
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Utracono komunikaty dziennika
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Komunikaty jądra zostały utracone, ponieważ system dziennika nie mógł
 przetworzyć ich odpowiednio szybko.
@@ -83,7 +83,7 @@ przetworzyć ich odpowiednio szybko.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Proces @COREDUMP_PID@ (@COREDUMP_COMM@) zrzucił plik core
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Proces @COREDUMP_PID@ (@COREDUMP_COMM@) uległ awarii i zrzucił plik core.
@@ -94,7 +94,7 @@ zgłoszone jego producentowi jako błąd.
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Utworzono nową sesję @SESSION_ID@ dla użytkownika @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Nowa sesja o identyfikatorze @SESSION_ID@ została utworzona dla użytkownika
@@ -105,7 +105,7 @@ Proces prowadzący sesji: @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Zakończono sesję @SESSION_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Sesja o identyfikatorze @SESSION_ID@ została zakończona.
@@ -113,7 +113,7 @@ Sesja o identyfikatorze @SESSION_ID@ została zakończona.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Dostępne jest nowe stanowisko @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Nowe stanowisko @SEAT_ID@ zostało skonfigurowane i jest teraz dostępne.
@@ -121,7 +121,7 @@ Nowe stanowisko @SEAT_ID@ zostało skonfigurowane i jest teraz dostępne.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Usunięto stanowisko @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Stanowisko @SEAT_ID@ zostało usunięte i nie jest już dostępne.
@@ -129,21 +129,21 @@ Stanowisko @SEAT_ID@ zostało usunięte i nie jest już dostępne.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Zmiana czasu
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Zegar systemowy został zmieniony na @REALTIME@ μs po 1 stycznia 1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Zmiana strefy czasowej na @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemowa strefa czasowa została zmieniona na @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Ukończono uruchamianie systemu
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Wszystkie usługi systemowe obowiązkowo zakolejkowane do włączenia podczas
 uruchamiania systemu zostały pomyślnie uruchomione. Proszę zauważyć, że nie
@@ -159,21 +159,21 @@ Uruchamianie przestrzeni użytkownika zajęło @USERSPACE_USEC@ μs.
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Przejście do stanu uśpienia @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 System przeszedł do stanu uśpienia @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Wyjście ze stanu uśpienia @SLEEP@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 System wyszedł ze stanu uśpienia @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Zainicjowano wyłączenie systemu
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Zainicjowano wyłączenie systemd. Wyłączenie zostało rozpoczęte i wszystkie
 usługi systemowe zostały zakończone, a wszystkie systemy plików odmontowane.
@@ -181,14 +181,14 @@ usługi systemowe zostały zakończone, a wszystkie systemy plików odmontowane.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Rozpoczęto uruchamianie jednostki @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ rozpoczęła uruchamianie.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Ukończono uruchamianie jednostki @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ ukończyła uruchamianie.
 
@@ -197,21 +197,21 @@ Wynik uruchamiania: @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Rozpoczęto wyłączanie jednostki @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ rozpoczęła wyłączanie.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Ukończono wyłączanie jednostki @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ ukończyła wyłączanie.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Jednostka @UNIT@ się nie powiodła
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ się nie powiodła.
 
@@ -220,14 +220,14 @@ Wynik: @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: Rozpoczęto ponowne wczytywanie konfiguracji jednostki @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ rozpoczęła ponowne wczytywanie swojej konfiguracji.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Ukończono ponowne wczytywanie konfiguracji jednostki @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jednostka @UNIT@ ukończyła ponowne wczytywanie swojej konfiguracji.
 
@@ -236,7 +236,7 @@ Wynik: @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Nie można wykonać procesu @EXECUTABLE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Proces @EXECUTABLE@ nie mógł zostać wykonany i się nie powiódł.
 
@@ -245,7 +245,7 @@ Numer błędu zwrócony przez ten proces: @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Nie można przekazać jednego lub więcej komunikatów do syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Jeden lub więcej komunikatów nie może zostać przekazanych do usługi syslog
 uruchomionej obok journald. Zwykle oznacza to, że implementacja syslog nie
@@ -254,7 +254,7 @@ jest w stanie nadążyć za prędkością kolejki komunikatów.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Punkt montowania nie jest pusty
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Katalog @WHERE@ został podany jako punkt montowania (drugie pole w pliku
 /etc/fstab lub pole Where= w pliku jednostki systemd) i nie jest pusty. Nie
@@ -265,7 +265,7 @@ plików w innym położeniu.
 -- 24d8d4452573402496068381a6312df2
 Subject: Uruchomiono maszynę wirtualną lub kontener
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Maszyna wirtualna @NAME@ (PID prowadzący @LEADER@) została uruchomiona i jest
 gotowa do użycia.
@@ -273,14 +273,14 @@ gotowa do użycia.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Zakończono maszynę wirtualną lub kontener
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Maszyna wirtualna @NAME@ (PID prowadzący @LEADER@) została wyłączona.
 
 -- 36db2dfa5a9045e1bd4af5f93e1cf057
 Subject: Wyłączono tryb DNSSEC, ponieważ serwer go nie obsługuje
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 
 Usługa resolver (systemd-resolved.service) wykryła, że skonfigurowany serwer
@@ -298,7 +298,7 @@ albo że atakującemu udało się upozorować atak tego typu.
 -- 1675d7f172174098b1108bf8c7dc8f5d
 Subject: Walidacja DNSSEC się nie powiodła
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Zapytanie DNS lub ustawiony wpis zasobu nie przeszedł walidacji DNSSEC.
@@ -307,7 +307,7 @@ Zwykle wskazuje to, że ktoś manipulował używanym kanałem komunikacji.
 -- 4d4408cfd0d144859184d1e65d7c8a65
 Subject: Unieważniono kotwicę zaufania DNSSEC
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Kotwica zaufania DNSSEC została unieważniona. Należy skonfigurować nową, albo
diff --git a/src/grp-journal/catalog/systemd.pt_BR.catalog b/src/grp-journal/catalog/systemd.pt_BR.catalog.in
index 8b856e8355..e461c2b2ba 100644
--- a/src/grp-journal/catalog/systemd.pt_BR.catalog
+++ b/src/grp-journal/catalog/systemd.pt_BR.catalog.in
@@ -27,7 +27,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: O jornal foi inciado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O processo jornal do sistema foi iniciado, arquivos foram abertos e está
 pronto para processar requisições.
@@ -35,7 +35,7 @@ pronto para processar requisições.
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: O jornal foi interrompido
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O processo do jornal do sistema foi desligado e todos os arquivos de jornal
 do sistema foram fechados.
@@ -43,7 +43,7 @@ do sistema foram fechados.
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Mensagens de um serviço foram suprimidas
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Um serviço registrou no log um número excessivo de mensagens dentro de um
@@ -59,7 +59,7 @@ configurado com RateLimitIntervalSec= e RateLimitBurst= no
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Mensagens do jornal foram perdidas
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Mensagens do kernel foram perdidas pois o sistema do jornal não pôde
 processá-las em velocidade suficiente para a demanda.
@@ -67,7 +67,7 @@ processá-las em velocidade suficiente para a demanda.
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Processo @COREDUMP_PID@ (@COREDUMP_COMM@) despejou núcleo
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Processo @COREDUMP_PID@ (@COREDUMP_COMM@) travou e despejou o núcleo.
@@ -78,7 +78,7 @@ deveria ser relatado para seu fabricante como um erro.
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: A nova sessão @SESSION_ID@ foi criada para usuário o @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Uma nova sessão com o ID @SESSION_ID@ foi criada para o usuário @USER_ID@.
@@ -88,7 +88,7 @@ O processo originador da sessão é @LEADER@.
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Sessão @SESSION_ID@ foi terminada
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Um sessão com o ID @SESSION_ID@ foi terminada.
@@ -96,7 +96,7 @@ Um sessão com o ID @SESSION_ID@ foi terminada.
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Um novo seat @SEAT_ID@ está disponível
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Um novo seat @SEAT_ID@ foi configurado e está disponível.
@@ -104,7 +104,7 @@ Um novo seat @SEAT_ID@ foi configurado e está disponível.
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Seat @SEAT_ID@ foi removido agora
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Um seat @SEAT_ID@ foi removido e não está mais disponível.
@@ -112,7 +112,7 @@ Um seat @SEAT_ID@ foi removido e não está mais disponível.
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Time change
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O relógio do sistema foi alterado para @REALTIME@ microssegundos após 1º de
 janeiro de 1970.
@@ -120,14 +120,14 @@ janeiro de 1970.
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Fuso horário alterado para @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O fuso horário do sistema foi alterado para @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Inicialização do sistema foi concluída
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Todos os serviços do sistema necessários que estão enfileirados para
 executar na inicialização do sistema, foram iniciados com sucesso. Note
@@ -143,21 +143,21 @@ Inicialização do espaço do usuário precisou de @USERSPACE_USEC@ microssegund
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Estado de suspensão do sistema @SLEEP@ iniciado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O sistema entrou agora no estado de suspensão @SLEEP@.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Estado de suspensão do sistema @SLEEP@ finalizado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O sistema saiu agora do estado de suspensão @SLEEP@.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Desligamento do sistema iniciado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Desligamento do sistema foi inicializado. O desligamento se iniciou e todos
 os serviços do sistema foram terminados e todos os sistemas desmontados.
@@ -165,14 +165,14 @@ os serviços do sistema foram terminados e todos os sistemas desmontados.
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Unidade @UNIT@ sendo iniciado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ está sendo iniciada.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Unidade @UNIT@ concluiu a inicialização
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ concluiu a inicialização.
 
@@ -181,21 +181,21 @@ The start-up result is @RESULT@.
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Unidade @UNIT@ sendo desligado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ está sendo desligada.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: A unidade @UNIT@ concluiu o desligamento
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ concluiu o desligamento.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: A unidade @UNIT@ falhou
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ falhou.
 
@@ -204,14 +204,14 @@ O resultado é @RESULT@.
 -- d34d037fff1847e6ae669a370e694725
 Subject: Unidade @UNIT@ iniciou recarregamento de sua configuração
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ iniciou o recarregamento de sua configuração.
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Unidade @UNIT@ concluiu recarregamento de sua configuração
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A unidade @UNIT@ concluiu o recarregamento de sua configuração.
 
@@ -220,7 +220,7 @@ O resultado é @RESULT@.
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Processo @EXECUTABLE@ não pôde ser executado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O processo @EXECUTABLE@ não pôde ser executado e falhou.
 
@@ -229,7 +229,7 @@ O número de erro retornado por este processo é @ERRNO@.
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Uma ou mais mensagens não puderam ser encaminhadas para o syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Uma ou mais mensagens não puderam ser encaminhadas para o serviço do syslog
 em execução paralela ao journald. Isso normalmente indica que a implementação
@@ -239,7 +239,7 @@ enfileiradas.
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Ponto de montagem não está vazio
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 O diretório @WHERE@ está especificado como ponto de montagem (o segundo campo
 no /etc/fstab ou campo Where= no arquivo de unidade do systemd) e não está
@@ -251,7 +251,7 @@ arquivos subjacente para uma localização secundária.
 -- 24d8d4452573402496068381a6312df2
 Subject: Uma máquina virtual ou contêiner foi iniciado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A máquina virtual @NAME@ com seu PID @LEADER@ incial foi iniciada e está
 pronto para ser usad.
@@ -259,6 +259,6 @@ pronto para ser usad.
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Uma máquina virtual ou contêiner foi terminado
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 A máquina virtual @NAME@ com seu PID @LEADER@ incial foi desligada.
diff --git a/src/grp-journal/catalog/systemd.ru.catalog b/src/grp-journal/catalog/systemd.ru.catalog.in
index e56dbe3acc..df55478592 100644
--- a/src/grp-journal/catalog/systemd.ru.catalog
+++ b/src/grp-journal/catalog/systemd.ru.catalog.in
@@ -29,7 +29,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Запущена служба журналирования
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Процесс, отвечающий за журналирование системных событий, успешно запустился,
 открыл для записи файлы журнала, и готов обрабатывать запросы.
@@ -38,7 +38,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Служба журналирования остановлена
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Процесс, отвечающий за журналирование системных событий, завершил работу и
 закрыл все свои файлы.
@@ -47,26 +47,26 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- ec387f577b844b8fa948f33cad9a75e6
 Subject: Место на диске, занятое журналом
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @JOURNAL_NAME@ (@JOURNAL_PATH@) сейчас занимает @CURRENT_USE_PRETTY@.
 Максимальный разрешенный размер составляет @MAX_USE_PRETTY@.
-Оставляем свободными как минимум @DISK_KEEP_FREE_PRETTY@ (сейчас на диске 
+Оставляем свободными как минимум @DISK_KEEP_FREE_PRETTY@ (сейчас на диске
 свободно @DISK_AVAILABLE_PRETTY@).
 Таким образом, предел использования составляет @LIMIT_PRETTY@, из которых
 @AVAILABLE_PRETTY@ пока свободно.
 
 Ограничения на размер журнала настраиваются при помощи параметров
-SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize=, RuntimeMaxUse=, 
+SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize=, RuntimeMaxUse=,
 RuntimeKeepFree=, RuntimeMaxFileSize= в файле /etc/systemd/journald.conf.
-Более подробные сведения вы можете получить на справочной странице 
+Более подробные сведения вы можете получить на справочной странице
 journald.conf(5).
 
 # Subject: Messages from a service have been suppressed
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Часть сообщений от службы пропущена
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Служба отправила слишком много сообщений за короткий промежуток времени.
@@ -84,7 +84,7 @@ journald.conf(5).
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Часть сообщений ядра пропущена
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Часть сообщений, поступивших от ядра, была потеряна, так как служба
 журналирования не успела их обработать.
@@ -93,7 +93,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Процесс @COREDUMP_PID@ (@COREDUMP_COMM@) сбросил дамп памяти
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Процесс @COREDUMP_PID@ (@COREDUMP_COMM@) завершился из-за критической ошибки.
@@ -106,7 +106,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Для пользователя @USER_ID@ создан новый сеанс @SESSION_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Для пользователя @USER_ID@ создан новый сеанс с идентификатором @SESSION_ID@.
@@ -117,7 +117,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Сеанс @SESSION_ID@ завершен
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Сеанс с идентификатором @SESSION_ID@ завершился.
@@ -126,7 +126,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Добавлено новое рабочее место @SEAT_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Новое рабочее место (seat) @SEAT_ID@ полностью настроено и готово к
@@ -136,7 +136,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Рабочее место @SEAT_ID@ отключено
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Рабочее место (seat) @SEAT_ID@ было отключено.
@@ -145,7 +145,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Переведены системные часы
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системные часы были переведены. Сейчас они показывают @REALTIME@ микросекунд
 с момента 00:00:00 1 января 1970 года.
@@ -154,7 +154,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Часовой пояс изменен на @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системный часовой пояс был изменен. Новое значение: @TIMEZONE@.
 
@@ -162,7 +162,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Запуск системы завершен
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Все системные службы, запуск которых предписан настройками, были запущены.
 Впрочем, это ещё не означает, что система в данный момент ничем не занята,
@@ -179,7 +179,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Система перешла в состояние сна (@SLEEP@)
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Система была переведена в состояние сна (@SLEEP@).
 
@@ -187,7 +187,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Система вышла из состояния сна (@SLEEP@)
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Система была выведена из состояния сна (@SLEEP@).
 
@@ -195,7 +195,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Подготовка системы к выключению
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Начат процесс подготовки к выключению компьютера. Останавливаются все системные
 службы, отмонтируются все файловые системы.
@@ -204,7 +204,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Начинается запуск юнита @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Начат процесс запуска юнита @UNIT@.
 
@@ -212,7 +212,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Запуск юнита @UNIT@ завершен
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Процесс запуска юнита @UNIT@ был завершен.
 
@@ -222,7 +222,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Начинается остановка юнита @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Начат процесс остановки юнита @UNIT@.
 
@@ -230,7 +230,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Завершена остановка юнита @UNIT@.
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Процесс остановки юнита @UNIT@ был завершен.
 
@@ -238,7 +238,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Ошибка юнита @UNIT@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Произошел сбой юнита @UNIT@.
 
@@ -248,7 +248,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: Юнит @UNIT@ начал перечитывать свои настройки
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Юнит @UNIT@ начал процесс перечитывания своей конфигурации.
 
@@ -256,7 +256,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Юнит @UNIT@ завершил перечитывание своих настроек
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Юнит @UNIT@ завершил процесс перечитывания своей конфигурации.
 
@@ -266,7 +266,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Не удалось запустить процесс @EXECUTABLE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Сбой: не удалось запустить процесс @EXECUTABLE@.
 
@@ -276,7 +276,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Часть сообщений не удалось передать процессу syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Не удалось передать некоторые сообщения демону системного лога (syslog),
 дублирующему работу службы системного журнала. Скорее всего, причина в том, что
@@ -287,7 +287,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Каталог, являющийся точкой монтирования, не пуст
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Каталог @WHERE@, который был указан в качестве точки монтирования (во втором
 столбце файла /etc/fstab, либо в параметре Where= файла конфигурации юнита),
@@ -299,7 +299,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 24d8d4452573402496068381a6312df2
 Subject: Запущена виртуальная машина/контейнер
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Виртуальная машина @NAME@ (идентификатор главного процесса: @LEADER@) запущена и
 готова к работе.
@@ -308,7 +308,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Остановлена виртуальная машина/контейнер
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Виртуальная машина @NAME@ (идентификатор главного процесса: @LEADER@) выключена.
 
@@ -316,11 +316,11 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 36db2dfa5a9045e1bd4af5f93e1cf057
 Subject: Механизм DNSSEC был отключен, так как DNS-сервер его не поддерживает
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8) resolved.conf(5)
 
 Служба разрешения имен хостов (systemd-resolved.service) определила, что
-указанный в настойках DNS-сервер не поддерживает технологию DNSSEC, и 
+указанный в настойках DNS-сервер не поддерживает технологию DNSSEC, и
 автоматически отключила DNSSEC-проверки.
 
 Данное событие возникает, если в файле resolved.conf указан параметр
@@ -329,7 +329,7 @@ DNSSEC=allow-downgrade, и вышестоящий DNS-сервер не подд
 "DNSSEC downgrade", в ходе которой атакующий хакер блокирует проверки DNSSEC
 путем отправки ложных сообщений от имени DNS-сервера.
 
-Возникновение данного события может свидетельствовать как о том, что ваш 
+Возникновение данного события может свидетельствовать как о том, что ваш
 DNS-сервер не поддерживает DNSSEC, так и о том, что некий хакер успешно провел
 против вас атаку, направленную на блокировку DNSSEC-проверок.
 
@@ -337,7 +337,7 @@ DNS-сервер не поддерживает DNSSEC, так и о том, чт
 -- 1675d7f172174098b1108bf8c7dc8f5d
 Subject: Проверка DNSSEC провалена
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 DNS-запрос или отдельная ресурсная запись не прошла проверку DNSSEC.
@@ -347,8 +347,8 @@ DNS-запрос или отдельная ресурсная запись не
 -- 4d4408cfd0d144859184d1e65d7c8a65
 Subject: Открытый ключ DNSSEC был отозван
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
-Открытый ключ (trust ahcnor) DNSSEC был отозван. Необходимо настроить новый 
+Открытый ключ (trust ahcnor) DNSSEC был отозван. Необходимо настроить новый
 открытый ключ, либо обновить систему, чтобы получить обновленный открытый ключ.
diff --git a/src/grp-journal/catalog/systemd.sr.catalog b/src/grp-journal/catalog/systemd.sr.catalog.in
index cc689b7956..06a0ff648c 100644
--- a/src/grp-journal/catalog/systemd.sr.catalog
+++ b/src/grp-journal/catalog/systemd.sr.catalog.in
@@ -26,7 +26,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: Журнал је покренут
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системски журналски процес се покренуо, отворио журналске
 датотеке за упис и спреман је за обраду захтева.
@@ -34,7 +34,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: Журнал је заустављен
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системски журналски процес се зауставио и затворио све тренутно
 отворене журналске датотеке.
@@ -42,7 +42,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: Поруке од услуге су утишане
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Услуга је уписала сувише порука за једно време. Поруке
@@ -58,7 +58,7 @@ Documentation: man:journald.conf(5)
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: Журналске поруке су изгубљене
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Поруке кернела су изгубљене јер журналски систем није могао да их
 обради довољно брзо.
@@ -66,7 +66,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: Процес @COREDUMP_PID@ (@COREDUMP_COMM@) је избацио своје језгро
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 Процес @COREDUMP_PID@ (@COREDUMP_COMM@) је пао и избацио своје језгро.
@@ -77,7 +77,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: Нова сесија @SESSION_ID@ је направљена за корисника @USER_ID@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Нова сесија са ИБ-ом @SESSION_ID@ је направљена за корисника @USER_ID@.
@@ -87,7 +87,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: Сесија @SESSION_ID@ је окончана
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Сесија са ИБ-ом @SESSION_ID@ је окончана.
@@ -95,7 +95,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: Ново седиште @SEAT_ID@ је сада доступно
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Ново седиште @SEAT_ID@ је исподешавано и сада је доступно.
@@ -103,7 +103,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: Седиште @SEAT_ID@ је сада уклоњено
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 Седиште @SEAT_ID@ је сада уклоњено и више није доступно.
@@ -111,21 +111,21 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Време је промењено
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Системски сат је сада подешен на @REALTIME@ микросекунде након 1. јануара 1970. године.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Временска зона је промењена на @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Временска зона је промењена на @TIMEZONE@.
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: Подизање система је сада готово
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Све системске услуге које су заказане за подизање су успешно покренуте.
 Знајте да ово не значи да је машина сада беспослена јер услуге могу
@@ -140,21 +140,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 6bbd95ee977941e497c48be27c254128
 Subject: Системско стање спавања @SLEEP@ започето
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Систем је сада ушао у @SLEEP@ стање спавања.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: Системско стање спавања @SLEEP@ напуштено
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Систем је изашао из @SLEEP@ стања спавања.
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: Гашење система започето
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Систем-де гашење је започето. Гашење је сада почело и све
 системске услуге су окончане и сви системи датотека откачени.
@@ -162,14 +162,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Јединица @UNIT@ је почела са покретањем
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је почела са покретањем.
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: Јединица @UNIT@ је завршила са покретањем
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је завршила са покретањем.
 
@@ -178,21 +178,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: Јединица @UNIT@ је почела са гашењем
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је почела са гашењем.
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: Јединица @UNIT@ је завршила са гашењем
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је завршила са гашењем.
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: Јединица @UNIT@ је пукла
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је пукла.
 
@@ -201,14 +201,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: Јединица @UNIT@ је почела са поновним учитавањем свог подешавања
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је почела са поновним учитавањем свог подешавања
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: Јединица @UNIT@ је завршила са поновним учитавањем свог подешавања
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Јединица @UNIT@ је завршила са поновним учитавањем свог подешавања
 
@@ -217,7 +217,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: Процес @EXECUTABLE@ није могао бити извршен
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Процес @EXECUTABLE@ није могао бити извршен и пукао је.
 
@@ -226,7 +226,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Једна или више порука није могло бити прослеђено системском записнику
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Једна или више порука није могло бити прослеђено „syslog“ услузи
 која ради упоредно са журнал-деом. Ово обично значи да спроведена
@@ -236,7 +236,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Тачка качења није празна
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Директоријум @WHERE@ је наведен као тачка качења (друго поље у
 /etc/fstab датотеци или у „Where=“ пољу систем-де јединичне датотеке)
@@ -248,7 +248,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 24d8d4452573402496068381a6312df2
 Subject: Виртуелна машина или контејнер је покренут(а)
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Виртуелна машина @NAME@ са водећим ПИБ-ом @LEADER@ је
 покренута и сада је спремна за коришћење.
@@ -256,7 +256,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 58432bd3bace477cb514b56381b8a758
 Subject: Виртуелна машина или контејнер је окончан(а)
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Виртуелна машина @NAME@ са водећим ПИБ-ом @LEADER@ је
 угашена.
diff --git a/src/grp-journal/catalog/systemd.zh_CN.catalog b/src/grp-journal/catalog/systemd.zh_CN.catalog.in
index ed59fc9250..ba7c697c16 100644
--- a/src/grp-journal/catalog/systemd.zh_CN.catalog
+++ b/src/grp-journal/catalog/systemd.zh_CN.catalog.in
@@ -27,21 +27,21 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: 日志已开始
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系统日志进程已启动，已打开供写入的日志文件并准备好处理请求。
 
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: 日志已停止
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系统日志进程已终止，并已关闭所有当前活动的日志文件。
 
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: 由某个服务而来的消息已被抑制
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 某个服务在一个时间周期内记录了太多消息。
@@ -57,7 +57,7 @@ Documentation: man:journald.conf(5)
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: 日志消息已遗失
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 因日志系统对内核消息的处理速度不够快，
 部分信息已经遗失。
@@ -65,7 +65,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: 进程 @COREDUMP_PID@ (@COREDUMP_COMM@) 核心已转储
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 进程 @COREDUMP_PID@ (@COREDUMP_COMM@) 已崩溃并进行核心转储。
@@ -75,7 +75,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: 一个新会话 @SESSION_ID@ 已为用户 @USER_ID@ 建立
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 一个 ID 为 @SESSION_ID@ 的新会话已为用户 @USER_ID@ 建立。
@@ -85,7 +85,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: 会话 @SESSION_ID@ 已终止
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 一个 ID 为 @SESSION_ID@ 的会话已终止。
@@ -93,7 +93,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: 一个新的座位 @SEAT_ID@ 可用
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 一个新的座位 @SEAT_ID@ 已被配置并已可用。
@@ -101,7 +101,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: 座位 @SEAT_ID@ 已被移除
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 座位 @SEAT_ID@ 已被移除并不再可用。
@@ -109,21 +109,21 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: 时间已变更
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系统时钟已变更为1970年1月1日后 @REALTIME@ 微秒。
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: 时区变更为 @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系统时区已变更为 @TIMEZONE@。
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: 系统启动已完成
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 所有系统启动时需要的系统服务均已成功启动。
 请注意这并不代表现在机器已经空闲，因为某些服务可能仍处于完成启动的过程中。
@@ -144,14 +144,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-deve
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: 系统已离开 @SLEEP@ 睡眠状态
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系统现已离开 @SLEEP@ 睡眠状态。
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: 系统关机已开始
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系统关机操作已初始化。
 关机已开始，所有系统服务均已结束，所有文件系统已卸载。
@@ -159,14 +159,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: @UNIT@ 单元已开始启动
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已开始启动。
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: @UNIT@ 单元已结束启动
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已结束启动。
 
@@ -175,21 +175,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: @UNIT@ 单元已开始停止操作
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已开始停止操作。
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: @UNIT@ 单元已结束停止操作
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已结束停止操作。
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: @UNIT@ 单元已失败
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已失败。
 
@@ -198,14 +198,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: @UNIT@ 单元已开始重新载入其配置
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已开始重新载入其配置。
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: @UNIT@ 单元已结束配置重载入
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 @UNIT@ 单元已结束配置重载入操作。
 
@@ -214,7 +214,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: 进程 @EXECUTABLE@ 无法执行
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 进程 @EXECUTABLE@ 无法被执行并已失败。
 
@@ -223,7 +223,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: 一个或更多消息无法被转发至 syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 有一条或更多的消息无法被转发至与 journald 同时运行的 syslog 服务。
 这通常意味着 syslog 实现无法跟上队列中消息进入的速度。
@@ -231,7 +231,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: 挂载点不为空
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 目录 @WHERE@ 被指定为挂载点（即 /etc/fstab 文件的第二栏，或 systemd 单元
 文件的 Where= 字段），且该目录非空。
@@ -241,13 +241,13 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 24d8d4452573402496068381a6312df2
 Subject: 一个虚拟机或容器已启动
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 虚拟机 @NAME@，以及其首进程 PID @LEADER@，已被启动并可被使用。
 
 -- 58432bd3bace477cb514b56381b8a758
 Subject: 一个虚拟机或容器已被终止
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 虚拟机 @NAME@，以及其首进程 PID @LEADER@，已被关闭并停止。
diff --git a/src/grp-journal/catalog/systemd.zh_TW.catalog b/src/grp-journal/catalog/systemd.zh_TW.catalog.in
index aa5004db08..f7b42fa1c7 100644
--- a/src/grp-journal/catalog/systemd.zh_TW.catalog
+++ b/src/grp-journal/catalog/systemd.zh_TW.catalog.in
@@ -27,7 +27,7 @@
 -- f77379a8490b408bbe5f6940505a777b
 Subject: 日誌已開始
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系統日誌行程已啟動，已開啟日誌
 檔案供寫入並準備好對行程的要求做出回應。
@@ -35,7 +35,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d93fb3c9c24d451a97cea615ce59c00b
 Subject: 日誌已停止
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系統日誌行程已關閉，且關閉所有目前
 活躍的日誌檔案。
@@ -43,7 +43,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- a596d6fe7bfa4994828e72309e95d61e
 Subject: 從服務而來的訊息已被抑制
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 有一個服務在一個時間週期內記錄了太多訊息。
@@ -59,7 +59,7 @@ RateLimitIntervalSec= 以及 RateLimitBurst=
 -- e9bf28e6e834481bb6f48f548ad13606
 Subject: 日誌訊息已遺失
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 因日誌系統對核心訊息的處理不夠快速，
 部份訊息已遺失。
@@ -67,7 +67,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- fc2e22bc6ee647b6b90729ab34a250b1
 Subject: 行程 @COREDUMP_PID@ (@COREDUMP_COMM@) 核心傾印
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
 行程 @COREDUMP_PID@ (@COREDUMP_COMM@) 當掉並核心傾印。
@@ -78,7 +78,7 @@ Documentation: man:core(5)
 -- 8d45620c1a4348dbb17410da57c60c66
 Subject: 新的工作階段 @SESSION_ID@ 已為使用者 @USER_ID@ 建立
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 一個新的工作階段，ID @SESSION_ID@ 已為使用者 @USER_ID@ 建立。
@@ -88,7 +88,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- 3354939424b4456d9802ca8333ed424a
 Subject: 工作階段 @SESSION_ID@ 已結束
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 一個工作階段，ID @SESSION_ID@ 已結束。
@@ -96,7 +96,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- fcbefc5da23d428093f97c82a9290f7b
 Subject: 新的座位 @SEAT_ID@ 可用
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 一個新的座位 @SEAT_ID@ 已被設定且現在可用。
@@ -104,7 +104,7 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- e7852bfe46784ed0accde04bc864c2d5
 Subject: 座位 @SEAT_ID@ 已被移除
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 
 座位 @SEAT_ID@ 已被移除且不再可用。
@@ -112,21 +112,21 @@ Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: 時間變更
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系統時間已變更為1970年1月1日後 @REALTIME@ 微秒。
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: 時區變更為 @TIMEZONE@
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系統時區已變更為 @TIMEZONE@。
 
 -- b07a249cd024414a82dd00cd181378ff
 Subject: 系統啟動已完成
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 所有開機所必要的系統服務都已成功啟動。
 注意這並不代表這臺機器有空閒的時間
@@ -141,21 +141,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 6bbd95ee977941e497c48be27c254128
 Subject: 系統進入 @SLEEP@ 睡眠狀態
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系統現在已進入 @SLEEP@ 睡眠狀態。
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
 Subject: 系統離開 @SLEEP@ 睡眠狀態
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 系統現在已離開 @SLEEP@ 睡眠狀態。
 
 -- 98268866d1d54a499c4e98921d93bc40
 Subject: 系統關機開始
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 Systemd 關閉已經開始。關閉已開始且所有系統服務
 都已結束，所有的檔案系統也都已被卸載。
@@ -163,14 +163,14 @@ Systemd 關閉已經開始。關閉已開始且所有系統服務
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: 單位 @UNIT@ 已開始啟動
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 已開始啟動。
 
 -- 39f53479d3a045ac8e11786248231fbf
 Subject: 單位 @UNIT@ 啟動已結束
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 啟動已結束。
 
@@ -179,21 +179,21 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- de5b426a63be47a7b6ac3eaac82e2f6f
 Subject: 單位 @UNIT@ 已開始關閉
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 已開始關閉。
 
 -- 9d1aaa27d60140bd96365438aad20286
 Subject: 單位 @UNIT@ 已關閉結束
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 已關閉結束。
 
 -- be02cf6855d2428ba40df7e9d022f03d
 Subject: 單位 @UNIT@ 已失敗
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 已失敗。
 
@@ -202,14 +202,14 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- d34d037fff1847e6ae669a370e694725
 Subject: 單位 @UNIT@ 已開始重新載入其設定
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 已開始重新載入其設定
 
 -- 7b05ebc668384222baa8881179cfda54
 Subject: 單位 @UNIT@ 已結束重新載入其設定
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 單位 @UNIT@ 已結束重新載入其設定
 
@@ -218,7 +218,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 641257651c1b4ec9a8624d7a40a9e1e7
 Subject: 行程 @EXECUTABLE@ 無法執行
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 行程 @EXECUTABLE@ 無法執行且失敗。
 
@@ -227,7 +227,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: 一個或更多訊息無法被轉發到 syslog
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 一個或更多訊息無法被轉發到 syslog 服務
 以及並行執行的 journald。這通常代表著
@@ -237,7 +237,7 @@ syslog 實作並無未跟上佇列中訊息
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: 掛載點不為空
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 目錄 @WHERE@ 被指定為掛載點（在 /etc/fstab 中的
 第二欄或是在 systemd 單位檔案中的 Where= 欄位）且其不為空。
@@ -249,7 +249,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 24d8d4452573402496068381a6312df2
 Subject: 虛擬機器或容器已啟動
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 虛擬機器 @NAME@ 包含它的領導 PID @LEADER@ 現在
 已經開始並已經可以使用。
@@ -257,7 +257,7 @@ Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
 -- 58432bd3bace477cb514b56381b8a758
 Subject: 虛擬機器或容器已結束
 Defined-By: systemd
-Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
+Support: %SUPPORT_URL%
 
 虛擬機器 @NAME@ 包含它的領導 PID @LEADER@ 已經
 關閉。
diff --git a/src/grp-journal/grp-remote/microhttpd-util.c b/src/grp-journal/grp-remote/microhttpd-util.c
index 328e3b5a52..3fc5e13b71 100644
--- a/src/grp-journal/grp-remote/microhttpd-util.c
+++ b/src/grp-journal/grp-remote/microhttpd-util.c
@@ -61,7 +61,7 @@ static int mhd_respond_internal(struct MHD_Connection *connection,
         if (!response)
                 return MHD_NO;
 
-        log_debug("Queing response %u: %s", code, buffer);
+        log_debug("Queueing response %u: %s", code, buffer);
         MHD_add_response_header(response, "Content-Type", "text/plain");
         r = MHD_queue_response(connection, code, response);
         MHD_destroy_response(response);
diff --git a/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile b/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile
index d481db82dc..289228fb71 100644
--- a/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile
+++ b/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile
@@ -35,7 +35,7 @@ systemd_journal_gatewayd_SOURCES = \
 	src/journal-remote/microhttpd-util.c
 
 systemd_journal_gatewayd_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(MICROHTTPD_LIBS)
 
 ifneq ($(HAVE_GNUTLS),)
diff --git a/src/grp-journal/grp-remote/systemd-journal-upload/Makefile b/src/grp-journal/grp-remote/systemd-journal-upload/Makefile
index 3d90f294af..c2d1f42cc9 100644
--- a/src/grp-journal/grp-remote/systemd-journal-upload/Makefile
+++ b/src/grp-journal/grp-remote/systemd-journal-upload/Makefile
@@ -37,7 +37,7 @@ systemd_journal_upload_CFLAGS = \
         $(LIBCURL_CFLAGS)
 
 systemd_journal_upload_LDADD = \
-        libshared.la \
+        libsystemd-shared.la \
         $(LIBCURL_LIBS)
 
 nodist_systemunit_DATA += \
diff --git a/src/grp-journal/journalctl/Makefile b/src/grp-journal/journalctl/Makefile
index 3c98169647..bf5a4d3924 100644
--- a/src/grp-journal/journalctl/Makefile
+++ b/src/grp-journal/journalctl/Makefile
@@ -31,7 +31,7 @@ journalctl_SOURCES = \
 	src/journal/journalctl.c
 
 journalctl_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	libudev-core.la
 
 ifneq ($(HAVE_QRENCODE),)
diff --git a/src/grp-journal/journalctl/journalctl.c b/src/grp-journal/journalctl/journalctl.c
index 8901b46ae5..e50c21d681 100644
--- a/src/grp-journal/journalctl/journalctl.c
+++ b/src/grp-journal/journalctl/journalctl.c
@@ -350,6 +350,7 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_NO_FULL,
                 ARG_NO_TAIL,
                 ARG_NEW_ID128,
+                ARG_THIS_BOOT,
                 ARG_LIST_BOOTS,
                 ARG_USER,
                 ARG_SYSTEM,
@@ -394,9 +395,9 @@ static int parse_argv(int argc, char *argv[]) {
                 { "new-id128",      no_argument,       NULL, ARG_NEW_ID128      },
                 { "quiet",          no_argument,       NULL, 'q'                },
                 { "merge",          no_argument,       NULL, 'm'                },
+                { "this-boot",      no_argument,       NULL, ARG_THIS_BOOT      }, /* deprecated */
                 { "boot",           optional_argument, NULL, 'b'                },
                 { "list-boots",     no_argument,       NULL, ARG_LIST_BOOTS     },
-                { "this-boot",      optional_argument, NULL, 'b'                }, /* deprecated */
                 { "dmesg",          no_argument,       NULL, 'k'                },
                 { "system",         no_argument,       NULL, ARG_SYSTEM         },
                 { "user",           no_argument,       NULL, ARG_USER           },
@@ -546,6 +547,10 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_merge = true;
                         break;
 
+                case ARG_THIS_BOOT:
+                        arg_boot = true;
+                        break;
+
                 case 'b':
                         arg_boot = true;
 
@@ -870,8 +875,8 @@ static int parse_argv(int argc, char *argv[]) {
                 return -EINVAL;
         }
 
-        if ((arg_boot || arg_action == ACTION_LIST_BOOTS) && (arg_file || arg_directory || arg_merge)) {
-                log_error("Using --boot or --list-boots with --file, --directory or --merge is not supported.");
+        if ((arg_boot || arg_action == ACTION_LIST_BOOTS) && arg_merge) {
+                log_error("Using --boot or --list-boots with --merge is not supported.");
                 return -EINVAL;
         }
 
@@ -1104,13 +1109,13 @@ static int discover_next_boot(sd_journal *j,
 static int get_boots(
                 sd_journal *j,
                 BootId **boots,
-                sd_id128_t *query_ref_boot,
-                int ref_boot_offset) {
+                sd_id128_t *boot_id,
+                int offset) {
 
         bool skip_once;
         int r, count = 0;
         BootId *head = NULL, *tail = NULL;
-        const bool advance_older = query_ref_boot && ref_boot_offset <= 0;
+        const bool advance_older = boot_id && offset <= 0;
         sd_id128_t previous_boot_id;
 
         assert(j);
@@ -1118,19 +1123,19 @@ static int get_boots(
         /* Adjust for the asymmetry that offset 0 is
          * the last (and current) boot, while 1 is considered the
          * (chronological) first boot in the journal. */
-        skip_once = query_ref_boot && sd_id128_is_null(*query_ref_boot) && ref_boot_offset < 0;
+        skip_once = boot_id && sd_id128_is_null(*boot_id) && offset <= 0;
 
         /* Advance to the earliest/latest occurrence of our reference
          * boot ID (taking our lookup direction into account), so that
          * discover_next_boot() can do its job.
          * If no reference is given, the journal head/tail will do,
          * they're "virtual" boots after all. */
-        if (query_ref_boot && !sd_id128_is_null(*query_ref_boot)) {
+        if (boot_id && !sd_id128_is_null(*boot_id)) {
                 char match[9+32+1] = "_BOOT_ID=";
 
                 sd_journal_flush_matches(j);
 
-                sd_id128_to_string(*query_ref_boot, match + 9);
+                sd_id128_to_string(*boot_id, match + 9);
                 r = sd_journal_add_match(j, match, sizeof(match) - 1);
                 if (r < 0)
                         return r;
@@ -1150,7 +1155,7 @@ static int get_boots(
                         return r;
                 else if (r == 0)
                         goto finish;
-                else if (ref_boot_offset == 0) {
+                else if (offset == 0) {
                         count = 1;
                         goto finish;
                 }
@@ -1189,14 +1194,14 @@ static int get_boots(
 
                 previous_boot_id = current->id;
 
-                if (query_ref_boot) {
+                if (boot_id) {
                         if (!skip_once)
-                                ref_boot_offset += advance_older ? 1 : -1;
+                                offset += advance_older ? 1 : -1;
                         skip_once = false;
 
-                        if (ref_boot_offset == 0) {
+                        if (offset == 0) {
                                 count = 1;
-                                *query_ref_boot = current->id;
+                                *boot_id = current->id;
                                 break;
                         }
                 } else {
@@ -1252,7 +1257,7 @@ static int list_boots(sd_journal *j) {
 
 static int add_boot(sd_journal *j) {
         char match[9+32+1] = "_BOOT_ID=";
-        sd_id128_t ref_boot_id;
+        sd_id128_t boot_id;
         int r;
 
         assert(j);
@@ -1260,11 +1265,16 @@ static int add_boot(sd_journal *j) {
         if (!arg_boot)
                 return 0;
 
-        if (arg_boot_offset == 0 && sd_id128_equal(arg_boot_id, SD_ID128_NULL))
+        /* Take a shortcut and use the current boot_id, which we can do very quickly.
+         * We can do this only when we logs are coming from the current machine,
+         * so take the slow path if log location is specified. */
+        if (arg_boot_offset == 0 && sd_id128_is_null(arg_boot_id) &&
+            !arg_directory && !arg_file)
+
                 return add_match_this_boot(j, arg_machine);
 
-        ref_boot_id = arg_boot_id;
-        r = get_boots(j, NULL, &ref_boot_id, arg_boot_offset);
+        boot_id = arg_boot_id;
+        r = get_boots(j, NULL, &boot_id, arg_boot_offset);
         assert(r <= 1);
         if (r <= 0) {
                 const char *reason = (r == 0) ? "No such boot ID in journal" : strerror(-r);
@@ -1279,7 +1289,7 @@ static int add_boot(sd_journal *j) {
                 return r == 0 ? -ENODATA : r;
         }
 
-        sd_id128_to_string(ref_boot_id, match + 9);
+        sd_id128_to_string(boot_id, match + 9);
 
         r = sd_journal_add_match(j, match, sizeof(match) - 1);
         if (r < 0)
@@ -1666,15 +1676,19 @@ static int setup_keys(void) {
         if (on_tty()) {
                 fprintf(stderr,
                         "\n"
-                        "The new key pair has been generated. The " ANSI_HIGHLIGHT "secret sealing key" ANSI_NORMAL " has been written to\n"
+                        "The new key pair has been generated. The %ssecret sealing key%s has been written to\n"
                         "the following local file. This key file is automatically updated when the\n"
                         "sealing key is advanced. It should not be used on multiple hosts.\n"
                         "\n"
                         "\t%s\n"
                         "\n"
-                        "Please write down the following " ANSI_HIGHLIGHT "secret verification key" ANSI_NORMAL ". It should be stored\n"
+                        "Please write down the following %ssecret verification key%s. It should be stored\n"
                         "at a safe location and should not be saved locally on disk.\n"
-                        "\n\t" ANSI_HIGHLIGHT_RED, p);
+                        "\n\t%s",
+                        ansi_highlight(), ansi_normal(),
+                        ansi_highlight(), ansi_normal(),
+                        ansi_highlight_red(),
+                        p);
                 fflush(stderr);
         }
         for (i = 0; i < seed_size; i++) {
@@ -1689,8 +1703,9 @@ static int setup_keys(void) {
                 char tsb[FORMAT_TIMESPAN_MAX], *hn;
 
                 fprintf(stderr,
-                        ANSI_NORMAL "\n"
+                        "%s\n"
                         "The sealing key is automatically changed every %s.\n",
+                        ansi_normal(),
                         format_timespan(tsb, sizeof(tsb), arg_interval, 0));
 
                 hn = gethostname_malloc();
diff --git a/src/grp-journal/journalctl/journalctl.completion.bash b/src/grp-journal/journalctl/journalctl.completion.bash
index 7c8a9ce361..53bedcd92e 100644
--- a/src/grp-journal/journalctl/journalctl.completion.bash
+++ b/src/grp-journal/journalctl/journalctl.completion.bash
@@ -30,17 +30,6 @@ __get_machines() {
 		{ while read a b; do echo " $a"; done; } | sort -u;
 }
 
-__journal_fields=(MESSAGE{,_ID} PRIORITY CODE_{FILE,LINE,FUNC}
-                  ERRNO SYSLOG_{FACILITY,IDENTIFIER,PID} COREDUMP_EXE
-                  _{P,U,G}ID _COMM _EXE _CMDLINE
-                  _CAP_EFFECTIVE _AUDIT_{SESSION,LOGINUID}
-                  _SYSTEMD_{CGROUP,SESSION,{,USER_}UNIT,OWNER_UID,SLICE}
-                  _SELINUX_CONTEXT _SOURCE_REALTIME_TIMESTAMP
-                  _{BOOT,MACHINE}_ID _HOSTNAME _TRANSPORT
-                  _KERNEL_{DEVICE,SUBSYSTEM}
-                  _UDEV_{SYSNAME,DEVNODE,DEVLINK}
-                  __CURSOR __{REALTIME,MONOTONIC}_TIMESTAMP)
-
 __syslog_priorities=(emerg alert crit err warning notice info debug)
 
 _journalctl() {
@@ -79,7 +68,7 @@ _journalctl() {
                                 comps='short short-iso short-precise short-monotonic verbose export json json-pretty json-sse cat'
                         ;;
                         --field|-F)
-                                comps=${__journal_fields[*]}
+                                comps=$(journalctl --fields | sort 2>/dev/null)
 			;;
                         --machine|-M)
                                 comps=$( __get_machines )
@@ -125,8 +114,9 @@ _journalctl() {
                 mapfile -t field_vals < <(journalctl -F "${COMP_WORDS[COMP_CWORD-2]}" 2>/dev/null)
                 COMPREPLY=( $(compgen -W '${field_vals[*]}' -- "$cur") )
         else
+                mapfile -t field_vals < <(journalctl --fields 2>/dev/null)
                 compopt -o nospace
-                COMPREPLY=( $(compgen -W '${__journal_fields[*]}' -S= -- "$cur") )
+                COMPREPLY=( $(compgen -W '${field_vals[*]}' -S= -- "$cur") )
         fi
 }
 
diff --git a/src/grp-journal/journalctl/journalctl.xml b/src/grp-journal/journalctl/journalctl.xml
index 3efe6ef62a..e77621d7b3 100644
--- a/src/grp-journal/journalctl/journalctl.xml
+++ b/src/grp-journal/journalctl/journalctl.xml
@@ -87,18 +87,26 @@
       causes all matches before and after to be combined in a
       disjunction (i.e. logical OR).</para>
 
-      <para>As shortcuts for a few types of field/value matches, file
-      paths may be specified. If a file path refers to an executable
-      file, this is equivalent to an <literal>_EXE=</literal> match
-      for the canonicalized binary path. Similarly, if a path refers
-      to a device node then match is added for the kernel name of the
-      device (<literal>_KERNEL_DEVICE=</literal>). Also, matches for the
-      kernel names of all the parent devices are added automatically.
-      Device node paths are not stable across reboots, therefore match
-      for the current boot id (<literal>_BOOT_ID=</literal>) is
-      always added as well. Note that only the log entries for
-      the existing device nodes maybe queried by providing path to
-      the device node.</para>
+      <para>It is also possible to filter the entries by specifying an
+      absolute file path as an argument. The file path may be a file or
+      a symbolic link and the file must exist at the time of the query. If a
+      file path refers to an executable binary, an <literal>_EXE=</literal>
+      match for the canonicalized binary path is added to the query. If a
+      file path refers to an executable script, a <literal>_COMM=</literal>
+      match for the script name is added to the query. If a file path
+      refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
+      the kernel name of the device and for each of its ancestor devices is
+      added to the query. Symbolic links are dereferenced, kernel names are
+      synthesized, and parent devices are identified from the environment at
+      the time of the query. In general, a device node is the best proxy for
+      an actual device, as log entries do not usually contain fields that
+      identify an actual device. For the resulting log entries to be correct
+      for the actual device, the relevant parts of the environment at the time
+      the entry was logged, in particular the actual device corresponding to
+      the device node, must have been the same as those at the time of the
+      query. Because device nodes generally change their corresponding devices
+      across reboots, specifying a device node path causes the resulting
+      entries to be restricted to those from the current boot.</para>
 
       <para>Additional constraints may be added using options
       <option>--boot</option>, <option>--unit=</option>, etc., to
@@ -824,7 +832,7 @@
         flushed from <filename>/run/log/journal</filename> into
         <filename>/var/log/journal</filename> once during system
         runtime, and this command exits cleanly without executing any
-        operation if this has already has happened. This command
+        operation if this has already happened. This command
         effectively guarantees that all data is flushed to
         <filename>/var/log/journal</filename> at the time it
         returns.</para></listitem>
diff --git a/src/grp-journal/libjournal-core/Makefile b/src/grp-journal/libjournal-core/Makefile
index 997fcf0468..330620bbd9 100644
--- a/src/grp-journal/libjournal-core/Makefile
+++ b/src/grp-journal/libjournal-core/Makefile
@@ -48,7 +48,7 @@ nodist_libjournal_core_la_SOURCES = \
 	src/journal/journald-gperf.c
 
 libjournal_core_la_LIBADD = \
-	libshared.la
+	libsystemd-shared.la
 
 noinst_LTLIBRARIES += \
 	libjournal-core.la
diff --git a/src/grp-journal/libjournal-core/journald-server.c b/src/grp-journal/libjournal-core/journald-server.c
index 8bc2e55709..c314b74ac2 100644
--- a/src/grp-journal/libjournal-core/journald-server.c
+++ b/src/grp-journal/libjournal-core/journald-server.c
@@ -729,7 +729,7 @@ static void dispatch_message_real(
                                 *((char*) mempcpy(stpcpy(x, "_SELINUX_CONTEXT="), label, label_len)) = 0;
                                 IOVEC_SET_STRING(iovec[n++], x);
                         } else {
-                                security_context_t con;
+                                char *con;
 
                                 if (getpidcon(ucred->pid, &con) >= 0) {
                                         x = strjoina("_SELINUX_CONTEXT=", con);
@@ -879,7 +879,7 @@ void server_driver_message(Server *s, sd_id128_t message_id, const char *format,
         assert_cc(6 == LOG_INFO);
         IOVEC_SET_STRING(iovec[n++], "PRIORITY=6");
 
-        if (!sd_id128_equal(message_id, SD_ID128_NULL)) {
+        if (!sd_id128_is_null(message_id)) {
                 snprintf(mid, sizeof(mid), LOG_MESSAGE_ID(message_id));
                 IOVEC_SET_STRING(iovec[n++], mid);
         }
@@ -1609,7 +1609,7 @@ static int dispatch_notify_event(sd_event_source *es, int fd, uint32_t revents,
                 /* Dispatch one stream notification event */
                 stdout_stream_send_notify(s->stdout_streams_notify_queue);
 
-        /* Leave us enabled if there's still more to to do. */
+        /* Leave us enabled if there's still more to do. */
         if (s->send_watchdog || s->stdout_streams_notify_queue)
                 return 0;
 
diff --git a/src/grp-journal/libjournal-core/journald-stream.h b/src/grp-journal/libjournal-core/journald-stream.h
index c971d0a00d..fe88cc34f5 100644
--- a/src/grp-journal/libjournal-core/journald-stream.h
+++ b/src/grp-journal/libjournal-core/journald-stream.h
@@ -19,7 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include "basic/fdset.h"
+#include "shared/fdset.h"
 
 typedef struct StdoutStream StdoutStream;
 
diff --git a/src/grp-journal/systemd-journald/Makefile b/src/grp-journal/systemd-journald/Makefile
index 62f19aa1b8..4f05218d88 100644
--- a/src/grp-journal/systemd-journald/Makefile
+++ b/src/grp-journal/systemd-journald/Makefile
@@ -29,7 +29,7 @@ systemd_journald_SOURCES = \
 
 systemd_journald_LDADD = \
 	libjournal-core.la \
-	libshared.la
+	libsystemd-shared.la
 
 rootlibexec_PROGRAMS += \
 	systemd-journald
@@ -45,8 +45,7 @@ nodist_systemunit_DATA += \
 dist_pkgsysconf_DATA += \
 	src/journal/journald.conf
 
-# TODO
-_dist_catalog_DATA = \
+nodist_catalog_DATA = \
 	catalog/systemd.bg.catalog \
 	catalog/systemd.be.catalog \
 	catalog/systemd.be@latin.catalog \
@@ -59,6 +58,16 @@ _dist_catalog_DATA = \
 	catalog/systemd.zh_TW.catalog \
 	catalog/systemd.catalog
 
+EXTRA_DIST += \
+	$(nodist_catalog_DATA:.catalog=.catalog.in)
+
+# Note that we don't use @@ for replacement markers here, but %%. This is
+# because the catalog uses @@ already for its runtime replacement handling and
+# we don't want to conflict with that.
+$(outdir)/%.catalog: catalog/%.catalog.in
+	$(AM_V_GEN)$(MKDIR_P) $(dir $@) && \
+	$(SED) -e 's~%SUPPORT_URL%~$(SUPPORT_URL)~' < $< > $@
+
 SOCKETS_TARGET_WANTS += \
 	systemd-journald.socket \
 	systemd-journald-dev-log.socket \
diff --git a/src/grp-journal/systemd-journald/journald.conf.xml b/src/grp-journal/systemd-journald/journald.conf.xml
index 3964cd6bc5..fef4fde898 100644
--- a/src/grp-journal/systemd-journald/journald.conf.xml
+++ b/src/grp-journal/systemd-journald/journald.conf.xml
@@ -129,21 +129,22 @@
       <varlistentry>
         <term><varname>SplitMode=</varname></term>
 
-        <listitem><para>Controls whether to split up journal files per
-        user. One of <literal>uid</literal>, <literal>login</literal>
-        and <literal>none</literal>. If <literal>uid</literal>, all
-        users will get each their own journal files regardless of
-        whether they possess a login session or not, however system
-        users will log into the system journal. If
-        <literal>login</literal>, actually logged-in users will get
-        each their own journal files, but users without login session
-        and system users will log into the system journal. If
-        <literal>none</literal>, journal files are not split up by
-        user and all messages are instead stored in the single system
-        journal. Note that splitting up journal files by user is only
-        available for journals stored persistently. If journals are
-        stored on volatile storage (see above), only a single journal
-        file for all user IDs is kept. Defaults to
+        <listitem><para>Controls whether to split up journal files per user. Split-up journal files are primarily
+        useful for access control: on UNIX/Linux access control is managed per file, and the journal daemon will assign
+        users read access to their journal files. This setting takes one of <literal>uid</literal>,
+        <literal>login</literal> or <literal>none</literal>. If <literal>uid</literal>, all regular users will get each
+        their own journal files regardless of whether their processes possess login sessions or not, however system
+        users will log into the system journal. If <literal>login</literal>, actually logged-in users will get each
+        their own journal files, but users without login session and system users will log into the system
+        journal. Note that in this mode, user code running outside of any login session will log into the system log
+        instead of the split-out user logs. Most importantly, this means that information about core dumps of user
+        processes collected via the
+        <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry> subsystem
+        will end up in the system logs instead of the user logs, and thus not be accessible to the owning users. If
+        <literal>none</literal>, journal files are not split up by user and all messages are instead stored in the
+        single system journal. In this mode unprivileged users generally do not have access to their own log data. Note
+        that splitting up journal files by user is only available for journals stored persistently. If journals are
+        stored on volatile storage (see above), only a single journal file for all user IDs is kept. Defaults to
         <literal>uid</literal>.</para></listitem>
       </varlistentry>
 
diff --git a/src/grp-journal/systemd-journald/systemd-journald.service.in b/src/grp-journal/systemd-journald/systemd-journald.service.in
index 41bfde5be3..08ace8ae44 100644
--- a/src/grp-journal/systemd-journald/systemd-journald.service.in
+++ b/src/grp-journal/systemd-journald/systemd-journald.service.in
@@ -24,6 +24,8 @@ StandardOutput=null
 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
 WatchdogSec=3min
 FileDescriptorStoreMax=1024
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
 
 # Increase the default a bit in order to allow many simultaneous
 # services being run since we keep one fd open per service. Also, when
diff --git a/src/grp-locale/localectl/Makefile b/src/grp-locale/localectl/Makefile
index d0023df124..9e0e927650 100644
--- a/src/grp-locale/localectl/Makefile
+++ b/src/grp-locale/localectl/Makefile
@@ -29,7 +29,7 @@ localectl_SOURCES = \
 	src/locale/localectl.c
 
 localectl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 bin_PROGRAMS += \
 	localectl
diff --git a/src/grp-locale/localectl/localectl.c b/src/grp-locale/localectl/localectl.c
index 72ac1c0303..b33ebc1640 100644
--- a/src/grp-locale/localectl/localectl.c
+++ b/src/grp-locale/localectl/localectl.c
@@ -656,7 +656,7 @@ static int localectl_main(sd_bus *bus, int argc, char *argv[]) {
 }
 
 int main(int argc, char*argv[]) {
-        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
+        sd_bus *bus = NULL;
         int r;
 
         setlocale(LC_ALL, "");
@@ -676,6 +676,7 @@ int main(int argc, char*argv[]) {
         r = localectl_main(bus, argc, argv);
 
 finish:
+        sd_bus_flush_close_unref(bus);
         pager_close();
 
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
diff --git a/src/grp-locale/localectl/localectl.completion.zsh b/src/grp-locale/localectl/localectl.completion.zsh
index d8af4d1863..54c2d456e4 100644
--- a/src/grp-locale/localectl/localectl.completion.zsh
+++ b/src/grp-locale/localectl/localectl.completion.zsh
@@ -36,8 +36,8 @@ _localectl_set-x11-keymap() {
         local _xorg_lst
         _xorg_lst=${"$($commands[pkg-config] xkeyboard-config --variable=xkb_base)"}
         _file=( ${(ps:\n\!:)"$(<$_xorg_lst/rules/xorg.lst)"} )
-        _layout=( ${${${(M)${(f)_file[1]}:#  *}#  }%% *} )
-        _model=( ${${${(M)${(f)_file[2]}:#  *}#  }%% *} )
+        _layout=( ${${${(M)${(f)_file[2]}:#  *}#  }%% *} )
+        _model=( ${${${(M)${(f)_file[1]}:#  *}#  }%% *} )
         _variant=( ${${${(M)${(f)_file[3]}:#  *}#  }%% *} )
         _options=( ${${${(M)${(f)_file[4]}:#  *}#  }%% *} )
         #_layout=( ${(f)"$( echo $_file[1] | awk '/^  / {print $1}' )"} )
diff --git a/src/grp-locale/localectl/localectl.xml b/src/grp-locale/localectl/localectl.xml
index 7def047f62..8d2becb5d9 100644
--- a/src/grp-locale/localectl/localectl.xml
+++ b/src/grp-locale/localectl/localectl.xml
@@ -60,7 +60,10 @@
     <title>Description</title>
 
     <para><command>localectl</command> may be used to query and change
-    the system locale and keyboard layout settings.</para>
+    the system locale and keyboard layout settings. It communicates with
+    <citerefentry><refentrytitle>systemd-localed</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    to modify files such as <filename>/etc/locale.conf</filename> and
+    <filename>/etc/vconsole.conf</filename>.</para>
 
     <para>The system locale controls the language settings of system
     services and of the UI before the user logs in, such as the
@@ -72,9 +75,14 @@
     such as the display manager, as well as the default for users
     after login.</para>
 
-    <para>Use
+    <para>Note that the changes performed using this tool might require
+    the initramfs to be rebuilt to take effect during early system boot.
+    The initramfs is not rebuilt automatically by <filename>localectl</filename>.
+    </para>
+
+    <para>Note that
     <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
-    to initialize the system locale for mounted (but not booted)
+    may be used to initialize the system locale for mounted (but not booted)
     system images.</para>
   </refsect1>
 
@@ -214,7 +222,8 @@
       </ulink>,
       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>systemd-localed.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>mkinitrd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
     </para>
   </refsect1>
 
diff --git a/src/grp-locale/systemd-localed/Makefile b/src/grp-locale/systemd-localed/Makefile
index de38bb8576..e353bad200 100644
--- a/src/grp-locale/systemd-localed/Makefile
+++ b/src/grp-locale/systemd-localed/Makefile
@@ -25,10 +25,12 @@ include $(topsrcdir)/build-aux/Makefile.head.mk
 
 ifneq ($(ENABLE_LOCALED),)
 systemd_localed_SOURCES = \
-	src/locale/localed.c
+	src/locale/localed.c \
+	src/locale/keymap-util.c \
+	src/locale/keymap-util.h
 
 systemd_localed_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	-ldl
 
 systemd_localed_CFLAGS = \
@@ -63,6 +65,18 @@ dist_pkgdata_DATA = \
 	src/locale/kbd-model-map \
 	src/locale/language-fallback-map
 
+test_keymap_util_SOURCES = \
+	src/locale/test-keymap-util.c \
+	src/locale/keymap-util.c \
+	src/locale/keymap-util.h
+
+test_keymap_util_LDADD = \
+	libsystemd-shared.la \
+	-ldl
+
+tests += \
+	test-keymap-util
+
 endif # ENABLE_LOCALED
 
 .PHONY: update-kbd-model-map
diff --git a/src/grp-locale/systemd-localed/keymap-util.c b/src/grp-locale/systemd-localed/keymap-util.c
new file mode 100644
index 0000000000..1a99cef5e5
--- /dev/null
+++ b/src/grp-locale/systemd-localed/keymap-util.c
@@ -0,0 +1,725 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2011 Lennart Poettering
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "basic/def.h"
+#include "basic/env-util.h"
+#include "basic/fd-util.h"
+#include "basic/fileio-label.h"
+#include "basic/fileio.h"
+#include "basic/locale-util.h"
+#include "basic/macro.h"
+#include "basic/mkdir.h"
+#include "basic/string-util.h"
+#include "basic/strv.h"
+
+#include "keymap-util.h"
+
+static bool startswith_comma(const char *s, const char *prefix) {
+        s = startswith(s, prefix);
+        if (!s)
+                return false;
+
+        return *s == ',' || *s == '\0';
+}
+
+static const char* strnulldash(const char *s) {
+        return isempty(s) || streq(s, "-") ? NULL : s;
+}
+
+static const char* systemd_kbd_model_map(void) {
+        const char* s;
+
+        s = getenv("SYSTEMD_KBD_MODEL_MAP");
+        if (s)
+                return s;
+
+        return SYSTEMD_KBD_MODEL_MAP;
+}
+
+static const char* systemd_language_fallback_map(void) {
+        const char* s;
+
+        s = getenv("SYSTEMD_LANGUAGE_FALLBACK_MAP");
+        if (s)
+                return s;
+
+        return SYSTEMD_LANGUAGE_FALLBACK_MAP;
+}
+
+static void context_free_x11(Context *c) {
+        c->x11_layout = mfree(c->x11_layout);
+        c->x11_options = mfree(c->x11_options);
+        c->x11_model = mfree(c->x11_model);
+        c->x11_variant = mfree(c->x11_variant);
+}
+
+static void context_free_vconsole(Context *c) {
+        c->vc_keymap = mfree(c->vc_keymap);
+        c->vc_keymap_toggle = mfree(c->vc_keymap_toggle);
+}
+
+static void context_free_locale(Context *c) {
+        int p;
+
+        for (p = 0; p < _VARIABLE_LC_MAX; p++)
+                c->locale[p] = mfree(c->locale[p]);
+}
+
+void context_free(Context *c) {
+        context_free_locale(c);
+        context_free_x11(c);
+        context_free_vconsole(c);
+};
+
+void locale_simplify(Context *c) {
+        int p;
+
+        for (p = VARIABLE_LANG+1; p < _VARIABLE_LC_MAX; p++)
+                if (isempty(c->locale[p]) || streq_ptr(c->locale[VARIABLE_LANG], c->locale[p]))
+                        c->locale[p] = mfree(c->locale[p]);
+}
+
+static int locale_read_data(Context *c) {
+        int r;
+
+        context_free_locale(c);
+
+        r = parse_env_file("/etc/locale.conf", NEWLINE,
+                           "LANG",              &c->locale[VARIABLE_LANG],
+                           "LANGUAGE",          &c->locale[VARIABLE_LANGUAGE],
+                           "LC_CTYPE",          &c->locale[VARIABLE_LC_CTYPE],
+                           "LC_NUMERIC",        &c->locale[VARIABLE_LC_NUMERIC],
+                           "LC_TIME",           &c->locale[VARIABLE_LC_TIME],
+                           "LC_COLLATE",        &c->locale[VARIABLE_LC_COLLATE],
+                           "LC_MONETARY",       &c->locale[VARIABLE_LC_MONETARY],
+                           "LC_MESSAGES",       &c->locale[VARIABLE_LC_MESSAGES],
+                           "LC_PAPER",          &c->locale[VARIABLE_LC_PAPER],
+                           "LC_NAME",           &c->locale[VARIABLE_LC_NAME],
+                           "LC_ADDRESS",        &c->locale[VARIABLE_LC_ADDRESS],
+                           "LC_TELEPHONE",      &c->locale[VARIABLE_LC_TELEPHONE],
+                           "LC_MEASUREMENT",    &c->locale[VARIABLE_LC_MEASUREMENT],
+                           "LC_IDENTIFICATION", &c->locale[VARIABLE_LC_IDENTIFICATION],
+                           NULL);
+
+        if (r == -ENOENT) {
+                int p;
+
+                /* Fill in what we got passed from systemd. */
+                for (p = 0; p < _VARIABLE_LC_MAX; p++) {
+                        const char *name;
+
+                        name = locale_variable_to_string(p);
+                        assert(name);
+
+                        r = free_and_strdup(&c->locale[p], empty_to_null(getenv(name)));
+                        if (r < 0)
+                                return r;
+                }
+
+                r = 0;
+        }
+
+        locale_simplify(c);
+        return r;
+}
+
+static int vconsole_read_data(Context *c) {
+        int r;
+
+        context_free_vconsole(c);
+
+        r = parse_env_file("/etc/vconsole.conf", NEWLINE,
+                           "KEYMAP",        &c->vc_keymap,
+                           "KEYMAP_TOGGLE", &c->vc_keymap_toggle,
+                           NULL);
+
+        if (r < 0 && r != -ENOENT)
+                return r;
+
+        return 0;
+}
+
+static int x11_read_data(Context *c) {
+        _cleanup_fclose_ FILE *f;
+        char line[LINE_MAX];
+        bool in_section = false;
+        int r;
+
+        context_free_x11(c);
+
+        f = fopen("/etc/X11/xorg.conf.d/00-keyboard.conf", "re");
+        if (!f)
+                return errno == ENOENT ? 0 : -errno;
+
+        while (fgets(line, sizeof(line), f)) {
+                char *l;
+
+                char_array_0(line);
+                l = strstrip(line);
+
+                if (l[0] == 0 || l[0] == '#')
+                        continue;
+
+                if (in_section && first_word(l, "Option")) {
+                        _cleanup_strv_free_ char **a = NULL;
+
+                        r = strv_split_extract(&a, l, WHITESPACE, EXTRACT_QUOTES);
+                        if (r < 0)
+                                return r;
+
+                        if (strv_length(a) == 3) {
+                                char **p = NULL;
+
+                                if (streq(a[1], "XkbLayout"))
+                                        p = &c->x11_layout;
+                                else if (streq(a[1], "XkbModel"))
+                                        p = &c->x11_model;
+                                else if (streq(a[1], "XkbVariant"))
+                                        p = &c->x11_variant;
+                                else if (streq(a[1], "XkbOptions"))
+                                        p = &c->x11_options;
+
+                                if (p) {
+                                        free(*p);
+                                        *p = a[2];
+                                        a[2] = NULL;
+                                }
+                        }
+
+                } else if (!in_section && first_word(l, "Section")) {
+                        _cleanup_strv_free_ char **a = NULL;
+
+                        r = strv_split_extract(&a, l, WHITESPACE, EXTRACT_QUOTES);
+                        if (r < 0)
+                                return -ENOMEM;
+
+                        if (strv_length(a) == 2 && streq(a[1], "InputClass"))
+                                in_section = true;
+
+                } else if (in_section && first_word(l, "EndSection"))
+                        in_section = false;
+        }
+
+        return 0;
+}
+
+int context_read_data(Context *c) {
+        int r, q, p;
+
+        r = locale_read_data(c);
+        q = vconsole_read_data(c);
+        p = x11_read_data(c);
+
+        return r < 0 ? r : q < 0 ? q : p;
+}
+
+int locale_write_data(Context *c, char ***settings) {
+        int r, p;
+        _cleanup_strv_free_ char **l = NULL;
+
+        /* Set values will be returned as strv in *settings on success. */
+
+        r = load_env_file(NULL, "/etc/locale.conf", NULL, &l);
+        if (r < 0 && r != -ENOENT)
+                return r;
+
+        for (p = 0; p < _VARIABLE_LC_MAX; p++) {
+                _cleanup_free_ char *t = NULL;
+                char **u;
+                const char *name;
+
+                name = locale_variable_to_string(p);
+                assert(name);
+
+                if (isempty(c->locale[p])) {
+                        l = strv_env_unset(l, name);
+                        continue;
+                }
+
+                if (asprintf(&t, "%s=%s", name, c->locale[p]) < 0)
+                        return -ENOMEM;
+
+                u = strv_env_set(l, t);
+                if (!u)
+                        return -ENOMEM;
+
+                strv_free(l);
+                l = u;
+        }
+
+        if (strv_isempty(l)) {
+                if (unlink("/etc/locale.conf") < 0)
+                        return errno == ENOENT ? 0 : -errno;
+
+                return 0;
+        }
+
+        r = write_env_file_label("/etc/locale.conf", l);
+        if (r < 0)
+                return r;
+
+        *settings = l;
+        l = NULL;
+        return 0;
+}
+
+int vconsole_write_data(Context *c) {
+        int r;
+        _cleanup_strv_free_ char **l = NULL;
+
+        r = load_env_file(NULL, "/etc/vconsole.conf", NULL, &l);
+        if (r < 0 && r != -ENOENT)
+                return r;
+
+        if (isempty(c->vc_keymap))
+                l = strv_env_unset(l, "KEYMAP");
+        else {
+                _cleanup_free_ char *s = NULL;
+                char **u;
+
+                s = strappend("KEYMAP=", c->vc_keymap);
+                if (!s)
+                        return -ENOMEM;
+
+                u = strv_env_set(l, s);
+                if (!u)
+                        return -ENOMEM;
+
+                strv_free(l);
+                l = u;
+        }
+
+        if (isempty(c->vc_keymap_toggle))
+                l = strv_env_unset(l, "KEYMAP_TOGGLE");
+        else  {
+                _cleanup_free_ char *s = NULL;
+                char **u;
+
+                s = strappend("KEYMAP_TOGGLE=", c->vc_keymap_toggle);
+                if (!s)
+                        return -ENOMEM;
+
+                u = strv_env_set(l, s);
+                if (!u)
+                        return -ENOMEM;
+
+                strv_free(l);
+                l = u;
+        }
+
+        if (strv_isempty(l)) {
+                if (unlink("/etc/vconsole.conf") < 0)
+                        return errno == ENOENT ? 0 : -errno;
+
+                return 0;
+        }
+
+        return write_env_file_label("/etc/vconsole.conf", l);
+}
+
+int x11_write_data(Context *c) {
+        _cleanup_fclose_ FILE *f = NULL;
+        _cleanup_free_ char *temp_path = NULL;
+        int r;
+
+        if (isempty(c->x11_layout) &&
+            isempty(c->x11_model) &&
+            isempty(c->x11_variant) &&
+            isempty(c->x11_options)) {
+
+                if (unlink("/etc/X11/xorg.conf.d/00-keyboard.conf") < 0)
+                        return errno == ENOENT ? 0 : -errno;
+
+                return 0;
+        }
+
+        mkdir_p_label("/etc/X11/xorg.conf.d", 0755);
+
+        r = fopen_temporary("/etc/X11/xorg.conf.d/00-keyboard.conf", &f, &temp_path);
+        if (r < 0)
+                return r;
+
+        fchmod(fileno(f), 0644);
+
+        fputs("# Read and parsed by systemd-localed. It's probably wise not to edit this file\n"
+              "# manually too freely.\n"
+              "Section \"InputClass\"\n"
+              "        Identifier \"system-keyboard\"\n"
+              "        MatchIsKeyboard \"on\"\n", f);
+
+        if (!isempty(c->x11_layout))
+                fprintf(f, "        Option \"XkbLayout\" \"%s\"\n", c->x11_layout);
+
+        if (!isempty(c->x11_model))
+                fprintf(f, "        Option \"XkbModel\" \"%s\"\n", c->x11_model);
+
+        if (!isempty(c->x11_variant))
+                fprintf(f, "        Option \"XkbVariant\" \"%s\"\n", c->x11_variant);
+
+        if (!isempty(c->x11_options))
+                fprintf(f, "        Option \"XkbOptions\" \"%s\"\n", c->x11_options);
+
+        fputs("EndSection\n", f);
+
+        r = fflush_and_check(f);
+        if (r < 0)
+                goto fail;
+
+        if (rename(temp_path, "/etc/X11/xorg.conf.d/00-keyboard.conf") < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        return 0;
+
+fail:
+        (void) unlink("/etc/X11/xorg.conf.d/00-keyboard.conf");
+
+        if (temp_path)
+                (void) unlink(temp_path);
+
+        return r;
+}
+
+static int read_next_mapping(const char* filename,
+                             unsigned min_fields, unsigned max_fields,
+                             FILE *f, unsigned *n, char ***a) {
+        assert(f);
+        assert(n);
+        assert(a);
+
+        for (;;) {
+                char line[LINE_MAX];
+                char *l, **b;
+                int r;
+                size_t length;
+
+                errno = 0;
+                if (!fgets(line, sizeof(line), f)) {
+
+                        if (ferror(f))
+                                return errno > 0 ? -errno : -EIO;
+
+                        return 0;
+                }
+
+                (*n)++;
+
+                l = strstrip(line);
+                if (l[0] == 0 || l[0] == '#')
+                        continue;
+
+                r = strv_split_extract(&b, l, WHITESPACE, EXTRACT_QUOTES);
+                if (r < 0)
+                        return r;
+
+                length = strv_length(b);
+                if (length < min_fields || length > max_fields) {
+                        log_error("Invalid line %s:%u, ignoring.", filename, *n);
+                        strv_free(b);
+                        continue;
+
+                }
+
+                *a = b;
+                return 1;
+        }
+}
+
+int vconsole_convert_to_x11(Context *c) {
+        const char *map;
+        int modified = -1;
+
+        map = systemd_kbd_model_map();
+
+        if (isempty(c->vc_keymap)) {
+                modified =
+                        !isempty(c->x11_layout) ||
+                        !isempty(c->x11_model) ||
+                        !isempty(c->x11_variant) ||
+                        !isempty(c->x11_options);
+
+                context_free_x11(c);
+        } else {
+                _cleanup_fclose_ FILE *f = NULL;
+                unsigned n = 0;
+
+                f = fopen(map, "re");
+                if (!f)
+                        return -errno;
+
+                for (;;) {
+                        _cleanup_strv_free_ char **a = NULL;
+                        int r;
+
+                        r = read_next_mapping(map, 5, UINT_MAX, f, &n, &a);
+                        if (r < 0)
+                                return r;
+                        if (r == 0)
+                                break;
+
+                        if (!streq(c->vc_keymap, a[0]))
+                                continue;
+
+                        if (!streq_ptr(c->x11_layout, strnulldash(a[1])) ||
+                            !streq_ptr(c->x11_model, strnulldash(a[2])) ||
+                            !streq_ptr(c->x11_variant, strnulldash(a[3])) ||
+                            !streq_ptr(c->x11_options, strnulldash(a[4]))) {
+
+                                if (free_and_strdup(&c->x11_layout, strnulldash(a[1])) < 0 ||
+                                    free_and_strdup(&c->x11_model, strnulldash(a[2])) < 0 ||
+                                    free_and_strdup(&c->x11_variant, strnulldash(a[3])) < 0 ||
+                                    free_and_strdup(&c->x11_options, strnulldash(a[4])) < 0)
+                                        return -ENOMEM;
+
+                                modified = true;
+                        }
+
+                        break;
+                }
+        }
+
+        if (modified > 0)
+                log_info("Changing X11 keyboard layout to '%s' model '%s' variant '%s' options '%s'",
+                         strempty(c->x11_layout),
+                         strempty(c->x11_model),
+                         strempty(c->x11_variant),
+                         strempty(c->x11_options));
+        else if (modified < 0)
+                log_notice("X11 keyboard layout was not modified: no conversion found for \"%s\".",
+                           c->vc_keymap);
+        else
+                log_debug("X11 keyboard layout did not need to be modified.");
+
+        return modified > 0;
+}
+
+int find_converted_keymap(const char *x11_layout, const char *x11_variant, char **new_keymap) {
+        const char *dir;
+        _cleanup_free_ char *n;
+
+        if (x11_variant)
+                n = strjoin(x11_layout, "-", x11_variant, NULL);
+        else
+                n = strdup(x11_layout);
+        if (!n)
+                return -ENOMEM;
+
+        NULSTR_FOREACH(dir, KBD_KEYMAP_DIRS) {
+                _cleanup_free_ char *p = NULL, *pz = NULL;
+                bool uncompressed;
+
+                p = strjoin(dir, "xkb/", n, ".map", NULL);
+                pz = strjoin(dir, "xkb/", n, ".map.gz", NULL);
+                if (!p || !pz)
+                        return -ENOMEM;
+
+                uncompressed = access(p, F_OK) == 0;
+                if (uncompressed || access(pz, F_OK) == 0) {
+                        log_debug("Found converted keymap %s at %s",
+                                  n, uncompressed ? p : pz);
+
+                        *new_keymap = n;
+                        n = NULL;
+                        return 1;
+                }
+        }
+
+        return 0;
+}
+
+int find_legacy_keymap(Context *c, char **new_keymap) {
+        const char *map;
+        _cleanup_fclose_ FILE *f = NULL;
+        unsigned n = 0;
+        unsigned best_matching = 0;
+        int r;
+
+        assert(!isempty(c->x11_layout));
+
+        map = systemd_kbd_model_map();
+
+        f = fopen(map, "re");
+        if (!f)
+                return -errno;
+
+        for (;;) {
+                _cleanup_strv_free_ char **a = NULL;
+                unsigned matching = 0;
+
+                r = read_next_mapping(map, 5, UINT_MAX, f, &n, &a);
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        break;
+
+                /* Determine how well matching this entry is */
+                if (streq(c->x11_layout, a[1]))
+                        /* If we got an exact match, this is best */
+                        matching = 10;
+                else {
+                        /* We have multiple X layouts, look for an
+                         * entry that matches our key with everything
+                         * but the first layout stripped off. */
+                        if (startswith_comma(c->x11_layout, a[1]))
+                                matching = 5;
+                        else  {
+                                char *x;
+
+                                /* If that didn't work, strip off the
+                                 * other layouts from the entry, too */
+                                x = strndupa(a[1], strcspn(a[1], ","));
+                                if (startswith_comma(c->x11_layout, x))
+                                        matching = 1;
+                        }
+                }
+
+                if (matching > 0) {
+                        if (isempty(c->x11_model) || streq_ptr(c->x11_model, a[2])) {
+                                matching++;
+
+                                if (streq_ptr(c->x11_variant, a[3])) {
+                                        matching++;
+
+                                        if (streq_ptr(c->x11_options, a[4]))
+                                                matching++;
+                                }
+                        }
+                }
+
+                /* The best matching entry so far, then let's save that */
+                if (matching >= MAX(best_matching, 1u)) {
+                        log_debug("Found legacy keymap %s with score %u",
+                                  a[0], matching);
+
+                        if (matching > best_matching) {
+                                best_matching = matching;
+
+                                r = free_and_strdup(new_keymap, a[0]);
+                                if (r < 0)
+                                        return r;
+                        }
+                }
+        }
+
+        if (best_matching < 10 && c->x11_layout) {
+                /* The best match is only the first part of the X11
+                 * keymap. Check if we have a converted map which
+                 * matches just the first layout.
+                 */
+                char *l, *v = NULL, *converted;
+
+                l = strndupa(c->x11_layout, strcspn(c->x11_layout, ","));
+                if (c->x11_variant)
+                        v = strndupa(c->x11_variant, strcspn(c->x11_variant, ","));
+                r = find_converted_keymap(l, v, &converted);
+                if (r < 0)
+                        return r;
+                if (r > 0) {
+                        free(*new_keymap);
+                        *new_keymap = converted;
+                }
+        }
+
+        return (bool) *new_keymap;
+}
+
+int find_language_fallback(const char *lang, char **language) {
+        const char *map;
+        _cleanup_fclose_ FILE *f = NULL;
+        unsigned n = 0;
+
+        assert(lang);
+        assert(language);
+
+        map = systemd_language_fallback_map();
+
+        f = fopen(map, "re");
+        if (!f)
+                return -errno;
+
+        for (;;) {
+                _cleanup_strv_free_ char **a = NULL;
+                int r;
+
+                r = read_next_mapping(map, 2, 2, f, &n, &a);
+                if (r <= 0)
+                        return r;
+
+                if (streq(lang, a[0])) {
+                        assert(strv_length(a) == 2);
+                        *language = a[1];
+                        a[1] = NULL;
+                        return 1;
+                }
+        }
+
+        assert_not_reached("should not be here");
+}
+
+int x11_convert_to_vconsole(Context *c) {
+        bool modified = false;
+
+        if (isempty(c->x11_layout)) {
+                modified =
+                        !isempty(c->vc_keymap) ||
+                        !isempty(c->vc_keymap_toggle);
+
+                context_free_vconsole(c);
+        } else {
+                char *new_keymap = NULL;
+                int r;
+
+                r = find_converted_keymap(c->x11_layout, c->x11_variant, &new_keymap);
+                if (r < 0)
+                        return r;
+                else if (r == 0) {
+                        r = find_legacy_keymap(c, &new_keymap);
+                        if (r < 0)
+                                return r;
+                }
+                if (r == 0)
+                        /* We search for layout-variant match first, but then we also look
+                         * for anything which matches just the layout. So it's accurate to say
+                         * that we couldn't find anything which matches the layout. */
+                        log_notice("No conversion to virtual console map found for \"%s\".",
+                                   c->x11_layout);
+
+                if (!streq_ptr(c->vc_keymap, new_keymap)) {
+                        free(c->vc_keymap);
+                        c->vc_keymap = new_keymap;
+                        c->vc_keymap_toggle = mfree(c->vc_keymap_toggle);
+                        modified = true;
+                } else
+                        free(new_keymap);
+        }
+
+        if (modified)
+                log_info("Changing virtual console keymap to '%s' toggle '%s'",
+                         strempty(c->vc_keymap), strempty(c->vc_keymap_toggle));
+        else
+                log_debug("Virtual console keymap was not modified.");
+
+        return modified;
+}
diff --git a/src/grp-locale/systemd-localed/keymap-util.h b/src/grp-locale/systemd-localed/keymap-util.h
new file mode 100644
index 0000000000..58b6ec4d8f
--- /dev/null
+++ b/src/grp-locale/systemd-localed/keymap-util.h
@@ -0,0 +1,46 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2011 Lennart Poettering
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "basic/locale-util.h"
+
+typedef struct Context {
+        char *locale[_VARIABLE_LC_MAX];
+
+        char *x11_layout;
+        char *x11_model;
+        char *x11_variant;
+        char *x11_options;
+
+        char *vc_keymap;
+        char *vc_keymap_toggle;
+} Context;
+
+int find_converted_keymap(const char *x11_layout, const char *x11_variant, char **new_keymap);
+int find_legacy_keymap(Context *c, char **new_keymap);
+int find_language_fallback(const char *lang, char **language);
+
+int context_read_data(Context *c);
+void context_free(Context *c);
+int vconsole_convert_to_x11(Context *c);
+int vconsole_write_data(Context *c);
+int x11_convert_to_vconsole(Context *c);
+int x11_write_data(Context *c);
+void locale_simplify(Context *c);
+int locale_write_data(Context *c, char ***settings);
diff --git a/src/grp-locale/systemd-localed/localed.c b/src/grp-locale/systemd-localed/localed.c
index a876cd0718..55fadd78df 100644
--- a/src/grp-locale/systemd-localed/localed.c
+++ b/src/grp-locale/systemd-localed/localed.c
@@ -31,296 +31,20 @@
 
 #include "basic/alloc-util.h"
 #include "basic/def.h"
-#include "basic/env-util.h"
-#include "basic/fd-util.h"
-#include "basic/fileio-label.h"
-#include "basic/fileio.h"
 #include "basic/locale-util.h"
-#include "basic/mkdir.h"
+#include "basic/macro.h"
 #include "basic/path-util.h"
 #include "basic/selinux-util.h"
+#include "basic/string-util.h"
 #include "basic/strv.h"
 #include "basic/user-util.h"
-#include "basic/util.h"
 #include "sd-bus/bus-error.h"
 #include "sd-bus/bus-message.h"
 #include "shared/bus-util.h"
 
-enum {
-        /* We don't list LC_ALL here on purpose. People should be
-         * using LANG instead. */
-        LOCALE_LANG,
-        LOCALE_LANGUAGE,
-        LOCALE_LC_CTYPE,
-        LOCALE_LC_NUMERIC,
-        LOCALE_LC_TIME,
-        LOCALE_LC_COLLATE,
-        LOCALE_LC_MONETARY,
-        LOCALE_LC_MESSAGES,
-        LOCALE_LC_PAPER,
-        LOCALE_LC_NAME,
-        LOCALE_LC_ADDRESS,
-        LOCALE_LC_TELEPHONE,
-        LOCALE_LC_MEASUREMENT,
-        LOCALE_LC_IDENTIFICATION,
-        _LOCALE_MAX
-};
-
-static const char * const names[_LOCALE_MAX] = {
-        [LOCALE_LANG] = "LANG",
-        [LOCALE_LANGUAGE] = "LANGUAGE",
-        [LOCALE_LC_CTYPE] = "LC_CTYPE",
-        [LOCALE_LC_NUMERIC] = "LC_NUMERIC",
-        [LOCALE_LC_TIME] = "LC_TIME",
-        [LOCALE_LC_COLLATE] = "LC_COLLATE",
-        [LOCALE_LC_MONETARY] = "LC_MONETARY",
-        [LOCALE_LC_MESSAGES] = "LC_MESSAGES",
-        [LOCALE_LC_PAPER] = "LC_PAPER",
-        [LOCALE_LC_NAME] = "LC_NAME",
-        [LOCALE_LC_ADDRESS] = "LC_ADDRESS",
-        [LOCALE_LC_TELEPHONE] = "LC_TELEPHONE",
-        [LOCALE_LC_MEASUREMENT] = "LC_MEASUREMENT",
-        [LOCALE_LC_IDENTIFICATION] = "LC_IDENTIFICATION"
-};
-
-typedef struct Context {
-        char *locale[_LOCALE_MAX];
-
-        char *x11_layout;
-        char *x11_model;
-        char *x11_variant;
-        char *x11_options;
-
-        char *vc_keymap;
-        char *vc_keymap_toggle;
-
-        Hashmap *polkit_registry;
-} Context;
-
-static const char* nonempty(const char *s) {
-        return isempty(s) ? NULL : s;
-}
-
-static bool startswith_comma(const char *s, const char *prefix) {
-        const char *t;
-
-        return s && (t = startswith(s, prefix)) && (*t == ',');
-}
-
-static void context_free_x11(Context *c) {
-        c->x11_layout = mfree(c->x11_layout);
-        c->x11_options = mfree(c->x11_options);
-        c->x11_model = mfree(c->x11_model);
-        c->x11_variant = mfree(c->x11_variant);
-}
-
-static void context_free_vconsole(Context *c) {
-        c->vc_keymap = mfree(c->vc_keymap);
-        c->vc_keymap_toggle = mfree(c->vc_keymap_toggle);
-}
-
-static void context_free_locale(Context *c) {
-        int p;
-
-        for (p = 0; p < _LOCALE_MAX; p++)
-                c->locale[p] = mfree(c->locale[p]);
-}
-
-static void context_free(Context *c) {
-        context_free_locale(c);
-        context_free_x11(c);
-        context_free_vconsole(c);
-
-        bus_verify_polkit_async_registry_free(c->polkit_registry);
-};
-
-static void locale_simplify(Context *c) {
-        int p;
-
-        for (p = LOCALE_LANG+1; p < _LOCALE_MAX; p++)
-                if (isempty(c->locale[p]) || streq_ptr(c->locale[LOCALE_LANG], c->locale[p]))
-                        c->locale[p] = mfree(c->locale[p]);
-}
-
-static int locale_read_data(Context *c) {
-        int r;
-
-        context_free_locale(c);
-
-        r = parse_env_file("/etc/locale.conf", NEWLINE,
-                           "LANG",              &c->locale[LOCALE_LANG],
-                           "LANGUAGE",          &c->locale[LOCALE_LANGUAGE],
-                           "LC_CTYPE",          &c->locale[LOCALE_LC_CTYPE],
-                           "LC_NUMERIC",        &c->locale[LOCALE_LC_NUMERIC],
-                           "LC_TIME",           &c->locale[LOCALE_LC_TIME],
-                           "LC_COLLATE",        &c->locale[LOCALE_LC_COLLATE],
-                           "LC_MONETARY",       &c->locale[LOCALE_LC_MONETARY],
-                           "LC_MESSAGES",       &c->locale[LOCALE_LC_MESSAGES],
-                           "LC_PAPER",          &c->locale[LOCALE_LC_PAPER],
-                           "LC_NAME",           &c->locale[LOCALE_LC_NAME],
-                           "LC_ADDRESS",        &c->locale[LOCALE_LC_ADDRESS],
-                           "LC_TELEPHONE",      &c->locale[LOCALE_LC_TELEPHONE],
-                           "LC_MEASUREMENT",    &c->locale[LOCALE_LC_MEASUREMENT],
-                           "LC_IDENTIFICATION", &c->locale[LOCALE_LC_IDENTIFICATION],
-                           NULL);
-
-        if (r == -ENOENT) {
-                int p;
-
-                /* Fill in what we got passed from systemd. */
-                for (p = 0; p < _LOCALE_MAX; p++) {
-                        assert(names[p]);
-
-                        r = free_and_strdup(&c->locale[p],
-                                            nonempty(getenv(names[p])));
-                        if (r < 0)
-                                return r;
-                }
-
-                r = 0;
-        }
-
-        locale_simplify(c);
-        return r;
-}
-
-static int vconsole_read_data(Context *c) {
-        int r;
-
-        context_free_vconsole(c);
-
-        r = parse_env_file("/etc/vconsole.conf", NEWLINE,
-                           "KEYMAP",        &c->vc_keymap,
-                           "KEYMAP_TOGGLE", &c->vc_keymap_toggle,
-                           NULL);
-
-        if (r < 0 && r != -ENOENT)
-                return r;
-
-        return 0;
-}
-
-static int x11_read_data(Context *c) {
-        _cleanup_fclose_ FILE *f;
-        char line[LINE_MAX];
-        bool in_section = false;
-        int r;
-
-        context_free_x11(c);
-
-        f = fopen("/etc/X11/xorg.conf.d/00-keyboard.conf", "re");
-        if (!f)
-                return errno == ENOENT ? 0 : -errno;
-
-        while (fgets(line, sizeof(line), f)) {
-                char *l;
-
-                char_array_0(line);
-                l = strstrip(line);
-
-                if (l[0] == 0 || l[0] == '#')
-                        continue;
-
-                if (in_section && first_word(l, "Option")) {
-                        _cleanup_strv_free_ char **a = NULL;
-
-                        r = strv_split_extract(&a, l, WHITESPACE, EXTRACT_QUOTES);
-                        if (r < 0)
-                                return r;
-
-                        if (strv_length(a) == 3) {
-                                char **p = NULL;
-
-                                if (streq(a[1], "XkbLayout"))
-                                        p = &c->x11_layout;
-                                else if (streq(a[1], "XkbModel"))
-                                        p = &c->x11_model;
-                                else if (streq(a[1], "XkbVariant"))
-                                        p = &c->x11_variant;
-                                else if (streq(a[1], "XkbOptions"))
-                                        p = &c->x11_options;
-
-                                if (p) {
-                                        free(*p);
-                                        *p = a[2];
-                                        a[2] = NULL;
-                                }
-                        }
-
-                } else if (!in_section && first_word(l, "Section")) {
-                        _cleanup_strv_free_ char **a = NULL;
-
-                        r = strv_split_extract(&a, l, WHITESPACE, EXTRACT_QUOTES);
-                        if (r < 0)
-                                return -ENOMEM;
-
-                        if (strv_length(a) == 2 && streq(a[1], "InputClass"))
-                                in_section = true;
-
-                } else if (in_section && first_word(l, "EndSection"))
-                        in_section = false;
-        }
-
-        return 0;
-}
-
-static int context_read_data(Context *c) {
-        int r, q, p;
-
-        r = locale_read_data(c);
-        q = vconsole_read_data(c);
-        p = x11_read_data(c);
-
-        return r < 0 ? r : q < 0 ? q : p;
-}
-
-static int locale_write_data(Context *c, char ***settings) {
-        int r, p;
-        _cleanup_strv_free_ char **l = NULL;
+#include "keymap-util.h"
 
-        /* Set values will be returned as strv in *settings on success. */
-
-        r = load_env_file(NULL, "/etc/locale.conf", NULL, &l);
-        if (r < 0 && r != -ENOENT)
-                return r;
-
-        for (p = 0; p < _LOCALE_MAX; p++) {
-                _cleanup_free_ char *t = NULL;
-                char **u;
-
-                assert(names[p]);
-
-                if (isempty(c->locale[p])) {
-                        l = strv_env_unset(l, names[p]);
-                        continue;
-                }
-
-                if (asprintf(&t, "%s=%s", names[p], c->locale[p]) < 0)
-                        return -ENOMEM;
-
-                u = strv_env_set(l, t);
-                if (!u)
-                        return -ENOMEM;
-
-                strv_free(l);
-                l = u;
-        }
-
-        if (strv_isempty(l)) {
-                if (unlink("/etc/locale.conf") < 0)
-                        return errno == ENOENT ? 0 : -errno;
-
-                return 0;
-        }
-
-        r = write_env_file_label("/etc/locale.conf", l);
-        if (r < 0)
-                return r;
-
-        *settings = l;
-        l = NULL;
-        return 0;
-}
+static Hashmap *polkit_registry = NULL;
 
 static int locale_update_system_manager(Context *c, sd_bus *bus) {
         _cleanup_free_ char **l_unset = NULL;
@@ -332,30 +56,33 @@ static int locale_update_system_manager(Context *c, sd_bus *bus) {
 
         assert(bus);
 
-        l_unset = new0(char*, _LOCALE_MAX);
+        l_unset = new0(char*, _VARIABLE_LC_MAX);
         if (!l_unset)
                 return -ENOMEM;
 
-        l_set = new0(char*, _LOCALE_MAX);
+        l_set = new0(char*, _VARIABLE_LC_MAX);
         if (!l_set)
                 return -ENOMEM;
 
-        for (p = 0, c_set = 0, c_unset = 0; p < _LOCALE_MAX; p++) {
-                assert(names[p]);
+        for (p = 0, c_set = 0, c_unset = 0; p < _VARIABLE_LC_MAX; p++) {
+                const char *name;
+
+                name = locale_variable_to_string(p);
+                assert(name);
 
                 if (isempty(c->locale[p]))
-                        l_unset[c_set++] = (char*) names[p];
+                        l_unset[c_set++] = (char*) name;
                 else {
                         char *s;
 
-                        if (asprintf(&s, "%s=%s", names[p], c->locale[p]) < 0)
+                        if (asprintf(&s, "%s=%s", name, c->locale[p]) < 0)
                                 return -ENOMEM;
 
                         l_set[c_unset++] = s;
                 }
         }
 
-        assert(c_set + c_unset == _LOCALE_MAX);
+        assert(c_set + c_unset == _VARIABLE_LC_MAX);
         r = sd_bus_message_new_method_call(bus, &m,
                         "org.freedesktop.systemd1",
                         "/org/freedesktop/systemd1",
@@ -379,124 +106,6 @@ static int locale_update_system_manager(Context *c, sd_bus *bus) {
         return 0;
 }
 
-static int vconsole_write_data(Context *c) {
-        int r;
-        _cleanup_strv_free_ char **l = NULL;
-
-        r = load_env_file(NULL, "/etc/vconsole.conf", NULL, &l);
-        if (r < 0 && r != -ENOENT)
-                return r;
-
-        if (isempty(c->vc_keymap))
-                l = strv_env_unset(l, "KEYMAP");
-        else {
-                _cleanup_free_ char *s = NULL;
-                char **u;
-
-                s = strappend("KEYMAP=", c->vc_keymap);
-                if (!s)
-                        return -ENOMEM;
-
-                u = strv_env_set(l, s);
-                if (!u)
-                        return -ENOMEM;
-
-                strv_free(l);
-                l = u;
-        }
-
-        if (isempty(c->vc_keymap_toggle))
-                l = strv_env_unset(l, "KEYMAP_TOGGLE");
-        else  {
-                _cleanup_free_ char *s = NULL;
-                char **u;
-
-                s = strappend("KEYMAP_TOGGLE=", c->vc_keymap_toggle);
-                if (!s)
-                        return -ENOMEM;
-
-                u = strv_env_set(l, s);
-                if (!u)
-                        return -ENOMEM;
-
-                strv_free(l);
-                l = u;
-        }
-
-        if (strv_isempty(l)) {
-                if (unlink("/etc/vconsole.conf") < 0)
-                        return errno == ENOENT ? 0 : -errno;
-
-                return 0;
-        }
-
-        return write_env_file_label("/etc/vconsole.conf", l);
-}
-
-static int x11_write_data(Context *c) {
-        _cleanup_fclose_ FILE *f = NULL;
-        _cleanup_free_ char *temp_path = NULL;
-        int r;
-
-        if (isempty(c->x11_layout) &&
-            isempty(c->x11_model) &&
-            isempty(c->x11_variant) &&
-            isempty(c->x11_options)) {
-
-                if (unlink("/etc/X11/xorg.conf.d/00-keyboard.conf") < 0)
-                        return errno == ENOENT ? 0 : -errno;
-
-                return 0;
-        }
-
-        mkdir_p_label("/etc/X11/xorg.conf.d", 0755);
-
-        r = fopen_temporary("/etc/X11/xorg.conf.d/00-keyboard.conf", &f, &temp_path);
-        if (r < 0)
-                return r;
-
-        fchmod(fileno(f), 0644);
-
-        fputs("# Read and parsed by systemd-localed. It's probably wise not to edit this file\n"
-              "# manually too freely.\n"
-              "Section \"InputClass\"\n"
-              "        Identifier \"system-keyboard\"\n"
-              "        MatchIsKeyboard \"on\"\n", f);
-
-        if (!isempty(c->x11_layout))
-                fprintf(f, "        Option \"XkbLayout\" \"%s\"\n", c->x11_layout);
-
-        if (!isempty(c->x11_model))
-                fprintf(f, "        Option \"XkbModel\" \"%s\"\n", c->x11_model);
-
-        if (!isempty(c->x11_variant))
-                fprintf(f, "        Option \"XkbVariant\" \"%s\"\n", c->x11_variant);
-
-        if (!isempty(c->x11_options))
-                fprintf(f, "        Option \"XkbOptions\" \"%s\"\n", c->x11_options);
-
-        fputs("EndSection\n", f);
-
-        r = fflush_and_check(f);
-        if (r < 0)
-                goto fail;
-
-        if (rename(temp_path, "/etc/X11/xorg.conf.d/00-keyboard.conf") < 0) {
-                r = -errno;
-                goto fail;
-        }
-
-        return 0;
-
-fail:
-        (void) unlink("/etc/X11/xorg.conf.d/00-keyboard.conf");
-
-        if (temp_path)
-                (void) unlink(temp_path);
-
-        return r;
-}
-
 static int vconsole_reload(sd_bus *bus) {
         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
         int r;
@@ -517,337 +126,48 @@ static int vconsole_reload(sd_bus *bus) {
         return r;
 }
 
-static const char* strnulldash(const char *s) {
-        return isempty(s) || streq(s, "-") ? NULL : s;
-}
-
-static int read_next_mapping(const char* filename,
-                             unsigned min_fields, unsigned max_fields,
-                             FILE *f, unsigned *n, char ***a) {
-        assert(f);
-        assert(n);
-        assert(a);
-
-        for (;;) {
-                char line[LINE_MAX];
-                char *l, **b;
-                int r;
-                size_t length;
-
-                errno = 0;
-                if (!fgets(line, sizeof(line), f)) {
-
-                        if (ferror(f))
-                                return errno > 0 ? -errno : -EIO;
-
-                        return 0;
-                }
-
-                (*n)++;
-
-                l = strstrip(line);
-                if (l[0] == 0 || l[0] == '#')
-                        continue;
-
-                r = strv_split_extract(&b, l, WHITESPACE, EXTRACT_QUOTES);
-                if (r < 0)
-                        return r;
-
-                length = strv_length(b);
-                if (length < min_fields || length > max_fields) {
-                        log_error("Invalid line %s:%u, ignoring.", filename, *n);
-                        strv_free(b);
-                        continue;
-
-                }
-
-                *a = b;
-                return 1;
-        }
-}
-
-static int vconsole_convert_to_x11(Context *c, sd_bus *bus) {
-        bool modified = false;
-
-        assert(bus);
-
-        if (isempty(c->vc_keymap)) {
-
-                modified =
-                        !isempty(c->x11_layout) ||
-                        !isempty(c->x11_model) ||
-                        !isempty(c->x11_variant) ||
-                        !isempty(c->x11_options);
-
-                context_free_x11(c);
-        } else {
-                _cleanup_fclose_ FILE *f = NULL;
-                unsigned n = 0;
-
-                f = fopen(SYSTEMD_KBD_MODEL_MAP, "re");
-                if (!f)
-                        return -errno;
-
-                for (;;) {
-                        _cleanup_strv_free_ char **a = NULL;
-                        int r;
-
-                        r = read_next_mapping(SYSTEMD_KBD_MODEL_MAP, 5, UINT_MAX, f, &n, &a);
-                        if (r < 0)
-                                return r;
-                        if (r == 0)
-                                break;
-
-                        if (!streq(c->vc_keymap, a[0]))
-                                continue;
-
-                        if (!streq_ptr(c->x11_layout, strnulldash(a[1])) ||
-                            !streq_ptr(c->x11_model, strnulldash(a[2])) ||
-                            !streq_ptr(c->x11_variant, strnulldash(a[3])) ||
-                            !streq_ptr(c->x11_options, strnulldash(a[4]))) {
-
-                                if (free_and_strdup(&c->x11_layout, strnulldash(a[1])) < 0 ||
-                                    free_and_strdup(&c->x11_model, strnulldash(a[2])) < 0 ||
-                                    free_and_strdup(&c->x11_variant, strnulldash(a[3])) < 0 ||
-                                    free_and_strdup(&c->x11_options, strnulldash(a[4])) < 0)
-                                        return -ENOMEM;
-
-                                modified = true;
-                        }
-
-                        break;
-                }
-        }
-
-        if (modified) {
-                int r;
-
-                r = x11_write_data(c);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to set X11 keyboard layout: %m");
-
-                log_info("Changed X11 keyboard layout to '%s' model '%s' variant '%s' options '%s'",
-                         strempty(c->x11_layout),
-                         strempty(c->x11_model),
-                         strempty(c->x11_variant),
-                         strempty(c->x11_options));
-
-                sd_bus_emit_properties_changed(bus,
-                                "/org/freedesktop/locale1",
-                                "org.freedesktop.locale1",
-                                "X11Layout", "X11Model", "X11Variant", "X11Options", NULL);
-        } else
-                log_debug("X11 keyboard layout was not modified.");
-
-        return 0;
-}
-
-static int find_converted_keymap(const char *x11_layout, const char *x11_variant, char **new_keymap) {
-        const char *dir;
-        _cleanup_free_ char *n;
-
-        if (x11_variant)
-                n = strjoin(x11_layout, "-", x11_variant, NULL);
-        else
-                n = strdup(x11_layout);
-        if (!n)
-                return -ENOMEM;
-
-        NULSTR_FOREACH(dir, KBD_KEYMAP_DIRS) {
-                _cleanup_free_ char *p = NULL, *pz = NULL;
-                bool uncompressed;
-
-                p = strjoin(dir, "xkb/", n, ".map", NULL);
-                pz = strjoin(dir, "xkb/", n, ".map.gz", NULL);
-                if (!p || !pz)
-                        return -ENOMEM;
-
-                uncompressed = access(p, F_OK) == 0;
-                if (uncompressed || access(pz, F_OK) == 0) {
-                        log_debug("Found converted keymap %s at %s",
-                                  n, uncompressed ? p : pz);
-
-                        *new_keymap = n;
-                        n = NULL;
-                        return 1;
-                }
-        }
-
-        return 0;
-}
-
-static int find_legacy_keymap(Context *c, char **new_keymap) {
-        _cleanup_fclose_ FILE *f;
-        unsigned n = 0;
-        unsigned best_matching = 0;
+static int vconsole_convert_to_x11_and_emit(Context *c, sd_bus *bus) {
         int r;
 
-        f = fopen(SYSTEMD_KBD_MODEL_MAP, "re");
-        if (!f)
-                return -errno;
-
-        for (;;) {
-                _cleanup_strv_free_ char **a = NULL;
-                unsigned matching = 0;
-
-                r = read_next_mapping(SYSTEMD_KBD_MODEL_MAP, 5, UINT_MAX, f, &n, &a);
-                if (r < 0)
-                        return r;
-                if (r == 0)
-                        break;
-
-                /* Determine how well matching this entry is */
-                if (streq_ptr(c->x11_layout, a[1]))
-                        /* If we got an exact match, this is best */
-                        matching = 10;
-                else {
-                        /* We have multiple X layouts, look for an
-                         * entry that matches our key with everything
-                         * but the first layout stripped off. */
-                        if (startswith_comma(c->x11_layout, a[1]))
-                                matching = 5;
-                        else  {
-                                char *x;
-
-                                /* If that didn't work, strip off the
-                                 * other layouts from the entry, too */
-                                x = strndupa(a[1], strcspn(a[1], ","));
-                                if (startswith_comma(c->x11_layout, x))
-                                        matching = 1;
-                        }
-                }
-
-                if (matching > 0) {
-                        if (isempty(c->x11_model) || streq_ptr(c->x11_model, a[2])) {
-                                matching++;
-
-                                if (streq_ptr(c->x11_variant, a[3])) {
-                                        matching++;
-
-                                        if (streq_ptr(c->x11_options, a[4]))
-                                                matching++;
-                                }
-                        }
-                }
-
-                /* The best matching entry so far, then let's save that */
-                if (matching >= MAX(best_matching, 1u)) {
-                        log_debug("Found legacy keymap %s with score %u",
-                                  a[0], matching);
-
-                        if (matching > best_matching) {
-                                best_matching = matching;
-
-                                r = free_and_strdup(new_keymap, a[0]);
-                                if (r < 0)
-                                        return r;
-                        }
-                }
-        }
-
-        if (best_matching < 10 && c->x11_layout) {
-                /* The best match is only the first part of the X11
-                 * keymap. Check if we have a converted map which
-                 * matches just the first layout.
-                 */
-                char *l, *v = NULL, *converted;
-
-                l = strndupa(c->x11_layout, strcspn(c->x11_layout, ","));
-                if (c->x11_variant)
-                        v = strndupa(c->x11_variant, strcspn(c->x11_variant, ","));
-                r = find_converted_keymap(l, v, &converted);
-                if (r < 0)
-                        return r;
-                if (r > 0) {
-                        free(*new_keymap);
-                        *new_keymap = converted;
-                }
-        }
-
-        return 0;
-}
-
-static int find_language_fallback(const char *lang, char **language) {
-        _cleanup_fclose_ FILE *f = NULL;
-        unsigned n = 0;
-
-        assert(language);
-
-        f = fopen(SYSTEMD_LANGUAGE_FALLBACK_MAP, "re");
-        if (!f)
-                return -errno;
+        assert(bus);
 
-        for (;;) {
-                _cleanup_strv_free_ char **a = NULL;
-                int r;
+        r = vconsole_convert_to_x11(c);
+        if (r <= 0)
+                return r;
 
-                r = read_next_mapping(SYSTEMD_LANGUAGE_FALLBACK_MAP, 2, 2, f, &n, &a);
-                if (r <= 0)
-                        return r;
+        /* modified */
+        r = x11_write_data(c);
+        if (r < 0)
+                return log_error_errno(r, "Failed to write X11 keyboard layout: %m");
 
-                if (streq(lang, a[0])) {
-                        assert(strv_length(a) == 2);
-                        *language = a[1];
-                        a[1] = NULL;
-                        return 1;
-                }
-        }
+        sd_bus_emit_properties_changed(bus,
+                                       "/org/freedesktop/locale1",
+                                       "org.freedesktop.locale1",
+                                       "X11Layout", "X11Model", "X11Variant", "X11Options", NULL);
 
-        assert_not_reached("should not be here");
+        return 1;
 }
 
-static int x11_convert_to_vconsole(Context *c, sd_bus *bus) {
-        bool modified = false;
+static int x11_convert_to_vconsole_and_emit(Context *c, sd_bus *bus) {
         int r;
 
         assert(bus);
 
-        if (isempty(c->x11_layout)) {
-
-                modified =
-                        !isempty(c->vc_keymap) ||
-                        !isempty(c->vc_keymap_toggle);
-
-                context_free_x11(c);
-        } else {
-                char *new_keymap = NULL;
-
-                r = find_converted_keymap(c->x11_layout, c->x11_variant, &new_keymap);
-                if (r < 0)
-                        return r;
-                else if (r == 0) {
-                        r = find_legacy_keymap(c, &new_keymap);
-                        if (r < 0)
-                                return r;
-                }
-
-                if (!streq_ptr(c->vc_keymap, new_keymap)) {
-                        free(c->vc_keymap);
-                        c->vc_keymap = new_keymap;
-                        c->vc_keymap_toggle = mfree(c->vc_keymap_toggle);
-                        modified = true;
-                } else
-                        free(new_keymap);
-        }
-
-        if (modified) {
-                r = vconsole_write_data(c);
-                if (r < 0)
-                        log_error_errno(r, "Failed to set virtual console keymap: %m");
-
-                log_info("Changed virtual console keymap to '%s' toggle '%s'",
-                         strempty(c->vc_keymap), strempty(c->vc_keymap_toggle));
+        r = x11_convert_to_vconsole(c);
+        if (r <= 0)
+                return r;
 
-                sd_bus_emit_properties_changed(bus,
-                                "/org/freedesktop/locale1",
-                                "org.freedesktop.locale1",
-                                "VConsoleKeymap", "VConsoleKeymapToggle", NULL);
+        /* modified */
+        r = vconsole_write_data(c);
+        if (r < 0)
+                log_error_errno(r, "Failed to save virtual console keymap: %m");
 
-                return vconsole_reload(bus);
-        } else
-                log_debug("Virtual console keymap was not modified.");
+        sd_bus_emit_properties_changed(bus,
+                                       "/org/freedesktop/locale1",
+                                       "org.freedesktop.locale1",
+                                       "VConsoleKeymap", "VConsoleKeymapToggle", NULL);
 
-        return 0;
+        return vconsole_reload(bus);
 }
 
 static int property_get_locale(
@@ -863,17 +183,21 @@ static int property_get_locale(
         _cleanup_strv_free_ char **l = NULL;
         int p, q;
 
-        l = new0(char*, _LOCALE_MAX+1);
+        l = new0(char*, _VARIABLE_LC_MAX+1);
         if (!l)
                 return -ENOMEM;
 
-        for (p = 0, q = 0; p < _LOCALE_MAX; p++) {
+        for (p = 0, q = 0; p < _VARIABLE_LC_MAX; p++) {
                 char *t;
+                const char *name;
+
+                name = locale_variable_to_string(p);
+                assert(name);
 
                 if (isempty(c->locale[p]))
                         continue;
 
-                if (asprintf(&t, "%s=%s", names[p], c->locale[p]) < 0)
+                if (asprintf(&t, "%s=%s", name, c->locale[p]) < 0)
                         return -ENOMEM;
 
                 l[q++] = t;
@@ -889,7 +213,7 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
         const char *lang = NULL;
         int interactive;
         bool modified = false;
-        bool have[_LOCALE_MAX] = {};
+        bool have[_VARIABLE_LC_MAX] = {};
         int p;
         int r;
 
@@ -908,17 +232,21 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
         STRV_FOREACH(i, l) {
                 bool valid = false;
 
-                for (p = 0; p < _LOCALE_MAX; p++) {
+                for (p = 0; p < _VARIABLE_LC_MAX; p++) {
                         size_t k;
+                        const char *name;
 
-                        k = strlen(names[p]);
-                        if (startswith(*i, names[p]) &&
+                        name = locale_variable_to_string(p);
+                        assert(name);
+
+                        k = strlen(name);
+                        if (startswith(*i, name) &&
                             (*i)[k] == '=' &&
                             locale_is_valid((*i) + k + 1)) {
                                 valid = true;
                                 have[p] = true;
 
-                                if (p == LOCALE_LANG)
+                                if (p == VARIABLE_LANG)
                                         lang = (*i) + k + 1;
 
                                 if (!streq_ptr(*i + k + 1, c->locale[p]))
@@ -934,7 +262,7 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
 
         /* If LANG was specified, but not LANGUAGE, check if we should
          * set it based on the language fallback table. */
-        if (have[LOCALE_LANG] && !have[LOCALE_LANGUAGE]) {
+        if (have[VARIABLE_LANG] && !have[VARIABLE_LANGUAGE]) {
                 _cleanup_free_ char *language = NULL;
 
                 assert(lang);
@@ -942,12 +270,12 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
                 (void) find_language_fallback(lang, &language);
                 if (language) {
                         log_debug("Converted LANG=%s to LANGUAGE=%s", lang, language);
-                        if (!streq_ptr(language, c->locale[LOCALE_LANGUAGE])) {
+                        if (!streq_ptr(language, c->locale[VARIABLE_LANGUAGE])) {
                                 r = strv_extendf(&l, "LANGUAGE=%s", language);
                                 if (r < 0)
                                         return r;
 
-                                have[LOCALE_LANGUAGE] = true;
+                                have[VARIABLE_LANGUAGE] = true;
                                 modified = true;
                         }
                 }
@@ -955,7 +283,7 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
 
         /* Check whether a variable is unset */
         if (!modified)
-                for (p = 0; p < _LOCALE_MAX; p++)
+                for (p = 0; p < _VARIABLE_LC_MAX; p++)
                         if (!isempty(c->locale[p]) && !have[p]) {
                                 modified = true;
                                 break;
@@ -971,7 +299,7 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
                                 NULL,
                                 interactive,
                                 UID_INVALID,
-                                &c->polkit_registry,
+                                &polkit_registry,
                                 error);
                 if (r < 0)
                         return r;
@@ -979,11 +307,15 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
                         return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
                 STRV_FOREACH(i, l)
-                        for (p = 0; p < _LOCALE_MAX; p++) {
+                        for (p = 0; p < _VARIABLE_LC_MAX; p++) {
                                 size_t k;
+                                const char *name;
+
+                                name = locale_variable_to_string(p);
+                                assert(name);
 
-                                k = strlen(names[p]);
-                                if (startswith(*i, names[p]) && (*i)[k] == '=') {
+                                k = strlen(name);
+                                if (startswith(*i, name) && (*i)[k] == '=') {
                                         r = free_and_strdup(&c->locale[p], *i + k + 1);
                                         if (r < 0)
                                                 return r;
@@ -991,7 +323,7 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
                                 }
                         }
 
-                for (p = 0; p < _LOCALE_MAX; p++) {
+                for (p = 0; p < _VARIABLE_LC_MAX; p++) {
                         if (have[p])
                                 continue;
 
@@ -1041,11 +373,8 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
         if (r < 0)
                 return r;
 
-        if (isempty(keymap))
-                keymap = NULL;
-
-        if (isempty(keymap_toggle))
-                keymap_toggle = NULL;
+        keymap = empty_to_null(keymap);
+        keymap_toggle = empty_to_null(keymap_toggle);
 
         if (!streq_ptr(keymap, c->vc_keymap) ||
             !streq_ptr(keymap_toggle, c->vc_keymap_toggle)) {
@@ -1061,7 +390,7 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
                                 NULL,
                                 interactive,
                                 UID_INVALID,
-                                &c->polkit_registry,
+                                &polkit_registry,
                                 error);
                 if (r < 0)
                         return r;
@@ -1092,7 +421,7 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
                                 "VConsoleKeymap", "VConsoleKeymapToggle", NULL);
 
                 if (convert) {
-                        r = vconsole_convert_to_x11(c, sd_bus_message_get_bus(m));
+                        r = vconsole_convert_to_x11_and_emit(c, sd_bus_message_get_bus(m));
                         if (r < 0)
                                 log_error_errno(r, "Failed to convert keymap data: %m");
                 }
@@ -1214,17 +543,10 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
         if (r < 0)
                 return r;
 
-        if (isempty(layout))
-                layout = NULL;
-
-        if (isempty(model))
-                model = NULL;
-
-        if (isempty(variant))
-                variant = NULL;
-
-        if (isempty(options))
-                options = NULL;
+        layout = empty_to_null(layout);
+        model = empty_to_null(model);
+        variant = empty_to_null(variant);
+        options = empty_to_null(options);
 
         if (!streq_ptr(layout, c->x11_layout) ||
             !streq_ptr(model, c->x11_model) ||
@@ -1244,7 +566,7 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
                                 NULL,
                                 interactive,
                                 UID_INVALID,
-                                &c->polkit_registry,
+                                &polkit_registry,
                                 error);
                 if (r < 0)
                         return r;
@@ -1287,7 +609,7 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
                                 "X11Layout", "X11Model", "X11Variant", "X11Options", NULL);
 
                 if (convert) {
-                        r = x11_convert_to_vconsole(c, sd_bus_message_get_bus(m));
+                        r = x11_convert_to_vconsole_and_emit(c, sd_bus_message_get_bus(m));
                         if (r < 0)
                                 log_error_errno(r, "Failed to convert keymap data: %m");
                 }
@@ -1379,11 +701,11 @@ int main(int argc, char *argv[]) {
         }
 
         r = bus_event_loop_with_idle(event, bus, "org.freedesktop.locale1", DEFAULT_EXIT_USEC, NULL, NULL);
-        if (r < 0) {
+        if (r < 0)
                 log_error_errno(r, "Failed to run event loop: %m");
-                goto finish;
-        }
 
 finish:
+        bus_verify_polkit_async_registry_free(polkit_registry);
+
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
 }
diff --git a/src/grp-locale/systemd-localed/systemd-localed.service.in b/src/grp-locale/systemd-localed/systemd-localed.service.in
index 9b13f901a3..1f3151c2b5 100644
--- a/src/grp-locale/systemd-localed/systemd-localed.service.in
+++ b/src/grp-locale/systemd-localed/systemd-localed.service.in
@@ -20,3 +20,5 @@ PrivateDevices=yes
 PrivateNetwork=yes
 ProtectSystem=yes
 ProtectHome=yes
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
diff --git a/src/grp-locale/systemd-localed/test-keymap-util.c b/src/grp-locale/systemd-localed/test-keymap-util.c
new file mode 100644
index 0000000000..6c001b2f50
--- /dev/null
+++ b/src/grp-locale/systemd-localed/test-keymap-util.c
@@ -0,0 +1,221 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Zbigniew Jędrzejewski-Szmek
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "basic/alloc-util.h"
+#include "basic/log.h"
+#include "basic/string-util.h"
+
+#include "keymap-util.h"
+
+static void test_find_language_fallback(void) {
+        _cleanup_free_ char *ans = NULL, *ans2 = NULL;
+
+        log_info("/*** %s ***/", __func__);
+
+        assert_se(find_language_fallback("foobar", &ans) == 0);
+        assert_se(ans == NULL);
+
+        assert_se(find_language_fallback("csb", &ans) == 0);
+        assert_se(ans == NULL);
+
+        assert_se(find_language_fallback("csb_PL", &ans) == 1);
+        assert_se(streq(ans, "csb:pl"));
+
+        assert_se(find_language_fallback("szl_PL", &ans2) == 1);
+        assert_se(streq(ans2, "szl:pl"));
+}
+
+static void test_find_converted_keymap(void) {
+        _cleanup_free_ char *ans = NULL, *ans2 = NULL;
+        int r;
+
+        log_info("/*** %s ***/", __func__);
+
+        assert_se(find_converted_keymap("pl", "foobar", &ans) == 0);
+        assert_se(ans == NULL);
+
+        r = find_converted_keymap("pl", NULL, &ans);
+        if (r == 0) {
+                log_info("Skipping rest of %s: keymaps are not installed", __func__);
+                return;
+        }
+
+        assert_se(r == 1);
+        assert_se(streq(ans, "pl"));
+
+        assert_se(find_converted_keymap("pl", "dvorak", &ans2) == 1);
+        assert_se(streq(ans2, "pl-dvorak"));
+}
+
+static void test_find_legacy_keymap(void) {
+        Context c = {};
+        _cleanup_free_ char *ans = NULL, *ans2 = NULL;
+
+        log_info("/*** %s ***/", __func__);
+
+        c.x11_layout = (char*) "foobar";
+        assert_se(find_legacy_keymap(&c, &ans) == 0);
+        assert_se(ans == NULL);
+
+        c.x11_layout = (char*) "pl";
+        assert_se(find_legacy_keymap(&c, &ans) == 1);
+        assert_se(streq(ans, "pl2"));
+
+        c.x11_layout = (char*) "pl,ru";
+        assert_se(find_legacy_keymap(&c, &ans2) == 1);
+        assert_se(streq(ans, "pl2"));
+}
+
+static void test_vconsole_convert_to_x11(void) {
+        _cleanup_(context_free) Context c = {};
+
+        log_info("/*** %s ***/", __func__);
+
+        log_info("/* test emptying first (:) */");
+        assert_se(free_and_strdup(&c.x11_layout, "foo") >= 0);
+        assert_se(free_and_strdup(&c.x11_variant, "bar") >= 0);
+        assert_se(vconsole_convert_to_x11(&c) == 1);
+        assert_se(c.x11_layout == NULL);
+        assert_se(c.x11_variant == NULL);
+
+        log_info("/* test emptying second (:) */");
+
+        assert_se(vconsole_convert_to_x11(&c) == 0);
+        assert_se(c.x11_layout == NULL);
+        assert_se(c.x11_variant == NULL);
+
+        log_info("/* test without variant, new mapping (es:) */");
+        assert_se(free_and_strdup(&c.vc_keymap, "es") >= 0);
+
+        assert_se(vconsole_convert_to_x11(&c) == 1);
+        assert_se(streq(c.x11_layout, "es"));
+        assert_se(c.x11_variant == NULL);
+
+        log_info("/* test with known variant, new mapping (es:dvorak) */");
+        assert_se(free_and_strdup(&c.vc_keymap, "es-dvorak") >= 0);
+
+        assert_se(vconsole_convert_to_x11(&c) == 0); // FIXME
+        assert_se(streq(c.x11_layout, "es"));
+        assert_se(c.x11_variant == NULL); // FIXME: "dvorak"
+
+        log_info("/* test with old mapping (fr:latin9) */");
+        assert_se(free_and_strdup(&c.vc_keymap, "fr-latin9") >= 0);
+
+        assert_se(vconsole_convert_to_x11(&c) == 1);
+        assert_se(streq(c.x11_layout, "fr"));
+        assert_se(streq(c.x11_variant, "latin9"));
+
+        log_info("/* test with a compound mapping (ru,us) */");
+        assert_se(free_and_strdup(&c.vc_keymap, "ru") >= 0);
+
+        assert_se(vconsole_convert_to_x11(&c) == 1);
+        assert_se(streq(c.x11_layout, "ru,us"));
+        assert_se(c.x11_variant == NULL);
+
+        log_info("/* test with a simple mapping (us) */");
+        assert_se(free_and_strdup(&c.vc_keymap, "us") >= 0);
+
+        assert_se(vconsole_convert_to_x11(&c) == 1);
+        assert_se(streq(c.x11_layout, "us"));
+        assert_se(c.x11_variant == NULL);
+}
+
+static void test_x11_convert_to_vconsole(void) {
+        _cleanup_(context_free) Context c = {};
+        int r;
+
+        log_info("/*** %s ***/", __func__);
+
+        log_info("/* test emptying first (:) */");
+        assert_se(free_and_strdup(&c.vc_keymap, "foobar") >= 0);
+        assert_se(x11_convert_to_vconsole(&c) == 1);
+        assert_se(c.vc_keymap == NULL);
+
+        log_info("/* test emptying second (:) */");
+
+        assert_se(x11_convert_to_vconsole(&c) == 0);
+        assert_se(c.vc_keymap == NULL);
+
+        log_info("/* test without variant, new mapping (es:) */");
+        assert_se(free_and_strdup(&c.x11_layout, "es") >= 0);
+
+        assert_se(x11_convert_to_vconsole(&c) == 1);
+        assert_se(streq(c.vc_keymap, "es"));
+
+        log_info("/* test with unknown variant, new mapping (es:foobar) */");
+        assert_se(free_and_strdup(&c.x11_variant, "foobar") >= 0);
+
+        assert_se(x11_convert_to_vconsole(&c) == 0);
+        assert_se(streq(c.vc_keymap, "es"));
+
+        log_info("/* test with known variant, new mapping (es:dvorak) */");
+        assert_se(free_and_strdup(&c.x11_variant, "dvorak") >= 0);
+
+        r = x11_convert_to_vconsole(&c);
+        if (r == 0) {
+                log_info("Skipping rest of %s: keymaps are not installed", __func__);
+                return;
+        }
+
+        assert_se(r == 1);
+        assert_se(streq(c.vc_keymap, "es-dvorak"));
+
+        log_info("/* test with old mapping (fr:latin9) */");
+        assert_se(free_and_strdup(&c.x11_layout, "fr") >= 0);
+        assert_se(free_and_strdup(&c.x11_variant, "latin9") >= 0);
+
+        assert_se(x11_convert_to_vconsole(&c) == 1);
+        assert_se(streq(c.vc_keymap, "fr-latin9"));
+
+        log_info("/* test with a compound mapping (us,ru:) */");
+        assert_se(free_and_strdup(&c.x11_layout, "us,ru") >= 0);
+        assert_se(free_and_strdup(&c.x11_variant, NULL) >= 0);
+
+        assert_se(x11_convert_to_vconsole(&c) == 1);
+        assert_se(streq(c.vc_keymap, "us"));
+
+        log_info("/* test with a compound mapping (ru,us:) */");
+        assert_se(free_and_strdup(&c.x11_layout, "ru,us") >= 0);
+        assert_se(free_and_strdup(&c.x11_variant, NULL) >= 0);
+
+        assert_se(x11_convert_to_vconsole(&c) == 1);
+        assert_se(streq(c.vc_keymap, "ru"));
+
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1333998 */
+        log_info("/* test with a simple new mapping (ru:) */");
+        assert_se(free_and_strdup(&c.x11_layout, "ru") >= 0);
+        assert_se(free_and_strdup(&c.x11_variant, NULL) >= 0);
+
+        assert_se(x11_convert_to_vconsole(&c) == 0);
+        assert_se(streq(c.vc_keymap, "ru"));
+}
+
+int main(int argc, char **argv) {
+        log_set_max_level(LOG_DEBUG);
+        log_parse_environment();
+
+        test_find_language_fallback();
+        test_find_converted_keymap();
+        test_find_legacy_keymap();
+
+        test_vconsole_convert_to_x11();
+        test_x11_convert_to_vconsole();
+
+        return 0;
+}
diff --git a/src/grp-login/Makefile b/src/grp-login/Makefile
index fe0bab0f81..48a15db591 100644
--- a/src/grp-login/Makefile
+++ b/src/grp-login/Makefile
@@ -27,19 +27,19 @@ test_login_SOURCES = \
 	src/libsystemd/sd-login/test-login.c
 
 test_login_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_login_shared_SOURCES = \
 	src/login/test-login-shared.c
 
 test_login_shared_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_inhibit_SOURCES = \
 	src/login/test-inhibit.c
 
 test_inhibit_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_login_tables_SOURCES = \
 	src/login/test-login-tables.c
diff --git a/src/grp-login/loginctl/Makefile b/src/grp-login/loginctl/Makefile
index d2c6eebd27..f1a474e1cc 100644
--- a/src/grp-login/loginctl/Makefile
+++ b/src/grp-login/loginctl/Makefile
@@ -29,7 +29,7 @@ loginctl_SOURCES = \
 	src/login/sysfs-show.c
 
 loginctl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootbin_PROGRAMS += \
 	loginctl
diff --git a/src/grp-login/loginctl/loginctl.c b/src/grp-login/loginctl/loginctl.c
index 3ac325fc97..469bec582f 100644
--- a/src/grp-login/loginctl/loginctl.c
+++ b/src/grp-login/loginctl/loginctl.c
@@ -291,7 +291,7 @@ typedef struct SessionStatusInfo {
         char *seat;
         char *tty;
         char *display;
-        bool remote;
+        int remote;
         char *remote_host;
         char *remote_user;
         char *service;
@@ -305,7 +305,7 @@ typedef struct SessionStatusInfo {
 
 typedef struct UserStatusInfo {
         uid_t uid;
-        bool linger;
+        int linger;
         char *name;
         struct dual_timestamp timestamp;
         char *state;
@@ -1555,7 +1555,7 @@ static int loginctl_main(int argc, char *argv[], sd_bus *bus) {
 }
 
 int main(int argc, char *argv[]) {
-        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
+        sd_bus *bus = NULL;
         int r;
 
         setlocale(LC_ALL, "");
@@ -1577,6 +1577,8 @@ int main(int argc, char *argv[]) {
         r = loginctl_main(argc, argv, bus);
 
 finish:
+        sd_bus_flush_close_unref(bus);
+
         pager_close();
         polkit_agent_close();
 
diff --git a/src/grp-login/pam_systemd/pam_systemd.c b/src/grp-login/pam_systemd/pam_systemd.c
index 6f67506e5a..11f527cda0 100644
--- a/src/grp-login/pam_systemd/pam_systemd.c
+++ b/src/grp-login/pam_systemd/pam_systemd.c
@@ -182,25 +182,20 @@ static int export_legacy_dbus_address(
         _cleanup_free_ char *s = NULL;
         int r = PAM_BUF_ERR;
 
-        if (is_kdbus_available()) {
-                if (asprintf(&s, KERNEL_USER_BUS_ADDRESS_FMT ";" UNIX_USER_BUS_ADDRESS_FMT, uid, runtime) < 0)
-                        goto error;
-        } else {
-                /* FIXME: We *really* should move the access() check into the
-                 * daemons that spawn dbus-daemon, instead of forcing
-                 * DBUS_SESSION_BUS_ADDRESS= here. */
-
-                s = strjoin(runtime, "/bus", NULL);
-                if (!s)
-                        goto error;
-
-                if (access(s, F_OK) < 0)
-                        return PAM_SUCCESS;
+        /* FIXME: We *really* should move the access() check into the
+         * daemons that spawn dbus-daemon, instead of forcing
+         * DBUS_SESSION_BUS_ADDRESS= here. */
 
-                s = mfree(s);
-                if (asprintf(&s, UNIX_USER_BUS_ADDRESS_FMT, runtime) < 0)
-                        goto error;
-        }
+        s = strjoin(runtime, "/bus", NULL);
+        if (!s)
+                goto error;
+
+        if (access(s, F_OK) < 0)
+                return PAM_SUCCESS;
+
+        s = mfree(s);
+        if (asprintf(&s, UNIX_USER_BUS_ADDRESS_FMT, runtime) < 0)
+                goto error;
 
         r = pam_misc_setenv(handle, "DBUS_SESSION_BUS_ADDRESS", s, 0);
         if (r != PAM_SUCCESS)
diff --git a/src/grp-login/systemd-inhibit/Makefile b/src/grp-login/systemd-inhibit/Makefile
index 93440da575..8b3b7995d9 100644
--- a/src/grp-login/systemd-inhibit/Makefile
+++ b/src/grp-login/systemd-inhibit/Makefile
@@ -29,7 +29,7 @@ systemd_inhibit_SOURCES = \
 	src/login/inhibit.c
 
 systemd_inhibit_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootbin_PROGRAMS += \
 	systemd-inhibit
diff --git a/src/grp-login/systemd-logind/Makefile b/src/grp-login/systemd-logind/Makefile
index 3c9a0a05ef..ed2db4e038 100644
--- a/src/grp-login/systemd-logind/Makefile
+++ b/src/grp-login/systemd-logind/Makefile
@@ -59,6 +59,9 @@ _liblogind_core_la_SOURCES = \
 	src/login/logind-utmp.c \
 	src/login/logind-acl.h
 
+liblogind_core_la_LIBADD = \
+	libsystemd-shared.la
+
 ifneq ($(HAVE_ACL),)
 _liblogind_core_la_SOURCES += \
 	src/login/logind-acl.c
diff --git a/src/grp-login/systemd-logind/logind-action.c b/src/grp-login/systemd-logind/logind-action.c
index 0cfeab3fdb..a7c88e7e65 100644
--- a/src/grp-login/systemd-logind/logind-action.c
+++ b/src/grp-login/systemd-logind/logind-action.c
@@ -86,7 +86,7 @@ int manager_handle_action(
         }
 
         /* If the key handling is inhibited, don't do anything */
-        if (inhibit_key > 0) {
+        if (!ignore_inhibited && inhibit_key > 0) {
                 if (manager_is_inhibited(m, inhibit_key, INHIBIT_BLOCK, NULL, true, false, 0, NULL)) {
                         log_debug("Refusing operation, %s is inhibited.", inhibit_what_to_string(inhibit_key));
                         return 0;
@@ -125,7 +125,7 @@ int manager_handle_action(
                 return -EALREADY;
         }
 
-        inhibit_operation = handle == HANDLE_SUSPEND || handle == HANDLE_HIBERNATE || handle == HANDLE_HYBRID_SLEEP ? INHIBIT_SLEEP : INHIBIT_SHUTDOWN;
+        inhibit_operation = IN_SET(handle, HANDLE_SUSPEND, HANDLE_HIBERNATE, HANDLE_HYBRID_SLEEP) ? INHIBIT_SLEEP : INHIBIT_SHUTDOWN;
 
         /* If the actual operation is inhibited, warn and fail */
         if (!ignore_inhibited &&
diff --git a/src/grp-login/systemd-logind/logind-core.c b/src/grp-login/systemd-logind/logind-core.c
index 13ea97ae0d..b2ae7c2e1a 100644
--- a/src/grp-login/systemd-logind/logind-core.c
+++ b/src/grp-login/systemd-logind/logind-core.c
@@ -498,7 +498,7 @@ static int manager_count_external_displays(Manager *m) {
                         continue;
 
                 /* Ignore internal displays: the type is encoded in
-                 * the sysfs name, as the second dash seperated item
+                 * the sysfs name, as the second dash separated item
                  * (the first is the card name, the last the connector
                  * number). We implement a whitelist of external
                  * displays here, rather than a whitelist, to ensure
diff --git a/src/grp-login/systemd-logind/logind-gperf.gperf b/src/grp-login/systemd-logind/logind-gperf.gperf
index d578234e53..1a39c3bf96 100644
--- a/src/grp-login/systemd-logind/logind-gperf.gperf
+++ b/src/grp-login/systemd-logind/logind-gperf.gperf
@@ -38,4 +38,4 @@ Login.RuntimeDirectorySize,        config_parse_tmpfs_size,    0, offsetof(Manag
 Login.RemoveIPC,                   config_parse_bool,          0, offsetof(Manager, remove_ipc)
 Login.InhibitorsMax,               config_parse_uint64,        0, offsetof(Manager, inhibitors_max)
 Login.SessionsMax,                 config_parse_uint64,        0, offsetof(Manager, sessions_max)
-Login.UserTasksMax,                config_parse_uint64,        0, offsetof(Manager, user_tasks_max)
+Login.UserTasksMax,                config_parse_user_tasks_max,0, offsetof(Manager, user_tasks_max)
diff --git a/src/grp-login/systemd-logind/logind-session.c b/src/grp-login/systemd-logind/logind-session.c
index 928f4a6314..b08db54068 100644
--- a/src/grp-login/systemd-logind/logind-session.c
+++ b/src/grp-login/systemd-logind/logind-session.c
@@ -605,7 +605,6 @@ int session_start(Session *s) {
 
 static int session_stop_scope(Session *s, bool force) {
         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
-        char *job = NULL;
         int r;
 
         assert(s);
@@ -613,22 +612,25 @@ static int session_stop_scope(Session *s, bool force) {
         if (!s->scope)
                 return 0;
 
+        /* Let's always abandon the scope first. This tells systemd that we are not interested anymore, and everything
+         * that is left in in the scope is "left-over". Informing systemd about this has the benefit that it will log
+         * when killing any processes left after this point. */
+        r = manager_abandon_scope(s->manager, s->scope, &error);
+        if (r < 0)
+                log_warning_errno(r, "Failed to abandon session scope, ignoring: %s", bus_error_message(&error, r));
+
+        /* Optionally, let's kill everything that's left now. */
         if (force || manager_shall_kill(s->manager, s->user->name)) {
+                char *job = NULL;
+
                 r = manager_stop_unit(s->manager, s->scope, &error, &job);
-                if (r < 0) {
-                        log_error("Failed to stop session scope: %s", bus_error_message(&error, r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_error_errno(r, "Failed to stop session scope: %s", bus_error_message(&error, r));
 
                 free(s->scope_job);
                 s->scope_job = job;
-        } else {
-                r = manager_abandon_scope(s->manager, s->scope, &error);
-                if (r < 0) {
-                        log_error("Failed to abandon session scope: %s", bus_error_message(&error, r));
-                        return r;
-                }
-        }
+        } else
+                s->scope_job = mfree(s->scope_job);
 
         return 0;
 }
diff --git a/src/grp-login/systemd-logind/logind-user.c b/src/grp-login/systemd-logind/logind-user.c
index 015276efc8..5a2750b72b 100644
--- a/src/grp-login/systemd-logind/logind-user.c
+++ b/src/grp-login/systemd-logind/logind-user.c
@@ -312,8 +312,7 @@ int user_load(User *u) {
                 if (r == -ENOENT)
                         return 0;
 
-                log_error_errno(r, "Failed to read %s: %m", u->state_file);
-                return r;
+                return log_error_errno(r, "Failed to read %s: %m", u->state_file);
         }
 
         if (display)
@@ -844,7 +843,6 @@ int config_parse_tmpfs_size(
                 void *userdata) {
 
         size_t *sz = data;
-        const char *e;
         int r;
 
         assert(filename);
@@ -852,35 +850,68 @@ int config_parse_tmpfs_size(
         assert(rvalue);
         assert(data);
 
-        e = endswith(rvalue, "%");
-        if (e) {
-                unsigned long ul;
-                char *f;
+        /* First, try to parse as percentage */
+        r = parse_percent(rvalue);
+        if (r > 0 && r < 100)
+                *sz = physical_memory_scale(r, 100U);
+        else {
+                uint64_t k;
 
-                errno = 0;
-                ul = strtoul(rvalue, &f, 10);
-                if (errno > 0 || f != e) {
-                        log_syntax(unit, LOG_ERR, filename, line, errno, "Failed to parse percentage value, ignoring: %s", rvalue);
-                        return 0;
-                }
+                /* If the passed argument was not a percentage, or out of range, parse as byte size */
 
-                if (ul <= 0 || ul >= 100) {
-                        log_syntax(unit, LOG_ERR, filename, line, 0, "Percentage value out of range, ignoring: %s", rvalue);
+                r = parse_size(rvalue, 1024, &k);
+                if (r < 0 || k <= 0 || (uint64_t) (size_t) k != k) {
+                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse size value, ignoring: %s", rvalue);
                         return 0;
                 }
 
-                *sz = PAGE_ALIGN((size_t) ((physical_memory() * (uint64_t) ul) / (uint64_t) 100));
-        } else {
-                uint64_t k;
+                *sz = PAGE_ALIGN((size_t) k);
+        }
 
-                r = parse_size(rvalue, 1024, &k);
-                if (r < 0 || (uint64_t) (size_t) k != k) {
-                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse size value, ignoring: %s", rvalue);
+        return 0;
+}
+
+int config_parse_user_tasks_max(
+                const char* unit,
+                const char *filename,
+                unsigned line,
+                const char *section,
+                unsigned section_line,
+                const char *lvalue,
+                int ltype,
+                const char *rvalue,
+                void *data,
+                void *userdata) {
+
+        uint64_t *m = data;
+        uint64_t k;
+        int r;
+
+        assert(filename);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+
+        /* First, try to parse as percentage */
+        r = parse_percent(rvalue);
+        if (r > 0 && r < 100)
+                k = system_tasks_max_scale(r, 100U);
+        else {
+
+                /* If the passed argument was not a percentage, or out of range, parse as byte size */
+
+                r = safe_atou64(rvalue, &k);
+                if (r < 0) {
+                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse tasks maximum, ignoring: %s", rvalue);
                         return 0;
                 }
+        }
 
-                *sz = PAGE_ALIGN((size_t) k);
+        if (k <= 0 || k >= UINT64_MAX) {
+                log_syntax(unit, LOG_ERR, filename, line, 0, "Tasks maximum out of range, ignoring: %s", rvalue);
+                return 0;
         }
 
+        *m = k;
         return 0;
 }
diff --git a/src/grp-login/systemd-logind/logind.c b/src/grp-login/systemd-logind/logind.c
index e5e21f7567..84e23beef0 100644
--- a/src/grp-login/systemd-logind/logind.c
+++ b/src/grp-login/systemd-logind/logind.c
@@ -62,8 +62,8 @@ static void manager_reset_config(Manager *m) {
         m->idle_action_usec = 30 * USEC_PER_MINUTE;
         m->idle_action = HANDLE_IGNORE;
 
-        m->runtime_dir_size = PAGE_ALIGN((size_t) (physical_memory() / 10)); /* 10% */
-        m->user_tasks_max = 12288;
+        m->runtime_dir_size = physical_memory_scale(10U, 100U); /* 10% */
+        m->user_tasks_max = system_tasks_max_scale(33U, 100U); /* 33% */
         m->sessions_max = 8192;
         m->inhibitors_max = 8192;
 
diff --git a/src/grp-login/systemd-logind/logind.conf.in b/src/grp-login/systemd-logind/logind.conf.in
index 32c0844cb6..6f720b7708 100644
--- a/src/grp-login/systemd-logind/logind.conf.in
+++ b/src/grp-login/systemd-logind/logind.conf.in
@@ -34,4 +34,4 @@
 #RemoveIPC=yes
 #InhibitorsMax=8192
 #SessionsMax=8192
-#UserTasksMax=12288
+#UserTasksMax=33%
diff --git a/src/grp-login/systemd-logind/logind.conf.xml b/src/grp-login/systemd-logind/logind.conf.xml
index fe92277a1f..adba5a4131 100644
--- a/src/grp-login/systemd-logind/logind.conf.xml
+++ b/src/grp-login/systemd-logind/logind.conf.xml
@@ -315,12 +315,11 @@
       <varlistentry>
         <term><varname>UserTasksMax=</varname></term>
 
-        <listitem><para>Sets the maximum number of OS tasks each user
-        may run concurrently. This controls the
-        <varname>TasksMax=</varname> setting of the per-user slice
-        unit, see
+        <listitem><para>Sets the maximum number of OS tasks each user may run concurrently. This controls the
+        <varname>TasksMax=</varname> setting of the per-user slice unit, see
         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-        for details. Defaults to 12288 (12K).</para></listitem>
+        for details. Defaults to 33%, which equals 10813 with the kernel's defaults on the host, but might be smaller
+        in OS containers.</para></listitem>
       </varlistentry>
 
       <varlistentry>
diff --git a/src/grp-login/systemd-logind/logind.h b/src/grp-login/systemd-logind/logind.h
index effc498118..c637cdfcac 100644
--- a/src/grp-login/systemd-logind/logind.h
+++ b/src/grp-login/systemd-logind/logind.h
@@ -187,6 +187,7 @@ const struct ConfigPerfItem* logind_gperf_lookup(const char *key, unsigned lengt
 int manager_set_lid_switch_ignore(Manager *m, usec_t until);
 
 int config_parse_tmpfs_size(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
+int config_parse_user_tasks_max(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
 
 int manager_get_session_from_creds(Manager *m, sd_bus_message *message, const char *name, sd_bus_error *error, Session **ret);
 int manager_get_user_from_creds(Manager *m, sd_bus_message *message, uid_t uid, sd_bus_error *error, User **ret);
diff --git a/src/grp-login/systemd-logind/org.freedesktop.login1.policy.in b/src/grp-login/systemd-logind/org.freedesktop.login1.policy.in
index 1fa6441629..66cbce393c 100644
--- a/src/grp-login/systemd-logind/org.freedesktop.login1.policy.in
+++ b/src/grp-login/systemd-logind/org.freedesktop.login1.policy.in
@@ -116,6 +116,8 @@
                 <_message>Explicit request is required to run programs as a non-logged-in user.</_message>
                 <defaults>
                         <allow_any>yes</allow_any>
+                        <allow_inactive>yes</allow_inactive>
+                        <allow_active>yes</allow_active>
                 </defaults>
         </action>
 
diff --git a/src/grp-login/systemd-logind/systemd-logind.service.in b/src/grp-login/systemd-logind/systemd-logind.service.in
index ff049134ee..bee08d011f 100644
--- a/src/grp-login/systemd-logind/systemd-logind.service.in
+++ b/src/grp-login/systemd-logind/systemd-logind.service.in
@@ -25,6 +25,8 @@ RestartSec=0
 BusName=org.freedesktop.login1
 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG
 WatchdogSec=3min
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io
 
 # Increase the default a bit in order to allow many simultaneous
 # logins since we keep one fd open per session.
diff --git a/src/grp-machine/grp-import/libimport/Makefile b/src/grp-machine/grp-import/libimport/Makefile
index 5691d0bba1..ee10c0f6df 100644
--- a/src/grp-machine/grp-import/libimport/Makefile
+++ b/src/grp-machine/grp-import/libimport/Makefile
@@ -45,7 +45,7 @@ test_qcow2_CFLAGS = \
 	$(ZLIB_CFLAGS)
 
 test_qcow2_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(ZLIB_LIBS)
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-machine/grp-import/libimport/import-common.c b/src/grp-machine/grp-import/libimport/import-common.c
index cd69e900ec..9061cd4da1 100644
--- a/src/grp-machine/grp-import/libimport/import-common.c
+++ b/src/grp-machine/grp-import/libimport/import-common.c
@@ -126,9 +126,7 @@ int import_fork_tar_x(const char *path, pid_t *ret) {
                 if (null_fd != STDOUT_FILENO)
                         null_fd = safe_close(null_fd);
 
-                fd_cloexec(STDIN_FILENO, false);
-                fd_cloexec(STDOUT_FILENO, false);
-                fd_cloexec(STDERR_FILENO, false);
+                stdio_unset_cloexec();
 
                 if (unshare(CLONE_NEWNET) < 0)
                         log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
@@ -200,9 +198,7 @@ int import_fork_tar_c(const char *path, pid_t *ret) {
                 if (null_fd != STDIN_FILENO)
                         null_fd = safe_close(null_fd);
 
-                fd_cloexec(STDIN_FILENO, false);
-                fd_cloexec(STDOUT_FILENO, false);
-                fd_cloexec(STDERR_FILENO, false);
+                stdio_unset_cloexec();
 
                 if (unshare(CLONE_NEWNET) < 0)
                         log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
diff --git a/src/grp-machine/grp-import/systemd-export/Makefile b/src/grp-machine/grp-import/systemd-export/Makefile
index f8fcbc3cca..aa8792565a 100644
--- a/src/grp-machine/grp-import/systemd-export/Makefile
+++ b/src/grp-machine/grp-import/systemd-export/Makefile
@@ -39,7 +39,7 @@ systemd_export_CFLAGS = \
 	$(BZIP2_CFLAGS)
 
 systemd_export_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	libimport.la \
 	$(XZ_LIBS) \
 	$(ZLIB_LIBS) \
diff --git a/src/grp-machine/grp-import/systemd-import/Makefile b/src/grp-machine/grp-import/systemd-import/Makefile
index 06fd01fcd7..221659c346 100644
--- a/src/grp-machine/grp-import/systemd-import/Makefile
+++ b/src/grp-machine/grp-import/systemd-import/Makefile
@@ -38,8 +38,7 @@ systemd_import_CFLAGS = \
 	$(BZIP2_CFLAGS)
 
 systemd_import_LDADD = \
-	libshared.la \
-	libimport.la \
+	libsystemd-shared.la \
 	$(XZ_LIBS) \
 	$(ZLIB_LIBS) \
 	$(BZIP2_LIBS)
diff --git a/src/grp-machine/grp-import/systemd-import/import.c b/src/grp-machine/grp-import/systemd-import/import.c
index 6744006312..38fe7f8110 100644
--- a/src/grp-machine/grp-import/systemd-import/import.c
+++ b/src/grp-machine/grp-import/systemd-import/import.c
@@ -91,7 +91,7 @@ static int import_tar(int argc, char *argv[], void *userdata) {
                         if (r < 0)
                                 return log_error_errno(r, "Failed to check whether image '%s' exists: %m", local);
                         else if (r > 0) {
-                                log_error_errno(EEXIST, "Image '%s' already exists.", local);
+                                log_error("Image '%s' already exists.", local);
                                 return -EEXIST;
                         }
                 }
@@ -186,7 +186,7 @@ static int import_raw(int argc, char *argv[], void *userdata) {
                         if (r < 0)
                                 return log_error_errno(r, "Failed to check whether image '%s' exists: %m", local);
                         else if (r > 0) {
-                                log_error_errno(EEXIST, "Image '%s' already exists.", local);
+                                log_error("Image '%s' already exists.", local);
                                 return -EEXIST;
                         }
                 }
diff --git a/src/grp-machine/grp-import/systemd-importd/Makefile b/src/grp-machine/grp-import/systemd-importd/Makefile
index 1f5bae1267..e00f531a0d 100644
--- a/src/grp-machine/grp-import/systemd-importd/Makefile
+++ b/src/grp-machine/grp-import/systemd-importd/Makefile
@@ -34,9 +34,9 @@ systemd_importd_CFLAGS = \
 	-D SYSTEMD_EXPORT_PATH=\"$(rootlibexecdir)/systemd-export\"
 
 systemd_importd_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
-dist_rootlibexec_DATA = \
+dist_rootlibexec_DATA += \
 	src/import/import-pubring.gpg
 
 nodist_systemunit_DATA += \
diff --git a/src/grp-machine/grp-import/systemd-importd/importd.c b/src/grp-machine/grp-import/systemd-importd/importd.c
index e790c0c475..f032f06fcf 100644
--- a/src/grp-machine/grp-import/systemd-importd/importd.c
+++ b/src/grp-machine/grp-import/systemd-importd/importd.c
@@ -448,9 +448,7 @@ static int transfer_start(Transfer *t) {
                                 safe_close(null_fd);
                 }
 
-                fd_cloexec(STDIN_FILENO, false);
-                fd_cloexec(STDOUT_FILENO, false);
-                fd_cloexec(STDERR_FILENO, false);
+                stdio_unset_cloexec();
 
                 setenv("SYSTEMD_LOG_TARGET", "console-prefixed", 1);
                 setenv("NOTIFY_SOCKET", "/run/systemd/import/notify", 1);
diff --git a/src/grp-machine/grp-import/systemd-importd/systemd-importd.service.in b/src/grp-machine/grp-import/systemd-importd/systemd-importd.service.in
index b74ad72cdc..0f5489e7e3 100644
--- a/src/grp-machine/grp-import/systemd-importd/systemd-importd.service.in
+++ b/src/grp-machine/grp-import/systemd-importd/systemd-importd.service.in
@@ -17,3 +17,5 @@ CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_
 NoNewPrivileges=yes
 WatchdogSec=3min
 KillMode=mixed
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
diff --git a/src/grp-machine/grp-import/systemd-pull/Makefile b/src/grp-machine/grp-import/systemd-pull/Makefile
index 1ee9fa25de..780a5a4610 100644
--- a/src/grp-machine/grp-import/systemd-pull/Makefile
+++ b/src/grp-machine/grp-import/systemd-pull/Makefile
@@ -48,8 +48,8 @@ systemd_pull_CFLAGS = \
 	-D USER_KEYRING_PATH=\"$(pkgsysconfdir)/import-pubring.gpg\"
 
 systemd_pull_LDADD = \
+	libsystemd-shared.la \
 	libimport.la \
-	libshared.la \
 	$(LIBCURL_LIBS) \
 	$(XZ_LIBS) \
 	$(ZLIB_LIBS) \
diff --git a/src/grp-machine/grp-import/systemd-pull/pull-common.c b/src/grp-machine/grp-import/systemd-pull/pull-common.c
index f5815c216d..bd1623e003 100644
--- a/src/grp-machine/grp-import/systemd-pull/pull-common.c
+++ b/src/grp-machine/grp-import/systemd-pull/pull-common.c
@@ -507,9 +507,7 @@ int pull_verify(PullJob *main_job,
                 cmd[k++] = "-";
                 cmd[k++] = NULL;
 
-                fd_cloexec(STDIN_FILENO, false);
-                fd_cloexec(STDOUT_FILENO, false);
-                fd_cloexec(STDERR_FILENO, false);
+                stdio_unset_cloexec();
 
                 execvp("gpg2", (char * const *) cmd);
                 execvp("gpg", (char * const *) cmd);
diff --git a/src/grp-machine/grp-import/systemd-pull/pull.c b/src/grp-machine/grp-import/systemd-pull/pull.c
index 166f91d6e1..4153c938d8 100644
--- a/src/grp-machine/grp-import/systemd-pull/pull.c
+++ b/src/grp-machine/grp-import/systemd-pull/pull.c
@@ -98,7 +98,7 @@ static int pull_tar(int argc, char *argv[], void *userdata) {
                         if (r < 0)
                                 return log_error_errno(r, "Failed to check whether image '%s' exists: %m", local);
                         else if (r > 0) {
-                                log_error_errno(EEXIST, "Image '%s' already exists.", local);
+                                log_error("Image '%s' already exists.", local);
                                 return -EEXIST;
                         }
                 }
@@ -184,7 +184,7 @@ static int pull_raw(int argc, char *argv[], void *userdata) {
                         if (r < 0)
                                 return log_error_errno(r, "Failed to check whether image '%s' exists: %m", local);
                         else if (r > 0) {
-                                log_error_errno(EEXIST, "Image '%s' already exists.", local);
+                                log_error("Image '%s' already exists.", local);
                                 return -EEXIST;
                         }
                 }
diff --git a/src/grp-machine/machinectl/Makefile b/src/grp-machine/machinectl/Makefile
index a3ad40e59c..f6760f3174 100644
--- a/src/grp-machine/machinectl/Makefile
+++ b/src/grp-machine/machinectl/Makefile
@@ -27,7 +27,7 @@ machinectl_SOURCES = \
 	src/machine/machinectl.c
 
 machinectl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootbin_PROGRAMS += \
 	machinectl
diff --git a/src/grp-machine/machinectl/machinectl.c b/src/grp-machine/machinectl/machinectl.c
index fa607c57e4..d5304dba37 100644
--- a/src/grp-machine/machinectl/machinectl.c
+++ b/src/grp-machine/machinectl/machinectl.c
@@ -50,6 +50,7 @@
 #include "basic/util.h"
 #include "basic/verbs.h"
 #include "basic/web-util.h"
+#include "sd-bus/bus-common-errors.h"
 #include "sd-bus/bus-error.h"
 #include "shared/bus-unit-util.h"
 #include "shared/bus-util.h"
@@ -527,7 +528,7 @@ static void print_machine_status_info(sd_bus *bus, MachineStatusInfo *i) {
 
         fputs(strna(i->name), stdout);
 
-        if (!sd_id128_equal(i->id, SD_ID128_NULL))
+        if (!sd_id128_is_null(i->id))
                 printf("(" SD_ID128_FORMAT_STR ")\n", SD_ID128_FORMAT_VAL(i->id));
         else
                 putchar('\n');
@@ -1523,8 +1524,33 @@ static int read_only_image(int argc, char *argv[], void *userdata) {
         return 0;
 }
 
+static int image_exists(sd_bus *bus, const char *name) {
+        _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+        int r;
+
+        assert(bus);
+        assert(name);
+
+        r = sd_bus_call_method(
+                        bus,
+                        "org.freedesktop.machine1",
+                        "/org/freedesktop/machine1",
+                        "org.freedesktop.machine1.Manager",
+                        "GetImage",
+                        &error,
+                        NULL,
+                        "s", name);
+        if (r < 0) {
+                if (sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_IMAGE))
+                        return 0;
+
+                return log_error_errno(r, "Failed to check whether image %s exists: %s", name, bus_error_message(&error, -r));
+        }
+
+        return 1;
+}
+
 static int make_service_name(const char *name, char **ret) {
-        _cleanup_free_ char *e = NULL;
         int r;
 
         assert(name);
@@ -1535,11 +1561,7 @@ static int make_service_name(const char *name, char **ret) {
                 return -EINVAL;
         }
 
-        e = unit_name_escape(name);
-        if (!e)
-                return log_oom();
-
-        r = unit_name_build("systemd-nspawn", e, ".service", ret);
+        r = unit_name_build("systemd-nspawn", name, ".service", ret);
         if (r < 0)
                 return log_error_errno(r, "Failed to build unit name: %m");
 
@@ -1569,6 +1591,14 @@ static int start_machine(int argc, char *argv[], void *userdata) {
                 if (r < 0)
                         return r;
 
+                r = image_exists(bus, argv[i]);
+                if (r < 0)
+                        return r;
+                if (r == 0) {
+                        log_error("Machine image '%s' does not exist.", argv[1]);
+                        return -ENXIO;
+                }
+
                 r = sd_bus_call_method(
                                 bus,
                                 "org.freedesktop.systemd1",
@@ -1636,6 +1666,14 @@ static int enable_machine(int argc, char *argv[], void *userdata) {
                 if (r < 0)
                         return r;
 
+                r = image_exists(bus, argv[i]);
+                if (r < 0)
+                        return r;
+                if (r == 0) {
+                        log_error("Machine image '%s' does not exist.", argv[1]);
+                        return -ENXIO;
+                }
+
                 r = sd_bus_message_append(m, "s", unit);
                 if (r < 0)
                         return bus_log_create_error(r);
@@ -2379,7 +2417,7 @@ static int set_limit(int argc, char *argv[], void *userdata) {
 }
 
 static int clean_images(int argc, char *argv[], void *userdata) {
-        _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
+        _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL;
         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
         uint64_t usage, total = 0;
         char fb[FORMAT_BYTES_MAX];
@@ -2388,15 +2426,22 @@ static int clean_images(int argc, char *argv[], void *userdata) {
         unsigned c = 0;
         int r;
 
-        r = sd_bus_call_method(
+        r = sd_bus_message_new_method_call(
                         bus,
+                        &m,
                         "org.freedesktop.machine1",
                         "/org/freedesktop/machine1",
                         "org.freedesktop.machine1.Manager",
-                        "CleanPool",
-                        &error,
-                        &reply,
-                        "s", arg_all ? "all" : "hidden");
+                        "CleanPool");
+        if (r < 0)
+                return bus_log_create_error(r);
+
+        r = sd_bus_message_append(m, "s", arg_all ? "all" : "hidden");
+        if (r < 0)
+                return bus_log_create_error(r);
+
+        /* This is a slow operation, hence permit a longer time for completion. */
+        r = sd_bus_call(bus, m, USEC_INFINITY, &error, &reply);
         if (r < 0)
                 return log_error_errno(r, "Could not clean pool: %s", bus_error_message(&error, r));
 
@@ -2540,35 +2585,65 @@ static int parse_argv(int argc, char *argv[]) {
         };
 
         bool reorder = false;
-        int c, r;
+        int c, r, shell = -1;
 
         assert(argc >= 0);
         assert(argv);
 
         for (;;) {
-                const char * const option_string = "+hp:als:H:M:qn:o:";
+                static const char option_string[] = "-hp:als:H:M:qn:o:";
 
                 c = getopt_long(argc, argv, option_string + reorder, options, NULL);
-                if (c < 0) {
+                if (c < 0)
+                        break;
+
+                switch (c) {
+
+                case 1: /* getopt_long() returns 1 if "-" was the first character of the option string, and a
+                         * non-option argument was discovered. */
+
+                        assert(!reorder);
+
                         /* We generally are fine with the fact that getopt_long() reorders the command line, and looks
                          * for switches after the main verb. However, for "shell" we really don't want that, since we
-                         * want that switches passed after that are passed to the program to execute, and not processed
-                         * by us. To make this possible, we'll first invoke getopt_long() with reordering disabled
-                         * (i.e. with the "+" prefix in the option string), and as soon as we hit the end (i.e. the
-                         * verb) we check if that's "shell". If it is, we exit the loop, since we don't want any
-                         * further options processed. However, if it is anything else, we process the same argument
-                         * again, but this time allow reordering. */
-
-                        if (!reorder && optind < argc && !streq(argv[optind], "shell")) {
+                         * want that switches specified after the machine name are passed to the program to execute,
+                         * and not processed by us. To make this possible, we'll first invoke getopt_long() with
+                         * reordering disabled (i.e. with the "-" prefix in the option string), looking for the first
+                         * non-option parameter. If it's the verb "shell" we remember its position and continue
+                         * processing options. In this case, as soon as we hit the next non-option argument we found
+                         * the machine name, and stop further processing. If the first non-option argument is any other
+                         * verb than "shell" we switch to normal reordering mode and continue processing arguments
+                         * normally. */
+
+                        if (shell >= 0) {
+                                /* If we already found the "shell" verb on the command line, and now found the next
+                                 * non-option argument, then this is the machine name and we should stop processing
+                                 * further arguments.  */
+                                optind --; /* don't process this argument, go one step back */
+                                goto done;
+                        }
+                        if (streq(optarg, "shell"))
+                                /* Remember the position of the "shell" verb, and continue processing normally. */
+                                shell = optind - 1;
+                        else {
+                                int saved_optind;
+
+                                /* OK, this is some other verb. In this case, turn on reordering again, and continue
+                                 * processing normally. */
                                 reorder = true;
-                                optind--;
-                                continue;
+
+                                /* We changed the option string. getopt_long() only looks at it again if we invoke it
+                                 * at least once with a reset option index. Hence, let's reset the option index here,
+                                 * then invoke getopt_long() again (ignoring what it has to say, after all we most
+                                 * likely already processed it), and the bump the option index so that we read the
+                                 * intended argument again. */
+                                saved_optind = optind;
+                                optind = 0;
+                                (void) getopt_long(argc, argv, option_string + reorder, options, NULL);
+                                optind = saved_optind - 1; /* go one step back, process this argument again */
                         }
 
                         break;
-                }
-
-                switch (c) {
 
                 case 'h':
                         return help(0, NULL, NULL);
@@ -2704,6 +2779,22 @@ static int parse_argv(int argc, char *argv[]) {
                 }
         }
 
+done:
+        if (shell >= 0) {
+                char *t;
+                int i;
+
+                /* We found the "shell" verb while processing the argument list. Since we turned off reordering of the
+                 * argument list initially let's readjust it now, and move the "shell" verb to the back. */
+
+                optind -= 1; /* place the option index where the "shell" verb will be placed */
+
+                t = argv[shell];
+                for (i = shell; i < optind; i++)
+                        argv[i] = argv[i+1];
+                argv[optind] = t;
+        }
+
         return 1;
 }
 
@@ -2720,6 +2811,7 @@ static int machinectl_main(int argc, char *argv[], sd_bus *bus) {
                 { "terminate",       2,        VERB_ANY, 0,            terminate_machine },
                 { "reboot",          2,        VERB_ANY, 0,            reboot_machine    },
                 { "poweroff",        2,        VERB_ANY, 0,            poweroff_machine  },
+                { "stop",            2,        VERB_ANY, 0,            poweroff_machine  }, /* Convenience alias */
                 { "kill",            2,        VERB_ANY, 0,            kill_machine      },
                 { "login",           VERB_ANY, 2,        0,            login_machine     },
                 { "shell",           VERB_ANY, VERB_ANY, 0,            shell_machine     },
@@ -2750,7 +2842,7 @@ static int machinectl_main(int argc, char *argv[], sd_bus *bus) {
 }
 
 int main(int argc, char*argv[]) {
-        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
+        sd_bus *bus = NULL;
         int r;
 
         setlocale(LC_ALL, "");
@@ -2772,6 +2864,7 @@ int main(int argc, char*argv[]) {
         r = machinectl_main(argc, argv, bus);
 
 finish:
+        sd_bus_flush_close_unref(bus);
         pager_close();
         polkit_agent_close();
 
diff --git a/src/grp-machine/machinectl/machinectl.completion.bash b/src/grp-machine/machinectl/machinectl.completion.bash
index e7829ca968..aebe48304d 100644
--- a/src/grp-machine/machinectl/machinectl.completion.bash
+++ b/src/grp-machine/machinectl/machinectl.completion.bash
@@ -41,7 +41,7 @@ _machinectl() {
 
         local -A VERBS=(
                [STANDALONE]='list list-images pull-tar pull-raw import-tar import-raw export-tar export-raw list-transfers cancel-transfer'
-                 [MACHINES]='status show start login shell enable disable poweroff reboot terminate kill copy-to copy-from image-status show-image clone rename read-only remove set-limit'
+                 [MACHINES]='status show start stop login shell enable disable poweroff reboot terminate kill copy-to copy-from image-status show-image clone rename read-only remove set-limit'
         )
 
         _init_completion || return
diff --git a/src/grp-machine/machinectl/machinectl.completion.zsh b/src/grp-machine/machinectl/machinectl.completion.zsh
index 198fa28f7b..92d77109a5 100644
--- a/src/grp-machine/machinectl/machinectl.completion.zsh
+++ b/src/grp-machine/machinectl/machinectl.completion.zsh
@@ -23,6 +23,7 @@ _available_machines() {
     "status:Show VM/container status"
     "show:Show properties of one or more VMs/containers"
     "start:Start container as a service"
+    "stop:Stop container (equal to poweroff)"
     "login:Get a login prompt on a VM/container"
     "enable:Enable automatic container start at boot"
     "disable:Disable automatic container start at boot"
diff --git a/src/grp-machine/machinectl/machinectl.xml b/src/grp-machine/machinectl/machinectl.xml
index 4b7f9a0391..597a5cc583 100644
--- a/src/grp-machine/machinectl/machinectl.xml
+++ b/src/grp-machine/machinectl/machinectl.xml
@@ -333,7 +333,7 @@
         <listitem><para>Show properties of one or more registered
         virtual machines or containers or the manager itself. If no
         argument is specified, properties of the manager will be
-        shown. If an NAME is specified, properties of this virtual
+        shown. If a NAME is specified, properties of this virtual
         machine or container are shown. By default, empty properties
         are suppressed. Use <option>--all</option> to show those too.
         To select specific properties to show, use
@@ -373,8 +373,7 @@
         <para>To interactively start a container on the command line
         with full access to the container's console, please invoke
         <command>systemd-nspawn</command> directly. To stop a running
-        container use <command>machinectl poweroff</command>, see
-        below.</para></listitem>
+        container use <command>machinectl poweroff</command>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -461,8 +460,8 @@
         <listitem><para>Power off one or more containers. This will
         trigger a reboot by sending SIGRTMIN+4 to the container's init
         process, which causes systemd-compatible init systems to shut
-        down cleanly. This operation does not work on containers that
-        do not run a
+        down cleanly. Use <command>stop</command> as alias for <command>poweroff</command>.
+        This operation does not work on containers that do not run a
         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible
         init system, such as sysvinit. Use
         <command>terminate</command> (see below) to immediately
@@ -576,7 +575,7 @@
         <listitem><para>Show properties of one or more registered
         virtual machine or container images, or the manager itself. If
         no argument is specified, properties of the manager will be
-        shown. If an NAME is specified, properties of this virtual
+        shown. If a NAME is specified, properties of this virtual
         machine or container image are shown. By default, empty
         properties are suppressed. Use <option>--all</option> to show
         those too. To select specific properties to show, use
diff --git a/src/grp-machine/nss-mymachines/Makefile b/src/grp-machine/nss-mymachines/Makefile
index 78cb6419c0..bc7f9e791a 100644
--- a/src/grp-machine/nss-mymachines/Makefile
+++ b/src/grp-machine/nss-mymachines/Makefile
@@ -37,7 +37,8 @@ libnss_mymachines_la_LDFLAGS = \
 	-Wl,--version-script=$(srcdir)/nss-mymachines.sym
 
 libnss_mymachines_la_LIBADD = \
-	libsystemd-internal.la
+	libsystemd-internal.la \
+	libbasic.la
 
 lib_LTLIBRARIES += \
 	libnss_mymachines.la
diff --git a/src/grp-machine/systemd-machined/Makefile b/src/grp-machine/systemd-machined/Makefile
index 66ac0b9275..97fa68c5f9 100644
--- a/src/grp-machine/systemd-machined/Makefile
+++ b/src/grp-machine/systemd-machined/Makefile
@@ -24,19 +24,19 @@ include $(dir $(lastword $(MAKEFILE_LIST)))/../../../config.mk
 include $(topsrcdir)/build-aux/Makefile.head.mk
 
 systemd_machined_SOURCES = \
-	$(_libmachine_core_la_SOURCES) \
 	src/machine/machined.c \
 	src/machine/machined.h
 
 systemd_machined_LDADD = \
 	libsystemd-internal.la \
 	libshared.la \
-	libbasic.la
+	libbasic.la \
+	libmachine-core.la
 
 rootlibexec_PROGRAMS += \
 	systemd-machined
 
-_libmachine_core_la_SOURCES = \
+libmachine_core_la_SOURCES = \
 	src/machine/machine.c \
 	src/machine/machine.h \
 	src/machine/machined-dbus.c \
@@ -47,10 +47,18 @@ _libmachine_core_la_SOURCES = \
 	src/machine/operation.c \
 	src/machine/operation.h
 
+libmachine_core_la_LIBADD = \
+	libsystemd-shared.la
+
+noinst_LTLIBRARIES += \
+	libmachine-core.la
+
 test_machine_tables_SOURCES = \
-	$(_libmachine_core_la_SOURCES) \
 	src/machine/test-machine-tables.c
 
+test_machine_tables_LDADD = \
+	libmachine-core.la
+
 tests += \
 	test-machine-tables
 
diff --git a/src/grp-machine/systemd-machined/image-dbus.c b/src/grp-machine/systemd-machined/image-dbus.c
index 584777e5ad..6ab627a710 100644
--- a/src/grp-machine/systemd-machined/image-dbus.c
+++ b/src/grp-machine/systemd-machined/image-dbus.c
@@ -82,7 +82,7 @@ int bus_image_method_remove(
 
         errno_pipe_fd[1] = safe_close(errno_pipe_fd[1]);
 
-        r = operation_new(m, NULL, child, message, errno_pipe_fd[0]);
+        r = operation_new(m, NULL, child, message, errno_pipe_fd[0], NULL);
         if (r < 0) {
                 (void) sigkill_wait(child);
                 return r;
@@ -194,7 +194,7 @@ int bus_image_method_clone(
 
         errno_pipe_fd[1] = safe_close(errno_pipe_fd[1]);
 
-        r = operation_new(m, NULL, child, message, errno_pipe_fd[0]);
+        r = operation_new(m, NULL, child, message, errno_pipe_fd[0], NULL);
         if (r < 0) {
                 (void) sigkill_wait(child);
                 return r;
diff --git a/src/grp-machine/systemd-machined/machine-dbus.c b/src/grp-machine/systemd-machined/machine-dbus.c
index 95f2084455..91b5dfa993 100644
--- a/src/grp-machine/systemd-machined/machine-dbus.c
+++ b/src/grp-machine/systemd-machined/machine-dbus.c
@@ -656,8 +656,7 @@ int bus_machine_method_open_shell(sd_bus_message *message, void *userdata, sd_bu
         r = sd_bus_message_read(message, "ss", &user, &path);
         if (r < 0)
                 return r;
-        if (isempty(user))
-                user = NULL;
+        user = empty_to_null(user);
         if (isempty(path))
                 path = "/bin/sh";
         if (!path_is_absolute(path))
@@ -1202,8 +1201,6 @@ int bus_machine_method_copy(sd_bus_message *message, void *userdata, sd_bus_erro
 
         child_fail:
                 (void) write(errno_pipe_fd[1], &r, sizeof(r));
-                errno_pipe_fd[1] = safe_close(errno_pipe_fd[1]);
-
                 _exit(EXIT_FAILURE);
         }
 
@@ -1211,7 +1208,7 @@ int bus_machine_method_copy(sd_bus_message *message, void *userdata, sd_bus_erro
 
         /* Copying might take a while, hence install a watch on the child, and return */
 
-        r = operation_new(m->manager, m, child, message, errno_pipe_fd[0]);
+        r = operation_new(m->manager, m, child, message, errno_pipe_fd[0], NULL);
         if (r < 0) {
                 (void) sigkill_wait(child);
                 return r;
diff --git a/src/grp-machine/systemd-machined/machine.c b/src/grp-machine/systemd-machined/machine.c
index 82d8f66395..701fec0e67 100644
--- a/src/grp-machine/systemd-machined/machine.c
+++ b/src/grp-machine/systemd-machined/machine.c
@@ -182,7 +182,7 @@ int machine_save(Machine *m) {
                 fprintf(f, "ROOT=%s\n", escaped);
         }
 
-        if (!sd_id128_equal(m->id, SD_ID128_NULL))
+        if (!sd_id128_is_null(m->id))
                 fprintf(f, "ID=" SD_ID128_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(m->id));
 
         if (m->leader != 0)
diff --git a/src/grp-machine/systemd-machined/machined-dbus.c b/src/grp-machine/systemd-machined/machined-dbus.c
index 7caecd43a0..349ffcf298 100644
--- a/src/grp-machine/systemd-machined/machined-dbus.c
+++ b/src/grp-machine/systemd-machined/machined-dbus.c
@@ -27,6 +27,7 @@
 #include "basic/btrfs-util.h"
 #include "basic/cgroup-util.h"
 #include "basic/fd-util.h"
+#include "basic/fileio.h"
 #include "basic/formats-util.h"
 #include "basic/hostname-util.h"
 #include "basic/io-util.h"
@@ -823,22 +824,106 @@ static int method_mark_image_read_only(sd_bus_message *message, void *userdata,
         return bus_image_method_mark_read_only(message, i, error);
 }
 
+static int clean_pool_done(Operation *operation, int ret, sd_bus_error *error) {
+        _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
+        _cleanup_fclose_ FILE *f = NULL;
+        bool success;
+        size_t n;
+        int r;
+
+        assert(operation);
+        assert(operation->extra_fd >= 0);
+
+        if (lseek(operation->extra_fd, 0, SEEK_SET) == (off_t) -1)
+                return -errno;
+
+        f = fdopen(operation->extra_fd, "re");
+        if (!f)
+                return -errno;
+
+        operation->extra_fd = -1;
+
+        /* The resulting temporary file starts with a boolean value that indicates success or not. */
+        errno = 0;
+        n = fread(&success, 1, sizeof(success), f);
+        if (n != sizeof(success))
+                return ret < 0 ? ret : (errno != 0 ? -errno : -EIO);
+
+        if (ret < 0) {
+                _cleanup_free_ char *name = NULL;
+
+                /* The clean-up operation failed. In this case the resulting temporary file should contain a boolean
+                 * set to false followed by the name of the failed image. Let's try to read this and use it for the
+                 * error message. If we can't read it, don't mind, and return the naked error. */
+
+                if (success) /* The resulting temporary file could not be updated, ignore it. */
+                        return ret;
+
+                r = read_nul_string(f, &name);
+                if (r < 0 || isempty(name)) /* Same here... */
+                        return ret;
+
+                return sd_bus_error_set_errnof(error, ret, "Failed to remove image %s: %m", name);
+        }
+
+        assert(success);
+
+        r = sd_bus_message_new_method_return(operation->message, &reply);
+        if (r < 0)
+                return r;
+
+        r = sd_bus_message_open_container(reply, 'a', "(st)");
+        if (r < 0)
+                return r;
+
+        /* On success the resulting temporary file will contain a list of image names that were removed followed by
+         * their size on disk. Let's read that and turn it into a bus message. */
+        for (;;) {
+                _cleanup_free_ char *name = NULL;
+                uint64_t size;
+
+                r = read_nul_string(f, &name);
+                if (r < 0)
+                        return r;
+                if (isempty(name)) /* reached the end */
+                        break;
+
+                errno = 0;
+                n = fread(&size, 1, sizeof(size), f);
+                if (n != sizeof(size))
+                        return errno != 0 ? -errno : -EIO;
+
+                r = sd_bus_message_append(reply, "(st)", name, size);
+                if (r < 0)
+                        return r;
+        }
+
+        r = sd_bus_message_close_container(reply);
+        if (r < 0)
+                return r;
+
+        return sd_bus_send(NULL, reply, NULL);
+}
+
 static int method_clean_pool(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         enum {
                 REMOVE_ALL,
                 REMOVE_HIDDEN,
         } mode;
 
-        _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
-        _cleanup_(image_hashmap_freep) Hashmap *images = NULL;
+        _cleanup_close_pair_ int errno_pipe_fd[2] = { -1, -1 };
+        _cleanup_close_ int result_fd = -1;
         Manager *m = userdata;
-        Image *image;
+        Operation *operation;
         const char *mm;
-        Iterator i;
+        pid_t child;
         int r;
 
         assert(message);
 
+        if (m->n_operations >= OPERATIONS_MAX)
+                return sd_bus_error_setf(error, SD_BUS_ERROR_LIMITS_EXCEEDED, "Too many ongoing operations.");
+
         r = sd_bus_message_read(message, "s", &mm);
         if (r < 0)
                 return r;
@@ -864,50 +949,109 @@ static int method_clean_pool(sd_bus_message *message, void *userdata, sd_bus_err
         if (r == 0)
                 return 1; /* Will call us back */
 
-        images = hashmap_new(&string_hash_ops);
-        if (!images)
-                return -ENOMEM;
+        if (pipe2(errno_pipe_fd, O_CLOEXEC|O_NONBLOCK) < 0)
+                return sd_bus_error_set_errnof(error, errno, "Failed to create pipe: %m");
 
-        r = image_discover(images);
-        if (r < 0)
-                return r;
+        /* Create a temporary file we can dump information about deleted images into. We use a temporary file for this
+         * instead of a pipe or so, since this might grow quit large in theory and we don't want to process this
+         * continuously */
+        result_fd = open_tmpfile_unlinkable("/tmp/", O_RDWR|O_CLOEXEC);
+        if (result_fd < 0)
+                return -errno;
 
-        r = sd_bus_message_new_method_return(message, &reply);
-        if (r < 0)
-                return r;
+        /* This might be a slow operation, run it asynchronously in a background process */
+        child = fork();
+        if (child < 0)
+                return sd_bus_error_set_errnof(error, errno, "Failed to fork(): %m");
 
-        r = sd_bus_message_open_container(reply, 'a', "(st)");
-        if (r < 0)
-                return r;
+        if (child == 0) {
+                _cleanup_(image_hashmap_freep) Hashmap *images = NULL;
+                bool success = true;
+                Image *image;
+                Iterator i;
+                ssize_t l;
 
-        HASHMAP_FOREACH(image, images, i) {
+                errno_pipe_fd[0] = safe_close(errno_pipe_fd[0]);
 
-                /* We can't remove vendor images (i.e. those in /usr) */
-                if (IMAGE_IS_VENDOR(image))
-                        continue;
+                images = hashmap_new(&string_hash_ops);
+                if (!images) {
+                        r = -ENOMEM;
+                        goto child_fail;
+                }
 
-                if (IMAGE_IS_HOST(image))
-                        continue;
+                r = image_discover(images);
+                if (r < 0)
+                        goto child_fail;
 
-                if (mode == REMOVE_HIDDEN && !IMAGE_IS_HIDDEN(image))
-                        continue;
+                l = write(result_fd, &success, sizeof(success));
+                if (l < 0) {
+                        r = -errno;
+                        goto child_fail;
+                }
 
-                r = image_remove(image);
-                if (r == -EBUSY) /* keep images that are currently being used. */
-                        continue;
-                if (r < 0)
-                        return sd_bus_error_set_errnof(error, r, "Failed to remove image %s: %m", image->name);
+                HASHMAP_FOREACH(image, images, i) {
 
-                r = sd_bus_message_append(reply, "(st)", image->name, image->usage_exclusive);
-                if (r < 0)
-                        return r;
+                        /* We can't remove vendor images (i.e. those in /usr) */
+                        if (IMAGE_IS_VENDOR(image))
+                                continue;
+
+                        if (IMAGE_IS_HOST(image))
+                                continue;
+
+                        if (mode == REMOVE_HIDDEN && !IMAGE_IS_HIDDEN(image))
+                                continue;
+
+                        r = image_remove(image);
+                        if (r == -EBUSY) /* keep images that are currently being used. */
+                                continue;
+                        if (r < 0) {
+                                /* If the operation failed, let's override everything we wrote, and instead write there at which image we failed. */
+                                success = false;
+                                (void) ftruncate(result_fd, 0);
+                                (void) lseek(result_fd, 0, SEEK_SET);
+                                (void) write(result_fd, &success, sizeof(success));
+                                (void) write(result_fd, image->name, strlen(image->name)+1);
+                                goto child_fail;
+                        }
+
+                        l = write(result_fd, image->name, strlen(image->name)+1);
+                        if (l < 0) {
+                                r = -errno;
+                                goto child_fail;
+                        }
+
+                        l = write(result_fd, &image->usage_exclusive, sizeof(image->usage_exclusive));
+                        if (l < 0) {
+                                r = -errno;
+                                goto child_fail;
+                        }
+                }
+
+                result_fd = safe_close(result_fd);
+                _exit(EXIT_SUCCESS);
+
+        child_fail:
+                (void) write(errno_pipe_fd[1], &r, sizeof(r));
+                _exit(EXIT_FAILURE);
         }
 
-        r = sd_bus_message_close_container(reply);
-        if (r < 0)
+        errno_pipe_fd[1] = safe_close(errno_pipe_fd[1]);
+
+        /* The clean-up might take a while, hence install a watch on the child and return */
+
+        r = operation_new(m, NULL, child, message, errno_pipe_fd[0], &operation);
+        if (r < 0) {
+                (void) sigkill_wait(child);
                 return r;
+        }
 
-        return sd_bus_send(NULL, reply, NULL);
+        operation->extra_fd = result_fd;
+        operation->done = clean_pool_done;
+
+        result_fd = -1;
+        errno_pipe_fd[0] = -1;
+
+        return 1;
 }
 
 static int method_set_pool_limit(sd_bus_message *message, void *userdata, sd_bus_error *error) {
diff --git a/src/grp-machine/systemd-machined/machined.c b/src/grp-machine/systemd-machined/machined.c
index 83a74e2549..a01d1820a1 100644
--- a/src/grp-machine/systemd-machined/machined.c
+++ b/src/grp-machine/systemd-machined/machined.c
@@ -304,7 +304,7 @@ void manager_gc(Manager *m, bool drop_not_started) {
                     machine_get_state(machine) != MACHINE_CLOSING)
                         machine_stop(machine);
 
-                /* Now, the stop stop probably made this referenced
+                /* Now, the stop probably made this referenced
                  * again, but if it didn't, then it's time to let it
                  * go entirely. */
                 if (!machine_check_gc(machine, drop_not_started)) {
diff --git a/src/grp-machine/systemd-machined/operation.c b/src/grp-machine/systemd-machined/operation.c
index f1bcb1d860..f16c38c47a 100644
--- a/src/grp-machine/systemd-machined/operation.c
+++ b/src/grp-machine/systemd-machined/operation.c
@@ -31,7 +31,7 @@ static int operation_done(sd_event_source *s, const siginfo_t *si, void *userdat
         assert(o);
         assert(si);
 
-        log_debug("Operating " PID_FMT " is now complete with with code=%s status=%i",
+        log_debug("Operating " PID_FMT " is now complete with code=%s status=%i",
                   o->pid,
                   sigchld_code_to_string(si->si_code), si->si_status);
 
@@ -42,18 +42,33 @@ static int operation_done(sd_event_source *s, const siginfo_t *si, void *userdat
                 goto fail;
         }
 
-        if (si->si_status != EXIT_SUCCESS) {
-                if (read(o->errno_fd, &r, sizeof(r)) == sizeof(r))
-                        r = sd_bus_error_set_errnof(&error, r, "%m");
-                else
-                        r = sd_bus_error_setf(&error, SD_BUS_ERROR_FAILED, "Child failed.");
-
+        if (si->si_status == EXIT_SUCCESS)
+                r = 0;
+        else if (read(o->errno_fd, &r, sizeof(r)) != sizeof(r)) { /* Try to acquire error code for failed operation */
+                r = sd_bus_error_setf(&error, SD_BUS_ERROR_FAILED, "Child failed.");
                 goto fail;
         }
 
-        r = sd_bus_reply_method_return(o->message, NULL);
-        if (r < 0)
-                log_error_errno(r, "Failed to reply to message: %m");
+        if (o->done) {
+                /* A completion routine is set for this operation, call it. */
+                r = o->done(o, r, &error);
+                if (r < 0) {
+                        if (!sd_bus_error_is_set(&error))
+                                sd_bus_error_set_errno(&error, r);
+
+                        goto fail;
+                }
+
+        } else {
+                /* The default operation when done is to simply return an error on failure or an empty success
+                 * message on success. */
+                if (r < 0)
+                        goto fail;
+
+                r = sd_bus_reply_method_return(o->message, NULL);
+                if (r < 0)
+                        log_error_errno(r, "Failed to reply to message: %m");
+        }
 
         operation_free(o);
         return 0;
@@ -67,7 +82,7 @@ fail:
         return 0;
 }
 
-int operation_new(Manager *manager, Machine *machine, pid_t child, sd_bus_message *message, int errno_fd) {
+int operation_new(Manager *manager, Machine *machine, pid_t child, sd_bus_message *message, int errno_fd, Operation **ret) {
         Operation *o;
         int r;
 
@@ -80,6 +95,8 @@ int operation_new(Manager *manager, Machine *machine, pid_t child, sd_bus_messag
         if (!o)
                 return -ENOMEM;
 
+        o->extra_fd = -1;
+
         r = sd_event_add_child(manager->event, &o->event_source, child, WEXITED, operation_done, o);
         if (r < 0) {
                 free(o);
@@ -103,6 +120,9 @@ int operation_new(Manager *manager, Machine *machine, pid_t child, sd_bus_messag
 
         /* At this point we took ownership of both the child and the errno file descriptor! */
 
+        if (ret)
+                *ret = o;
+
         return 0;
 }
 
@@ -113,6 +133,7 @@ Operation *operation_free(Operation *o) {
         sd_event_source_unref(o->event_source);
 
         safe_close(o->errno_fd);
+        safe_close(o->extra_fd);
 
         if (o->pid > 1)
                 (void) sigkill_wait(o->pid);
diff --git a/src/grp-machine/systemd-machined/operation.h b/src/grp-machine/systemd-machined/operation.h
index 0821466a00..713ffe88c4 100644
--- a/src/grp-machine/systemd-machined/operation.h
+++ b/src/grp-machine/systemd-machined/operation.h
@@ -38,10 +38,12 @@ struct Operation {
         pid_t pid;
         sd_bus_message *message;
         int errno_fd;
+        int extra_fd;
         sd_event_source *event_source;
+        int (*done)(Operation *o, int ret, sd_bus_error *error);
         LIST_FIELDS(Operation, operations);
         LIST_FIELDS(Operation, operations_by_machine);
 };
 
-int operation_new(Manager *manager, Machine *machine, pid_t child, sd_bus_message *message, int errno_fd);
+int operation_new(Manager *manager, Machine *machine, pid_t child, sd_bus_message *message, int errno_fd, Operation **ret);
 Operation *operation_free(Operation *o);
diff --git a/src/grp-machine/systemd-machined/org.freedesktop.machine1.conf b/src/grp-machine/systemd-machined/org.freedesktop.machine1.conf
index 9d40b90151..562b9d3cc0 100644
--- a/src/grp-machine/systemd-machined/org.freedesktop.machine1.conf
+++ b/src/grp-machine/systemd-machined/org.freedesktop.machine1.conf
@@ -118,6 +118,10 @@
 
                 <allow send_destination="org.freedesktop.machine1"
                        send_interface="org.freedesktop.machine1.Manager"
+                       send_member="CleanPool"/>
+
+                <allow send_destination="org.freedesktop.machine1"
+                       send_interface="org.freedesktop.machine1.Manager"
                        send_member="MapFromMachineUser"/>
 
                 <allow send_destination="org.freedesktop.machine1"
diff --git a/src/grp-machine/systemd-machined/systemd-machined.service.in b/src/grp-machine/systemd-machined/systemd-machined.service.in
index 685baab21d..dcf9f347b7 100644
--- a/src/grp-machine/systemd-machined/systemd-machined.service.in
+++ b/src/grp-machine/systemd-machined/systemd-machined.service.in
@@ -17,6 +17,8 @@ ExecStart=@rootlibexecdir@/systemd-machined
 BusName=org.freedesktop.machine1
 CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
 WatchdogSec=3min
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io
 
 # Note that machined cannot be placed in a mount namespace, since it
 # needs access to the host's mount namespace in order to implement the
diff --git a/src/grp-network/libnetworkd-core/Makefile b/src/grp-network/libnetworkd-core/Makefile
index 4375a4d4f3..3821f06c0f 100644
--- a/src/grp-network/libnetworkd-core/Makefile
+++ b/src/grp-network/libnetworkd-core/Makefile
@@ -38,6 +38,8 @@ libnetworkd_core_la_SOURCES = \
 	src/network/networkd-link.c \
 	src/network/networkd-netdev.h \
 	src/network/networkd-netdev.c \
+	src/network/networkd-netdev-vrf.h \
+	src/network/networkd-netdev-vrf.c \
 	src/network/networkd-netdev-tunnel.h \
 	src/network/networkd-netdev-tunnel.c \
 	src/network/networkd-netdev-veth.h \
@@ -62,6 +64,7 @@ libnetworkd_core_la_SOURCES = \
 	src/network/networkd-ipv4ll.c \
 	src/network/networkd-dhcp4.c \
 	src/network/networkd-dhcp6.c \
+	src/network/networkd-ndisc.h \
 	src/network/networkd-ndisc.c \
 	src/network/networkd-network.h \
 	src/network/networkd-network.c \
@@ -74,6 +77,8 @@ libnetworkd_core_la_SOURCES = \
 	src/network/networkd-manager-bus.c \
 	src/network/networkd-fdb.h \
 	src/network/networkd-fdb.c \
+	src/network/networkd-brvlan.h \
+	src/network/networkd-brvlan.c \
 	src/network/networkd-address-pool.h \
 	src/network/networkd-address-pool.c \
 	src/network/networkd-util.h \
@@ -90,7 +95,7 @@ libnetworkd_core_la_LIBADD = \
 	libsystemd-network.la \
 	libsystemd-internal.la \
 	libfirewall.la \
-	libshared.la
+	libsystemd-shared.la
 
 sd.CPPFLAGS += -DPKGSYSCONFDIR=\"$(pkgsysconfdir)\"
 
diff --git a/src/grp-network/libnetworkd-core/networkd-address.c b/src/grp-network/libnetworkd-core/networkd-address.c
index 3c814db91b..cd24bc12f2 100644
--- a/src/grp-network/libnetworkd-core/networkd-address.c
+++ b/src/grp-network/libnetworkd-core/networkd-address.c
@@ -33,6 +33,9 @@
 #include "networkd-address.h"
 #include "networkd.h"
 
+#define ADDRESSES_PER_LINK_MAX 2048U
+#define STATIC_ADDRESSES_PER_NETWORK_MAX 1024U
+
 int address_new(Address **ret) {
         _cleanup_address_free_ Address *address = NULL;
 
@@ -55,6 +58,9 @@ int address_new_static(Network *network, unsigned section, Address **ret) {
         _cleanup_address_free_ Address *address = NULL;
         int r;
 
+        assert(network);
+        assert(ret);
+
         if (section) {
                 address = hashmap_get(network->addresses_by_section, UINT_TO_PTR(section));
                 if (address) {
@@ -65,18 +71,21 @@ int address_new_static(Network *network, unsigned section, Address **ret) {
                 }
         }
 
+        if (network->n_static_addresses >= STATIC_ADDRESSES_PER_NETWORK_MAX)
+                return -E2BIG;
+
         r = address_new(&address);
         if (r < 0)
                 return r;
 
         if (section) {
                 address->section = section;
-                hashmap_put(network->addresses_by_section,
-                            UINT_TO_PTR(address->section), address);
+                hashmap_put(network->addresses_by_section, UINT_TO_PTR(address->section), address);
         }
 
         address->network = network;
         LIST_APPEND(addresses, network->static_addresses, address);
+        network->n_static_addresses++;
 
         *ret = address;
         address = NULL;
@@ -90,10 +99,11 @@ void address_free(Address *address) {
 
         if (address->network) {
                 LIST_REMOVE(addresses, address->network->static_addresses, address);
+                assert(address->network->n_static_addresses > 0);
+                address->network->n_static_addresses--;
 
                 if (address->section)
-                        hashmap_remove(address->network->addresses_by_section,
-                                       UINT_TO_PTR(address->section));
+                        hashmap_remove(address->network->addresses_by_section, UINT_TO_PTR(address->section));
         }
 
         if (address->link) {
@@ -329,7 +339,12 @@ static int address_release(Address *address) {
         return 0;
 }
 
-int address_update(Address *address, unsigned char flags, unsigned char scope, struct ifa_cacheinfo *cinfo) {
+int address_update(
+                Address *address,
+                unsigned char flags,
+                unsigned char scope,
+                const struct ifa_cacheinfo *cinfo) {
+
         bool ready;
         int r;
 
@@ -384,31 +399,38 @@ int address_drop(Address *address) {
         return 0;
 }
 
-int address_get(Link *link, int family, const union in_addr_union *in_addr, unsigned char prefixlen, Address **ret) {
-        Address address = {}, *existing;
+int address_get(Link *link,
+                int family,
+                const union in_addr_union *in_addr,
+                unsigned char prefixlen,
+                Address **ret) {
+
+        Address address, *existing;
 
         assert(link);
         assert(in_addr);
-        assert(ret);
 
-        address.family = family;
-        address.in_addr = *in_addr;
-        address.prefixlen = prefixlen;
+        address = (Address) {
+                .family = family,
+                .in_addr = *in_addr,
+                .prefixlen = prefixlen,
+        };
 
         existing = set_get(link->addresses, &address);
         if (existing) {
-                *ret = existing;
-
+                if (ret)
+                        *ret = existing;
                 return 1;
-        } else {
-                existing = set_get(link->addresses_foreign, &address);
-                if (!existing)
-                        return -ENOENT;
         }
 
-        *ret = existing;
+        existing = set_get(link->addresses_foreign, &address);
+        if (existing) {
+                if (ret)
+                        *ret = existing;
+                return 0;
+        }
 
-        return 0;
+        return -ENOENT;
 }
 
 int address_remove(
@@ -510,7 +532,12 @@ static int address_acquire(Link *link, Address *original, Address **ret) {
         return 0;
 }
 
-int address_configure(Address *address, Link *link, sd_netlink_message_handler_t callback, bool update) {
+int address_configure(
+                Address *address,
+                Link *link,
+                sd_netlink_message_handler_t callback,
+                bool update) {
+
         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL;
         int r;
 
@@ -521,6 +548,11 @@ int address_configure(Address *address, Link *link, sd_netlink_message_handler_t
         assert(link->manager);
         assert(link->manager->rtnl);
 
+        /* If this is a new address, then refuse adding more than the limit */
+        if (address_get(link, address->family, &address->in_addr, address->prefixlen, NULL) <= 0 &&
+            set_size(link->addresses) >= ADDRESSES_PER_LINK_MAX)
+                return -E2BIG;
+
         r = address_acquire(link, address, &address);
         if (r < 0)
                 return r;
diff --git a/src/grp-network/libnetworkd-core/networkd-address.h b/src/grp-network/libnetworkd-core/networkd-address.h
index 1e178a0ca3..9378621580 100644
--- a/src/grp-network/libnetworkd-core/networkd-address.h
+++ b/src/grp-network/libnetworkd-core/networkd-address.h
@@ -63,7 +63,7 @@ void address_free(Address *address);
 int address_add_foreign(Link *link, int family, const union in_addr_union *in_addr, unsigned char prefixlen, Address **ret);
 int address_add(Link *link, int family, const union in_addr_union *in_addr, unsigned char prefixlen, Address **ret);
 int address_get(Link *link, int family, const union in_addr_union *in_addr, unsigned char prefixlen, Address **ret);
-int address_update(Address *address, unsigned char flags, unsigned char scope, struct ifa_cacheinfo *cinfo);
+int address_update(Address *address, unsigned char flags, unsigned char scope, const struct ifa_cacheinfo *cinfo);
 int address_drop(Address *address);
 int address_configure(Address *address, Link *link, sd_netlink_message_handler_t callback, bool update);
 int address_remove(Address *address, Link *link, sd_netlink_message_handler_t callback);
diff --git a/src/grp-network/libnetworkd-core/networkd-brvlan.c b/src/grp-network/libnetworkd-core/networkd-brvlan.c
new file mode 100644
index 0000000000..118a6ed464
--- /dev/null
+++ b/src/grp-network/libnetworkd-core/networkd-brvlan.c
@@ -0,0 +1,331 @@
+/***
+  This file is part of systemd.
+
+  Copyright (C) 2016 BISDN GmbH. All rights reserved.
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <netinet/in.h>
+#include <stdbool.h>
+
+#include <linux/if_bridge.h>
+
+#include "basic/alloc-util.h"
+#include "basic/parse-util.h"
+#include "sd-netlink/netlink-util.h"
+#include "shared/conf-parser.h"
+#include "shared/vlan-util.h"
+
+#include "networkd-brvlan.h"
+#include "networkd.h"
+
+static bool is_bit_set(unsigned bit, uint32_t scope) {
+        assert(bit < sizeof(scope)*8);
+        return scope & (1 << bit);
+}
+
+static inline void set_bit(unsigned nr, uint32_t *addr) {
+        if (nr < BRIDGE_VLAN_BITMAP_MAX)
+                addr[nr / 32] |= (((uint32_t) 1) << (nr % 32));
+}
+
+static int find_next_bit(int i, uint32_t x) {
+        int j;
+
+        if (i >= 32)
+                return -1;
+
+        /* find first bit */
+        if (i < 0)
+                return BUILTIN_FFS_U32(x);
+
+        /* mask off prior finds to get next */
+        j = __builtin_ffs(x >> i);
+        return j ? j + i : 0;
+}
+
+static int append_vlan_info_data(Link *const link, sd_netlink_message *req, uint16_t pvid, const uint32_t *br_vid_bitmap, const uint32_t *br_untagged_bitmap) {
+        struct bridge_vlan_info br_vlan;
+        int i, j, k, r, done, cnt;
+        uint16_t begin, end;
+        bool untagged = false;
+
+        assert(link);
+        assert(req);
+        assert(br_vid_bitmap);
+        assert(br_untagged_bitmap);
+
+        i = cnt = -1;
+
+        begin = end = UINT16_MAX;
+        for (k = 0; k < BRIDGE_VLAN_BITMAP_LEN; k++) {
+                unsigned base_bit;
+                uint32_t vid_map = br_vid_bitmap[k];
+                uint32_t untagged_map = br_untagged_bitmap[k];
+
+                base_bit = k * 32;
+                i = -1;
+                done = 0;
+                do {
+                        j = find_next_bit(i, vid_map);
+                        if (j > 0) {
+                                /* first hit of any bit */
+                                if (begin == UINT16_MAX && end == UINT16_MAX) {
+                                        begin = end = j - 1 + base_bit;
+                                        untagged = is_bit_set(j - 1, untagged_map);
+                                        goto next;
+                                }
+
+                                /* this bit is a continuation of prior bits */
+                                if (j - 2 + base_bit == end && untagged == is_bit_set(j - 1, untagged_map) && (uint16_t)j - 1 + base_bit != pvid && (uint16_t)begin != pvid) {
+                                        end++;
+                                        goto next;
+                                }
+                        } else
+                                done = 1;
+
+                        if (begin != UINT16_MAX) {
+                                cnt++;
+                                if (done && k < BRIDGE_VLAN_BITMAP_LEN - 1)
+                                        break;
+
+                                br_vlan.flags = 0;
+                                if (untagged)
+                                        br_vlan.flags |= BRIDGE_VLAN_INFO_UNTAGGED;
+
+                                if (begin == end) {
+                                        br_vlan.vid = begin;
+
+                                        if (begin == pvid)
+                                                br_vlan.flags |= BRIDGE_VLAN_INFO_PVID;
+
+                                        r = sd_netlink_message_append_data(req, IFLA_BRIDGE_VLAN_INFO, &br_vlan, sizeof(br_vlan));
+                                        if (r < 0)
+                                                return log_link_error_errno(link, r, "Could not append IFLA_BRIDGE_VLAN_INFO attribute: %m");
+                                } else {
+                                        br_vlan.vid = begin;
+                                        br_vlan.flags |= BRIDGE_VLAN_INFO_RANGE_BEGIN;
+
+                                        r = sd_netlink_message_append_data(req, IFLA_BRIDGE_VLAN_INFO, &br_vlan, sizeof(br_vlan));
+                                        if (r < 0)
+                                                return log_link_error_errno(link, r, "Could not append IFLA_BRIDGE_VLAN_INFO attribute: %m");
+
+                                        br_vlan.vid = end;
+                                        br_vlan.flags &= ~BRIDGE_VLAN_INFO_RANGE_BEGIN;
+                                        br_vlan.flags |= BRIDGE_VLAN_INFO_RANGE_END;
+
+                                        r = sd_netlink_message_append_data(req, IFLA_BRIDGE_VLAN_INFO, &br_vlan, sizeof(br_vlan));
+                                        if (r < 0)
+                                                return log_link_error_errno(link, r, "Could not append IFLA_BRIDGE_VLAN_INFO attribute: %m");
+                                }
+
+                                if (done)
+                                        break;
+                        }
+                        if (j > 0) {
+                                begin = end = j - 1 + base_bit;
+                                untagged = is_bit_set(j - 1, untagged_map);
+                        }
+
+                next:
+                        i = j;
+                } while(!done);
+        }
+        if (!cnt)
+                return -EINVAL;
+
+        return cnt;
+}
+
+static int set_brvlan_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
+        Link *link = userdata;
+        int r;
+
+        assert(link);
+
+        r = sd_netlink_message_get_errno(m);
+        if (r < 0 && r != -EEXIST)
+                log_link_error_errno(link, r, "Could not add VLAN to bridge port: %m");
+
+        return 1;
+}
+
+int br_vlan_configure(Link *link, uint16_t pvid, uint32_t *br_vid_bitmap, uint32_t *br_untagged_bitmap) {
+        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL;
+        int r;
+        uint16_t flags;
+        sd_netlink *rtnl;
+
+        assert(link);
+        assert(link->manager);
+        assert(br_vid_bitmap);
+        assert(br_untagged_bitmap);
+        assert(link->network);
+
+        /* pvid might not be in br_vid_bitmap yet */
+        if (pvid)
+                set_bit(pvid, br_vid_bitmap);
+
+        rtnl = link->manager->rtnl;
+
+        /* create new RTM message */
+        r = sd_rtnl_message_new_link(rtnl, &req, RTM_SETLINK, link->ifindex);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Could not allocate RTM_SETLINK message: %m");
+
+        r = sd_rtnl_message_link_set_family(req, PF_BRIDGE);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Could not set message family: %m");
+
+        r = sd_netlink_message_open_container(req, IFLA_AF_SPEC);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Could not open IFLA_AF_SPEC container: %m");
+
+        /* master needs flag self */
+        if (!link->network->bridge) {
+                flags = BRIDGE_FLAGS_SELF;
+                sd_netlink_message_append_data(req, IFLA_BRIDGE_FLAGS, &flags, sizeof(uint16_t));
+        }
+
+        /* add vlan info */
+        r = append_vlan_info_data(link, req, pvid, br_vid_bitmap, br_untagged_bitmap);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Could not append VLANs: %m");
+
+        r = sd_netlink_message_close_container(req);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Could not close IFLA_AF_SPEC container: %m");
+
+        /* send message to the kernel */
+        r = sd_netlink_call_async(rtnl, req, set_brvlan_handler, link, 0, NULL);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Could not send rtnetlink message: %m");
+
+        return 0;
+}
+
+static int parse_vid_range(const char *rvalue, uint16_t *vid, uint16_t *vid_end) {
+        int r;
+        char *p;
+        char *_rvalue = NULL;
+        uint16_t _vid = UINT16_MAX;
+        uint16_t _vid_end = UINT16_MAX;
+
+        assert(rvalue);
+        assert(vid);
+        assert(vid_end);
+
+        _rvalue = strdupa(rvalue);
+        p = strchr(_rvalue, '-');
+        if (p) {
+                *p = '\0';
+                p++;
+                r = parse_vlanid(_rvalue, &_vid);
+                if (r < 0)
+                        return r;
+
+                if (_vid == 0)
+                        return -ERANGE;
+
+                r = parse_vlanid(p, &_vid_end);
+                if (r < 0)
+                        return r;
+
+                if (_vid_end == 0)
+                        return -ERANGE;
+        } else {
+                r = parse_vlanid(_rvalue, &_vid);
+                if (r < 0)
+                        return r;
+
+                if (_vid == 0)
+                        return -ERANGE;
+        }
+
+        *vid = _vid;
+        *vid_end = _vid_end;
+        return r;
+}
+
+int config_parse_brvlan_vlan(const char *unit, const char *filename,
+                             unsigned line, const char *section,
+                             unsigned section_line, const char *lvalue,
+                             int ltype, const char *rvalue, void *data,
+                             void *userdata) {
+        Network *network = userdata;
+        int r;
+        uint16_t vid, vid_end;
+
+        assert(filename);
+        assert(section);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+
+        r = parse_vid_range(rvalue, &vid, &vid_end);
+        if (r < 0) {
+                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse VLAN, ignoring: %s", rvalue);
+                return 0;
+        }
+
+        if (UINT16_MAX == vid_end)
+                set_bit(vid++, network->br_vid_bitmap);
+        else {
+                if (vid >= vid_end) {
+                        log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid VLAN range, ignoring %s", rvalue);
+                        return 0;
+                }
+                for (; vid <= vid_end; vid++)
+                        set_bit(vid, network->br_vid_bitmap);
+        }
+        return 0;
+}
+
+int config_parse_brvlan_untagged(const char *unit, const char *filename,
+                                 unsigned line, const char *section,
+                                 unsigned section_line, const char *lvalue,
+                                 int ltype, const char *rvalue, void *data,
+                                 void *userdata) {
+        Network *network = userdata;
+        int r;
+        uint16_t vid, vid_end;
+
+        assert(filename);
+        assert(section);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+
+        r = parse_vid_range(rvalue, &vid, &vid_end);
+        if (r < 0) {
+                log_syntax(unit, LOG_ERR, filename, line, r, "Could not parse VLAN: %s", rvalue);
+                return 0;
+        }
+
+        if (UINT16_MAX == vid_end) {
+                set_bit(vid, network->br_vid_bitmap);
+                set_bit(vid, network->br_untagged_bitmap);
+        } else {
+                if (vid >= vid_end) {
+                        log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid VLAN range, ignoring %s", rvalue);
+                        return 0;
+                }
+                for (; vid <= vid_end; vid++) {
+                        set_bit(vid, network->br_vid_bitmap);
+                        set_bit(vid, network->br_untagged_bitmap);
+                }
+        }
+        return 0;
+}
diff --git a/src/grp-network/libnetworkd-core/networkd-brvlan.h b/src/grp-network/libnetworkd-core/networkd-brvlan.h
new file mode 100644
index 0000000000..6aa6883bfc
--- /dev/null
+++ b/src/grp-network/libnetworkd-core/networkd-brvlan.h
@@ -0,0 +1,29 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright (C) 2016 BISDN GmbH. All rights reserved.
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <stdint.h>
+
+typedef struct Link Link;
+
+int br_vlan_configure(Link *link, uint16_t pvid, uint32_t *br_vid_bitmap, uint32_t *br_untagged_bitmap);
+
+int config_parse_brvlan_vlan(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
+int config_parse_brvlan_untagged(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
diff --git a/src/grp-network/libnetworkd-core/networkd-conf.c b/src/grp-network/libnetworkd-core/networkd-conf.c
index e9993f9f32..44f5170219 100644
--- a/src/grp-network/libnetworkd-core/networkd-conf.c
+++ b/src/grp-network/libnetworkd-core/networkd-conf.c
@@ -71,7 +71,7 @@ int config_parse_duid_rawdata(
         for (;;) {
                 int n1, n2, len, r;
                 uint32_t byte;
-                 _cleanup_free_ char *cbyte = NULL;
+                _cleanup_free_ char *cbyte = NULL;
 
                 r = extract_first_word(&rvalue, &cbyte, ":", 0);
                 if (r < 0) {
diff --git a/src/grp-network/libnetworkd-core/networkd-dhcp4.c b/src/grp-network/libnetworkd-core/networkd-dhcp4.c
index fe565ad075..2e7858ccd3 100644
--- a/src/grp-network/libnetworkd-core/networkd-dhcp4.c
+++ b/src/grp-network/libnetworkd-core/networkd-dhcp4.c
@@ -556,7 +556,7 @@ int dhcp4_configure(Link *link) {
         if (r < 0)
                 return r;
 
-        r = sd_dhcp_client_set_index(link->dhcp_client, link->ifindex);
+        r = sd_dhcp_client_set_ifindex(link->dhcp_client, link->ifindex);
         if (r < 0)
                 return r;
 
diff --git a/src/grp-network/libnetworkd-core/networkd-dhcp6.c b/src/grp-network/libnetworkd-core/networkd-dhcp6.c
index 6399849ff6..d00190c520 100644
--- a/src/grp-network/libnetworkd-core/networkd-dhcp6.c
+++ b/src/grp-network/libnetworkd-core/networkd-dhcp6.c
@@ -61,10 +61,15 @@ static int dhcp6_address_handler(sd_netlink *rtnl, sd_netlink_message *m,
         return 1;
 }
 
-static int dhcp6_address_change(Link *link, struct in6_addr *ip6_addr,
-                                uint32_t lifetime_preferred, uint32_t lifetime_valid) {
-        int r;
+static int dhcp6_address_change(
+                Link *link,
+                struct in6_addr *ip6_addr,
+                uint32_t lifetime_preferred,
+                uint32_t lifetime_valid) {
+
         _cleanup_address_free_ Address *addr = NULL;
+        char buffer[INET6_ADDRSTRLEN];
+        int r;
 
         r = address_new(&addr);
         if (r < 0)
@@ -80,8 +85,8 @@ static int dhcp6_address_change(Link *link, struct in6_addr *ip6_addr,
         addr->cinfo.ifa_valid = lifetime_valid;
 
         log_link_info(link,
-                      "DHCPv6 address "SD_NDISC_ADDRESS_FORMAT_STR"/%d timeout preferred %d valid %d",
-                      SD_NDISC_ADDRESS_FORMAT_VAL(addr->in_addr.in6),
+                      "DHCPv6 address %s/%d timeout preferred %d valid %d",
+                      inet_ntop(AF_INET6, &addr->in_addr.in6, buffer, sizeof(buffer)),
                       addr->prefixlen, lifetime_preferred, lifetime_valid);
 
         r = address_configure(addr, link, dhcp6_address_handler, true);
@@ -165,19 +170,13 @@ static void dhcp6_handler(sd_dhcp6_client *client, int event, void *userdata) {
         link_check_ready(link);
 }
 
-int dhcp6_request_address(Link *link) {
+int dhcp6_request_address(Link *link, int ir) {
         int r, inf_req;
         bool running;
 
         assert(link);
         assert(link->dhcp6_client);
-
-        r = sd_dhcp6_client_get_information_request(link->dhcp6_client, &inf_req);
-        if (r < 0)
-                return r;
-
-        if (!inf_req)
-                return 0;
+        assert(in_addr_is_link_local(AF_INET6, (const union in_addr_union*)&link->ipv6ll_address) > 0);
 
         r = sd_dhcp6_client_is_running(link->dhcp6_client);
         if (r < 0)
@@ -186,12 +185,27 @@ int dhcp6_request_address(Link *link) {
                 running = !!r;
 
         if (running) {
+                r = sd_dhcp6_client_get_information_request(link->dhcp6_client, &inf_req);
+                if (r < 0)
+                        return r;
+
+                if (inf_req == ir)
+                        return 0;
+
                 r = sd_dhcp6_client_stop(link->dhcp6_client);
                 if (r < 0)
                         return r;
+        } else {
+                r = sd_dhcp6_client_set_local_address(link->dhcp6_client, &link->ipv6ll_address);
+                if (r < 0)
+                        return r;
         }
 
-        r = sd_dhcp6_client_set_information_request(link->dhcp6_client, false);
+        r = sd_dhcp6_client_set_information_request(link->dhcp6_client, ir);
+        if (r < 0)
+                return r;
+
+        r = sd_dhcp6_client_start(link->dhcp6_client);
         if (r < 0)
                 return r;
 
@@ -216,10 +230,6 @@ int dhcp6_configure(Link *link) {
         if (r < 0)
                 goto error;
 
-        r = sd_dhcp6_client_set_information_request(client, true);
-        if (r < 0)
-                goto error;
-
         r = sd_dhcp6_client_set_mac(client,
                                     (const uint8_t *) &link->mac,
                                     sizeof (link->mac), ARPHRD_ETHER);
@@ -238,7 +248,7 @@ int dhcp6_configure(Link *link) {
         if (r < 0)
                 goto error;
 
-        r = sd_dhcp6_client_set_index(client, link->ifindex);
+        r = sd_dhcp6_client_set_ifindex(client, link->ifindex);
         if (r < 0)
                 goto error;
 
diff --git a/src/grp-network/libnetworkd-core/networkd-fdb.c b/src/grp-network/libnetworkd-core/networkd-fdb.c
index 5f6146d52c..2949def65b 100644
--- a/src/grp-network/libnetworkd-core/networkd-fdb.c
+++ b/src/grp-network/libnetworkd-core/networkd-fdb.c
@@ -24,18 +24,24 @@
 #include "basic/util.h"
 #include "sd-netlink/netlink-util.h"
 #include "shared/conf-parser.h"
+#include "shared/vlan-util.h"
 
 #include "networkd-fdb.h"
 #include "networkd.h"
 
+#define STATIC_FDB_ENTRIES_PER_NETWORK_MAX 1024U
+
 /* create a new FDB entry or get an existing one. */
-int fdb_entry_new_static(Network *const network,
-                         const unsigned section,
-                         FdbEntry **ret) {
+int fdb_entry_new_static(
+                Network *network,
+                unsigned section,
+                FdbEntry **ret) {
+
         _cleanup_fdbentry_free_ FdbEntry *fdb_entry = NULL;
         struct ether_addr *mac_addr = NULL;
 
         assert(network);
+        assert(ret);
 
         /* search entry in hashmap first. */
         if (section) {
@@ -48,6 +54,9 @@ int fdb_entry_new_static(Network *const network,
                 }
         }
 
+        if (network->n_static_fdb_entries >= STATIC_FDB_ENTRIES_PER_NETWORK_MAX)
+                return -E2BIG;
+
         /* allocate space for MAC address. */
         mac_addr = new0(struct ether_addr, 1);
         if (!mac_addr)
@@ -55,7 +64,6 @@ int fdb_entry_new_static(Network *const network,
 
         /* allocate space for and FDB entry. */
         fdb_entry = new0(FdbEntry, 1);
-
         if (!fdb_entry) {
                 /* free previously allocated space for mac_addr. */
                 free(mac_addr);
@@ -67,6 +75,7 @@ int fdb_entry_new_static(Network *const network,
         fdb_entry->mac_addr = mac_addr;
 
         LIST_PREPEND(static_fdb_entries, network->static_fdb_entries, fdb_entry);
+        network->n_static_fdb_entries++;
 
         if (section) {
                 fdb_entry->section = section;
@@ -95,7 +104,7 @@ static int set_fdb_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userda
 }
 
 /* send a request to the kernel to add a FDB entry in its static MAC table. */
-int fdb_entry_configure(Link *const link, FdbEntry *const fdb_entry) {
+int fdb_entry_configure(Link *link, FdbEntry *fdb_entry) {
         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL;
         sd_netlink *rtnl;
         int r;
@@ -146,12 +155,13 @@ void fdb_entry_free(FdbEntry *fdb_entry) {
                 return;
 
         if (fdb_entry->network) {
-                LIST_REMOVE(static_fdb_entries, fdb_entry->network->static_fdb_entries,
-                            fdb_entry);
+                LIST_REMOVE(static_fdb_entries, fdb_entry->network->static_fdb_entries, fdb_entry);
+
+                assert(fdb_entry->network->n_static_fdb_entries > 0);
+                fdb_entry->network->n_static_fdb_entries--;
 
                 if (fdb_entry->section)
-                        hashmap_remove(fdb_entry->network->fdb_entries_by_section,
-                                       UINT_TO_PTR(fdb_entry->section));
+                        hashmap_remove(fdb_entry->network->fdb_entries_by_section, UINT_TO_PTR(fdb_entry->section));
         }
 
         free(fdb_entry->mac_addr);
@@ -232,9 +242,9 @@ int config_parse_fdb_vlan_id(
         if (r < 0)
                 return log_oom();
 
-        r = config_parse_unsigned(unit, filename, line, section,
-                                  section_line, lvalue, ltype,
-                                  rvalue, &fdb_entry->vlan_id, userdata);
+        r = config_parse_vlanid(unit, filename, line, section,
+                                section_line, lvalue, ltype,
+                                rvalue, &fdb_entry->vlan_id, userdata);
         if (r < 0)
                 return r;
 
diff --git a/src/grp-network/libnetworkd-core/networkd-fdb.h b/src/grp-network/libnetworkd-core/networkd-fdb.h
index c04a2b0d37..a1ad4183dc 100644
--- a/src/grp-network/libnetworkd-core/networkd-fdb.h
+++ b/src/grp-network/libnetworkd-core/networkd-fdb.h
@@ -36,9 +36,9 @@ struct FdbEntry {
         LIST_FIELDS(FdbEntry, static_fdb_entries);
 };
 
-int fdb_entry_new_static(Network *const network, const unsigned section, FdbEntry **ret);
+int fdb_entry_new_static(Network *network, unsigned section, FdbEntry **ret);
 void fdb_entry_free(FdbEntry *fdb_entry);
-int fdb_entry_configure(Link *const link, FdbEntry *const fdb_entry);
+int fdb_entry_configure(Link *link, FdbEntry *fdb_entry);
 
 DEFINE_TRIVIAL_CLEANUP_FUNC(FdbEntry*, fdb_entry_free);
 #define _cleanup_fdbentry_free_ _cleanup_(fdb_entry_freep)
diff --git a/src/grp-network/libnetworkd-core/networkd-ipv4ll.c b/src/grp-network/libnetworkd-core/networkd-ipv4ll.c
index 735cbc624d..5c6ffe30a7 100644
--- a/src/grp-network/libnetworkd-core/networkd-ipv4ll.c
+++ b/src/grp-network/libnetworkd-core/networkd-ipv4ll.c
@@ -140,7 +140,7 @@ static int ipv4ll_address_claimed(sd_ipv4ll *ll, Link *link) {
         ll_addr->family = AF_INET;
         ll_addr->in_addr.in = address;
         ll_addr->prefixlen = 16;
-        ll_addr->broadcast.s_addr = ll_addr->in_addr.in.s_addr | htonl(0xfffffffflu >> ll_addr->prefixlen);
+        ll_addr->broadcast.s_addr = ll_addr->in_addr.in.s_addr | htobe32(0xfffffffflu >> ll_addr->prefixlen);
         ll_addr->scope = RT_SCOPE_LINK;
 
         r = address_configure(ll_addr, link, ipv4ll_address_handler, false);
@@ -217,9 +217,7 @@ int ipv4ll_configure(Link *link) {
         if (link->udev_device) {
                 r = net_get_unique_predictable_data(link->udev_device, &seed);
                 if (r >= 0) {
-                        assert_cc(sizeof(unsigned) <= 8);
-
-                        r = sd_ipv4ll_set_address_seed(link->ipv4ll, (unsigned)seed);
+                        r = sd_ipv4ll_set_address_seed(link->ipv4ll, seed);
                         if (r < 0)
                                 return r;
                 }
@@ -233,7 +231,7 @@ int ipv4ll_configure(Link *link) {
         if (r < 0)
                 return r;
 
-        r = sd_ipv4ll_set_index(link->ipv4ll, link->ifindex);
+        r = sd_ipv4ll_set_ifindex(link->ipv4ll, link->ifindex);
         if (r < 0)
                 return r;
 
diff --git a/src/grp-network/libnetworkd-core/networkd-link.c b/src/grp-network/libnetworkd-core/networkd-link.c
index 72f6b5057e..d73629d679 100644
--- a/src/grp-network/libnetworkd-core/networkd-link.c
+++ b/src/grp-network/libnetworkd-core/networkd-link.c
@@ -38,6 +38,7 @@
 #include "systemd-network/network-internal.h"
 
 #include "networkd-lldp-tx.h"
+#include "networkd-ndisc.h"
 #include "networkd.h"
 
 static bool link_dhcp6_enabled(Link *link) {
@@ -112,7 +113,11 @@ static bool link_ipv6_enabled(Link *link) {
         if (!socket_ipv6_is_supported())
                 return false;
 
-        return link_dhcp6_enabled(link) || link_ipv6ll_enabled(link) || network_has_static_ipv6_addresses(link->network);
+        if (link->network->bridge)
+                return false;
+
+        /* DHCPv6 client will not be started if no IPv6 link-local address is configured. */
+        return link_ipv6ll_enabled(link) || network_has_static_ipv6_addresses(link->network);
 }
 
 static bool link_lldp_rx_enabled(Link *link) {
@@ -393,7 +398,7 @@ static int link_update_flags(Link *link, sd_netlink_message *m) {
 static int link_new(Manager *manager, sd_netlink_message *message, Link **ret) {
         _cleanup_link_unref_ Link *link = NULL;
         uint16_t type;
-        const char *ifname;
+        const char *ifname, *kind = NULL;
         int r, ifindex;
         unsigned short iftype;
 
@@ -401,6 +406,15 @@ static int link_new(Manager *manager, sd_netlink_message *message, Link **ret) {
         assert(message);
         assert(ret);
 
+        /* check for link kind */
+        r = sd_netlink_message_enter_container(message, IFLA_LINKINFO);
+        if (r == 0) {
+                (void)sd_netlink_message_read_string(message, IFLA_INFO_KIND, &kind);
+                r = sd_netlink_message_exit_container(message);
+                if (r < 0)
+                        return r;
+        }
+
         r = sd_netlink_message_get_type(message, &type);
         if (r < 0)
                 return r;
@@ -435,6 +449,12 @@ static int link_new(Manager *manager, sd_netlink_message *message, Link **ret) {
         if (!link->ifname)
                 return -ENOMEM;
 
+        if (kind) {
+                link->kind = strdup(kind);
+                if (!link->kind)
+                        return -ENOMEM;
+        }
+
         r = sd_netlink_message_read_ether_addr(message, IFLA_ADDRESS, &link->mac);
         if (r < 0)
                 log_link_debug_errno(link, r, "MAC address not found for new device, continuing without");
@@ -502,13 +522,18 @@ static void link_free(Link *link) {
 
         sd_ipv4ll_unref(link->ipv4ll);
         sd_dhcp6_client_unref(link->dhcp6_client);
-        sd_ndisc_unref(link->ndisc_router_discovery);
+        sd_ndisc_unref(link->ndisc);
+
+        set_free_free(link->ndisc_rdnss);
+        set_free_free(link->ndisc_dnssl);
 
         if (link->manager)
                 hashmap_remove(link->manager->links, INT_TO_PTR(link->ifindex));
 
         free(link->ifname);
 
+        free(link->kind);
+
         (void)unlink(link->state_file);
         free(link->state_file);
 
@@ -614,8 +639,8 @@ static int link_stop_clients(Link *link) {
                         r = log_link_warning_errno(link, k, "Could not stop DHCPv6 client: %m");
         }
 
-        if (link->ndisc_router_discovery) {
-                k = sd_ndisc_stop(link->ndisc_router_discovery);
+        if (link->ndisc) {
+                k = sd_ndisc_stop(link->ndisc);
                 if (k < 0)
                         r = log_link_warning_errno(link, k, "Could not stop IPv6 Router Discovery: %m");
         }
@@ -1090,7 +1115,17 @@ int link_address_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, void *u
         return 1;
 }
 
-static int link_set_bridge_fdb(Link *const link) {
+static int link_set_bridge_vlan(Link *link) {
+        int r = 0;
+
+        r = br_vlan_configure(link, link->network->pvid, link->network->br_vid_bitmap, link->network->br_untagged_bitmap);
+        if (r < 0)
+                log_link_error_errno(link, r, "Failed to assign VLANs to bridge port: %m");
+
+        return r;
+}
+
+static int link_set_bridge_fdb(Link *link) {
         FdbEntry *fdb_entry;
         int r = 0;
 
@@ -1105,7 +1140,7 @@ static int link_set_bridge_fdb(Link *const link) {
         return r;
 }
 
-static int link_set_proxy_arp(Link *const link) {
+static int link_set_proxy_arp(Link *link) {
         const char *p = NULL;
         int r;
 
@@ -1442,23 +1477,20 @@ static int link_acquire_ipv6_conf(Link *link) {
                 assert(link->dhcp6_client);
                 assert(in_addr_is_link_local(AF_INET6, (const union in_addr_union*)&link->ipv6ll_address) > 0);
 
-                log_link_debug(link, "Acquiring DHCPv6 lease");
-
-                r = sd_dhcp6_client_set_local_address(link->dhcp6_client, &link->ipv6ll_address);
-                if (r < 0 && r != -EBUSY)
-                        return log_link_warning_errno(link, r, "Could not set IPv6LL address in DHCP client: %m");
-
-                r = sd_dhcp6_client_start(link->dhcp6_client);
+                /* start DHCPv6 client in stateless mode */
+                r = dhcp6_request_address(link, true);
                 if (r < 0 && r != -EBUSY)
                         return log_link_warning_errno(link, r,  "Could not acquire DHCPv6 lease: %m");
+                else
+                        log_link_debug(link, "Acquiring DHCPv6 lease");
         }
 
         if (link_ipv6_accept_ra_enabled(link)) {
-                assert(link->ndisc_router_discovery);
+                assert(link->ndisc);
 
                 log_link_debug(link, "Discovering IPv6 routers");
 
-                r = sd_ndisc_router_discovery_start(link->ndisc_router_discovery);
+                r = sd_ndisc_start(link->ndisc);
                 if (r < 0 && r != -EBUSY)
                         return log_link_warning_errno(link, r, "Could not start IPv6 Router Discovery: %m");
         }
@@ -1569,6 +1601,13 @@ static int link_up(Link *link) {
         if (r < 0)
                 return log_link_error_errno(link, r, "Could not allocate RTM_SETLINK message: %m");
 
+        /* set it free if not enslaved with networkd */
+        if (!link->network->bridge && !link->network->bond && !link->network->vrf) {
+                r = sd_netlink_message_append_u32(req, IFLA_MASTER, 0);
+                if (r < 0)
+                        return log_link_error_errno(link, r, "Could not append IFLA_MASTER attribute: %m");
+        }
+
         r = sd_rtnl_message_link_set_flags(req, IFF_UP, IFF_UP);
         if (r < 0)
                 return log_link_error_errno(link, r, "Could not set link flags: %m");
@@ -1579,8 +1618,8 @@ static int link_up(Link *link) {
                         return log_link_error_errno(link, r, "Could not set MAC address: %m");
         }
 
-        /* If IPv6 not configured (no static IPv6 address and neither DHCPv6 nor IPv6LL is enabled)
-           for this interface then disable IPv6 else enable it. */
+        /* If IPv6 not configured (no static IPv6 address and IPv6LL autoconfiguration is disabled)
+           for this interface, or if it is a bridge slave, then disable IPv6 else enable it. */
         (void) link_enable_ipv6(link);
 
         if (link->network->mtu) {
@@ -1609,7 +1648,20 @@ static int link_up(Link *link) {
                 if (r < 0)
                         return log_link_error_errno(link, r, "Could not open AF_INET6 container: %m");
 
-                ipv6ll_mode = link_ipv6ll_enabled(link) ? IN6_ADDR_GEN_MODE_EUI64 : IN6_ADDR_GEN_MODE_NONE;
+                if (!link_ipv6ll_enabled(link))
+                        ipv6ll_mode = IN6_ADDR_GEN_MODE_NONE;
+                else {
+                        const char *p = NULL;
+                        _cleanup_free_ char *stable_secret = NULL;
+
+                        p = strjoina("/proc/sys/net/ipv6/conf/", link->ifname, "/stable_secret");
+                        r = read_one_line_file(p, &stable_secret);
+
+                        if (r < 0)
+                                ipv6ll_mode = IN6_ADDR_GEN_MODE_EUI64;
+                        else
+                                ipv6ll_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
+                }
                 r = sd_netlink_message_append_u8(req, IFLA_INET6_ADDR_GEN_MODE, ipv6ll_mode);
                 if (r < 0)
                         return log_link_error_errno(link, r, "Could not append IFLA_INET6_ADDR_GEN_MODE: %m");
@@ -1955,6 +2007,12 @@ static int link_joined(Link *link) {
                         log_link_error_errno(link, r, "Could not set bridge message: %m");
         }
 
+        if (link->network->bridge || streq_ptr("bridge", link->kind)) {
+                r = link_set_bridge_vlan(link);
+                if (r < 0)
+                        log_link_error_errno(link, r, "Could not set bridge vlan: %m");
+        }
+
         return link_enter_set_addresses(link);
 }
 
@@ -1999,6 +2057,7 @@ static int link_enter_join_netdev(Link *link) {
 
         if (!link->network->bridge &&
             !link->network->bond &&
+            !link->network->vrf &&
             hashmap_isempty(link->network->stacked_netdevs))
                 return link_joined(link);
 
@@ -2045,6 +2104,26 @@ static int link_enter_join_netdev(Link *link) {
                 link->enslaving++;
         }
 
+        if (link->network->vrf) {
+                log_struct(LOG_DEBUG,
+                           LOG_LINK_INTERFACE(link),
+                           LOG_NETDEV_INTERFACE(link->network->vrf),
+                           LOG_LINK_MESSAGE(link, "Enslaving by '%s'", link->network->vrf->ifname),
+                           NULL);
+                r = netdev_join(link->network->vrf, link, netdev_join_handler);
+                if (r < 0) {
+                        log_struct_errno(LOG_WARNING, r,
+                                         LOG_LINK_INTERFACE(link),
+                                         LOG_NETDEV_INTERFACE(link->network->vrf),
+                                         LOG_LINK_MESSAGE(link, "Could not join netdev '%s': %m", link->network->vrf->ifname),
+                                         NULL);
+                        link_enter_failed(link);
+                        return r;
+                }
+
+                link->enslaving++;
+        }
+
         HASHMAP_FOREACH(netdev, link->network->stacked_netdevs, i) {
 
                 log_struct(LOG_DEBUG,
@@ -2096,7 +2175,7 @@ static int link_set_ipv6_forward(Link *link) {
         if (!link_ipv6_forward_enabled(link))
                 return 0;
 
-        /* On Linux, the IPv6 stack does not not know a per-interface
+        /* On Linux, the IPv6 stack does not know a per-interface
          * packet forwarding setting: either packet forwarding is on
          * for all, or off for all. We hence don't bother with a
          * per-interface setting, but simply propagate the interface
@@ -2148,7 +2227,7 @@ static int link_set_ipv6_accept_ra(Link *link) {
 
         p = strjoina("/proc/sys/net/ipv6/conf/", link->ifname, "/accept_ra");
 
-        /* We handle router advertisments ourselves, tell the kernel to GTFO */
+        /* We handle router advertisements ourselves, tell the kernel to GTFO */
         r = write_string_file(p, "0", WRITE_STRING_FILE_VERIFY_ON_FAILURE);
         if (r < 0)
                 log_link_warning_errno(link, r, "Cannot disable kernel IPv6 accept_ra for interface: %m");
@@ -2233,7 +2312,7 @@ static int link_drop_foreign_config(Link *link) {
                 if (route->protocol == RTPROT_KERNEL)
                         continue;
 
-                r = route_remove(route, link, link_address_remove_handler);
+                r = route_remove(route, link, link_route_remove_handler);
                 if (r < 0)
                         return r;
         }
@@ -2345,7 +2424,11 @@ static int link_configure(Link *link) {
         }
 
         if (link_lldp_rx_enabled(link)) {
-                r = sd_lldp_new(&link->lldp, link->ifindex);
+                r = sd_lldp_new(&link->lldp);
+                if (r < 0)
+                        return r;
+
+                r = sd_lldp_set_ifindex(link->lldp, link->ifindex);
                 if (r < 0)
                         return r;
 
@@ -2645,7 +2728,7 @@ network_file_fail:
 
                 r = sd_dhcp_client_set_request_address(link->dhcp_client, &address.in);
                 if (r < 0)
-                        return log_link_error_errno(link, r, "Falied to set inital DHCPv4 address %s: %m", dhcp4_address);
+                        return log_link_error_errno(link, r, "Falied to set initial DHCPv4 address %s: %m", dhcp4_address);
         }
 
 dhcp4_address_fail:
@@ -2663,7 +2746,7 @@ dhcp4_address_fail:
 
                 r = sd_ipv4ll_set_address(link->ipv4ll, &address.in);
                 if (r < 0)
-                        return log_link_error_errno(link, r, "Falied to set inital IPv4LL address %s: %m", ipv4ll_address);
+                        return log_link_error_errno(link, r, "Falied to set initial IPv4LL address %s: %m", ipv4ll_address);
         }
 
 ipv4ll_address_fail:
@@ -3064,6 +3147,22 @@ int link_save(Link *link) {
                                 if (space)
                                         fputc(' ', f);
                                 serialize_in6_addrs(f, in6_addrs, r);
+                                space = true;
+                        }
+                }
+
+                /* Make sure to flush out old entries before we use the NDISC data */
+                ndisc_vacuum(link);
+
+                if (link->network->dhcp_use_dns && link->ndisc_rdnss) {
+                        NDiscRDNSS *dd;
+
+                        SET_FOREACH(dd, link->ndisc_rdnss, i) {
+                                if (space)
+                                        fputc(' ', f);
+
+                                serialize_in6_addrs(f, &dd->address, 1);
+                                space = true;
                         }
                 }
 
@@ -3109,7 +3208,6 @@ int link_save(Link *link) {
                 if (link->network->dhcp_use_domains != DHCP_USE_DOMAINS_NO) {
                         if (link->dhcp_lease)
                                 (void) sd_dhcp_lease_get_domainname(link->dhcp_lease, &dhcp_domainname);
-
                         if (dhcp6_lease)
                                 (void) sd_dhcp6_lease_get_domains(dhcp6_lease, &dhcp6_domains);
                 }
@@ -3117,22 +3215,34 @@ int link_save(Link *link) {
                 fputs("DOMAINS=", f);
                 fputstrv(f, link->network->search_domains, NULL, &space);
 
-                if (link->network->dhcp_use_domains == DHCP_USE_DOMAINS_YES && dhcp_domainname)
-                        fputs_with_space(f, dhcp_domainname, NULL, &space);
+                if (link->network->dhcp_use_domains == DHCP_USE_DOMAINS_YES) {
+                        NDiscDNSSL *dd;
 
-                if (link->network->dhcp_use_domains == DHCP_USE_DOMAINS_YES && dhcp6_domains)
-                        fputstrv(f, dhcp6_domains, NULL, &space);
+                        if (dhcp_domainname)
+                                fputs_with_space(f, dhcp_domainname, NULL, &space);
+                        if (dhcp6_domains)
+                                fputstrv(f, dhcp6_domains, NULL, &space);
+
+                        SET_FOREACH(dd, link->ndisc_dnssl, i)
+                                fputs_with_space(f, NDISC_DNSSL_DOMAIN(dd), NULL, &space);
+                }
 
                 fputc('\n', f);
 
                 fputs("ROUTE_DOMAINS=", f);
                 fputstrv(f, link->network->route_domains, NULL, NULL);
 
-                if (link->network->dhcp_use_domains == DHCP_USE_DOMAINS_ROUTE && dhcp_domainname)
-                        fputs_with_space(f, dhcp_domainname, NULL, &space);
+                if (link->network->dhcp_use_domains == DHCP_USE_DOMAINS_ROUTE) {
+                        NDiscDNSSL *dd;
 
-                if (link->network->dhcp_use_domains == DHCP_USE_DOMAINS_ROUTE && dhcp6_domains)
-                        fputstrv(f, dhcp6_domains, NULL, &space);
+                        if (dhcp_domainname)
+                                fputs_with_space(f, dhcp_domainname, NULL, &space);
+                        if (dhcp6_domains)
+                                fputstrv(f, dhcp6_domains, NULL, &space);
+
+                        SET_FOREACH(dd, link->ndisc_dnssl, i)
+                                fputs_with_space(f, NDISC_DNSSL_DOMAIN(dd), NULL, &space);
+                }
 
                 fputc('\n', f);
 
diff --git a/src/grp-network/libnetworkd-core/networkd-link.h b/src/grp-network/libnetworkd-core/networkd-link.h
index ac10bd41b7..5c7b64a243 100644
--- a/src/grp-network/libnetworkd-core/networkd-link.h
+++ b/src/grp-network/libnetworkd-core/networkd-link.h
@@ -68,6 +68,7 @@ typedef struct Link {
 
         int ifindex;
         char *ifname;
+        char *kind;
         unsigned short iftype;
         char *state_file;
         struct ether_addr mac;
@@ -98,6 +99,7 @@ typedef struct Link {
         unsigned dhcp4_messages;
         bool dhcp4_configured;
         bool dhcp6_configured;
+
         unsigned ndisc_messages;
         bool ndisc_configured;
 
@@ -111,7 +113,10 @@ typedef struct Link {
 
         sd_dhcp_server *dhcp_server;
 
-        sd_ndisc *ndisc_router_discovery;
+        sd_ndisc *ndisc;
+        Set *ndisc_rdnss;
+        Set *ndisc_dnssl;
+
         sd_dhcp6_client *dhcp6_client;
         bool rtnl_extended_attrs;
 
@@ -160,8 +165,7 @@ int link_set_timezone(Link *link, const char *timezone);
 int ipv4ll_configure(Link *link);
 int dhcp4_configure(Link *link);
 int dhcp6_configure(Link *link);
-int dhcp6_request_address(Link *link);
-int ndisc_configure(Link *link);
+int dhcp6_request_address(Link *link, int ir);
 
 const char* link_state_to_string(LinkState s) _const_;
 LinkState link_state_from_string(const char *s) _pure_;
diff --git a/src/grp-network/libnetworkd-core/networkd-ndisc.c b/src/grp-network/libnetworkd-core/networkd-ndisc.c
index c454be7ba3..27fbf3bc76 100644
--- a/src/grp-network/libnetworkd-core/networkd-ndisc.c
+++ b/src/grp-network/libnetworkd-core/networkd-ndisc.c
@@ -17,16 +17,16 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include <netinet/ether.h>
 #include <netinet/icmp6.h>
-#include <netinet/in.h>
-
-#include <linux/if.h>
 
 #include "systemd-network/sd-ndisc.h"
 
+#include "networkd-ndisc.h"
 #include "networkd.h"
 
+#define NDISC_DNSSL_MAX 64U
+#define NDISC_RDNSS_MAX 64U
+
 static int ndisc_netlink_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
         _cleanup_link_unref_ Link *link = userdata;
         int r;
@@ -50,19 +50,92 @@ static int ndisc_netlink_handler(sd_netlink *rtnl, sd_netlink_message *m, void *
         return 1;
 }
 
-static void ndisc_prefix_autonomous_handler(sd_ndisc *nd, const struct in6_addr *prefix, unsigned prefixlen,
-                                            unsigned lifetime_preferred, unsigned lifetime_valid, void *userdata) {
-        _cleanup_address_free_ Address *address = NULL;
-        Link *link = userdata;
+static void ndisc_router_process_default(Link *link, sd_ndisc_router *rt) {
+        _cleanup_route_free_ Route *route = NULL;
+        struct in6_addr gateway;
+        uint16_t lifetime;
+        unsigned preference;
         usec_t time_now;
         int r;
 
-        assert(nd);
         assert(link);
-        assert(link->network);
+        assert(rt);
 
-        if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
+        r = sd_ndisc_router_get_lifetime(rt, &lifetime);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get gateway address from RA: %m");
+                return;
+        }
+        if (lifetime == 0) /* not a default router */
+                return;
+
+        r = sd_ndisc_router_get_address(rt, &gateway);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get gateway address from RA: %m");
+                return;
+        }
+
+        r = sd_ndisc_router_get_preference(rt, &preference);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get default router preference from RA: %m");
+                return;
+        }
+
+        r = sd_ndisc_router_get_timestamp(rt, clock_boottime_or_monotonic(), &time_now);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RA timestamp: %m");
+                return;
+        }
+
+        r = route_new(&route);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Could not allocate route: %m");
+                return;
+        }
+
+        route->family = AF_INET6;
+        route->table = RT_TABLE_MAIN;
+        route->protocol = RTPROT_RA;
+        route->pref = preference;
+        route->gw.in6 = gateway;
+        route->lifetime = time_now + lifetime * USEC_PER_SEC;
+
+        r = route_configure(route, link, ndisc_netlink_handler);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Could not set default route: %m");
+                link_enter_failed(link);
+                return;
+        }
+
+        link->ndisc_messages++;
+}
+
+static void ndisc_router_process_autonomous_prefix(Link *link, sd_ndisc_router *rt) {
+        _cleanup_address_free_ Address *address = NULL;
+        uint32_t lifetime_valid, lifetime_preferred;
+        unsigned prefixlen;
+        int r;
+
+        assert(link);
+        assert(rt);
+
+        r = sd_ndisc_router_prefix_get_prefixlen(rt, &prefixlen);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix length: %m");
                 return;
+        }
+
+        r = sd_ndisc_router_prefix_get_valid_lifetime(rt, &lifetime_valid);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix valid lifetime: %m");
+                return;
+        }
+
+        r = sd_ndisc_router_prefix_get_preferred_lifetime(rt, &lifetime_preferred);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix preferred lifetime: %m");
+                return;
+        }
 
         r = address_new(&address);
         if (r < 0) {
@@ -70,10 +143,13 @@ static void ndisc_prefix_autonomous_handler(sd_ndisc *nd, const struct in6_addr
                 return;
         }
 
-        assert_se(sd_event_now(link->manager->event, clock_boottime_or_monotonic(), &time_now) >= 0);
-
         address->family = AF_INET6;
-        address->in_addr.in6 = *prefix;
+        r = sd_ndisc_router_prefix_get_address(rt, &address->in_addr.in6);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix address: %m");
+                return;
+        }
+
         if (in_addr_is_null(AF_INET6, (const union in_addr_union *) &link->network->ipv6_token) == 0)
                 memcpy(((char *)&address->in_addr.in6) + 8, ((char *)&link->network->ipv6_token) + 8, 8);
         else {
@@ -103,17 +179,33 @@ static void ndisc_prefix_autonomous_handler(sd_ndisc *nd, const struct in6_addr
         link->ndisc_messages++;
 }
 
-static void ndisc_prefix_onlink_handler(sd_ndisc *nd, const struct in6_addr *prefix, unsigned prefixlen, unsigned lifetime, void *userdata) {
+static void ndisc_router_process_onlink_prefix(Link *link, sd_ndisc_router *rt) {
         _cleanup_route_free_ Route *route = NULL;
-        Link *link = userdata;
         usec_t time_now;
+        uint32_t lifetime;
+        unsigned prefixlen;
         int r;
 
-        assert(nd);
         assert(link);
+        assert(rt);
 
-        if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
+        r = sd_ndisc_router_get_timestamp(rt, clock_boottime_or_monotonic(), &time_now);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RA timestamp: %m");
                 return;
+        }
+
+        r = sd_ndisc_router_prefix_get_prefixlen(rt, &prefixlen);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix length: %m");
+                return;
+        }
+
+        r = sd_ndisc_router_prefix_get_valid_lifetime(rt, &lifetime);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix lifetime: %m");
+                return;
+        }
 
         r = route_new(&route);
         if (r < 0) {
@@ -121,16 +213,19 @@ static void ndisc_prefix_onlink_handler(sd_ndisc *nd, const struct in6_addr *pre
                 return;
         }
 
-        assert_se(sd_event_now(link->manager->event, clock_boottime_or_monotonic(), &time_now) >= 0);
-
         route->family = AF_INET6;
         route->table = RT_TABLE_MAIN;
         route->protocol = RTPROT_RA;
         route->flags = RTM_F_PREFIX;
-        route->dst.in6 = *prefix;
         route->dst_prefixlen = prefixlen;
         route->lifetime = time_now + lifetime * USEC_PER_SEC;
 
+        r = sd_ndisc_router_prefix_get_address(rt, &route->dst.in6);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get prefix address: %m");
+                return;
+        }
+
         r = route_configure(route, link, ndisc_netlink_handler);
         if (r < 0) {
                 log_link_warning_errno(link, r, "Could not set prefix route: %m");
@@ -141,34 +236,47 @@ static void ndisc_prefix_onlink_handler(sd_ndisc *nd, const struct in6_addr *pre
         link->ndisc_messages++;
 }
 
-static void ndisc_router_handler(sd_ndisc *nd, uint8_t flags, const struct in6_addr *gateway, unsigned lifetime, int pref, void *userdata) {
+static void ndisc_router_process_route(Link *link, sd_ndisc_router *rt) {
         _cleanup_route_free_ Route *route = NULL;
-        Link *link = userdata;
+        struct in6_addr gateway;
+        uint32_t lifetime;
+        unsigned preference, prefixlen;
         usec_t time_now;
         int r;
 
         assert(link);
-        assert(link->network);
-        assert(link->manager);
 
-        if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
+        r = sd_ndisc_router_route_get_lifetime(rt, &lifetime);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get gateway address from RA: %m");
+                return;
+        }
+        if (lifetime == 0)
                 return;
 
-        if (flags & (ND_RA_FLAG_MANAGED | ND_RA_FLAG_OTHER)) {
-                if (flags & ND_RA_FLAG_MANAGED)
-                        dhcp6_request_address(link);
+        r = sd_ndisc_router_get_address(rt, &gateway);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get gateway address from RA: %m");
+                return;
+        }
 
-                r = sd_dhcp6_client_set_local_address(link->dhcp6_client, &link->ipv6ll_address);
-                if (r < 0 && r != -EBUSY)
-                        log_link_warning_errno(link, r, "Could not set IPv6LL address in DHCP client: %m");
+        r = sd_ndisc_router_route_get_prefixlen(rt, &prefixlen);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get route prefix length: %m");
+                return;
+        }
 
-                r = sd_dhcp6_client_start(link->dhcp6_client);
-                if (r < 0 && r != -EBUSY)
-                        log_link_warning_errno(link, r, "Starting DHCPv6 client on NDisc request failed: %m");
+        r = sd_ndisc_router_route_get_preference(rt, &preference);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get default router preference from RA: %m");
+                return;
         }
 
-        if (!gateway)
+        r = sd_ndisc_router_get_timestamp(rt, clock_boottime_or_monotonic(), &time_now);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RA timestamp: %m");
                 return;
+        }
 
         r = route_new(&route);
         if (r < 0) {
@@ -176,18 +284,23 @@ static void ndisc_router_handler(sd_ndisc *nd, uint8_t flags, const struct in6_a
                 return;
         }
 
-        assert_se(sd_event_now(link->manager->event, clock_boottime_or_monotonic(), &time_now) >= 0);
-
         route->family = AF_INET6;
         route->table = RT_TABLE_MAIN;
         route->protocol = RTPROT_RA;
-        route->pref = pref;
-        route->gw.in6 = *gateway;
+        route->pref = preference;
+        route->gw.in6 = gateway;
+        route->dst_prefixlen = prefixlen;
         route->lifetime = time_now + lifetime * USEC_PER_SEC;
 
+        r = sd_ndisc_router_route_get_address(rt, &route->dst.in6);
+        if (r < 0) {
+                log_link_error_errno(link, r, "Failed to get route address: %m");
+                return;
+        }
+
         r = route_configure(route, link, ndisc_netlink_handler);
         if (r < 0) {
-                log_link_warning_errno(link, r, "Could not set default route: %m");
+                log_link_warning_errno(link, r, "Could not set additional route: %m");
                 link_enter_failed(link);
                 return;
         }
@@ -195,33 +308,303 @@ static void ndisc_router_handler(sd_ndisc *nd, uint8_t flags, const struct in6_a
         link->ndisc_messages++;
 }
 
-static void ndisc_handler(sd_ndisc *nd, int event, void *userdata) {
-        Link *link = userdata;
+static void ndisc_rdnss_hash_func(const void *p, struct siphash *state) {
+        const NDiscRDNSS *x = p;
+
+        siphash24_compress(&x->address, sizeof(x->address), state);
+}
+
+static int ndisc_rdnss_compare_func(const void *_a, const void *_b) {
+        const NDiscRDNSS *a = _a, *b = _b;
+
+        return memcmp(&a->address, &b->address, sizeof(a->address));
+}
+
+static const struct hash_ops ndisc_rdnss_hash_ops = {
+        .hash = ndisc_rdnss_hash_func,
+        .compare = ndisc_rdnss_compare_func
+};
+
+static void ndisc_router_process_rdnss(Link *link, sd_ndisc_router *rt) {
+        uint32_t lifetime;
+        const struct in6_addr *a;
+        usec_t time_now;
+        int i, n, r;
+
+        assert(link);
+        assert(rt);
+
+        r = sd_ndisc_router_get_timestamp(rt, clock_boottime_or_monotonic(), &time_now);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RA timestamp: %m");
+                return;
+        }
+
+        r = sd_ndisc_router_rdnss_get_lifetime(rt, &lifetime);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RDNSS lifetime: %m");
+                return;
+        }
+
+        n = sd_ndisc_router_rdnss_get_addresses(rt, &a);
+        if (n < 0) {
+                log_link_warning_errno(link, n, "Failed to get RDNSS addresses: %m");
+                return;
+        }
+
+        for (i = 0; i < n; i++) {
+                NDiscRDNSS d = {
+                        .address = a[i]
+                }, *x;
+
+                if (lifetime == 0) {
+                        (void) set_remove(link->ndisc_rdnss, &d);
+                        link_dirty(link);
+                        continue;
+                }
+
+                x = set_get(link->ndisc_rdnss, &d);
+                if (x) {
+                        x->valid_until = time_now + lifetime * USEC_PER_SEC;
+                        continue;
+                }
+
+                ndisc_vacuum(link);
+
+                if (set_size(link->ndisc_rdnss) >= NDISC_RDNSS_MAX) {
+                        log_link_warning(link, "Too many RDNSS records per link, ignoring.");
+                        continue;
+                }
+
+                r = set_ensure_allocated(&link->ndisc_rdnss, &ndisc_rdnss_hash_ops);
+                if (r < 0) {
+                        log_oom();
+                        return;
+                }
+
+                x = new0(NDiscRDNSS, 1);
+                if (!x) {
+                        log_oom();
+                        return;
+                }
+
+                x->address = a[i];
+                x->valid_until = time_now + lifetime * USEC_PER_SEC;
+
+                r = set_put(link->ndisc_rdnss, x);
+                if (r < 0) {
+                        free(x);
+                        log_oom();
+                        return;
+                }
+
+                assert(r > 0);
+                link_dirty(link);
+        }
+}
+
+static void ndisc_dnssl_hash_func(const void *p, struct siphash *state) {
+        const NDiscDNSSL *x = p;
+
+        siphash24_compress(NDISC_DNSSL_DOMAIN(x), strlen(NDISC_DNSSL_DOMAIN(x)), state);
+}
+
+static int ndisc_dnssl_compare_func(const void *_a, const void *_b) {
+        const NDiscDNSSL *a = _a, *b = _b;
+
+        return strcmp(NDISC_DNSSL_DOMAIN(a), NDISC_DNSSL_DOMAIN(b));
+}
+
+static const struct hash_ops ndisc_dnssl_hash_ops = {
+        .hash = ndisc_dnssl_hash_func,
+        .compare = ndisc_dnssl_compare_func
+};
+
+static void ndisc_router_process_dnssl(Link *link, sd_ndisc_router *rt) {
+        _cleanup_strv_free_ char **l = NULL;
+        uint32_t lifetime;
+        usec_t time_now;
+        char **i;
         int r;
 
         assert(link);
+        assert(rt);
 
-        if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
+        r = sd_ndisc_router_get_timestamp(rt, clock_boottime_or_monotonic(), &time_now);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RA timestamp: %m");
                 return;
+        }
 
-        switch (event) {
-        case SD_NDISC_EVENT_TIMEOUT:
-                dhcp6_request_address(link);
+        r = sd_ndisc_router_dnssl_get_lifetime(rt, &lifetime);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RDNSS lifetime: %m");
+                return;
+        }
 
-                r = sd_dhcp6_client_set_local_address(link->dhcp6_client, &link->ipv6ll_address);
-                if (r < 0 && r != -EBUSY)
-                        log_link_warning_errno(link, r, "Could not set IPv6LL address in DHCP client: %m");
+        r = sd_ndisc_router_dnssl_get_domains(rt, &l);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RDNSS addresses: %m");
+                return;
+        }
+
+        STRV_FOREACH(i, l) {
+                _cleanup_free_ NDiscDNSSL *s;
+                NDiscDNSSL *x;
+
+                s = malloc0(ALIGN(sizeof(NDiscDNSSL)) + strlen(*i) + 1);
+                if (!s) {
+                        log_oom();
+                        return;
+                }
+
+                strcpy(NDISC_DNSSL_DOMAIN(s), *i);
+
+                if (lifetime == 0) {
+                        (void) set_remove(link->ndisc_dnssl, s);
+                        link_dirty(link);
+                        continue;
+                }
+
+                x = set_get(link->ndisc_dnssl, s);
+                if (x) {
+                        x->valid_until = time_now + lifetime * USEC_PER_SEC;
+                        continue;
+                }
+
+                ndisc_vacuum(link);
+
+                if (set_size(link->ndisc_dnssl) >= NDISC_DNSSL_MAX) {
+                        log_link_warning(link, "Too many DNSSL records per link, ignoring.");
+                        continue;
+                }
+
+                r = set_ensure_allocated(&link->ndisc_dnssl, &ndisc_dnssl_hash_ops);
+                if (r < 0) {
+                        log_oom();
+                        return;
+                }
+
+                s->valid_until = time_now + lifetime * USEC_PER_SEC;
+
+                r = set_put(link->ndisc_dnssl, s);
+                if (r < 0) {
+                        log_oom();
+                        return;
+                }
+
+                s = NULL;
+                assert(r > 0);
+                link_dirty(link);
+        }
+}
+
+static void ndisc_router_process_options(Link *link, sd_ndisc_router *rt) {
+        int r;
+
+        assert(link);
+        assert(rt);
+
+        r = sd_ndisc_router_option_rewind(rt);
+        for (;;) {
+                uint8_t type;
+
+                if (r < 0) {
+                        log_link_warning_errno(link, r, "Failed to iterate through options: %m");
+                        return;
+                }
+                if (r == 0) /* EOF */
+                        break;
+
+                r = sd_ndisc_router_option_get_type(rt, &type);
+                if (r < 0) {
+                        log_link_warning_errno(link, r, "Failed to get RA option type: %m");
+                        return;
+                }
+
+                switch (type) {
+
+                case SD_NDISC_OPTION_PREFIX_INFORMATION: {
+                        uint8_t flags;
+
+                        r = sd_ndisc_router_prefix_get_flags(rt, &flags);
+                        if (r < 0) {
+                                log_link_warning_errno(link, r, "Failed to get RA prefix flags: %m");
+                                return;
+                        }
+
+                        if (flags & ND_OPT_PI_FLAG_ONLINK)
+                                ndisc_router_process_onlink_prefix(link, rt);
+                        if (flags & ND_OPT_PI_FLAG_AUTO)
+                                ndisc_router_process_autonomous_prefix(link, rt);
+
+                        break;
+                }
+
+                case SD_NDISC_OPTION_ROUTE_INFORMATION:
+                        ndisc_router_process_route(link, rt);
+                        break;
+
+                case SD_NDISC_OPTION_RDNSS:
+                        ndisc_router_process_rdnss(link, rt);
+                        break;
+
+                case SD_NDISC_OPTION_DNSSL:
+                        ndisc_router_process_dnssl(link, rt);
+                        break;
+                }
+
+                r = sd_ndisc_router_option_next(rt);
+        }
+}
+
+static void ndisc_router_handler(Link *link, sd_ndisc_router *rt) {
+        uint64_t flags;
+        int r;
 
-                r = sd_dhcp6_client_start(link->dhcp6_client);
+        assert(link);
+        assert(link->network);
+        assert(link->manager);
+        assert(rt);
+
+        r = sd_ndisc_router_get_flags(rt, &flags);
+        if (r < 0) {
+                log_link_warning_errno(link, r, "Failed to get RA flags: %m");
+                return;
+        }
+
+        if (flags & (ND_RA_FLAG_MANAGED | ND_RA_FLAG_OTHER)) {
+                /* (re)start DHCPv6 client in stateful or stateless mode according to RA flags */
+                r = dhcp6_request_address(link, !(flags & ND_RA_FLAG_MANAGED));
                 if (r < 0 && r != -EBUSY)
-                        log_link_warning_errno(link, r, "Starting DHCPv6 client after NDisc timeout failed: %m");
+                        log_link_warning_errno(link, r, "Could not acquire DHCPv6 lease on NDisc request: %m");
+                else
+                        log_link_debug(link, "Acquiring DHCPv6 lease on NDisc request");
+        }
+
+        ndisc_router_process_default(link, rt);
+        ndisc_router_process_options(link, rt);
+}
 
+static void ndisc_handler(sd_ndisc *nd, sd_ndisc_event event, sd_ndisc_router *rt, void *userdata) {
+        Link *link = userdata;
+
+        assert(link);
+
+        if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
+                return;
+
+        switch (event) {
+
+        case SD_NDISC_EVENT_ROUTER:
+                ndisc_router_handler(link, rt);
+                break;
+
+        case SD_NDISC_EVENT_TIMEOUT:
                 link->ndisc_configured = true;
                 link_check_ready(link);
 
                 break;
-        case SD_NDISC_EVENT_STOP:
-                break;
         default:
                 log_link_warning(link, "IPv6 Neighbor Discovery unknown event: %d", event);
         }
@@ -230,30 +613,52 @@ static void ndisc_handler(sd_ndisc *nd, int event, void *userdata) {
 int ndisc_configure(Link *link) {
         int r;
 
-        assert_return(link, -EINVAL);
+        assert(link);
+
+        r = sd_ndisc_new(&link->ndisc);
+        if (r < 0)
+                return r;
 
-        r = sd_ndisc_new(&link->ndisc_router_discovery);
+        r = sd_ndisc_attach_event(link->ndisc, NULL, 0);
         if (r < 0)
                 return r;
 
-        r = sd_ndisc_attach_event(link->ndisc_router_discovery, NULL, 0);
+        r = sd_ndisc_set_mac(link->ndisc, &link->mac);
         if (r < 0)
                 return r;
 
-        r = sd_ndisc_set_mac(link->ndisc_router_discovery, &link->mac);
+        r = sd_ndisc_set_ifindex(link->ndisc, link->ifindex);
         if (r < 0)
                 return r;
 
-        r = sd_ndisc_set_index(link->ndisc_router_discovery, link->ifindex);
+        r = sd_ndisc_set_callback(link->ndisc, ndisc_handler, link);
         if (r < 0)
                 return r;
 
-        r = sd_ndisc_set_callback(link->ndisc_router_discovery,
-                                  ndisc_router_handler,
-                                  ndisc_prefix_onlink_handler,
-                                  ndisc_prefix_autonomous_handler,
-                                  ndisc_handler,
-                                  link);
+        return 0;
+}
+
+void ndisc_vacuum(Link *link) {
+        NDiscRDNSS *r;
+        NDiscDNSSL *d;
+        Iterator i;
+        usec_t time_now;
+
+        assert(link);
+
+        /* Removes all RDNSS and DNSSL entries whose validity time has passed */
+
+        time_now = now(clock_boottime_or_monotonic());
+
+        SET_FOREACH(r, link->ndisc_rdnss, i)
+                if (r->valid_until < time_now) {
+                        (void) set_remove(link->ndisc_rdnss, r);
+                        link_dirty(link);
+                }
 
-        return r;
+        SET_FOREACH(d, link->ndisc_dnssl, i)
+                if (d->valid_until < time_now) {
+                        (void) set_remove(link->ndisc_dnssl, d);
+                        link_dirty(link);
+                }
 }
diff --git a/src/grp-network/libnetworkd-core/networkd-ndisc.h b/src/grp-network/libnetworkd-core/networkd-ndisc.h
new file mode 100644
index 0000000000..2002f55107
--- /dev/null
+++ b/src/grp-network/libnetworkd-core/networkd-ndisc.h
@@ -0,0 +1,39 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2013 Tom Gundersen <teg@jklm.no>
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "networkd-link.h"
+
+typedef struct NDiscRDNSS {
+        usec_t valid_until;
+        struct in6_addr address;
+} NDiscRDNSS;
+
+typedef struct NDiscDNSSL {
+        usec_t valid_until;
+        /* The domain name follows immediately. */
+} NDiscDNSSL;
+
+static inline char* NDISC_DNSSL_DOMAIN(const NDiscDNSSL *n) {
+        return ((char*) n) + ALIGN(sizeof(NDiscDNSSL));
+}
+
+int ndisc_configure(Link *link);
+void ndisc_vacuum(Link *link);
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-bridge.c b/src/grp-network/libnetworkd-core/networkd-netdev-bridge.c
index 54ef059df0..2de2587e36 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-bridge.c
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-bridge.c
@@ -103,6 +103,12 @@ static int netdev_bridge_post_create(NetDev *netdev, Link *link, sd_netlink_mess
                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_BR_MCAST_SNOOPING attribute: %m");
         }
 
+        if (b->vlan_filtering >= 0) {
+                r = sd_netlink_message_append_u8(req, IFLA_BR_VLAN_FILTERING, b->vlan_filtering);
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BR_VLAN_FILTERING attribute: %m");
+        }
+
         r = sd_netlink_message_close_container(req);
         if (r < 0)
                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_LINKINFO attribute: %m");
@@ -129,6 +135,7 @@ static void bridge_init(NetDev *n) {
 
         b->mcast_querier = -1;
         b->mcast_snooping = -1;
+        b->vlan_filtering = -1;
 }
 
 const NetDevVTable bridge_vtable = {
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-bridge.h b/src/grp-network/libnetworkd-core/networkd-netdev-bridge.h
index f2ae21fc50..a637aea0a3 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-bridge.h
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-bridge.h
@@ -26,6 +26,7 @@ typedef struct Bridge {
 
         int mcast_querier;
         int mcast_snooping;
+        int vlan_filtering;
 
         usec_t forward_delay;
         usec_t hello_time;
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-gperf.gperf b/src/grp-network/libnetworkd-core/networkd-netdev-gperf.gperf
index 09eed25146..e478b53f43 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-gperf.gperf
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-gperf.gperf
@@ -2,6 +2,7 @@
 #include <stddef.h>
 
 #include "shared/conf-parser.h"
+#include "shared/vlan-util.h"
 #include "systemd-network/network-internal.h"
 
 #include "networkd-netdev-bond.h"
@@ -12,6 +13,7 @@
 #include "networkd-netdev-tuntap.h"
 #include "networkd-netdev-veth.h"
 #include "networkd-netdev-vlan.h"
+#include "networkd-netdev-vrf.h"
 #include "networkd-netdev-vxlan.h"
 #include "networkd-netdev.h"
 %}
@@ -35,7 +37,7 @@ NetDev.Name,                 config_parse_ifname,                0,
 NetDev.Kind,                 config_parse_netdev_kind,           0,                             offsetof(NetDev, kind)
 NetDev.MTUBytes,             config_parse_iec_size,              0,                             offsetof(NetDev, mtu)
 NetDev.MACAddress,           config_parse_hwaddr,                0,                             offsetof(NetDev, mac)
-VLAN.Id,                     config_parse_uint64,                0,                             offsetof(VLan, id)
+VLAN.Id,                     config_parse_vlanid,                0,                             offsetof(VLan, id)
 MACVLAN.Mode,                config_parse_macvlan_mode,          0,                             offsetof(MacVlan, mode)
 MACVTAP.Mode,                config_parse_macvlan_mode,          0,                             offsetof(MacVlan, mode)
 IPVLAN.Mode,                 config_parse_ipvlan_mode,           0,                             offsetof(IPVlan, mode)
@@ -43,6 +45,9 @@ Tunnel.Local,                config_parse_tunnel_address,        0,
 Tunnel.Remote,               config_parse_tunnel_address,        0,                             offsetof(Tunnel, remote)
 Tunnel.TOS,                  config_parse_unsigned,              0,                             offsetof(Tunnel, tos)
 Tunnel.TTL,                  config_parse_unsigned,              0,                             offsetof(Tunnel, ttl)
+Tunnel.Key,                  config_parse_tunnel_key,            0,                             offsetof(Tunnel, key)
+Tunnel.InputKey,             config_parse_tunnel_key,            0,                             offsetof(Tunnel, ikey)
+Tunnel.OutputKey,            config_parse_tunnel_key,            0,                             offsetof(Tunnel, okey)
 Tunnel.DiscoverPathMTU,      config_parse_bool,                  0,                             offsetof(Tunnel, pmtudisc)
 Tunnel.Mode,                 config_parse_ip6tnl_mode,           0,                             offsetof(Tunnel, ip6tnl_mode)
 Tunnel.IPv6FlowLabel,        config_parse_ipv6_flowlabel,        0,                             offsetof(Tunnel, ipv6_flowlabel)
@@ -102,3 +107,5 @@ Bridge.MaxAgeSec,            config_parse_sec,                   0,
 Bridge.ForwardDelaySec,      config_parse_sec,                   0,                             offsetof(Bridge, forward_delay)
 Bridge.MulticastQuerier,     config_parse_tristate,              0,                             offsetof(Bridge, mcast_querier)
 Bridge.MulticastSnooping,    config_parse_tristate,              0,                             offsetof(Bridge, mcast_snooping)
+Bridge.VLANFiltering,        config_parse_tristate,              0,                             offsetof(Bridge, vlan_filtering)
+VRF.TableId,                 config_parse_uint32,                0,                             offsetof(Vrf, table_id)
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.c b/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.c
index c372dd7860..e94c19126b 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.c
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.c
@@ -36,7 +36,7 @@
 #include "networkd-netdev-tunnel.h"
 
 #define DEFAULT_TNL_HOP_LIMIT   64
-#define IP6_FLOWINFO_FLOWLABEL  htonl(0x000FFFFF)
+#define IP6_FLOWINFO_FLOWLABEL  htobe32(0x000FFFFF)
 
 static const char* const ip6tnl_mode_table[_NETDEV_IP6_TNL_MODE_MAX] = {
         [NETDEV_IP6_TNL_MODE_IP6IP6] = "ip6ip6",
@@ -201,6 +201,33 @@ static int netdev_ip6gre_fill_message_create(NetDev *netdev, Link *link, sd_netl
         return r;
 }
 
+static int netdev_vti_fill_message_key(NetDev *netdev, Link *link, sd_netlink_message *m) {
+        Tunnel *t = VTI(netdev);
+        uint32_t ikey, okey;
+        int r;
+
+        assert(link);
+        assert(m);
+        assert(t);
+
+        if (t->key != 0)
+                ikey = okey = htobe32(t->key);
+        else {
+                ikey = htobe32(t->ikey);
+                okey = htobe32(t->okey);
+        }
+
+        r = sd_netlink_message_append_u32(m, IFLA_VTI_IKEY, ikey);
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_IKEY attribute: %m");
+
+        r = sd_netlink_message_append_u32(m, IFLA_VTI_OKEY, okey);
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_OKEY attribute: %m");
+
+        return 0;
+}
+
 static int netdev_vti_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
         Tunnel *t = VTI(netdev);
         int r;
@@ -215,6 +242,10 @@ static int netdev_vti_fill_message_create(NetDev *netdev, Link *link, sd_netlink
         if (r < 0)
                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
 
+        r = netdev_vti_fill_message_key(netdev, link, m);
+        if (r < 0)
+                return r;
+
         r = sd_netlink_message_append_in_addr(m, IFLA_VTI_LOCAL, &t->local.in);
         if (r < 0)
                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
@@ -240,6 +271,10 @@ static int netdev_vti6_fill_message_create(NetDev *netdev, Link *link, sd_netlin
         if (r < 0)
                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
 
+        r = netdev_vti_fill_message_key(netdev, link, m);
+        if (r < 0)
+                return r;
+
         r = sd_netlink_message_append_in6_addr(m, IFLA_VTI_LOCAL, &t->local.in6);
         if (r < 0)
                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
@@ -414,6 +449,46 @@ int config_parse_tunnel_address(const char *unit,
         return 0;
 }
 
+int config_parse_tunnel_key(const char *unit,
+                            const char *filename,
+                            unsigned line,
+                            const char *section,
+                            unsigned section_line,
+                            const char *lvalue,
+                            int ltype,
+                            const char *rvalue,
+                            void *data,
+                            void *userdata) {
+        union in_addr_union buffer;
+        Tunnel *t = userdata;
+        uint32_t k;
+        int r;
+
+        assert(filename);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+
+        r = in_addr_from_string(AF_INET, rvalue, &buffer);
+        if (r < 0) {
+                r = safe_atou32(rvalue, &k);
+                if (r < 0) {
+                        log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to parse tunnel key ignoring assignment: %s", rvalue);
+                        return 0;
+                }
+        } else
+                k = be32toh(buffer.in.s_addr);
+
+        if (streq(lvalue, "Key"))
+                t->key = k;
+        else if (streq(lvalue, "InputKey"))
+                t->ikey = k;
+        else
+                t->okey = k;
+
+        return 0;
+}
+
 int config_parse_ipv6_flowlabel(const char* unit,
                                 const char *filename,
                                 unsigned line,
@@ -445,7 +520,7 @@ int config_parse_ipv6_flowlabel(const char* unit,
                 if (k > 0xFFFFF)
                         log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to parse IPv6 flowlabel option, ignoring: %s", rvalue);
                 else {
-                        *ipv6_flowlabel = htonl(k) & IP6_FLOWINFO_FLOWLABEL;
+                        *ipv6_flowlabel = htobe32(k) & IP6_FLOWINFO_FLOWLABEL;
                         t->flags &= ~IP6_TNL_F_USE_ORIG_FLOWLABEL;
                 }
         }
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.h b/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.h
index 6b65431e7e..09bd86656e 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.h
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-tunnel.h
@@ -49,6 +49,10 @@ typedef struct Tunnel {
         unsigned tos;
         unsigned flags;
 
+        uint32_t key;
+        uint32_t ikey;
+        uint32_t okey;
+
         union in_addr_union local;
         union in_addr_union remote;
 
@@ -108,3 +112,8 @@ int config_parse_encap_limit(const char *unit, const char *filename,
                              unsigned section_line, const char *lvalue,
                              int ltype, const char *rvalue, void *data,
                              void *userdata);
+int config_parse_tunnel_key(const char *unit, const char *filename,
+                            unsigned line, const char *section,
+                            unsigned section_line, const char *lvalue,
+                            int ltype, const char *rvalue, void *data,
+                            void *userdata);
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-vlan.c b/src/grp-network/libnetworkd-core/networkd-netdev-vlan.c
index b1f4714afa..0c24d5e859 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-vlan.c
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-vlan.c
@@ -19,6 +19,8 @@
 
 #include <net/if.h>
 
+#include "shared/vlan-util.h"
+
 #include "networkd-netdev-vlan.h"
 
 static int netdev_vlan_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *req) {
@@ -33,11 +35,9 @@ static int netdev_vlan_fill_message_create(NetDev *netdev, Link *link, sd_netlin
 
         assert(v);
 
-        if (v->id <= VLANID_MAX) {
-                r = sd_netlink_message_append_u16(req, IFLA_VLAN_ID, v->id);
-                if (r < 0)
-                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_VLAN_ID attribute: %m");
-        }
+        r = sd_netlink_message_append_u16(req, IFLA_VLAN_ID, v->id);
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VLAN_ID attribute: %m");
 
         return 0;
 }
@@ -52,8 +52,8 @@ static int netdev_vlan_verify(NetDev *netdev, const char *filename) {
 
         assert(v);
 
-        if (v->id > VLANID_MAX) {
-                log_warning("VLAN without valid Id (%"PRIu64") configured in %s. Ignoring", v->id, filename);
+        if (v->id == VLANID_INVALID) {
+                log_warning("VLAN without valid Id (%"PRIu16") configured in %s.", v->id, filename);
                 return -EINVAL;
         }
 
@@ -66,7 +66,7 @@ static void vlan_init(NetDev *netdev) {
         assert(netdev);
         assert(v);
 
-        v->id = VLANID_MAX + 1;
+        v->id = VLANID_INVALID;
 }
 
 const NetDevVTable vlan_vtable = {
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-vlan.h b/src/grp-network/libnetworkd-core/networkd-netdev-vlan.h
index 73aacf4a0f..2dfe314b6e 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev-vlan.h
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-vlan.h
@@ -23,12 +23,10 @@ typedef struct VLan VLan;
 
 #include "networkd-netdev.h"
 
-#define VLANID_MAX 4094
-
 struct VLan {
         NetDev meta;
 
-        uint64_t id;
+        uint16_t id;
 };
 
 DEFINE_NETDEV_CAST(VLAN, VLan);
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-vrf.c b/src/grp-network/libnetworkd-core/networkd-netdev-vrf.c
new file mode 100644
index 0000000000..8f91a11757
--- /dev/null
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-vrf.c
@@ -0,0 +1,51 @@
+/***
+    This file is part of systemd.
+
+    Copyright 2016 Andreas Rammhold <andreas@rammhold.de>
+
+    systemd is free software; you can redistribute it and/or modify it
+    under the terms of the GNU Lesser General Public License as published by
+    the Free Software Foundation; either version 2.1 of the License, or
+    (at your option) any later version.
+
+    systemd is distributed in the hope that it will be useful, but
+    WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <net/if.h>
+
+#include "basic/missing.h"
+#include "sd-netlink/sd-netlink.h"
+
+#include "networkd-netdev-vrf.h"
+
+static int netdev_vrf_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
+        Vrf *v;
+        int r;
+
+        assert(netdev);
+        assert(!link);
+        assert(m);
+
+        v = VRF(netdev);
+
+        assert(v);
+
+        r = sd_netlink_message_append_u32(m, IFLA_VRF_TABLE, v->table_id);
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IPLA_VRF_TABLE attribute: %m");
+
+        return r;
+}
+
+const NetDevVTable vrf_vtable = {
+        .object_size = sizeof(Vrf),
+        .sections = "NetDev\0VRF\0",
+        .fill_message_create = netdev_vrf_fill_message_create,
+        .create_type = NETDEV_CREATE_MASTER,
+};
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev-vrf.h b/src/grp-network/libnetworkd-core/networkd-netdev-vrf.h
new file mode 100644
index 0000000000..3d92a26a4d
--- /dev/null
+++ b/src/grp-network/libnetworkd-core/networkd-netdev-vrf.h
@@ -0,0 +1,33 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Andreas Rammhold <andreas@rammhold.de>
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+typedef struct Vrf Vrf;
+
+#include "networkd-netdev.h"
+
+struct Vrf {
+        NetDev meta;
+
+        uint32_t table_id;
+};
+
+DEFINE_NETDEV_CAST(VRF, Vrf);
+extern const NetDevVTable vrf_vtable;
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev.c b/src/grp-network/libnetworkd-core/networkd-netdev.c
index c421042196..7cc5969cce 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev.c
+++ b/src/grp-network/libnetworkd-core/networkd-netdev.c
@@ -56,6 +56,8 @@ const NetDevVTable * const netdev_vtable[_NETDEV_KIND_MAX] = {
         [NETDEV_KIND_TUN] = &tun_vtable,
         [NETDEV_KIND_TAP] = &tap_vtable,
         [NETDEV_KIND_IP6TNL] = &ip6tnl_vtable,
+        [NETDEV_KIND_VRF] = &vrf_vtable,
+
 };
 
 static const char* const netdev_kind_table[_NETDEV_KIND_MAX] = {
@@ -79,6 +81,8 @@ static const char* const netdev_kind_table[_NETDEV_KIND_MAX] = {
         [NETDEV_KIND_TUN] = "tun",
         [NETDEV_KIND_TAP] = "tap",
         [NETDEV_KIND_IP6TNL] = "ip6tnl",
+        [NETDEV_KIND_VRF] = "vrf",
+
 };
 
 DEFINE_STRING_TABLE_LOOKUP(netdev_kind, NetDevKind);
@@ -199,7 +203,7 @@ static int netdev_enslave_ready(NetDev *netdev, Link* link, sd_netlink_message_h
         assert(netdev->state == NETDEV_STATE_READY);
         assert(netdev->manager);
         assert(netdev->manager->rtnl);
-        assert(IN_SET(netdev->kind, NETDEV_KIND_BRIDGE, NETDEV_KIND_BOND));
+        assert(IN_SET(netdev->kind, NETDEV_KIND_BRIDGE, NETDEV_KIND_BOND, NETDEV_KIND_VRF));
         assert(link);
         assert(callback);
 
@@ -282,7 +286,7 @@ int netdev_enslave(NetDev *netdev, Link *link, sd_netlink_message_handler_t call
         assert(netdev);
         assert(netdev->manager);
         assert(netdev->manager->rtnl);
-        assert(IN_SET(netdev->kind, NETDEV_KIND_BRIDGE, NETDEV_KIND_BOND));
+        assert(IN_SET(netdev->kind, NETDEV_KIND_BRIDGE, NETDEV_KIND_BOND, NETDEV_KIND_VRF));
 
         if (netdev->state == NETDEV_STATE_READY) {
                 r = netdev_enslave_ready(netdev, link, callback);
@@ -616,7 +620,7 @@ static int netdev_load_one(Manager *manager, const char *filename) {
                              NULL, NULL, NULL, NULL, NULL, NULL) <= 0)
                 return 0;
 
-        if (!NETDEV_VTABLE(netdev_raw)) {
+        if (netdev_raw->kind == _NETDEV_KIND_INVALID) {
                 log_warning("NetDev with invalid Kind configured in %s. Ignoring", filename);
                 return 0;
         }
diff --git a/src/grp-network/libnetworkd-core/networkd-netdev.h b/src/grp-network/libnetworkd-core/networkd-netdev.h
index 43311852b2..dcec00af47 100644
--- a/src/grp-network/libnetworkd-core/networkd-netdev.h
+++ b/src/grp-network/libnetworkd-core/networkd-netdev.h
@@ -54,6 +54,7 @@ typedef enum NetDevKind {
         NETDEV_KIND_DUMMY,
         NETDEV_KIND_TUN,
         NETDEV_KIND_TAP,
+        NETDEV_KIND_VRF,
         _NETDEV_KIND_MAX,
         _NETDEV_KIND_INVALID = -1
 } NetDevKind;
diff --git a/src/grp-network/libnetworkd-core/networkd-network-bus.c b/src/grp-network/libnetworkd-core/networkd-network-bus.c
index 572c0913a9..d4cd275ffe 100644
--- a/src/grp-network/libnetworkd-core/networkd-network-bus.c
+++ b/src/grp-network/libnetworkd-core/networkd-network-bus.c
@@ -61,7 +61,7 @@ const sd_bus_vtable network_vtable[] = {
 
         SD_BUS_PROPERTY("Description", "s", NULL, offsetof(Network, description), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("SourcePath", "s", NULL, offsetof(Network, filename), SD_BUS_VTABLE_PROPERTY_CONST),
-        SD_BUS_PROPERTY("MatchMAC", "as", property_get_ether_addrs, offsetof(Network, match_mac), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("MatchMAC", "as", property_get_ether_addrs, 0, SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("MatchPath", "as", NULL, offsetof(Network, match_path), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("MatchDriver", "as", NULL, offsetof(Network, match_driver), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("MatchType", "as", NULL, offsetof(Network, match_type), SD_BUS_VTABLE_PROPERTY_CONST),
diff --git a/src/grp-network/libnetworkd-core/networkd-network-gperf.gperf b/src/grp-network/libnetworkd-core/networkd-network-gperf.gperf
index 490fbb06e9..e214790436 100644
--- a/src/grp-network/libnetworkd-core/networkd-network-gperf.gperf
+++ b/src/grp-network/libnetworkd-core/networkd-network-gperf.gperf
@@ -2,6 +2,7 @@
 #include <stddef.h>
 
 #include "shared/conf-parser.h"
+#include "shared/vlan-util.h"
 #include "systemd-network/network-internal.h"
 
 #include "networkd-conf.h"
@@ -38,6 +39,7 @@ Network.MACVTAP,                        config_parse_netdev,
 Network.IPVLAN,                         config_parse_netdev,                            0,                             0
 Network.VXLAN,                          config_parse_netdev,                            0,                             0
 Network.Tunnel,                         config_parse_tunnel,                            0,                             0
+Network.VRF,                            config_parse_netdev,                            0,                             0
 Network.DHCP,                           config_parse_dhcp,                              0,                             offsetof(Network, dhcp)
 Network.DHCPServer,                     config_parse_bool,                              0,                             offsetof(Network, dhcp_server)
 Network.LinkLocalAddressing,            config_parse_address_family_boolean,            0,                             offsetof(Network, link_local)
@@ -52,11 +54,13 @@ Network.DNS,                            config_parse_strv,
 Network.LLMNR,                          config_parse_resolve_support,                   0,                             offsetof(Network, llmnr)
 Network.MulticastDNS,                   config_parse_resolve_support,                   0,                             offsetof(Network, mdns)
 Network.DNSSEC,                         config_parse_dnssec_mode,                       0,                             offsetof(Network, dnssec_mode)
-Network.DNSSECNegativeTrustAnchors,     config_parse_dnssec_negative_trust_anchors,     0,                             offsetof(Network, dnssec_negative_trust_anchors)
+Network.DNSSECNegativeTrustAnchors,     config_parse_dnssec_negative_trust_anchors,     0,                             0
 Network.NTP,                            config_parse_strv,                              0,                             offsetof(Network, ntp)
 Network.IPForward,                      config_parse_address_family_boolean_with_kernel,0,                             offsetof(Network, ip_forward)
 Network.IPMasquerade,                   config_parse_bool,                              0,                             offsetof(Network, ip_masquerade)
 Network.IPv6PrivacyExtensions,          config_parse_ipv6_privacy_extensions,           0,                             offsetof(Network, ipv6_privacy_extensions)
+Network.IPv6AcceptRA,                   config_parse_tristate,                          0,                             offsetof(Network, ipv6_accept_ra)
+/* legacy alias for the above */
 Network.IPv6AcceptRouterAdvertisements, config_parse_tristate,                          0,                             offsetof(Network, ipv6_accept_ra)
 Network.IPv6DuplicateAddressDetection,  config_parse_int,                               0,                             offsetof(Network, ipv6_dad_transmits)
 Network.IPv6HopLimit,                   config_parse_int,                               0,                             offsetof(Network, ipv6_hop_limit)
@@ -91,6 +95,8 @@ DHCP.DUIDRawData,                       config_parse_duid_rawdata,
 DHCP.RouteMetric,                       config_parse_unsigned,                          0,                             offsetof(Network, dhcp_route_metric)
 DHCP.UseTimezone,                       config_parse_bool,                              0,                             offsetof(Network, dhcp_use_timezone)
 DHCP.IAID,                              config_parse_iaid,                              0,                             offsetof(Network, iaid)
+IPv6AcceptRA.UseDNS,                    config_parse_bool,                              0,                             offsetof(Network, ipv6_accept_ra_use_dns)
+IPv6AcceptRA.UseDomains,                config_parse_dhcp_use_domains,                  0,                             offsetof(Network, ipv6_accept_ra_use_domains)
 DHCPServer.MaxLeaseTimeSec,             config_parse_sec,                               0,                             offsetof(Network, dhcp_server_max_lease_time_usec)
 DHCPServer.DefaultLeaseTimeSec,         config_parse_sec,                               0,                             offsetof(Network, dhcp_server_default_lease_time_usec)
 DHCPServer.EmitDNS,                     config_parse_bool,                              0,                             offsetof(Network, dhcp_server_emit_dns)
@@ -110,6 +116,9 @@ Bridge.AllowPortToBeRoot,               config_parse_bool,
 Bridge.UnicastFlood,                    config_parse_bool,                              0,                             offsetof(Network, unicast_flood)
 BridgeFDB.MACAddress,                   config_parse_fdb_hwaddr,                        0,                             0
 BridgeFDB.VLANId,                       config_parse_fdb_vlan_id,                       0,                             0
+BridgeVLAN.PVID,                        config_parse_vlanid,                            0,                             offsetof(Network, pvid)
+BridgeVLAN.VLAN,                        config_parse_brvlan_vlan,                       0,                             0
+BridgeVLAN.EgressUntagged,              config_parse_brvlan_untagged,                   0,                             0
 /* backwards compatibility: do not add new entries to this section */
 Network.IPv4LL,                         config_parse_ipv4ll,                            0,                             offsetof(Network, link_local)
 DHCPv4.UseDNS,                          config_parse_bool,                              0,                             offsetof(Network, dhcp_use_dns)
diff --git a/src/grp-network/libnetworkd-core/networkd-network.c b/src/grp-network/libnetworkd-core/networkd-network.c
index 2895fd4bd9..697b748e52 100644
--- a/src/grp-network/libnetworkd-core/networkd-network.c
+++ b/src/grp-network/libnetworkd-core/networkd-network.c
@@ -52,8 +52,8 @@ static int network_load_one(Manager *manager, const char *filename) {
         if (!file) {
                 if (errno == ENOENT)
                         return 0;
-                else
-                        return -errno;
+
+                return -errno;
         }
 
         if (null_or_empty_fd(fileno(file))) {
@@ -135,6 +135,7 @@ static int network_load_one(Manager *manager, const char *filename) {
         network->ipv6_hop_limit = -1;
         network->duid.type = _DUID_TYPE_INVALID;
         network->proxy_arp = -1;
+        network->ipv6_accept_ra_use_dns = true;
 
         r = config_parse(NULL, filename, file,
                          "Match\0"
@@ -145,8 +146,10 @@ static int network_load_one(Manager *manager, const char *filename) {
                          "DHCP\0"
                          "DHCPv4\0" /* compat */
                          "DHCPServer\0"
+                         "IPv6AcceptRA\0"
                          "Bridge\0"
-                         "BridgeFDB\0",
+                         "BridgeFDB\0"
+                         "BridgeVLAN\0",
                          config_item_perf_lookup, network_network_gperf_lookup,
                          false, false, true, network);
         if (r < 0)
@@ -242,8 +245,8 @@ void network_free(Network *network) {
         strv_free(network->bind_carrier);
 
         netdev_unref(network->bridge);
-
         netdev_unref(network->bond);
+        netdev_unref(network->vrf);
 
         HASHMAP_FOREACH(netdev, network->stacked_netdevs, i) {
                 hashmap_remove(network->stacked_netdevs, netdev->ifname);
@@ -469,6 +472,10 @@ int config_parse_netdev(const char *unit,
                 network->bond = netdev;
 
                 break;
+        case NETDEV_KIND_VRF:
+                network->vrf = netdev;
+
+                break;
         case NETDEV_KIND_VLAN:
         case NETDEV_KIND_MACVLAN:
         case NETDEV_KIND_MACVTAP:
diff --git a/src/grp-network/libnetworkd-core/networkd-network.h b/src/grp-network/libnetworkd-core/networkd-network.h
index fdf76b8924..66430a7c45 100644
--- a/src/grp-network/libnetworkd-core/networkd-network.h
+++ b/src/grp-network/libnetworkd-core/networkd-network.h
@@ -28,6 +28,7 @@
 #include "udev.h"
 
 #include "networkd-address.h"
+#include "networkd-brvlan.h"
 #include "networkd-fdb.h"
 #include "networkd-lldp-tx.h"
 #include "networkd-netdev.h"
@@ -37,6 +38,9 @@
 #define DHCP_ROUTE_METRIC 1024
 #define IPV4LL_ROUTE_METRIC 2048
 
+#define BRIDGE_VLAN_BITMAP_MAX 4096
+#define BRIDGE_VLAN_BITMAP_LEN (BRIDGE_VLAN_BITMAP_MAX / 32)
+
 typedef enum DCHPClientIdentifier {
         DHCP_CLIENT_ID_MAC,
         DHCP_CLIENT_ID_DUID,
@@ -100,6 +104,7 @@ struct Network {
 
         NetDev *bridge;
         NetDev *bond;
+        NetDev *vrf;
         Hashmap *stacked_netdevs;
 
         /* DHCP Client Support */
@@ -146,6 +151,10 @@ struct Network {
         bool unicast_flood;
         unsigned cost;
 
+        uint16_t pvid;
+        uint32_t br_vid_bitmap[BRIDGE_VLAN_BITMAP_LEN];
+        uint32_t br_untagged_bitmap[BRIDGE_VLAN_BITMAP_LEN];
+
         AddressFamilyBoolean ip_forward;
         bool ip_masquerade;
 
@@ -154,6 +163,9 @@ struct Network {
         int ipv6_hop_limit;
         int proxy_arp;
 
+        bool ipv6_accept_ra_use_dns;
+        DHCPUseDomains ipv6_accept_ra_use_domains;
+
         union in_addr_union ipv6_token;
         IPv6PrivacyExtensions ipv6_privacy_extensions;
 
@@ -169,6 +181,10 @@ struct Network {
         LIST_HEAD(Route, static_routes);
         LIST_HEAD(FdbEntry, static_fdb_entries);
 
+        unsigned n_static_addresses;
+        unsigned n_static_routes;
+        unsigned n_static_fdb_entries;
+
         Hashmap *addresses_by_section;
         Hashmap *routes_by_section;
         Hashmap *fdb_entries_by_section;
diff --git a/src/grp-network/libnetworkd-core/networkd-route.c b/src/grp-network/libnetworkd-core/networkd-route.c
index 974a7fa847..f6e2d4858e 100644
--- a/src/grp-network/libnetworkd-core/networkd-route.c
+++ b/src/grp-network/libnetworkd-core/networkd-route.c
@@ -29,6 +29,9 @@
 #include "networkd-route.h"
 #include "networkd.h"
 
+#define ROUTES_PER_LINK_MAX 2048U
+#define STATIC_ROUTES_PER_NETWORK_MAX 1024U
+
 int route_new(Route **ret) {
         _cleanup_route_free_ Route *route = NULL;
 
@@ -52,6 +55,9 @@ int route_new_static(Network *network, unsigned section, Route **ret) {
         _cleanup_route_free_ Route *route = NULL;
         int r;
 
+        assert(network);
+        assert(ret);
+
         if (section) {
                 route = hashmap_get(network->routes_by_section, UINT_TO_PTR(section));
                 if (route) {
@@ -62,6 +68,9 @@ int route_new_static(Network *network, unsigned section, Route **ret) {
                 }
         }
 
+        if (network->n_static_routes >= STATIC_ROUTES_PER_NETWORK_MAX)
+                return -E2BIG;
+
         r = route_new(&route);
         if (r < 0)
                 return r;
@@ -78,6 +87,7 @@ int route_new_static(Network *network, unsigned section, Route **ret) {
 
         route->network = network;
         LIST_PREPEND(routes, network->static_routes, route);
+        network->n_static_routes++;
 
         *ret = route;
         route = NULL;
@@ -92,9 +102,11 @@ void route_free(Route *route) {
         if (route->network) {
                 LIST_REMOVE(routes, route->network->static_routes, route);
 
+                assert(route->network->n_static_routes > 0);
+                route->network->n_static_routes--;
+
                 if (route->section)
-                        hashmap_remove(route->network->routes_by_section,
-                                       UINT_TO_PTR(route->section));
+                        hashmap_remove(route->network->routes_by_section, UINT_TO_PTR(route->section));
         }
 
         if (route->link) {
@@ -177,48 +189,55 @@ static const struct hash_ops route_hash_ops = {
 
 int route_get(Link *link,
               int family,
-              union in_addr_union *dst,
+              const union in_addr_union *dst,
               unsigned char dst_prefixlen,
               unsigned char tos,
               uint32_t priority,
               unsigned char table,
               Route **ret) {
-        Route route = {
+
+        Route route, *existing;
+
+        assert(link);
+        assert(dst);
+
+        route = (Route) {
                 .family = family,
+                .dst = *dst,
                 .dst_prefixlen = dst_prefixlen,
                 .tos = tos,
                 .priority = priority,
                 .table = table,
-        }, *existing;
-
-        assert(link);
-        assert(dst);
-        assert(ret);
-
-        route.dst = *dst;
+        };
 
         existing = set_get(link->routes, &route);
         if (existing) {
-                *ret = existing;
+                if (ret)
+                        *ret = existing;
                 return 1;
-        } else {
-                existing = set_get(link->routes_foreign, &route);
-                if (!existing)
-                        return -ENOENT;
         }
 
-        *ret = existing;
+        existing = set_get(link->routes_foreign, &route);
+        if (existing) {
+                if (ret)
+                        *ret = existing;
+                return 0;
+        }
 
-        return 0;
+        return -ENOENT;
 }
 
-static int route_add_internal(Link *link, Set **routes,
-                              int family,
-                              union in_addr_union *dst,
-                              unsigned char dst_prefixlen,
-                              unsigned char tos,
-                              uint32_t priority,
-                              unsigned char table, Route **ret) {
+static int route_add_internal(
+                Link *link,
+                Set **routes,
+                int family,
+                const union in_addr_union *dst,
+                unsigned char dst_prefixlen,
+                unsigned char tos,
+                uint32_t priority,
+                unsigned char table,
+                Route **ret) {
+
         _cleanup_route_free_ Route *route = NULL;
         int r;
 
@@ -255,23 +274,29 @@ static int route_add_internal(Link *link, Set **routes,
         return 0;
 }
 
-int route_add_foreign(Link *link,
-                      int family,
-                      union in_addr_union *dst,
-                      unsigned char dst_prefixlen,
-                      unsigned char tos,
-                      uint32_t priority,
-                      unsigned char table, Route **ret) {
+int route_add_foreign(
+                Link *link,
+                int family,
+                const union in_addr_union *dst,
+                unsigned char dst_prefixlen,
+                unsigned char tos,
+                uint32_t priority,
+                unsigned char table,
+                Route **ret) {
+
         return route_add_internal(link, &link->routes_foreign, family, dst, dst_prefixlen, tos, priority, table, ret);
 }
 
-int route_add(Link *link,
+int route_add(
+              Link *link,
               int family,
-              union in_addr_union *dst,
+              const union in_addr_union *dst,
               unsigned char dst_prefixlen,
               unsigned char tos,
               uint32_t priority,
-              unsigned char table, Route **ret) {
+              unsigned char table,
+              Route **ret) {
+
         Route *route;
         int r;
 
@@ -304,12 +329,13 @@ int route_add(Link *link,
 }
 
 int route_update(Route *route,
-                 union in_addr_union *src,
+                 const union in_addr_union *src,
                  unsigned char src_prefixlen,
-                 union in_addr_union *gw,
-                 union in_addr_union *prefsrc,
+                 const union in_addr_union *gw,
+                 const union in_addr_union *prefsrc,
                  unsigned char scope,
                  unsigned char protocol) {
+
         assert(route);
         assert(src);
         assert(gw);
@@ -450,8 +476,11 @@ int route_expire_handler(sd_event_source *s, uint64_t usec, void *userdata) {
         return 1;
 }
 
-int route_configure(Route *route, Link *link,
-                    sd_netlink_message_handler_t callback) {
+int route_configure(
+                Route *route,
+                Link *link,
+                sd_netlink_message_handler_t callback) {
+
         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL;
         _cleanup_(sd_event_source_unrefp) sd_event_source *expire = NULL;
         usec_t lifetime;
@@ -463,6 +492,10 @@ int route_configure(Route *route, Link *link,
         assert(link->ifindex > 0);
         assert(route->family == AF_INET || route->family == AF_INET6);
 
+        if (route_get(link, route->family, &route->dst, route->dst_prefixlen, route->tos, route->priority, route->table, NULL) <= 0 &&
+            set_size(link->routes) >= ROUTES_PER_LINK_MAX)
+                return -E2BIG;
+
         r = sd_rtnl_message_new_route(link->manager->rtnl, &req,
                                       RTM_NEWROUTE, route->family,
                                       route->protocol);
@@ -763,6 +796,7 @@ int config_parse_route_priority(const char *unit,
                                 void *userdata) {
         Network *network = userdata;
         _cleanup_route_free_ Route *n = NULL;
+        uint32_t k;
         int r;
 
         assert(filename);
@@ -775,12 +809,14 @@ int config_parse_route_priority(const char *unit,
         if (r < 0)
                 return r;
 
-        r = config_parse_uint32(unit, filename, line, section,
-                                section_line, lvalue, ltype,
-                                rvalue, &n->priority, userdata);
-        if (r < 0)
-                return r;
+        r = safe_atou32(rvalue, &k);
+        if (r < 0) {
+                log_syntax(unit, LOG_ERR, filename, line, r,
+                           "Could not parse route priority \"%s\", ignoring assignment: %m", rvalue);
+                return 0;
+        }
 
+        n->priority = k;
         n = NULL;
 
         return 0;
diff --git a/src/grp-network/libnetworkd-core/networkd-route.h b/src/grp-network/libnetworkd-core/networkd-route.h
index 39de8363ed..d4e4dbac0b 100644
--- a/src/grp-network/libnetworkd-core/networkd-route.h
+++ b/src/grp-network/libnetworkd-core/networkd-route.h
@@ -57,10 +57,10 @@ void route_free(Route *route);
 int route_configure(Route *route, Link *link, sd_netlink_message_handler_t callback);
 int route_remove(Route *route, Link *link, sd_netlink_message_handler_t callback);
 
-int route_get(Link *link, int family, union in_addr_union *dst, unsigned char dst_prefixlen, unsigned char tos, uint32_t priority, unsigned char table, Route **ret);
-int route_add(Link *link, int family, union in_addr_union *dst, unsigned char dst_prefixlen, unsigned char tos, uint32_t priority, unsigned char table, Route **ret);
-int route_add_foreign(Link *link, int family, union in_addr_union *dst, unsigned char dst_prefixlen, unsigned char tos, uint32_t priority, unsigned char table, Route **ret);
-int route_update(Route *route, union in_addr_union *src, unsigned char src_prefixlen, union in_addr_union *gw, union in_addr_union *prefsrc, unsigned char scope, unsigned char protocol);
+int route_get(Link *link, int family, const union in_addr_union *dst, unsigned char dst_prefixlen, unsigned char tos, uint32_t priority, unsigned char table, Route **ret);
+int route_add(Link *link, int family, const union in_addr_union *dst, unsigned char dst_prefixlen, unsigned char tos, uint32_t priority, unsigned char table, Route **ret);
+int route_add_foreign(Link *link, int family, const union in_addr_union *dst, unsigned char dst_prefixlen, unsigned char tos, uint32_t priority, unsigned char table, Route **ret);
+int route_update(Route *route, const union in_addr_union *src, unsigned char src_prefixlen, const union in_addr_union *gw, const union in_addr_union *prefsrc, unsigned char scope, unsigned char protocol);
 
 int route_expire_handler(sd_event_source *s, uint64_t usec, void *userdata);
 
diff --git a/src/grp-network/libnetworkd-core/networkd.h b/src/grp-network/libnetworkd-core/networkd.h
index cfee5dd045..dbc846a07e 100644
--- a/src/grp-network/libnetworkd-core/networkd.h
+++ b/src/grp-network/libnetworkd-core/networkd.h
@@ -41,6 +41,7 @@
 #include "networkd-netdev-tuntap.h"
 #include "networkd-netdev-veth.h"
 #include "networkd-netdev-vlan.h"
+#include "networkd-netdev-vrf.h"
 #include "networkd-netdev-vxlan.h"
 #include "networkd-network.h"
 #include "networkd-util.h"
diff --git a/src/grp-network/networkctl/Makefile b/src/grp-network/networkctl/Makefile
index f92d402f78..7b651c7f74 100644
--- a/src/grp-network/networkctl/Makefile
+++ b/src/grp-network/networkctl/Makefile
@@ -30,7 +30,7 @@ networkctl_SOURCES = \
 	src/network/networkctl.c
 
 networkctl_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	libsystemd-network.la
 
 dist_bashcompletion_data += \
diff --git a/src/grp-network/systemd-networkd-wait-online/Makefile b/src/grp-network/systemd-networkd-wait-online/Makefile
index 8d1870c862..25134d4966 100644
--- a/src/grp-network/systemd-networkd-wait-online/Makefile
+++ b/src/grp-network/systemd-networkd-wait-online/Makefile
@@ -39,7 +39,7 @@ systemd_networkd_wait_online_SOURCES = \
 
 systemd_networkd_wait_online_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 nodist_systemunit_DATA += \
 	units/systemd-networkd-wait-online.service
diff --git a/src/grp-network/systemd-networkd-wait-online/networkd-wait-online-manager.c b/src/grp-network/systemd-networkd-wait-online/networkd-wait-online-manager.c
index 9ec0550d44..e4f6d68f16 100644
--- a/src/grp-network/systemd-networkd-wait-online/networkd-wait-online-manager.c
+++ b/src/grp-network/systemd-networkd-wait-online/networkd-wait-online-manager.c
@@ -32,8 +32,6 @@
 #include "networkd-wait-online.h"
 
 bool manager_ignore_link(Manager *m, Link *link) {
-        char **ignore;
-
         assert(m);
         assert(link);
 
@@ -46,11 +44,7 @@ bool manager_ignore_link(Manager *m, Link *link) {
                 return true;
 
         /* ignore interfaces we explicitly are asked to ignore */
-        STRV_FOREACH(ignore, m->ignore)
-                if (fnmatch(*ignore, link->ifname, 0) == 0)
-                        return true;
-
-        return false;
+        return strv_fnmatch(m->ignore, link->ifname, 0);
 }
 
 bool manager_all_configured(Manager *m) {
diff --git a/src/grp-network/systemd-networkd/systemd-networkd.service.m4.in b/src/grp-network/systemd-networkd/systemd-networkd.service.m4.in
index 27d4d58962..38d967d2d1 100644
--- a/src/grp-network/systemd-networkd/systemd-networkd.service.m4.in
+++ b/src/grp-network/systemd-networkd/systemd-networkd.service.m4.in
@@ -31,6 +31,8 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_N
 ProtectSystem=full
 ProtectHome=yes
 WatchdogSec=3min
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
 
 [Install]
 WantedBy=multi-user.target
diff --git a/src/grp-resolve/libbasic-dns/Makefile b/src/grp-resolve/libbasic-dns/Makefile
index 1d342c5f3b..b1a760cc10 100644
--- a/src/grp-resolve/libbasic-dns/Makefile
+++ b/src/grp-resolve/libbasic-dns/Makefile
@@ -62,9 +62,15 @@ test_resolve_tables_SOURCES = \
 	$(basic_dns_sources) \
 	src/shared/test-tables.h
 
+test_resolve_tables_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(GCRYPT_CFLAGS)
+
 test_resolve_tables_LDADD = \
         libbasic-dns.la \
-	libshared.la
+	libsystemd-shared.la \
+	$(GCRYPT_LIBS) \
+	-lm
 
 test_dns_packet_SOURCES = \
 	src/resolve/test-dns-packet.c \
@@ -74,9 +80,14 @@ test_dns_packet_CPPFLAGS = \
 	$(AM_CPPFLAGS) \
 	-DRESOLVE_TEST_DIR=\"$(abs_top_srcdir)/src/resolve/test-data\"
 
+test_dns_packet_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(GCRYPT_CFLAGS)
+
 test_dns_packet_LDADD = \
         libbasic-dns.la \
-	libshared.la
+	$(GCRYPT_LIBS) \
+	-lm
 
 EXTRA_DIST += \
 	src/resolve/test-data/_openpgpkey.fedoraproject.org.pkts \
@@ -95,9 +106,15 @@ test_dnssec_SOURCES = \
 	src/resolve/test-dnssec.c \
 	$(basic_dns_sources)
 
+test_dnssec_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(GCRYPT_CFLAGS)
+
 test_dnssec_LDADD = \
         libbasic-dns.la \
-	libshared.la
+	libsystemd-shared.la \
+	$(GCRYPT_LIBS) \
+	-lm
 
 test_dnssec_complex_SOURCES = \
 	src/resolve/test-dnssec-complex.c \
@@ -105,7 +122,7 @@ test_dnssec_complex_SOURCES = \
 	src/resolve/dns-type.h
 
 test_dnssec_complex_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 noinst_LTLIBRARIES = libbasic-dns.la
 libbasic_dns_la_LIBADD = libshared.la
diff --git a/src/grp-resolve/libbasic-dns/dns-type.c b/src/grp-resolve/libbasic-dns/dns-type.c
index 6d5b9d616f..eceb72f545 100644
--- a/src/grp-resolve/libbasic-dns/dns-type.c
+++ b/src/grp-resolve/libbasic-dns/dns-type.c
@@ -97,6 +97,15 @@ bool dns_type_is_valid_query(uint16_t type) {
                        DNS_TYPE_RRSIG);
 }
 
+bool dns_type_is_zone_transer(uint16_t type) {
+
+        /* Zone transfers, either normal or incremental */
+
+        return IN_SET(type,
+                      DNS_TYPE_AXFR,
+                      DNS_TYPE_IXFR);
+}
+
 bool dns_type_is_valid_rr(uint16_t type) {
 
         /* The types valid as RR in packets (but not necessarily
diff --git a/src/grp-resolve/libbasic-dns/dns-type.h b/src/grp-resolve/libbasic-dns/dns-type.h
index a8ee105e16..be548b6073 100644
--- a/src/grp-resolve/libbasic-dns/dns-type.h
+++ b/src/grp-resolve/libbasic-dns/dns-type.h
@@ -136,6 +136,7 @@ bool dns_type_is_obsolete(uint16_t type);
 bool dns_type_may_wildcard(uint16_t type);
 bool dns_type_apex_only(uint16_t type);
 bool dns_type_needs_authentication(uint16_t type);
+bool dns_type_is_zone_transer(uint16_t type);
 int dns_type_to_af(uint16_t type);
 
 bool dns_class_is_pseudo(uint16_t class);
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-answer.c b/src/grp-resolve/libbasic-dns/resolved-dns-answer.c
index 1ade0507db..c45505b441 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-answer.c
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-answer.c
@@ -186,7 +186,7 @@ int dns_answer_add_extend(DnsAnswer **a, DnsResourceRecord *rr, int ifindex, Dns
         return dns_answer_add(*a, rr, ifindex, flags);
 }
 
-int dns_answer_add_soa(DnsAnswer *a, const char *name, uint32_t ttl) {
+int dns_answer_add_soa(DnsAnswer *a, const char *name, uint32_t ttl, int ifindex) {
         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *soa = NULL;
 
         soa = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_SOA, name);
@@ -209,7 +209,7 @@ int dns_answer_add_soa(DnsAnswer *a, const char *name, uint32_t ttl) {
         soa->soa.expire = 1;
         soa->soa.minimum = ttl;
 
-        return dns_answer_add(a, soa, 0, DNS_ANSWER_AUTHENTICATED);
+        return dns_answer_add(a, soa, ifindex, DNS_ANSWER_AUTHENTICATED);
 }
 
 int dns_answer_match_key(DnsAnswer *a, const DnsResourceKey *key, DnsAnswerFlags *ret_flags) {
@@ -703,7 +703,7 @@ void dns_answer_order_by_scope(DnsAnswer *a, bool prefer_link_local) {
                 if (a->items[i].rr->key->class == DNS_CLASS_IN &&
                     ((a->items[i].rr->key->type == DNS_TYPE_A && in_addr_is_link_local(AF_INET, (union in_addr_union*) &a->items[i].rr->a.in_addr) != prefer_link_local) ||
                      (a->items[i].rr->key->type == DNS_TYPE_AAAA && in_addr_is_link_local(AF_INET6, (union in_addr_union*) &a->items[i].rr->aaaa.in6_addr) != prefer_link_local)))
-                        /* Order address records that are are not preferred to the end of the array */
+                        /* Order address records that are not preferred to the end of the array */
                         items[end--] = a->items[i];
                 else
                         /* Order all other records to the beginning of the array */
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-answer.h b/src/grp-resolve/libbasic-dns/resolved-dns-answer.h
index 92557a410a..bbb836fc7e 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-answer.h
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-answer.h
@@ -57,7 +57,7 @@ DnsAnswer *dns_answer_unref(DnsAnswer *a);
 
 int dns_answer_add(DnsAnswer *a, DnsResourceRecord *rr, int ifindex, DnsAnswerFlags flags);
 int dns_answer_add_extend(DnsAnswer **a, DnsResourceRecord *rr, int ifindex, DnsAnswerFlags flags);
-int dns_answer_add_soa(DnsAnswer *a, const char *name, uint32_t ttl);
+int dns_answer_add_soa(DnsAnswer *a, const char *name, uint32_t ttl, int ifindex);
 
 int dns_answer_match_key(DnsAnswer *a, const DnsResourceKey *key, DnsAnswerFlags *combined_flags);
 int dns_answer_contains_rr(DnsAnswer *a, DnsResourceRecord *rr, DnsAnswerFlags *combined_flags);
@@ -88,6 +88,10 @@ static inline unsigned dns_answer_size(DnsAnswer *a) {
         return a ? a->n_rrs : 0;
 }
 
+static inline bool dns_answer_isempty(DnsAnswer *a) {
+        return dns_answer_size(a) <= 0;
+}
+
 void dns_answer_dump(DnsAnswer *answer, FILE *f);
 
 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsAnswer*, dns_answer_unref);
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-dnssec.c b/src/grp-resolve/libbasic-dns/resolved-dns-dnssec.c
index 7d58edcdfa..a53f2daa28 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-dnssec.c
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-dnssec.c
@@ -1643,7 +1643,7 @@ static int dnssec_nsec_in_path(DnsResourceRecord *rr, const char *name) {
         if (r <= 0)
                 return r;
 
-        /* If the name we we are interested in is not a prefix of the common suffix of the NSEC RR's owner and next domain names, then we can't say anything either. */
+        /* If the name we are interested in is not a prefix of the common suffix of the NSEC RR's owner and next domain names, then we can't say anything either. */
         r = dns_name_common_suffix(dns_resource_key_name(rr->key), rr->nsec.next_domain_name, &common_suffix);
         if (r < 0)
                 return r;
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-packet.c b/src/grp-resolve/libbasic-dns/resolved-dns-packet.c
index 37c0244b7e..e5a497e0ed 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-packet.c
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-packet.c
@@ -265,6 +265,7 @@ int dns_packet_validate_query(DnsPacket *p) {
         switch (p->protocol) {
 
         case DNS_PROTOCOL_LLMNR:
+        case DNS_PROTOCOL_DNS:
                 /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
                 if (DNS_PACKET_QDCOUNT(p) != 1)
                         return -EBADMSG;
@@ -677,13 +678,15 @@ fail:
 }
 
 /* Append the OPT pseudo-RR described in RFC6891 */
-int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, size_t *start) {
+int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, int rcode, size_t *start) {
         size_t saved_size;
         int r;
 
         assert(p);
         /* we must never advertise supported packet size smaller than the legacy max */
         assert(max_udp_size >= DNS_PACKET_UNICAST_SIZE_MAX);
+        assert(rcode >= 0);
+        assert(rcode <= _DNS_RCODE_MAX);
 
         if (p->opt_start != (size_t) -1)
                 return -EBUSY;
@@ -702,13 +705,13 @@ int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, si
         if (r < 0)
                 goto fail;
 
-        /* maximum udp packet that can be received */
+        /* class: maximum udp packet that can be received */
         r = dns_packet_append_uint16(p, max_udp_size, NULL);
         if (r < 0)
                 goto fail;
 
         /* extended RCODE and VERSION */
-        r = dns_packet_append_uint16(p, 0, NULL);
+        r = dns_packet_append_uint16(p, ((uint16_t) rcode & 0x0FF0) << 4, NULL);
         if (r < 0)
                 goto fail;
 
@@ -718,9 +721,8 @@ int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, si
                 goto fail;
 
         /* RDLENGTH */
-
-        if (edns0_do) {
-                /* If DO is on, also append RFC6975 Algorithm data */
+        if (edns0_do && !DNS_PACKET_QR(p)) {
+                /* If DO is on and this is not a reply, also append RFC6975 Algorithm data */
 
                 static const uint8_t rfc6975[] = {
 
@@ -751,7 +753,6 @@ int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, si
                 r = dns_packet_append_blob(p, rfc6975, sizeof(rfc6975), NULL);
         } else
                 r = dns_packet_append_uint16(p, 0, NULL);
-
         if (r < 0)
                 goto fail;
 
@@ -792,6 +793,7 @@ int dns_packet_truncate_opt(DnsPacket *p) {
 }
 
 int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, size_t *start, size_t *rdata_start) {
+
         size_t saved_size, rdlength_offset, end, rdlength, rds;
         int r;
 
@@ -1135,6 +1137,36 @@ fail:
         return r;
 }
 
+int dns_packet_append_question(DnsPacket *p, DnsQuestion *q) {
+        DnsResourceKey *key;
+        int r;
+
+        assert(p);
+
+        DNS_QUESTION_FOREACH(key, q) {
+                r = dns_packet_append_key(p, key, NULL);
+                if (r < 0)
+                        return r;
+        }
+
+        return 0;
+}
+
+int dns_packet_append_answer(DnsPacket *p, DnsAnswer *a) {
+        DnsResourceRecord *rr;
+        int r;
+
+        assert(p);
+
+        DNS_ANSWER_FOREACH(rr, a) {
+                r = dns_packet_append_rr(p, rr, NULL, NULL);
+                if (r < 0)
+                        return r;
+        }
+
+        return 0;
+}
+
 int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
         assert(p);
 
@@ -2030,8 +2062,10 @@ static bool opt_is_good(DnsResourceRecord *rr, bool *rfc6975) {
         assert(rr->key->type == DNS_TYPE_OPT);
 
         /* Check that the version is 0 */
-        if (((rr->ttl >> 16) & UINT32_C(0xFF)) != 0)
-                return false;
+        if (((rr->ttl >> 16) & UINT32_C(0xFF)) != 0) {
+                *rfc6975 = false;
+                return true; /* if it's not version 0, it's OK, but we will ignore the OPT field contents */
+        }
 
         p = rr->opt.data;
         l = rr->opt.data_size;
@@ -2154,16 +2188,27 @@ int dns_packet_extract(DnsPacket *p) {
                                         continue;
                                 }
 
-                                if (has_rfc6975) {
-                                        /* If the OPT RR contains RFC6975 algorithm data, then this is indication that
-                                         * the server just copied the OPT it got from us (which contained that data)
-                                         * back into the reply. If so, then it doesn't properly support EDNS, as
-                                         * RFC6975 makes it very clear that the algorithm data should only be contained
-                                         * in questions, never in replies. Crappy Belkin routers copy the OPT data for
-                                         * example, hence let's detect this so that we downgrade early. */
-                                        log_debug("OPT RR contained RFC6975 data, ignoring.");
-                                        bad_opt = true;
-                                        continue;
+                                if (DNS_PACKET_QR(p)) {
+                                        /* Additional checks for responses */
+
+                                        if (!DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(rr)) {
+                                                /* If this is a reply and we don't know the EDNS version then something
+                                                 * is weird... */
+                                                log_debug("EDNS version newer that our request, bad server.");
+                                                return -EBADMSG;
+                                        }
+
+                                        if (has_rfc6975) {
+                                                /* If the OPT RR contains RFC6975 algorithm data, then this is indication that
+                                                 * the server just copied the OPT it got from us (which contained that data)
+                                                 * back into the reply. If so, then it doesn't properly support EDNS, as
+                                                 * RFC6975 makes it very clear that the algorithm data should only be contained
+                                                 * in questions, never in replies. Crappy Belkin routers copy the OPT data for
+                                                 * example, hence let's detect this so that we downgrade early. */
+                                                log_debug("OPT RR contained RFC6975 data, ignoring.");
+                                                bad_opt = true;
+                                                continue;
+                                        }
                                 }
 
                                 p->opt = dns_resource_record_ref(rr);
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-packet.h b/src/grp-resolve/libbasic-dns/resolved-dns-packet.h
index 2e0eba83b6..a9e95ebd75 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-packet.h
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-packet.h
@@ -118,6 +118,8 @@ static inline uint8_t* DNS_PACKET_DATA(DnsPacket *p) {
 #define DNS_PACKET_AD(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 5) & 1)
 #define DNS_PACKET_CD(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 4) & 1)
 
+#define DNS_PACKET_FLAG_TC (UINT16_C(1) << 9)
+
 static inline uint16_t DNS_PACKET_RCODE(DnsPacket *p) {
         uint16_t rcode;
 
@@ -126,7 +128,34 @@ static inline uint16_t DNS_PACKET_RCODE(DnsPacket *p) {
         else
                 rcode = 0;
 
-        return rcode | (be16toh(DNS_PACKET_HEADER(p)->flags) & 15);
+        return rcode | (be16toh(DNS_PACKET_HEADER(p)->flags) & 0xF);
+}
+
+static inline uint16_t DNS_PACKET_PAYLOAD_SIZE_MAX(DnsPacket *p) {
+
+        /* Returns the advertised maximum datagram size for replies, or the DNS default if there's nothing defined. */
+
+        if (p->opt)
+                return MAX(DNS_PACKET_UNICAST_SIZE_MAX, p->opt->key->class);
+
+        return DNS_PACKET_UNICAST_SIZE_MAX;
+}
+
+static inline bool DNS_PACKET_DO(DnsPacket *p) {
+        if (!p->opt)
+                return false;
+
+        return !!(p->opt->ttl & (1U << 15));
+}
+
+static inline bool DNS_PACKET_VERSION_SUPPORTED(DnsPacket *p) {
+        /* Returns true if this packet is in a version we support. Which means either non-EDNS or EDNS(0), but not EDNS
+         * of any newer versions */
+
+        if (!p->opt)
+                return true;
+
+        return DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(p->opt);
 }
 
 /* LLMNR defines some bits differently */
@@ -182,7 +211,9 @@ int dns_packet_append_label(DnsPacket *p, const char *s, size_t l, bool canonica
 int dns_packet_append_name(DnsPacket *p, const char *name, bool allow_compression, bool canonical_candidate, size_t *start);
 int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *key, size_t *start);
 int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, size_t *start, size_t *rdata_start);
-int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, size_t *start);
+int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, int rcode, size_t *start);
+int dns_packet_append_question(DnsPacket *p, DnsQuestion *q);
+int dns_packet_append_answer(DnsPacket *p, DnsAnswer *a);
 
 void dns_packet_truncate(DnsPacket *p, size_t sz);
 int dns_packet_truncate_opt(DnsPacket *p);
@@ -232,7 +263,8 @@ enum {
         DNS_RCODE_BADNAME = 20,
         DNS_RCODE_BADALG = 21,
         DNS_RCODE_BADTRUNC = 22,
-        _DNS_RCODE_MAX_DEFINED
+        _DNS_RCODE_MAX_DEFINED,
+        _DNS_RCODE_MAX = 4095 /* 4 bit rcode in the header plus 8 bit rcode in OPT, makes 12 bit */
 };
 
 const char* dns_rcode_to_string(int i) _const_;
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-question.h b/src/grp-resolve/libbasic-dns/resolved-dns-question.h
index 320bf53488..fe47a6bd9e 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-question.h
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-question.h
@@ -57,6 +57,10 @@ static inline unsigned dns_question_size(DnsQuestion *q) {
         return q ? q->n_keys : 0;
 }
 
+static inline bool dns_question_isempty(DnsQuestion *q) {
+        return dns_question_size(q) <= 0;
+}
+
 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsQuestion*, dns_question_unref);
 
 #define _DNS_QUESTION_FOREACH(u, key, q)                                \
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-rr.c b/src/grp-resolve/libbasic-dns/resolved-dns-rr.c
index c6a60b65b7..73ca3c7fb9 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-rr.c
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-rr.c
@@ -1533,6 +1533,232 @@ const struct hash_ops dns_resource_record_hash_ops = {
         .compare = dns_resource_record_compare_func,
 };
 
+DnsResourceRecord *dns_resource_record_copy(DnsResourceRecord *rr) {
+        _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *copy = NULL;
+        DnsResourceRecord *t;
+
+        assert(rr);
+
+        copy = dns_resource_record_new(rr->key);
+        if (!copy)
+                return NULL;
+
+        copy->ttl = rr->ttl;
+        copy->expiry = rr->expiry;
+        copy->n_skip_labels_signer = rr->n_skip_labels_signer;
+        copy->n_skip_labels_source = rr->n_skip_labels_source;
+        copy->unparseable = rr->unparseable;
+
+        switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {
+
+        case DNS_TYPE_SRV:
+                copy->srv.priority = rr->srv.priority;
+                copy->srv.weight = rr->srv.weight;
+                copy->srv.port = rr->srv.port;
+                copy->srv.name = strdup(rr->srv.name);
+                if (!copy->srv.name)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_PTR:
+        case DNS_TYPE_NS:
+        case DNS_TYPE_CNAME:
+        case DNS_TYPE_DNAME:
+                copy->ptr.name = strdup(rr->ptr.name);
+                if (!copy->ptr.name)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_HINFO:
+                copy->hinfo.cpu = strdup(rr->hinfo.cpu);
+                if (!copy->hinfo.cpu)
+                        return NULL;
+
+                copy->hinfo.os = strdup(rr->hinfo.os);
+                if(!copy->hinfo.os)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_TXT:
+        case DNS_TYPE_SPF:
+                copy->txt.items = dns_txt_item_copy(rr->txt.items);
+                if (!copy->txt.items)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_A:
+                copy->a = rr->a;
+                break;
+
+        case DNS_TYPE_AAAA:
+                copy->aaaa = rr->aaaa;
+                break;
+
+        case DNS_TYPE_SOA:
+                copy->soa.mname = strdup(rr->soa.mname);
+                if (!copy->soa.mname)
+                        return NULL;
+                copy->soa.rname = strdup(rr->soa.rname);
+                if (!copy->soa.rname)
+                        return NULL;
+                copy->soa.serial = rr->soa.serial;
+                copy->soa.refresh = rr->soa.refresh;
+                copy->soa.retry = rr->soa.retry;
+                copy->soa.expire = rr->soa.expire;
+                copy->soa.minimum = rr->soa.minimum;
+                break;
+
+        case DNS_TYPE_MX:
+                copy->mx.priority = rr->mx.priority;
+                copy->mx.exchange = strdup(rr->mx.exchange);
+                if (!copy->mx.exchange)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_LOC:
+                copy->loc = rr->loc;
+                break;
+
+        case DNS_TYPE_SSHFP:
+                copy->sshfp.algorithm = rr->sshfp.algorithm;
+                copy->sshfp.fptype = rr->sshfp.fptype;
+                copy->sshfp.fingerprint = memdup(rr->sshfp.fingerprint, rr->sshfp.fingerprint_size);
+                if (!copy->sshfp.fingerprint)
+                        return NULL;
+                copy->sshfp.fingerprint_size = rr->sshfp.fingerprint_size;
+                break;
+
+        case DNS_TYPE_DNSKEY:
+                copy->dnskey.flags = rr->dnskey.flags;
+                copy->dnskey.protocol = rr->dnskey.protocol;
+                copy->dnskey.algorithm = rr->dnskey.algorithm;
+                copy->dnskey.key = memdup(rr->dnskey.key, rr->dnskey.key_size);
+                if (!copy->dnskey.key)
+                        return NULL;
+                copy->dnskey.key_size = rr->dnskey.key_size;
+                break;
+
+        case DNS_TYPE_RRSIG:
+                copy->rrsig.type_covered = rr->rrsig.type_covered;
+                copy->rrsig.algorithm = rr->rrsig.algorithm;
+                copy->rrsig.labels = rr->rrsig.labels;
+                copy->rrsig.original_ttl = rr->rrsig.original_ttl;
+                copy->rrsig.expiration = rr->rrsig.expiration;
+                copy->rrsig.inception = rr->rrsig.inception;
+                copy->rrsig.key_tag = rr->rrsig.key_tag;
+                copy->rrsig.signer = strdup(rr->rrsig.signer);
+                if (!copy->rrsig.signer)
+                        return NULL;
+                copy->rrsig.signature = memdup(rr->rrsig.signature, rr->rrsig.signature_size);
+                if (!copy->rrsig.signature)
+                        return NULL;
+                copy->rrsig.signature_size = rr->rrsig.signature_size;
+                break;
+
+        case DNS_TYPE_NSEC:
+                copy->nsec.next_domain_name = strdup(rr->nsec.next_domain_name);
+                if (!copy->nsec.next_domain_name)
+                        return NULL;
+                copy->nsec.types = bitmap_copy(rr->nsec.types);
+                if (!copy->nsec.types)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_DS:
+                copy->ds.key_tag = rr->ds.key_tag;
+                copy->ds.algorithm = rr->ds.algorithm;
+                copy->ds.digest_type = rr->ds.digest_type;
+                copy->ds.digest = memdup(rr->ds.digest, rr->ds.digest_size);
+                if (!copy->ds.digest)
+                        return NULL;
+                copy->ds.digest_size = rr->ds.digest_size;
+                break;
+
+        case DNS_TYPE_NSEC3:
+                copy->nsec3.algorithm = rr->nsec3.algorithm;
+                copy->nsec3.flags = rr->nsec3.flags;
+                copy->nsec3.iterations = rr->nsec3.iterations;
+                copy->nsec3.salt = memdup(rr->nsec3.salt, rr->nsec3.salt_size);
+                if (!copy->nsec3.salt)
+                        return NULL;
+                copy->nsec3.salt_size = rr->nsec3.salt_size;
+                copy->nsec3.next_hashed_name = memdup(rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size);
+                if (!copy->nsec3.next_hashed_name_size)
+                        return NULL;
+                copy->nsec3.next_hashed_name_size = rr->nsec3.next_hashed_name_size;
+                copy->nsec3.types = bitmap_copy(rr->nsec3.types);
+                if (!copy->nsec3.types)
+                        return NULL;
+                break;
+
+        case DNS_TYPE_TLSA:
+                copy->tlsa.cert_usage = rr->tlsa.cert_usage;
+                copy->tlsa.selector = rr->tlsa.selector;
+                copy->tlsa.matching_type = rr->tlsa.matching_type;
+                copy->tlsa.data = memdup(rr->tlsa.data, rr->tlsa.data_size);
+                if (!copy->tlsa.data)
+                        return NULL;
+                copy->tlsa.data_size = rr->tlsa.data_size;
+                break;
+
+        case DNS_TYPE_CAA:
+                copy->caa.flags = rr->caa.flags;
+                copy->caa.tag = strdup(rr->caa.tag);
+                if (!copy->caa.tag)
+                        return NULL;
+                copy->caa.value = memdup(rr->caa.value, rr->caa.value_size);
+                if (!copy->caa.value)
+                        return NULL;
+                copy->caa.value_size = rr->caa.value_size;
+                break;
+
+        case DNS_TYPE_OPT:
+        default:
+                copy->generic.data = memdup(rr->generic.data, rr->generic.data_size);
+                if (!copy->generic.data)
+                        return NULL;
+                copy->generic.data_size = rr->generic.data_size;
+                break;
+        }
+
+        t = copy;
+        copy = NULL;
+
+        return t;
+}
+
+int dns_resource_record_clamp_ttl(DnsResourceRecord **rr, uint32_t max_ttl) {
+        DnsResourceRecord *old_rr, *new_rr;
+        uint32_t new_ttl;
+
+        assert(rr);
+        old_rr = *rr;
+
+        if (old_rr->key->type == DNS_TYPE_OPT)
+                return -EINVAL;
+
+        new_ttl = MIN(old_rr->ttl, max_ttl);
+        if (new_ttl == old_rr->ttl)
+                return 0;
+
+        if (old_rr->n_ref == 1) {
+                /* Patch in place */
+                old_rr->ttl = new_ttl;
+                return 1;
+        }
+
+        new_rr = dns_resource_record_copy(old_rr);
+        if (!new_rr)
+                return -ENOMEM;
+
+        new_rr->ttl = new_ttl;
+
+        dns_resource_record_unref(*rr);
+        *rr = new_rr;
+
+        return 1;
+}
+
 DnsTxtItem *dns_txt_item_free_all(DnsTxtItem *i) {
         DnsTxtItem *n;
 
@@ -1565,6 +1791,25 @@ bool dns_txt_item_equal(DnsTxtItem *a, DnsTxtItem *b) {
         return dns_txt_item_equal(a->items_next, b->items_next);
 }
 
+DnsTxtItem *dns_txt_item_copy(DnsTxtItem *first) {
+        DnsTxtItem *i, *copy = NULL, *end = NULL;
+
+        LIST_FOREACH(items, i, first) {
+                DnsTxtItem *j;
+
+                j = memdup(i, offsetof(DnsTxtItem, data) + i->length + 1);
+                if (!j) {
+                        dns_txt_item_free_all(copy);
+                        return NULL;
+                }
+
+                LIST_INSERT_AFTER(items, copy, end, j);
+                end = j;
+        }
+
+        return copy;
+}
+
 static const char* const dnssec_algorithm_table[_DNSSEC_ALGORITHM_MAX_DEFINED] = {
         /* Mnemonics as listed on https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml */
         [DNSSEC_ALGORITHM_RSAMD5]             = "RSAMD5",
diff --git a/src/grp-resolve/libbasic-dns/resolved-dns-rr.h b/src/grp-resolve/libbasic-dns/resolved-dns-rr.h
index daf9c8c210..13240e57ed 100644
--- a/src/grp-resolve/libbasic-dns/resolved-dns-rr.h
+++ b/src/grp-resolve/libbasic-dns/resolved-dns-rr.h
@@ -283,6 +283,13 @@ static inline size_t DNS_RESOURCE_RECORD_RDATA_SIZE(DnsResourceRecord *rr) {
         return rr->wire_format_size - rr->wire_format_rdata_offset;
 }
 
+static inline uint8_t DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(DnsResourceRecord *rr) {
+        assert(rr);
+        assert(rr->key->type == DNS_TYPE_OPT);
+
+        return ((rr->ttl >> 16) & 0xFF) == 0;
+}
+
 DnsResourceKey* dns_resource_key_new(uint16_t class, uint16_t type, const char *name);
 DnsResourceKey* dns_resource_key_new_redirect(const DnsResourceKey *key, const DnsResourceRecord *cname);
 int dns_resource_key_new_append_suffix(DnsResourceKey **ret, DnsResourceKey *key, char *name);
@@ -319,6 +326,7 @@ int dns_resource_record_new_reverse(DnsResourceRecord **ret, int family, const u
 int dns_resource_record_new_address(DnsResourceRecord **ret, int family, const union in_addr_union *address, const char *name);
 int dns_resource_record_equal(const DnsResourceRecord *a, const DnsResourceRecord *b);
 const char* dns_resource_record_to_string(DnsResourceRecord *rr);
+DnsResourceRecord *dns_resource_record_copy(DnsResourceRecord *rr);
 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsResourceRecord*, dns_resource_record_unref);
 
 int dns_resource_record_to_wire_format(DnsResourceRecord *rr, bool canonical);
@@ -328,8 +336,11 @@ int dns_resource_record_source(DnsResourceRecord *rr, const char **ret);
 int dns_resource_record_is_signer(DnsResourceRecord *rr, const char *zone);
 int dns_resource_record_is_synthetic(DnsResourceRecord *rr);
 
+int dns_resource_record_clamp_ttl(DnsResourceRecord **rr, uint32_t max_ttl);
+
 DnsTxtItem *dns_txt_item_free_all(DnsTxtItem *i);
 bool dns_txt_item_equal(DnsTxtItem *a, DnsTxtItem *b);
+DnsTxtItem *dns_txt_item_copy(DnsTxtItem *i);
 
 void dns_resource_record_hash_func(const void *i, struct siphash *state);
 
diff --git a/src/grp-resolve/libbasic-dns/test-dns-packet.c b/src/grp-resolve/libbasic-dns/test-dns-packet.c
index 18d04b930d..c9e210fa94 100644
--- a/src/grp-resolve/libbasic-dns/test-dns-packet.c
+++ b/src/grp-resolve/libbasic-dns/test-dns-packet.c
@@ -27,12 +27,26 @@
 #include "basic/macro.h"
 #include "basic/string-util.h"
 #include "basic/strv.h"
+#include "basic/unaligned.h"
 
 #include "resolved-dns-packet.h"
 #include "resolved-dns-rr.h"
 
 #define HASH_KEY SD_ID128_MAKE(d3,1e,48,90,4b,fa,4c,fe,af,9d,d5,a1,d7,2e,8a,b1)
 
+static void verify_rr_copy(DnsResourceRecord *rr) {
+        _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *copy = NULL;
+        const char *a, *b;
+
+        assert_se(copy = dns_resource_record_copy(rr));
+        assert_se(dns_resource_record_equal(copy, rr) > 0);
+
+        assert_se(a = dns_resource_record_to_string(rr));
+        assert_se(b = dns_resource_record_to_string(copy));
+
+        assert_se(streq(a, b));
+}
+
 static uint64_t hash(DnsResourceRecord *rr) {
         struct siphash state;
 
@@ -57,7 +71,7 @@ static void test_packet_from_file(const char* filename, bool canonical) {
                 const char *s, *s2;
                 uint64_t hash1, hash2;
 
-                packet_size = le64toh( *(uint64_t*)(data + offset) );
+                packet_size = unaligned_read_le64(data + offset);
                 assert_se(packet_size > 0);
                 assert_se(offset + 8 + packet_size <= data_size);
 
@@ -66,6 +80,8 @@ static void test_packet_from_file(const char* filename, bool canonical) {
                 assert_se(dns_packet_append_blob(p, data + offset + 8, packet_size, NULL) >= 0);
                 assert_se(dns_packet_read_rr(p, &rr, NULL, NULL) >= 0);
 
+                verify_rr_copy(rr);
+
                 s = dns_resource_record_to_string(rr);
                 assert_se(s);
                 puts(s);
@@ -78,6 +94,8 @@ static void test_packet_from_file(const char* filename, bool canonical) {
                 assert_se(dns_packet_append_blob(p2, rr->wire_format, rr->wire_format_size, NULL) >= 0);
                 assert_se(dns_packet_read_rr(p2, &rr2, NULL, NULL) >= 0);
 
+                verify_rr_copy(rr);
+
                 s2 = dns_resource_record_to_string(rr);
                 assert_se(s2);
                 assert_se(streq(s, s2));
diff --git a/src/grp-resolve/nss-resolve/Makefile b/src/grp-resolve/nss-resolve/Makefile
index acfbe831ae..8ed87994ce 100644
--- a/src/grp-resolve/nss-resolve/Makefile
+++ b/src/grp-resolve/nss-resolve/Makefile
@@ -38,6 +38,7 @@ libnss_resolve_la_LDFLAGS = \
 
 libnss_resolve_la_LIBADD = \
 	libsystemd-internal.la \
+	libbasic.la \
         -ldl
 
 lib_LTLIBRARIES += \
diff --git a/src/grp-resolve/systemd-resolve/Makefile b/src/grp-resolve/systemd-resolve/Makefile
index edb2270c3e..6a21bc2559 100644
--- a/src/grp-resolve/systemd-resolve/Makefile
+++ b/src/grp-resolve/systemd-resolve/Makefile
@@ -33,8 +33,14 @@ nodist_systemd_resolve_SOURCES = \
 	src/resolve/dns_type-from-name.h \
 	src/resolve/dns_type-to-name.h
 
+systemd_resolve_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(GCRYPT_CFLAGS)
+
 systemd_resolve_LDADD = \
-	libshared.la
+	libsystemd-shared.la \
+	$(GCRYPT_LIBS) \
+	-lm
 
 bin_PROGRAMS += \
 	systemd-resolve
diff --git a/src/grp-resolve/systemd-resolve/resolve-tool.c b/src/grp-resolve/systemd-resolve/resolve-tool.c
index dee23289b3..433a103b57 100644
--- a/src/grp-resolve/systemd-resolve/resolve-tool.c
+++ b/src/grp-resolve/systemd-resolve/resolve-tool.c
@@ -27,12 +27,16 @@
 #include "basic/escape.h"
 #include "basic/in-addr-util.h"
 #include "basic/parse-util.h"
+#include "basic/strv.h"
 #include "basic/terminal-util.h"
 #include "resolved-def.h"
 #include "resolved-dns-packet.h"
 #include "sd-bus/bus-error.h"
+#include "sd-netlink/netlink-util.h"
+#include "sd-netlink/sd-netlink.h"
 #include "shared/bus-util.h"
 #include "shared/gcrypt-util.h"
+#include "shared/pager.h"
 
 #define DNS_CALL_TIMEOUT_USEC (45*USEC_PER_SEC)
 
@@ -42,6 +46,7 @@ static uint16_t arg_type = 0;
 static uint16_t arg_class = 0;
 static bool arg_legend = true;
 static uint64_t arg_flags = 0;
+static bool arg_no_pager = false;
 
 typedef enum ServiceFamily {
         SERVICE_FAMILY_TCP,
@@ -66,6 +71,8 @@ static enum {
         MODE_RESOLVE_TLSA,
         MODE_STATISTICS,
         MODE_RESET_STATISTICS,
+        MODE_FLUSH_CACHES,
+        MODE_STATUS,
 } arg_mode = MODE_RESOLVE_HOST;
 
 static ServiceFamily service_family_from_string(const char *s) {
@@ -198,7 +205,7 @@ static int resolve_host(sd_bus *bus, const char *name) {
                 if (ifindex > 0 && !if_indextoname(ifindex, ifname))
                         log_warning_errno(errno, "Failed to resolve interface name for index %i: %m", ifindex);
 
-                r = in_addr_to_string(family, a, &pretty);
+                r = in_addr_ifindex_to_string(family, a, ifindex, &pretty);
                 if (r < 0)
                         return log_error_errno(r, "Failed to print address for %s: %m", name);
 
@@ -252,7 +259,7 @@ static int resolve_address(sd_bus *bus, int family, const union in_addr_union *a
         if (ifindex <= 0)
                 ifindex = arg_ifindex;
 
-        r = in_addr_to_string(family, address, &pretty);
+        r = in_addr_ifindex_to_string(family, address, ifindex, &pretty);
         if (r < 0)
                 return log_oom();
 
@@ -344,31 +351,6 @@ static int resolve_address(sd_bus *bus, int family, const union in_addr_union *a
         return 0;
 }
 
-static int parse_address(const char *s, int *family, union in_addr_union *address, int *ifindex) {
-        const char *percent, *a;
-        int ifi = 0;
-        int r;
-
-        percent = strchr(s, '%');
-        if (percent) {
-                if (parse_ifindex(percent+1, &ifi) < 0) {
-                        ifi = if_nametoindex(percent+1);
-                        if (ifi <= 0)
-                                return -EINVAL;
-                }
-
-                a = strndupa(s, percent - s);
-        } else
-                a = s;
-
-        r = in_addr_from_string_auto(a, family, address);
-        if (r < 0)
-                return r;
-
-        *ifindex = ifi;
-        return 0;
-}
-
 static int output_rr_packet(const void *d, size_t l, int ifindex) {
         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
@@ -658,10 +640,8 @@ static int resolve_service(sd_bus *bus, const char *name, const char *type, cons
         assert(bus);
         assert(domain);
 
-        if (isempty(name))
-                name = NULL;
-        if (isempty(type))
-                type = NULL;
+        name = empty_to_null(name);
+        type = empty_to_null(type);
 
         if (arg_ifindex > 0 && !if_indextoname(arg_ifindex, ifname))
                 return log_error_errno(errno, "Failed to resolve interface name for index %i: %m", arg_ifindex);
@@ -820,10 +800,8 @@ static int resolve_service(sd_bus *bus, const char *name, const char *type, cons
         if (r < 0)
                 return bus_log_parse_error(r);
 
-        if (isempty(canonical_name))
-                canonical_name = NULL;
-        if (isempty(canonical_type))
-                canonical_type = NULL;
+        canonical_name = empty_to_null(canonical_name);
+        canonical_type = empty_to_null(canonical_type);
 
         if (!streq_ptr(name, canonical_name) ||
             !streq_ptr(type, canonical_type) ||
@@ -1041,6 +1019,490 @@ static int reset_statistics(sd_bus *bus) {
         return 0;
 }
 
+static int flush_caches(sd_bus *bus) {
+        _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+        int r;
+
+        r = sd_bus_call_method(bus,
+                               "org.freedesktop.resolve1",
+                               "/org/freedesktop/resolve1",
+                               "org.freedesktop.resolve1.Manager",
+                               "FlushCaches",
+                               &error,
+                               NULL,
+                               NULL);
+        if (r < 0)
+                return log_error_errno(r, "Failed to flush caches: %s", bus_error_message(&error, r));
+
+        return 0;
+}
+
+static int map_link_dns_servers(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_error *error, void *userdata) {
+        char ***l = userdata;
+        int r;
+
+        assert(bus);
+        assert(member);
+        assert(m);
+        assert(l);
+
+        r = sd_bus_message_enter_container(m, 'a', "(iay)");
+        if (r < 0)
+                return r;
+
+        for (;;) {
+                const void *a;
+                char *pretty;
+                int family;
+                size_t sz;
+
+                r = sd_bus_message_enter_container(m, 'r', "iay");
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        break;
+
+                r = sd_bus_message_read(m, "i", &family);
+                if (r < 0)
+                        return r;
+
+                r = sd_bus_message_read_array(m, 'y', &a, &sz);
+                if (r < 0)
+                        return r;
+
+                r = sd_bus_message_exit_container(m);
+                if (r < 0)
+                        return r;
+
+                if (!IN_SET(family, AF_INET, AF_INET6)) {
+                        log_debug("Unexpected family, ignoring.");
+                        continue;
+                }
+
+                if (sz != FAMILY_ADDRESS_SIZE(family)) {
+                        log_debug("Address size mismatch, ignoring.");
+                        continue;
+                }
+
+                r = in_addr_to_string(family, a, &pretty);
+                if (r < 0)
+                        return r;
+
+                r = strv_consume(l, pretty);
+                if (r < 0)
+                        return r;
+        }
+
+        r = sd_bus_message_exit_container(m);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+static int map_link_domains(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_error *error, void *userdata) {
+        char ***l = userdata;
+        int r;
+
+        assert(bus);
+        assert(member);
+        assert(m);
+        assert(l);
+
+        r = sd_bus_message_enter_container(m, 'a', "(sb)");
+        if (r < 0)
+                return r;
+
+        for (;;) {
+                const char *domain;
+                int route_only;
+                char *pretty;
+
+                r = sd_bus_message_read(m, "(sb)", &domain, &route_only);
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        break;
+
+                if (route_only)
+                        pretty = strappend("~", domain);
+                else
+                        pretty = strdup(domain);
+                if (!pretty)
+                        return -ENOMEM;
+
+                r = strv_consume(l, pretty);
+                if (r < 0)
+                        return r;
+        }
+
+        r = sd_bus_message_exit_container(m);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+static int status_ifindex(sd_bus *bus, int ifindex, const char *name, bool *empty_line) {
+
+        struct link_info {
+                uint64_t scopes_mask;
+                char *llmnr;
+                char *mdns;
+                char *dnssec;
+                char **dns;
+                char **domains;
+                char **ntas;
+                int dnssec_supported;
+        } link_info = {};
+
+        static const struct bus_properties_map property_map[] = {
+                { "ScopesMask",                 "t",      NULL,                 offsetof(struct link_info, scopes_mask)      },
+                { "DNS",                        "a(iay)", map_link_dns_servers, offsetof(struct link_info, dns)              },
+                { "Domains",                    "a(sb)",  map_link_domains,     offsetof(struct link_info, domains)          },
+                { "LLMNR",                      "s",      NULL,                 offsetof(struct link_info, llmnr)            },
+                { "MulticastDNS",               "s",      NULL,                 offsetof(struct link_info, mdns)             },
+                { "DNSSEC",                     "s",      NULL,                 offsetof(struct link_info, dnssec)           },
+                { "DNSSECNegativeTrustAnchors", "as",     NULL,                 offsetof(struct link_info, ntas)             },
+                { "DNSSECSupported",            "b",      NULL,                 offsetof(struct link_info, dnssec_supported) },
+                {}
+        };
+
+        _cleanup_free_ char *ifi = NULL, *p = NULL;
+        char ifname[IF_NAMESIZE] = "";
+        char **i;
+        int r;
+
+        assert(bus);
+        assert(ifindex > 0);
+        assert(empty_line);
+
+        if (!name) {
+                if (!if_indextoname(ifindex, ifname))
+                        return log_error_errno(errno, "Failed to resolve interface name for %i: %m", ifindex);
+
+                name = ifname;
+        }
+
+        if (asprintf(&ifi, "%i", ifindex) < 0)
+                return log_oom();
+
+        r = sd_bus_path_encode("/org/freedesktop/resolve1/link", ifi, &p);
+        if (r < 0)
+                return log_oom();
+
+        r = bus_map_all_properties(bus,
+                                   "org.freedesktop.resolve1",
+                                   p,
+                                   property_map,
+                                   &link_info);
+        if (r < 0) {
+                log_error_errno(r, "Failed to get link data for %i: %m", ifindex);
+                goto finish;
+        }
+
+        pager_open(arg_no_pager, false);
+
+        if (*empty_line)
+                fputc('\n', stdout);
+
+        printf("%sLink %i (%s)%s\n",
+               ansi_highlight(), ifindex, name, ansi_normal());
+
+        if (link_info.scopes_mask == 0)
+                printf("      Current Scopes: none\n");
+        else
+                printf("      Current Scopes:%s%s%s%s%s\n",
+                       link_info.scopes_mask & SD_RESOLVED_DNS ? " DNS" : "",
+                       link_info.scopes_mask & SD_RESOLVED_LLMNR_IPV4 ? " LLMNR/IPv4" : "",
+                       link_info.scopes_mask & SD_RESOLVED_LLMNR_IPV6 ? " LLMNR/IPv6" : "",
+                       link_info.scopes_mask & SD_RESOLVED_MDNS_IPV4 ? " mDNS/IPv4" : "",
+                       link_info.scopes_mask & SD_RESOLVED_MDNS_IPV6 ? " mDNS/IPv6" : "");
+
+        printf("       LLMNR setting: %s\n"
+               "MulticastDNS setting: %s\n"
+               "      DNSSEC setting: %s\n"
+               "    DNSSEC supported: %s\n",
+               strna(link_info.llmnr),
+               strna(link_info.mdns),
+               strna(link_info.dnssec),
+               yes_no(link_info.dnssec_supported));
+
+        STRV_FOREACH(i, link_info.dns) {
+                printf("         %s %s\n",
+                       i == link_info.dns ? "DNS Servers:" : "            ",
+                       *i);
+        }
+
+        STRV_FOREACH(i, link_info.domains) {
+                printf("          %s %s\n",
+                       i == link_info.domains ? "DNS Domain:" : "           ",
+                       *i);
+        }
+
+        STRV_FOREACH(i, link_info.ntas) {
+                printf("          %s %s\n",
+                       i == link_info.ntas ? "DNSSEC NTA:" : "           ",
+                       *i);
+        }
+
+        *empty_line = true;
+
+        r = 0;
+
+finish:
+        strv_free(link_info.dns);
+        strv_free(link_info.domains);
+        free(link_info.llmnr);
+        free(link_info.mdns);
+        free(link_info.dnssec);
+        strv_free(link_info.ntas);
+        return r;
+}
+
+static int map_global_dns_servers(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_error *error, void *userdata) {
+        char ***l = userdata;
+        int r;
+
+        assert(bus);
+        assert(member);
+        assert(m);
+        assert(l);
+
+        r = sd_bus_message_enter_container(m, 'a', "(iiay)");
+        if (r < 0)
+                return r;
+
+        for (;;) {
+                const void *a;
+                char *pretty;
+                int family, ifindex;
+                size_t sz;
+
+                r = sd_bus_message_enter_container(m, 'r', "iiay");
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        break;
+
+                r = sd_bus_message_read(m, "ii", &ifindex, &family);
+                if (r < 0)
+                        return r;
+
+                r = sd_bus_message_read_array(m, 'y', &a, &sz);
+                if (r < 0)
+                        return r;
+
+                r = sd_bus_message_exit_container(m);
+                if (r < 0)
+                        return r;
+
+                if (ifindex != 0) /* only show the global ones here */
+                        continue;
+
+                if (!IN_SET(family, AF_INET, AF_INET6)) {
+                        log_debug("Unexpected family, ignoring.");
+                        continue;
+                }
+
+                if (sz != FAMILY_ADDRESS_SIZE(family)) {
+                        log_debug("Address size mismatch, ignoring.");
+                        continue;
+                }
+
+                r = in_addr_to_string(family, a, &pretty);
+                if (r < 0)
+                        return r;
+
+                r = strv_consume(l, pretty);
+                if (r < 0)
+                        return r;
+        }
+
+        r = sd_bus_message_exit_container(m);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+static int map_global_domains(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_error *error, void *userdata) {
+        char ***l = userdata;
+        int r;
+
+        assert(bus);
+        assert(member);
+        assert(m);
+        assert(l);
+
+        r = sd_bus_message_enter_container(m, 'a', "(isb)");
+        if (r < 0)
+                return r;
+
+        for (;;) {
+                const char *domain;
+                int route_only, ifindex;
+                char *pretty;
+
+                r = sd_bus_message_read(m, "(isb)", &ifindex, &domain, &route_only);
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        break;
+
+                if (ifindex != 0) /* only show the global ones here */
+                        continue;
+
+                if (route_only)
+                        pretty = strappend("~", domain);
+                else
+                        pretty = strdup(domain);
+                if (!pretty)
+                        return -ENOMEM;
+
+                r = strv_consume(l, pretty);
+                if (r < 0)
+                        return r;
+        }
+
+        r = sd_bus_message_exit_container(m);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+static int status_global(sd_bus *bus, bool *empty_line) {
+
+        struct global_info {
+                char **dns;
+                char **domains;
+                char **ntas;
+        } global_info = {};
+
+        static const struct bus_properties_map property_map[] = {
+                { "DNS",                        "a(iiay)", map_global_dns_servers, offsetof(struct global_info, dns)     },
+                { "Domains",                    "a(isb)",  map_global_domains,     offsetof(struct global_info, domains) },
+                { "DNSSECNegativeTrustAnchors", "as",      NULL,                   offsetof(struct global_info, ntas)    },
+                {}
+        };
+
+        char **i;
+        int r;
+
+        assert(bus);
+        assert(empty_line);
+
+        r = bus_map_all_properties(bus,
+                                   "org.freedesktop.resolve1",
+                                   "/org/freedesktop/resolve1",
+                                   property_map,
+                                   &global_info);
+        if (r < 0) {
+                log_error_errno(r, "Failed to get global data: %m");
+                goto finish;
+        }
+
+        if (strv_isempty(global_info.dns) && strv_isempty(global_info.domains) && strv_isempty(global_info.ntas)) {
+                r = 0;
+                goto finish;
+        }
+
+        pager_open(arg_no_pager, false);
+
+        printf("%sGlobal%s\n", ansi_highlight(), ansi_normal());
+        STRV_FOREACH(i, global_info.dns) {
+                printf("         %s %s\n",
+                       i == global_info.dns ? "DNS Servers:" : "            ",
+                       *i);
+        }
+
+        STRV_FOREACH(i, global_info.domains) {
+                printf("          %s %s\n",
+                       i == global_info.domains ? "DNS Domain:" : "           ",
+                       *i);
+        }
+
+        strv_sort(global_info.ntas);
+        STRV_FOREACH(i, global_info.ntas) {
+                printf("          %s %s\n",
+                       i == global_info.ntas ? "DNSSEC NTA:" : "           ",
+                       *i);
+        }
+
+        *empty_line = true;
+
+        r = 0;
+
+finish:
+        strv_free(global_info.dns);
+        strv_free(global_info.domains);
+        strv_free(global_info.ntas);
+
+        return r;
+}
+
+static int status_all(sd_bus *bus) {
+        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;
+        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
+        sd_netlink_message *i;
+        bool empty_line = false;
+        int r;
+
+        assert(bus);
+
+        r = status_global(bus, &empty_line);
+        if (r < 0)
+                return r;
+
+        r = sd_netlink_open(&rtnl);
+        if (r < 0)
+                return log_error_errno(r, "Failed to connect to netlink: %m");
+
+        r = sd_rtnl_message_new_link(rtnl, &req, RTM_GETLINK, 0);
+        if (r < 0)
+                return rtnl_log_create_error(r);
+
+        r = sd_netlink_message_request_dump(req, true);
+        if (r < 0)
+                return rtnl_log_create_error(r);
+
+        r = sd_netlink_call(rtnl, req, 0, &reply);
+        if (r < 0)
+                return log_error_errno(r, "Failed to enumerate links: %m");
+
+        r = 0;
+        for (i = reply; i; i = sd_netlink_message_next(i)) {
+                const char *name;
+                int ifindex, q;
+                uint16_t type;
+
+                q = sd_netlink_message_get_type(i, &type);
+                if (q < 0)
+                        return rtnl_log_parse_error(q);
+
+                if (type != RTM_NEWLINK)
+                        continue;
+
+                q = sd_rtnl_message_link_get_ifindex(i, &ifindex);
+                if (q < 0)
+                        return rtnl_log_parse_error(q);
+
+                if (ifindex == LOOPBACK_IFINDEX)
+                        continue;
+
+                q = sd_netlink_message_read_string(i, IFLA_IFNAME, &name);
+                if (q < 0)
+                        return rtnl_log_parse_error(q);
+
+                q = status_ifindex(bus, ifindex, name, &empty_line);
+                if (q < 0 && r >= 0)
+                        r = q;
+        }
+
+        return r;
+}
+
 static void help_protocol_types(void) {
         if (arg_legend)
                 puts("Known protocol types:");
@@ -1048,8 +1510,8 @@ static void help_protocol_types(void) {
 }
 
 static void help_dns_types(void) {
-        int i;
         const char *t;
+        int i;
 
         if (arg_legend)
                 puts("Known DNS RR types:");
@@ -1061,8 +1523,8 @@ static void help_dns_types(void) {
 }
 
 static void help_dns_classes(void) {
-        int i;
         const char *t;
+        int i;
 
         if (arg_legend)
                 puts("Known DNS RR classes:");
@@ -1083,6 +1545,7 @@ static void help(void) {
                "Resolve domain names, IPv4 and IPv6 addresses, DNS resource records, and services.\n\n"
                "  -h --help                 Show this help\n"
                "     --version              Show package version\n"
+               "     --no-pager             Do not pipe output into a pager\n"
                "  -4                        Resolve IPv4 addresses\n"
                "  -6                        Resolve IPv6 addresses\n"
                "  -i --interface=INTERFACE  Look on interface\n"
@@ -1101,6 +1564,8 @@ static void help(void) {
                "     --legend=BOOL          Print headers and additional info (default: yes)\n"
                "     --statistics           Show resolver statistics\n"
                "     --reset-statistics     Reset resolver statistics\n"
+               "     --status               Show link and server status\n"
+               "     --flush-caches         Flush all local DNS caches\n"
                , program_invocation_short_name);
 }
 
@@ -1118,6 +1583,9 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_SEARCH,
                 ARG_STATISTICS,
                 ARG_RESET_STATISTICS,
+                ARG_STATUS,
+                ARG_FLUSH_CACHES,
+                ARG_NO_PAGER,
         };
 
         static const struct option options[] = {
@@ -1138,6 +1606,9 @@ static int parse_argv(int argc, char *argv[]) {
                 { "search",           required_argument, NULL, ARG_SEARCH           },
                 { "statistics",       no_argument,       NULL, ARG_STATISTICS,      },
                 { "reset-statistics", no_argument,       NULL, ARG_RESET_STATISTICS },
+                { "status",           no_argument,       NULL, ARG_STATUS           },
+                { "flush-caches",     no_argument,       NULL, ARG_FLUSH_CACHES     },
+                { "no-pager",         no_argument,       NULL, ARG_NO_PAGER         },
                 {}
         };
 
@@ -1311,6 +1782,18 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_mode = MODE_RESET_STATISTICS;
                         break;
 
+                case ARG_FLUSH_CACHES:
+                        arg_mode = MODE_FLUSH_CACHES;
+                        break;
+
+                case ARG_STATUS:
+                        arg_mode = MODE_STATUS;
+                        break;
+
+                case ARG_NO_PAGER:
+                        arg_no_pager = true;
+                        break;
+
                 case '?':
                         return -EINVAL;
 
@@ -1370,7 +1853,7 @@ int main(int argc, char **argv) {
                         if (startswith(argv[optind], "dns:"))
                                 k = resolve_rfc4501(bus, argv[optind]);
                         else {
-                                k = parse_address(argv[optind], &family, &a, &ifindex);
+                                k = in_addr_ifindex_from_string_auto(argv[optind], &family, &a, &ifindex);
                                 if (k >= 0)
                                         k = resolve_address(bus, family, &a, ifindex);
                                 else
@@ -1477,8 +1960,48 @@ int main(int argc, char **argv) {
 
                 r = reset_statistics(bus);
                 break;
+
+        case MODE_FLUSH_CACHES:
+                if (argc > optind) {
+                        log_error("Too many arguments.");
+                        r = -EINVAL;
+                        goto finish;
+                }
+
+                r = flush_caches(bus);
+                break;
+
+        case MODE_STATUS:
+
+                if (argc > optind) {
+                        char **ifname;
+                        bool empty_line = false;
+
+                        r = 0;
+                        STRV_FOREACH(ifname, argv + optind) {
+                                int ifindex, q;
+
+                                q = parse_ifindex(argv[optind], &ifindex);
+                                if (q < 0) {
+                                        ifindex = if_nametoindex(argv[optind]);
+                                        if (ifindex <= 0) {
+                                                log_error_errno(errno, "Failed to resolve interface name: %s", argv[optind]);
+                                                continue;
+                                        }
+                                }
+
+                                q = status_ifindex(bus, ifindex, NULL, &empty_line);
+                                if (q < 0 && r >= 0)
+                                        r = q;
+                        }
+                } else
+                        r = status_all(bus);
+
+                break;
         }
 
 finish:
+        pager_close();
+
         return r == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 }
diff --git a/src/grp-resolve/systemd-resolve/systemd-resolve.xml b/src/grp-resolve/systemd-resolve/systemd-resolve.xml
index 4b66f836a2..ca26bb4d49 100644
--- a/src/grp-resolve/systemd-resolve/systemd-resolve.xml
+++ b/src/grp-resolve/systemd-resolve/systemd-resolve.xml
@@ -114,6 +114,12 @@
     and IPv6 addresses. If the parameters specified are formatted as IPv4 or IPv6 operation the reverse operation is
     done, and a hostname is retrieved for the specified addresses.</para>
 
+    <para>The program's output contains information about the protocol used for the look-up and on which network
+    interface the data was discovered. It also contains information on whether the information could be
+    authenticated. All data for which local DNSSEC validation succeeds is considered authenticated. Moreover all data
+    originating from local, trusted sources is also reported authenticated, including resolution of the local host
+    name, the <literal>localhost</literal> host name or all data from <filename>/etc/hosts</filename>.</para>
+
     <para>The <option>--type=</option> switch may be used to specify a DNS resource record type (A, AAAA, SOA, MX, ...) in
     order to request a specific DNS resource record, instead of the address or reverse address lookups.
     The special value <literal>help</literal> may be used to list known values.</para>
@@ -288,8 +294,21 @@
         <listitem><para>Resets the statistics counters shown in <option>--statistics</option> to zero.</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--flush-caches</option></term>
+
+        <listitem><para>Flushes all DNS resource record caches the service maintains locally.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--status</option></term>
+
+        <listitem><para>Shows the global and per-link DNS settings in currently in effect.</para></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
+      <xi:include href="standard-options.xml" xpointer="no-pager" />
     </variablelist>
   </refsect1>
 
diff --git a/src/grp-resolve/systemd-resolved/Makefile b/src/grp-resolve/systemd-resolved/Makefile
index 30173ce08c..54a8b4f28c 100644
--- a/src/grp-resolve/systemd-resolved/Makefile
+++ b/src/grp-resolve/systemd-resolved/Makefile
@@ -65,6 +65,8 @@ systemd_resolved_SOURCES = \
 	src/resolve/resolved-dns-stream.c \
 	src/resolve/resolved-dns-trust-anchor.h \
 	src/resolve/resolved-dns-trust-anchor.c \
+	src/resolve/resolved-dns-stub.h \
+	src/resolve/resolved-dns-stub.c \
 	src/resolve/resolved-etc-hosts.h \
 	src/resolve/resolved-etc-hosts.c
 
@@ -73,9 +75,15 @@ nodist_systemd_resolved_SOURCES = \
 	src/resolve/dns_type-to-name.h \
 	src/resolve/resolved-gperf.c
 
+systemd_resolved_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(GCRYPT_CFLAGS)
+
 systemd_resolved_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la \
+	$(GCRYPT_LIBS) \
+	-lm
 
 rootlibexec_PROGRAMS += \
 	systemd-resolved
@@ -114,6 +122,9 @@ EXTRA_DIST += \
 	units/systemd-resolved.service.m4.in \
 	src/resolve/resolved.conf.in
 
+dist_rootlibexec_DATA += \
+	src/resolve/resolv.conf
+
 systemd_resolved_LDADD += libbasic-dns.la
 
 sd.CPPFLAGS += -DPKGSYSCONFDIR=\"$(pkgsysconfdir)\"
diff --git a/src/grp-resolve/systemd-resolved/resolv.conf b/src/grp-resolve/systemd-resolved/resolv.conf
new file mode 100644
index 0000000000..b8034d6829
--- /dev/null
+++ b/src/grp-resolve/systemd-resolved/resolv.conf
@@ -0,0 +1,11 @@
+# This is a static resolv.conf file for connecting local clients to
+# systemd-resolved via its DNS stub listener on 127.0.0.53.
+#
+# Third party programs must not access this file directly, but only through the
+# symlink at /etc/resolv.conf. To manage resolv.conf(5) in a different way,
+# replace this symlink by a static file or a different symlink.
+#
+# See systemd-resolved.service(8) for details about the supported modes of
+# operation for /etc/resolv.conf.
+
+nameserver 127.0.0.53
diff --git a/src/grp-resolve/systemd-resolved/resolved-bus.c b/src/grp-resolve/systemd-resolved/resolved-bus.c
index 1454e1f5f4..3c2a8b0892 100644
--- a/src/grp-resolve/systemd-resolved/resolved-bus.c
+++ b/src/grp-resolve/systemd-resolved/resolved-bus.c
@@ -246,17 +246,22 @@ static int parse_as_address(sd_bus_message *m, int ifindex, const char *hostname
         _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
         _cleanup_free_ char *canonical = NULL;
         union in_addr_union parsed;
-        int r, ff;
+        int r, ff, parsed_ifindex = 0;
 
         /* Check if the hostname is actually already an IP address formatted as string. In that case just parse it,
          * let's not attempt to look it up. */
 
-        r = in_addr_from_string_auto(hostname, &ff, &parsed);
+        r = in_addr_ifindex_from_string_auto(hostname, &ff, &parsed, &parsed_ifindex);
         if (r < 0) /* not an address */
                 return 0;
 
         if (family != AF_UNSPEC && ff != family)
                 return sd_bus_reply_method_errorf(m, BUS_ERROR_NO_SUCH_RR, "The specified address is not of the requested family.");
+        if (ifindex > 0 && parsed_ifindex > 0 && parsed_ifindex != ifindex)
+                return sd_bus_reply_method_errorf(m, BUS_ERROR_NO_SUCH_RR, "The specified address interface index does not match requested interface.");
+
+        if (parsed_ifindex > 0)
+                ifindex = parsed_ifindex;
 
         r = sd_bus_message_new_method_return(m, &reply);
         if (r < 0)
@@ -289,7 +294,7 @@ static int parse_as_address(sd_bus_message *m, int ifindex, const char *hostname
         /* When an IP address is specified we just return it as canonical name, in order to avoid a DNS
          * look-up. However, we reformat it to make sure it's in a truly canonical form (i.e. on IPv6 the inner
          * omissions are always done the same way). */
-        r = in_addr_to_string(ff, &parsed, &canonical);
+        r = in_addr_ifindex_to_string(ff, &parsed, ifindex, &canonical);
         if (r < 0)
                 return r;
 
@@ -643,6 +648,8 @@ static int bus_method_resolve_record(sd_bus_message *message, void *userdata, sd
 
         if (!dns_type_is_valid_query(type))
                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Specified resource record type %" PRIu16 " may not be used in a query.", type);
+        if (dns_type_is_zone_transer(type))
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Zone transfers not permitted via this programming interface.");
         if (dns_type_is_obsolete(type))
                 return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Specified DNS resource record type %" PRIu16 " is obsolete.", type);
 
@@ -666,6 +673,10 @@ static int bus_method_resolve_record(sd_bus_message *message, void *userdata, sd
         if (r < 0)
                 return r;
 
+        /* Let's request that the TTL is fixed up for locally cached entries, after all we return it in the wire format
+         * blob */
+        q->clamp_ttl = true;
+
         q->request = sd_bus_message_ref(message);
         q->complete = bus_method_resolve_record_complete;
 
@@ -1222,7 +1233,7 @@ int bus_dns_server_append(sd_bus_message *reply, DnsServer *s, bool with_ifindex
                 return r;
 
         if (with_ifindex) {
-                r = sd_bus_message_append(reply, "i", s->link ? s->link->ifindex : 0);
+                r = sd_bus_message_append(reply, "i", dns_server_ifindex(s));
                 if (r < 0)
                         return r;
         }
@@ -1410,6 +1421,36 @@ static int bus_property_get_dnssec_supported(
         return sd_bus_message_append(reply, "b", manager_dnssec_supported(m));
 }
 
+static int bus_property_get_ntas(
+                sd_bus *bus,
+                const char *path,
+                const char *interface,
+                const char *property,
+                sd_bus_message *reply,
+                void *userdata,
+                sd_bus_error *error) {
+
+        Manager *m = userdata;
+        const char *domain;
+        Iterator i;
+        int r;
+
+        assert(reply);
+        assert(m);
+
+        r = sd_bus_message_open_container(reply, 'a', "s");
+        if (r < 0)
+                return r;
+
+        SET_FOREACH(domain, m->trust_anchor.negative_by_name, i) {
+                r = sd_bus_message_append(reply, "s", domain);
+                if (r < 0)
+                        return r;
+        }
+
+        return sd_bus_message_close_container(reply);
+}
+
 static int bus_method_reset_statistics(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         DnsScope *s;
@@ -1443,26 +1484,6 @@ static int get_any_link(Manager *m, int ifindex, Link **ret, sd_bus_error *error
         return 0;
 }
 
-static int get_unmanaged_link(Manager *m, int ifindex, Link **ret, sd_bus_error *error) {
-        Link *l;
-        int r;
-
-        assert(m);
-        assert(ret);
-
-        r = get_any_link(m, ifindex, &l, error);
-        if (r < 0)
-                return r;
-
-        if (l->flags & IFF_LOOPBACK)
-                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is loopback device.", l->name);
-        if (l->is_managed)
-                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is managed.", l->name);
-
-        *ret = l;
-        return 0;
-}
-
 static int call_link_method(Manager *m, sd_bus_message *message, sd_bus_message_handler_t handler, sd_bus_error *error) {
         int ifindex, r;
         Link *l;
@@ -1476,7 +1497,7 @@ static int call_link_method(Manager *m, sd_bus_message *message, sd_bus_message_
         if (r < 0)
                 return r;
 
-        r = get_unmanaged_link(m, ifindex, &l, error);
+        r = get_any_link(m, ifindex, &l, error);
         if (r < 0)
                 return r;
 
@@ -1536,6 +1557,17 @@ static int bus_method_get_link(sd_bus_message *message, void *userdata, sd_bus_e
         return sd_bus_reply_method_return(message, "o", p);
 }
 
+static int bus_method_flush_caches(sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        Manager *m = userdata;
+
+        assert(message);
+        assert(m);
+
+        manager_flush_caches(m);
+
+        return sd_bus_reply_method_return(message, NULL);
+}
+
 static const sd_bus_vtable resolve_vtable[] = {
         SD_BUS_VTABLE_START(0),
         SD_BUS_PROPERTY("LLMNRHostname", "s", NULL, offsetof(Manager, llmnr_hostname), 0),
@@ -1545,12 +1577,14 @@ static const sd_bus_vtable resolve_vtable[] = {
         SD_BUS_PROPERTY("CacheStatistics", "(ttt)", bus_property_get_cache_statistics, 0, 0),
         SD_BUS_PROPERTY("DNSSECStatistics", "(tttt)", bus_property_get_dnssec_statistics, 0, 0),
         SD_BUS_PROPERTY("DNSSECSupported", "b", bus_property_get_dnssec_supported, 0, 0),
+        SD_BUS_PROPERTY("DNSSECNegativeTrustAnchors", "as", bus_property_get_ntas, 0, 0),
 
         SD_BUS_METHOD("ResolveHostname", "isit", "a(iiay)st", bus_method_resolve_hostname, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ResolveAddress", "iiayt", "a(is)t", bus_method_resolve_address, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ResolveRecord", "isqqt", "a(iqqay)t", bus_method_resolve_record, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ResolveService", "isssit", "a(qqqsa(iiay)s)aayssst", bus_method_resolve_service, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ResetStatistics", NULL, NULL, bus_method_reset_statistics, 0),
+        SD_BUS_METHOD("FlushCaches", NULL, NULL, bus_method_flush_caches, 0),
         SD_BUS_METHOD("GetLink", "i", "o", bus_method_get_link, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("SetLinkDNS", "ia(iay)", NULL, bus_method_set_link_dns_servers, 0),
         SD_BUS_METHOD("SetLinkDomains", "ia(sb)", NULL, bus_method_set_link_domains, 0),
diff --git a/src/grp-resolve/systemd-resolved/resolved-conf.c b/src/grp-resolve/systemd-resolved/resolved-conf.c
index 4dc169094b..c6d70b5938 100644
--- a/src/grp-resolve/systemd-resolved/resolved-conf.c
+++ b/src/grp-resolve/systemd-resolved/resolved-conf.c
@@ -28,18 +28,22 @@
 
 int manager_add_dns_server_by_string(Manager *m, DnsServerType type, const char *word) {
         union in_addr_union address;
-        int family, r;
+        int family, r, ifindex = 0;
         DnsServer *s;
 
         assert(m);
         assert(word);
 
-        r = in_addr_from_string_auto(word, &family, &address);
+        r = in_addr_ifindex_from_string_auto(word, &family, &address, &ifindex);
         if (r < 0)
                 return r;
 
+        /* Silently filter out 0.0.0.0 and 127.0.0.53 (our own stub DNS listener) */
+        if (!dns_server_address_valid(family, &address))
+                return 0;
+
         /* Filter out duplicates */
-        s = dns_server_find(manager_get_first_dns_server(m, type), family, &address);
+        s = dns_server_find(manager_get_first_dns_server(m, type), family, &address, ifindex);
         if (s) {
                 /*
                  * Drop the marker. This is used to find the servers
@@ -51,7 +55,7 @@ int manager_add_dns_server_by_string(Manager *m, DnsServerType type, const char
                 return 0;
         }
 
-        return dns_server_new(m, NULL, type, NULL, family, &address);
+        return dns_server_new(m, NULL, type, NULL, family, &address, ifindex);
 }
 
 int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string) {
@@ -71,7 +75,7 @@ int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, con
 
                 r = manager_add_dns_server_by_string(m, type, word);
                 if (r < 0)
-                        log_warning_errno(r, "Failed to add DNS server address '%s', ignoring.", word);
+                        log_warning_errno(r, "Failed to add DNS server address '%s', ignoring: %m", word);
         }
 
         return 0;
@@ -126,7 +130,7 @@ int manager_parse_search_domains_and_warn(Manager *m, const char *string) {
 
                 r = manager_add_search_domain_by_string(m, word);
                 if (r < 0)
-                        log_warning_errno(r, "Failed to add search domain '%s', ignoring.", word);
+                        log_warning_errno(r, "Failed to add search domain '%s', ignoring: %m", word);
         }
 
         return 0;
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-cache.c b/src/grp-resolve/systemd-resolved/resolved-dns-cache.c
index 33e0582d98..690ed6f0c1 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-cache.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-cache.c
@@ -625,6 +625,12 @@ int dns_cache_put(
 
         dns_cache_remove_previous(c, key, answer);
 
+        /* We only care for positive replies and NXDOMAINs, on all
+         * other replies we will simply flush the respective entries,
+         * and that's it */
+        if (!IN_SET(rcode, DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN))
+                return 0;
+
         if (dns_answer_size(answer) <= 0) {
                 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
 
@@ -633,12 +639,6 @@ int dns_cache_put(
                 return 0;
         }
 
-        /* We only care for positive replies and NXDOMAINs, on all
-         * other replies we will simply flush the respective entries,
-         * and that's it */
-        if (!IN_SET(rcode, DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN))
-                return 0;
-
         cache_keys = dns_answer_size(answer);
         if (key)
                 cache_keys++;
@@ -692,7 +692,7 @@ int dns_cache_put(
                 return 0;
 
         /* See https://tools.ietf.org/html/rfc2308, which say that a
-         * matching SOA record in the packet is used to to enable
+         * matching SOA record in the packet is used to enable
          * negative caching. */
         r = dns_answer_find_soa(answer, key, &soa, &flags);
         if (r < 0)
@@ -791,7 +791,7 @@ static DnsCacheItem *dns_cache_get_by_key_follow_cname_dname_nsec(DnsCache *c, D
         return NULL;
 }
 
-int dns_cache_lookup(DnsCache *c, DnsResourceKey *key, int *rcode, DnsAnswer **ret, bool *authenticated) {
+int dns_cache_lookup(DnsCache *c, DnsResourceKey *key, bool clamp_ttl, int *rcode, DnsAnswer **ret, bool *authenticated) {
         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
         char key_str[DNS_RESOURCE_KEY_STRING_MAX];
         unsigned n = 0;
@@ -799,6 +799,7 @@ int dns_cache_lookup(DnsCache *c, DnsResourceKey *key, int *rcode, DnsAnswer **r
         bool nxdomain = false;
         DnsCacheItem *j, *first, *nsec = NULL;
         bool have_authenticated = false, have_non_authenticated = false;
+        usec_t current;
 
         assert(c);
         assert(key);
@@ -893,11 +894,24 @@ int dns_cache_lookup(DnsCache *c, DnsResourceKey *key, int *rcode, DnsAnswer **r
         if (!answer)
                 return -ENOMEM;
 
+        if (clamp_ttl)
+                current = now(clock_boottime_or_monotonic());
+
         LIST_FOREACH(by_key, j, first) {
+                _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
+
                 if (!j->rr)
                         continue;
 
-                r = dns_answer_add(answer, j->rr, j->ifindex, j->authenticated ? DNS_ANSWER_AUTHENTICATED : 0);
+                if (clamp_ttl) {
+                        rr = dns_resource_record_ref(j->rr);
+
+                        r = dns_resource_record_clamp_ttl(&rr, LESS_BY(j->until, current) / USEC_PER_SEC);
+                        if (r < 0)
+                                return r;
+                }
+
+                r = dns_answer_add(answer, rr ?: j->rr, j->ifindex, j->authenticated ? DNS_ANSWER_AUTHENTICATED : 0);
                 if (r < 0)
                         return r;
         }
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-cache.h b/src/grp-resolve/systemd-resolved/resolved-dns-cache.h
index e7cdd2e27a..7c1581c99b 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-cache.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-cache.h
@@ -40,7 +40,7 @@ void dns_cache_flush(DnsCache *c);
 void dns_cache_prune(DnsCache *c);
 
 int dns_cache_put(DnsCache *c, DnsResourceKey *key, int rcode, DnsAnswer *answer, bool authenticated, uint32_t nsec_ttl, usec_t timestamp, int owner_family, const union in_addr_union *owner_address);
-int dns_cache_lookup(DnsCache *c, DnsResourceKey *key, int *rcode, DnsAnswer **answer, bool *authenticated);
+int dns_cache_lookup(DnsCache *c, DnsResourceKey *key, bool clamp_ttl, int *rcode, DnsAnswer **answer, bool *authenticated);
 
 int dns_cache_check_conflicts(DnsCache *cache, DnsResourceRecord *rr, int owner_family, const union in_addr_union *owner_address);
 
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-query.c b/src/grp-resolve/systemd-resolved/resolved-dns-query.c
index 7b9282a69d..3a187ee349 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-query.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-query.c
@@ -155,6 +155,7 @@ static int dns_query_candidate_add_transaction(DnsQueryCandidate *c, DnsResource
                 goto gc;
         }
 
+        t->clamp_ttl = c->query->clamp_ttl;
         return 1;
 
 gc:
@@ -404,6 +405,16 @@ DnsQuery *dns_query_free(DnsQuery *q) {
         sd_bus_message_unref(q->request);
         sd_bus_track_unref(q->bus_track);
 
+        dns_packet_unref(q->request_dns_packet);
+
+        if (q->request_dns_stream) {
+                /* Detach the stream from our query, in case something else keeps a reference to it. */
+                q->request_dns_stream->complete = NULL;
+                q->request_dns_stream->on_packet = NULL;
+                q->request_dns_stream->query = NULL;
+                dns_stream_unref(q->request_dns_stream);
+        }
+
         free(q->request_address_string);
 
         if (q->manager) {
@@ -421,7 +432,8 @@ int dns_query_new(
                 DnsQuery **ret,
                 DnsQuestion *question_utf8,
                 DnsQuestion *question_idna,
-                int ifindex, uint64_t flags) {
+                int ifindex,
+                uint64_t flags) {
 
         _cleanup_(dns_query_freep) DnsQuery *q = NULL;
         DnsResourceKey *key;
@@ -509,7 +521,7 @@ int dns_query_make_auxiliary(DnsQuery *q, DnsQuery *auxiliary_for) {
         assert(q);
         assert(auxiliary_for);
 
-        /* Ensure that that the query is not auxiliary yet, and
+        /* Ensure that the query is not auxiliary yet, and
          * nothing else is auxiliary to it either */
         assert(!q->auxiliary_for);
         assert(!q->auxiliary_queries);
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-query.h b/src/grp-resolve/systemd-resolved/resolved-dns-query.h
index 4a127930bd..a501cb1203 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-query.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-query.h
@@ -71,6 +71,10 @@ struct DnsQuery {
          * family */
         bool suppress_unroutable_family;
 
+
+        /* If true, the RR TTLs of the answer will be clamped by their current left validity in the cache */
+        bool clamp_ttl;
+
         DnsTransactionState state;
         unsigned n_cname_redirects;
 
@@ -95,6 +99,10 @@ struct DnsQuery {
         unsigned block_all_complete;
         char *request_address_string;
 
+        /* DNS stub information */
+        DnsPacket *request_dns_packet;
+        DnsStream *request_dns_stream;
+
         /* Completion callback */
         void (*complete)(DnsQuery* q);
         unsigned block_ready;
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-scope.c b/src/grp-resolve/systemd-resolved/resolved-dns-scope.c
index cf878cc783..9da091b5e9 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-scope.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-scope.c
@@ -233,7 +233,7 @@ static int dns_scope_emit_one(DnsScope *s, int fd, DnsPacket *p) {
                 if (fd < 0)
                         return fd;
 
-                r = manager_send(s->manager, fd, ifindex, family, &addr, LLMNR_PORT, p);
+                r = manager_send(s->manager, fd, ifindex, family, &addr, LLMNR_PORT, NULL, p);
                 if (r < 0)
                         return r;
 
@@ -258,7 +258,7 @@ static int dns_scope_emit_one(DnsScope *s, int fd, DnsPacket *p) {
                 if (fd < 0)
                         return fd;
 
-                r = manager_send(s->manager, fd, ifindex, family, &addr, MDNS_PORT, p);
+                r = manager_send(s->manager, fd, ifindex, family, &addr, MDNS_PORT, NULL, p);
                 if (r < 0)
                         return r;
 
@@ -308,7 +308,7 @@ static int dns_scope_socket(
         union sockaddr_union sa = {};
         socklen_t salen;
         static const int one = 1;
-        int ret, r;
+        int ret, r, ifindex;
 
         assert(s);
 
@@ -316,6 +316,8 @@ static int dns_scope_socket(
                 assert(family == AF_UNSPEC);
                 assert(!address);
 
+                ifindex = dns_server_ifindex(server);
+
                 sa.sa.sa_family = server->family;
                 if (server->family == AF_INET) {
                         sa.in.sin_port = htobe16(port);
@@ -324,7 +326,7 @@ static int dns_scope_socket(
                 } else if (server->family == AF_INET6) {
                         sa.in6.sin6_port = htobe16(port);
                         sa.in6.sin6_addr = server->address.in6;
-                        sa.in6.sin6_scope_id = s->link ? s->link->ifindex : 0;
+                        sa.in6.sin6_scope_id = ifindex;
                         salen = sizeof(sa.in6);
                 } else
                         return -EAFNOSUPPORT;
@@ -333,6 +335,7 @@ static int dns_scope_socket(
                 assert(address);
 
                 sa.sa.sa_family = family;
+                ifindex = s->link ? s->link->ifindex : 0;
 
                 if (family == AF_INET) {
                         sa.in.sin_port = htobe16(port);
@@ -341,7 +344,7 @@ static int dns_scope_socket(
                 } else if (family == AF_INET6) {
                         sa.in6.sin6_port = htobe16(port);
                         sa.in6.sin6_addr = address->in6;
-                        sa.in6.sin6_scope_id = s->link ? s->link->ifindex : 0;
+                        sa.in6.sin6_scope_id = ifindex;
                         salen = sizeof(sa.in6);
                 } else
                         return -EAFNOSUPPORT;
@@ -358,14 +361,14 @@ static int dns_scope_socket(
         }
 
         if (s->link) {
-                uint32_t ifindex = htobe32(s->link->ifindex);
+                be32_t ifindex_be = htobe32(ifindex);
 
                 if (sa.sa.sa_family == AF_INET) {
-                        r = setsockopt(fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
+                        r = setsockopt(fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex_be, sizeof(ifindex_be));
                         if (r < 0)
                                 return -errno;
                 } else if (sa.sa.sa_family == AF_INET6) {
-                        r = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
+                        r = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex_be, sizeof(ifindex_be));
                         if (r < 0)
                                 return -errno;
                 }
@@ -576,6 +579,7 @@ static int dns_scope_multicast_membership(DnsScope *s, bool b, struct in_addr in
 }
 
 int dns_scope_llmnr_membership(DnsScope *s, bool b) {
+        assert(s);
 
         if (s->protocol != DNS_PROTOCOL_LLMNR)
                 return 0;
@@ -584,6 +588,7 @@ int dns_scope_llmnr_membership(DnsScope *s, bool b) {
 }
 
 int dns_scope_mdns_membership(DnsScope *s, bool b) {
+        assert(s);
 
         if (s->protocol != DNS_PROTOCOL_MDNS)
                 return 0;
@@ -602,15 +607,14 @@ static int dns_scope_make_reply_packet(
                 DnsPacket **ret) {
 
         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
-        unsigned i;
         int r;
 
         assert(s);
         assert(ret);
 
-        if ((!q || q->n_keys <= 0)
-            && (!answer || answer->n_rrs <= 0)
-            && (!soa || soa->n_rrs <= 0))
+        if (dns_question_isempty(q) &&
+            dns_answer_isempty(answer) &&
+            dns_answer_isempty(soa))
                 return -EINVAL;
 
         r = dns_packet_new(&p, s->protocol, 0);
@@ -629,35 +633,20 @@ static int dns_scope_make_reply_packet(
                                                               0 /* (cd) */,
                                                               rcode));
 
-        if (q) {
-                for (i = 0; i < q->n_keys; i++) {
-                        r = dns_packet_append_key(p, q->keys[i], NULL);
-                        if (r < 0)
-                                return r;
-                }
-
-                DNS_PACKET_HEADER(p)->qdcount = htobe16(q->n_keys);
-        }
-
-        if (answer) {
-                for (i = 0; i < answer->n_rrs; i++) {
-                        r = dns_packet_append_rr(p, answer->items[i].rr, NULL, NULL);
-                        if (r < 0)
-                                return r;
-                }
-
-                DNS_PACKET_HEADER(p)->ancount = htobe16(answer->n_rrs);
-        }
+        r = dns_packet_append_question(p, q);
+        if (r < 0)
+                return r;
+        DNS_PACKET_HEADER(p)->qdcount = htobe16(dns_question_size(q));
 
-        if (soa) {
-                for (i = 0; i < soa->n_rrs; i++) {
-                        r = dns_packet_append_rr(p, soa->items[i].rr, NULL, NULL);
-                        if (r < 0)
-                                return r;
-                }
+        r = dns_packet_append_answer(p, answer);
+        if (r < 0)
+                return r;
+        DNS_PACKET_HEADER(p)->ancount = htobe16(dns_answer_size(answer));
 
-                DNS_PACKET_HEADER(p)->arcount = htobe16(soa->n_rrs);
-        }
+        r = dns_packet_append_answer(p, soa);
+        if (r < 0)
+                return r;
+        DNS_PACKET_HEADER(p)->arcount = htobe16(dns_answer_size(soa));
 
         *ret = p;
         p = NULL;
@@ -666,25 +655,25 @@ static int dns_scope_make_reply_packet(
 }
 
 static void dns_scope_verify_conflicts(DnsScope *s, DnsPacket *p) {
-        unsigned n;
+        DnsResourceRecord *rr;
+        DnsResourceKey *key;
 
         assert(s);
         assert(p);
 
-        if (p->question)
-                for (n = 0; n < p->question->n_keys; n++)
-                        dns_zone_verify_conflicts(&s->zone, p->question->keys[n]);
-        if (p->answer)
-                for (n = 0; n < p->answer->n_rrs; n++)
-                        dns_zone_verify_conflicts(&s->zone, p->answer->items[n].rr->key);
+        DNS_QUESTION_FOREACH(key, p->question)
+                dns_zone_verify_conflicts(&s->zone, key);
+
+        DNS_ANSWER_FOREACH(rr, p->answer)
+                dns_zone_verify_conflicts(&s->zone, rr->key);
 }
 
 void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
-        _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;
+        _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
         DnsResourceKey *key = NULL;
         bool tentative = false;
-        int r, fd;
+        int r;
 
         assert(s);
         assert(p);
@@ -706,7 +695,7 @@ void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
 
         r = dns_packet_extract(p);
         if (r < 0) {
-                log_debug_errno(r, "Failed to extract resources from incoming packet: %m");
+                log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");
                 return;
         }
 
@@ -716,10 +705,10 @@ void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
                 return;
         }
 
-        assert(p->question->n_keys == 1);
+        assert(dns_question_size(p->question) == 1);
         key = p->question->keys[0];
 
-        r = dns_zone_lookup(&s->zone, key, &answer, &soa, &tentative);
+        r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
         if (r < 0) {
                 log_debug_errno(r, "Failed to lookup key: %m");
                 return;
@@ -736,9 +725,21 @@ void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
                 return;
         }
 
-        if (stream)
+        if (stream) {
                 r = dns_stream_write_packet(stream, reply);
-        else {
+                if (r < 0) {
+                        log_debug_errno(r, "Failed to enqueue reply packet: %m");
+                        return;
+                }
+
+                /* Let's take an extra reference on this stream, so that it stays around after returning. The reference
+                 * will be dangling until the stream is disconnected, and the default completion handler of the stream
+                 * will then unref the stream and destroy it */
+                if (DNS_STREAM_QUEUED(stream))
+                        dns_stream_ref(stream);
+        } else {
+                int fd;
+
                 if (!ratelimit_test(&s->ratelimit))
                         return;
 
@@ -760,12 +761,11 @@ void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
                  * verified uniqueness for all records. Also see RFC
                  * 4795, Section 2.7 */
 
-                r = manager_send(s->manager, fd, p->ifindex, p->family, &p->sender, p->sender_port, reply);
-        }
-
-        if (r < 0) {
-                log_debug_errno(r, "Failed to send reply packet: %m");
-                return;
+                r = manager_send(s->manager, fd, p->ifindex, p->family, &p->sender, p->sender_port, NULL, reply);
+                if (r < 0) {
+                        log_debug_errno(r, "Failed to send reply packet: %m");
+                        return;
+                }
         }
 }
 
@@ -1027,3 +1027,12 @@ bool dns_scope_network_good(DnsScope *s) {
 
         return manager_routable(s->manager, AF_UNSPEC);
 }
+
+int dns_scope_ifindex(DnsScope *s) {
+        assert(s);
+
+        if (s->link)
+                return s->link->ifindex;
+
+        return 0;
+}
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-scope.h b/src/grp-resolve/systemd-resolved/resolved-dns-scope.h
index e3c4e15ead..c4bc95da45 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-scope.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-scope.h
@@ -109,3 +109,5 @@ DnsSearchDomain *dns_scope_get_search_domains(DnsScope *s);
 bool dns_scope_name_needs_search_domain(DnsScope *s, const char *name);
 
 bool dns_scope_network_good(DnsScope *s);
+
+int dns_scope_ifindex(DnsScope *s);
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-server.c b/src/grp-resolve/systemd-resolved/resolved-dns-server.c
index be11cfa743..bc97d89219 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-server.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-server.c
@@ -25,6 +25,7 @@
 #include "basic/string-util.h"
 
 #include "resolved-dns-server.h"
+#include "resolved-dns-stub.h"
 #include "resolved-resolv-conf.h"
 
 /* After how much time to repeat classic DNS requests */
@@ -44,7 +45,8 @@ int dns_server_new(
                 DnsServerType type,
                 Link *l,
                 int family,
-                const union in_addr_union *in_addr) {
+                const union in_addr_union *in_addr,
+                int ifindex) {
 
         DnsServer *s;
 
@@ -76,6 +78,7 @@ int dns_server_new(
         s->type = type;
         s->family = family;
         s->address = *in_addr;
+        s->ifindex = ifindex;
         s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
 
         switch (type) {
@@ -243,6 +246,26 @@ static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 }
 
+static void dns_server_reset_counters(DnsServer *s) {
+        assert(s);
+
+        s->n_failed_udp = 0;
+        s->n_failed_tcp = 0;
+        s->packet_truncated = false;
+        s->verified_usec = 0;
+
+        /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
+         * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
+         * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
+         * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
+         * either.
+         *
+         * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
+         * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
+         * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
+         * incomplete. */
+}
+
 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
         assert(s);
 
@@ -303,17 +326,6 @@ void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel le
         s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
 }
 
-void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level) {
-        assert(s);
-
-        /* Invoked whenever we get a FORMERR, SERVFAIL or NOTIMP rcode from a server. */
-
-        if (s->possible_feature_level != level)
-                return;
-
-        s->packet_failed = true;
-}
-
 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
         assert(s);
 
@@ -351,6 +363,24 @@ void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
         s->packet_bad_opt = true;
 }
 
+void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
+        assert(s);
+
+        /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
+         * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
+         * things work. */
+
+        if (s->verified_feature_level > level)
+                s->verified_feature_level = level;
+
+        if (s->possible_feature_level > level) {
+                s->possible_feature_level = level;
+                dns_server_reset_counters(s);
+        }
+
+        log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
+}
+
 static bool dns_server_grace_period_expired(DnsServer *s) {
         usec_t ts;
 
@@ -370,27 +400,6 @@ static bool dns_server_grace_period_expired(DnsServer *s) {
         return true;
 }
 
-static void dns_server_reset_counters(DnsServer *s) {
-        assert(s);
-
-        s->n_failed_udp = 0;
-        s->n_failed_tcp = 0;
-        s->packet_failed = false;
-        s->packet_truncated = false;
-        s->verified_usec = 0;
-
-        /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
-         * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
-         * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
-         * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
-         * either.
-         *
-         * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
-         * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
-         * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
-         * incomplete. */
-}
-
 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
         assert(s);
 
@@ -453,16 +462,6 @@ DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
                         log_debug("Lost too many UDP packets, downgrading feature level...");
                         s->possible_feature_level--;
 
-                } else if (s->packet_failed &&
-                           s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
-
-                        /* We got a failure packet, and are at a feature level above UDP. Note that in this case we
-                         * downgrade no further than UDP, under the assumption that a failure packet indicates an
-                         * incompatible packet contents, but not a problem with the transport. */
-
-                        log_debug("Got server failure, downgrading feature level...");
-                        s->possible_feature_level--;
-
                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
                            s->packet_truncated &&
                            s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
@@ -516,14 +515,27 @@ int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeature
         else
                 packet_size = server->received_udp_packet_max;
 
-        return dns_packet_append_opt(packet, packet_size, edns_do, NULL);
+        return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
+}
+
+int dns_server_ifindex(const DnsServer *s) {
+        assert(s);
+
+        /* The link ifindex always takes precedence */
+        if (s->link)
+                return s->link->ifindex;
+
+        if (s->ifindex > 0)
+                return s->ifindex;
+
+        return 0;
 }
 
 const char *dns_server_string(DnsServer *server) {
         assert(server);
 
         if (!server->server_string)
-                (void) in_addr_to_string(server->family, &server->address, &server->server_string);
+                (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 
         return strna(server->server_string);
 }
@@ -572,17 +584,28 @@ static void dns_server_hash_func(const void *p, struct siphash *state) {
 
         siphash24_compress(&s->family, sizeof(s->family), state);
         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
+        siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 }
 
 static int dns_server_compare_func(const void *a, const void *b) {
         const DnsServer *x = a, *y = b;
+        int r;
 
         if (x->family < y->family)
                 return -1;
         if (x->family > y->family)
                 return 1;
 
-        return memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
+        r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
+        if (r != 0)
+                return r;
+
+        if (x->ifindex < y->ifindex)
+                return -1;
+        if (x->ifindex > y->ifindex)
+                return 1;
+
+        return 0;
 }
 
 const struct hash_ops dns_server_hash_ops = {
@@ -624,11 +647,11 @@ void dns_server_mark_all(DnsServer *first) {
         dns_server_mark_all(first->servers_next);
 }
 
-DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr) {
+DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
         DnsServer *s;
 
         LIST_FOREACH(servers, s, first)
-                if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0)
+                if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
                         return s;
 
         return NULL;
@@ -725,6 +748,19 @@ void manager_next_dns_server(Manager *m) {
                 manager_set_dns_server(m, m->dns_servers);
 }
 
+bool dns_server_address_valid(int family, const union in_addr_union *sa) {
+
+        /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
+
+        if (in_addr_is_null(family, sa))
+                return false;
+
+        if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
+                return false;
+
+        return true;
+}
+
 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
         [DNS_SERVER_SYSTEM] = "system",
         [DNS_SERVER_FALLBACK] = "fallback",
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-server.h b/src/grp-resolve/systemd-resolved/resolved-dns-server.h
index bfbf692c64..e1f0ac5fd9 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-server.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-server.h
@@ -62,6 +62,7 @@ struct DnsServer {
 
         int family;
         union in_addr_union address;
+        int ifindex; /* for IPv6 link-local DNS servers */
 
         char *server_string;
 
@@ -76,7 +77,6 @@ struct DnsServer {
         unsigned n_failed_udp;
         unsigned n_failed_tcp;
 
-        bool packet_failed:1;
         bool packet_truncated:1;
         bool packet_bad_opt:1;
         bool packet_rrsig_missing:1;
@@ -101,7 +101,8 @@ int dns_server_new(
                 DnsServerType type,
                 Link *link,
                 int family,
-                const union in_addr_union *address);
+                const union in_addr_union *address,
+                int ifindex);
 
 DnsServer* dns_server_ref(DnsServer *s);
 DnsServer* dns_server_unref(DnsServer *s);
@@ -111,22 +112,23 @@ void dns_server_move_back_and_unmark(DnsServer *s);
 
 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size);
 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t usec);
-void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level);
 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level);
 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level);
 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level);
+void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level);
 
 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s);
 
 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level);
 
 const char *dns_server_string(DnsServer *server);
+int dns_server_ifindex(const DnsServer *s);
 
 bool dns_server_dnssec_supported(DnsServer *server);
 
 void dns_server_warn_downgrade(DnsServer *server);
 
-DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr);
+DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex);
 
 void dns_server_unlink_all(DnsServer *first);
 void dns_server_unlink_marked(DnsServer *first);
@@ -138,6 +140,8 @@ DnsServer *manager_set_dns_server(Manager *m, DnsServer *s);
 DnsServer *manager_get_dns_server(Manager *m);
 void manager_next_dns_server(Manager *m);
 
+bool dns_server_address_valid(int family, const union in_addr_union *sa);
+
 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsServer*, dns_server_unref);
 
 extern const struct hash_ops dns_server_hash_ops;
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-stream.c b/src/grp-resolve/systemd-resolved/resolved-dns-stream.c
index 0c55f6d6c7..4ba5b797b7 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-stream.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-stream.c
@@ -57,8 +57,8 @@ static int dns_stream_complete(DnsStream *s, int error) {
 
         if (s->complete)
                 s->complete(s, error);
-        else
-                dns_stream_free(s);
+        else /* the default action if no completion function is set is to close the stream */
+                dns_stream_unref(s);
 
         return 0;
 }
@@ -324,10 +324,16 @@ static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *use
         return 0;
 }
 
-DnsStream *dns_stream_free(DnsStream *s) {
+DnsStream *dns_stream_unref(DnsStream *s) {
         if (!s)
                 return NULL;
 
+        assert(s->n_ref > 0);
+        s->n_ref--;
+
+        if (s->n_ref > 0)
+                return NULL;
+
         dns_stream_stop(s);
 
         if (s->manager) {
@@ -340,13 +346,23 @@ DnsStream *dns_stream_free(DnsStream *s) {
 
         free(s);
 
-        return 0;
+        return NULL;
 }
 
-DEFINE_TRIVIAL_CLEANUP_FUNC(DnsStream*, dns_stream_free);
+DEFINE_TRIVIAL_CLEANUP_FUNC(DnsStream*, dns_stream_unref);
+
+DnsStream *dns_stream_ref(DnsStream *s) {
+        if (!s)
+                return NULL;
+
+        assert(s->n_ref > 0);
+        s->n_ref++;
+
+        return s;
+}
 
 int dns_stream_new(Manager *m, DnsStream **ret, DnsProtocol protocol, int fd) {
-        _cleanup_(dns_stream_freep) DnsStream *s = NULL;
+        _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
         int r;
 
         assert(m);
@@ -359,6 +375,7 @@ int dns_stream_new(Manager *m, DnsStream **ret, DnsProtocol protocol, int fd) {
         if (!s)
                 return -ENOMEM;
 
+        s->n_ref = 1;
         s->fd = -1;
         s->protocol = protocol;
 
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-stream.h b/src/grp-resolve/systemd-resolved/resolved-dns-stream.h
index 65be14c5ed..6538da457a 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-stream.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-stream.h
@@ -27,8 +27,16 @@ typedef struct DnsStream DnsStream;
 #include "resolved-dns-transaction.h"
 #include "resolved-manager.h"
 
+/* Streams are used by three subsystems:
+ *
+ *   1. The normal transaction logic when doing a DNS or LLMNR lookup via TCP
+ *   2. The LLMNR logic when accepting a TCP-based lookup
+ *   3. The DNS stub logic when accepting a TCP-based lookup
+ */
+
 struct DnsStream {
         Manager *manager;
+        int n_ref;
 
         DnsProtocol protocol;
 
@@ -51,12 +59,23 @@ struct DnsStream {
         int (*on_packet)(DnsStream *s);
         int (*complete)(DnsStream *s, int error);
 
-        DnsTransaction *transaction;
+        DnsTransaction *transaction; /* when used by the transaction logic */
+        DnsQuery *query;             /* when used by the DNS stub logic */
 
         LIST_FIELDS(DnsStream, streams);
 };
 
 int dns_stream_new(Manager *m, DnsStream **s, DnsProtocol protocol, int fd);
-DnsStream *dns_stream_free(DnsStream *s);
+DnsStream *dns_stream_unref(DnsStream *s);
+DnsStream *dns_stream_ref(DnsStream *s);
 
 int dns_stream_write_packet(DnsStream *s, DnsPacket *p);
+
+static inline bool DNS_STREAM_QUEUED(DnsStream *s) {
+        assert(s);
+
+        if (s->fd < 0) /* already stopped? */
+                return false;
+
+        return !!s->write_packet;
+}
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-stub.c b/src/grp-resolve/systemd-resolved/resolved-dns-stub.c
new file mode 100644
index 0000000000..520a67a7b4
--- /dev/null
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-stub.c
@@ -0,0 +1,573 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "basic/fd-util.h"
+#include "basic/socket-util.h"
+
+#include "resolved-dns-stub.h"
+
+/* The MTU of the loopback device is 64K on Linux, advertise that as maximum datagram size, but subtract the Ethernet,
+ * IP and UDP header sizes */
+#define ADVERTISE_DATAGRAM_SIZE_MAX (65536U-14U-20U-8U)
+
+static int dns_stub_make_reply_packet(
+                uint16_t id,
+                int rcode,
+                DnsQuestion *q,
+                DnsAnswer *answer,
+                bool add_opt,   /* add an OPT RR to this packet */
+                bool edns0_do,  /* set the EDNS0 DNSSEC OK bit */
+                bool ad,        /* set the DNSSEC authenticated data bit */
+                DnsPacket **ret) {
+
+        _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
+        DnsResourceRecord *rr;
+        unsigned c = 0;
+        int r;
+
+        /* Note that we don't bother with any additional RRs, as this is stub is for local lookups only, and hence
+         * roundtrips aren't expensive. */
+
+        r = dns_packet_new(&p, DNS_PROTOCOL_DNS, 0);
+        if (r < 0)
+                return r;
+
+        /* If the client didn't do EDNS, clamp the rcode to 4 bit */
+        if (!add_opt && rcode > 0xF)
+                rcode = DNS_RCODE_SERVFAIL;
+
+        DNS_PACKET_HEADER(p)->id = id;
+        DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
+                                                              1 /* qr */,
+                                                              0 /* opcode */,
+                                                              0 /* aa */,
+                                                              0 /* tc */,
+                                                              1 /* rd */,
+                                                              1 /* ra */,
+                                                              ad /* ad */,
+                                                              0 /* cd */,
+                                                              rcode));
+
+        r = dns_packet_append_question(p, q);
+        if (r < 0)
+                return r;
+        DNS_PACKET_HEADER(p)->qdcount = htobe16(dns_question_size(q));
+
+        DNS_ANSWER_FOREACH(rr, answer) {
+                r = dns_question_matches_rr(q, rr, NULL);
+                if (r < 0)
+                        return r;
+                if (r > 0)
+                        goto add;
+
+                r = dns_question_matches_cname_or_dname(q, rr, NULL);
+                if (r < 0)
+                        return r;
+                if (r > 0)
+                        goto add;
+
+                continue;
+        add:
+                r = dns_packet_append_rr(p, rr, NULL, NULL);
+                if (r < 0)
+                        return r;
+
+                c++;
+        }
+        DNS_PACKET_HEADER(p)->ancount = htobe16(c);
+
+        if (add_opt) {
+                r = dns_packet_append_opt(p, ADVERTISE_DATAGRAM_SIZE_MAX, edns0_do, rcode, NULL);
+                if (r < 0)
+                        return r;
+        }
+
+        *ret = p;
+        p = NULL;
+
+        return 0;
+}
+
+static void dns_stub_detach_stream(DnsStream *s) {
+        assert(s);
+
+        s->complete = NULL;
+        s->on_packet = NULL;
+        s->query = NULL;
+}
+
+static int dns_stub_send(Manager *m, DnsStream *s, DnsPacket *p, DnsPacket *reply) {
+        int r;
+
+        assert(m);
+        assert(p);
+        assert(reply);
+
+        if (s)
+                r = dns_stream_write_packet(s, reply);
+        else {
+                int fd;
+
+                /* Truncate the message to the right size */
+                if (reply->size > DNS_PACKET_PAYLOAD_SIZE_MAX(p)) {
+                        dns_packet_truncate(reply, DNS_PACKET_UNICAST_SIZE_MAX);
+                        DNS_PACKET_HEADER(reply)->flags = htobe16(be16toh(DNS_PACKET_HEADER(reply)->flags) | DNS_PACKET_FLAG_TC);
+                }
+
+                fd = manager_dns_stub_udp_fd(m);
+                if (fd < 0)
+                        return log_debug_errno(fd, "Failed to get reply socket: %m");
+
+                /* Note that it is essential here that we explicitly choose the source IP address for this packet. This
+                 * is because otherwise the kernel will choose it automatically based on the routing table and will
+                 * thus pick 127.0.0.1 rather than 127.0.0.53. */
+
+                r = manager_send(m, fd, LOOPBACK_IFINDEX, p->family, &p->sender, p->sender_port, &p->destination, reply);
+        }
+        if (r < 0)
+                return log_debug_errno(r, "Failed to send reply packet: %m");
+
+        return 0;
+}
+
+static int dns_stub_send_failure(Manager *m, DnsStream *s, DnsPacket *p, int rcode) {
+        _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
+        int r;
+
+        assert(m);
+        assert(p);
+
+        r = dns_stub_make_reply_packet(DNS_PACKET_ID(p), rcode, p->question, NULL, !!p->opt, DNS_PACKET_DO(p), false, &reply);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to build failure packet: %m");
+
+        return dns_stub_send(m, s, p, reply);
+}
+
+static void dns_stub_query_complete(DnsQuery *q) {
+        int r;
+
+        assert(q);
+        assert(q->request_dns_packet);
+
+        switch (q->state) {
+
+        case DNS_TRANSACTION_SUCCESS: {
+                _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
+
+                r = dns_stub_make_reply_packet(
+                                DNS_PACKET_ID(q->request_dns_packet),
+                                q->answer_rcode,
+                                q->question_idna,
+                                q->answer,
+                                !!q->request_dns_packet->opt,
+                                DNS_PACKET_DO(q->request_dns_packet),
+                                DNS_PACKET_DO(q->request_dns_packet) && q->answer_authenticated,
+                                &reply);
+                if (r < 0) {
+                        log_debug_errno(r, "Failed to build reply packet: %m");
+                        break;
+                }
+
+                (void) dns_stub_send(q->manager, q->request_dns_stream, q->request_dns_packet, reply);
+                break;
+        }
+
+        case DNS_TRANSACTION_RCODE_FAILURE:
+                (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, q->answer_rcode);
+                break;
+
+        case DNS_TRANSACTION_NOT_FOUND:
+                (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, DNS_RCODE_NXDOMAIN);
+                break;
+
+        case DNS_TRANSACTION_TIMEOUT:
+        case DNS_TRANSACTION_ATTEMPTS_MAX_REACHED:
+                /* Propagate a timeout as a no packet, i.e. that the client also gets a timeout */
+                break;
+
+        case DNS_TRANSACTION_NO_SERVERS:
+        case DNS_TRANSACTION_INVALID_REPLY:
+        case DNS_TRANSACTION_ERRNO:
+        case DNS_TRANSACTION_ABORTED:
+        case DNS_TRANSACTION_DNSSEC_FAILED:
+        case DNS_TRANSACTION_NO_TRUST_ANCHOR:
+        case DNS_TRANSACTION_RR_TYPE_UNSUPPORTED:
+        case DNS_TRANSACTION_NETWORK_DOWN:
+                (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, DNS_RCODE_SERVFAIL);
+                break;
+
+        case DNS_TRANSACTION_NULL:
+        case DNS_TRANSACTION_PENDING:
+        case DNS_TRANSACTION_VALIDATING:
+        default:
+                assert_not_reached("Impossible state");
+        }
+
+        /* If there's a packet to write set, let's leave the stream around */
+        if (q->request_dns_stream && DNS_STREAM_QUEUED(q->request_dns_stream)) {
+
+                /* Detach the stream from our query (make it an orphan), but do not drop the reference to it. The
+                 * default completion action of the stream will drop the reference. */
+
+                dns_stub_detach_stream(q->request_dns_stream);
+                q->request_dns_stream = NULL;
+        }
+
+        dns_query_free(q);
+}
+
+static int dns_stub_stream_complete(DnsStream *s, int error) {
+        assert(s);
+
+        log_debug_errno(error, "DNS TCP connection terminated, destroying query: %m");
+
+        assert(s->query);
+        dns_query_free(s->query);
+
+        return 0;
+}
+
+static void dns_stub_process_query(Manager *m, DnsStream *s, DnsPacket *p) {
+        DnsQuery *q = NULL;
+        int r;
+
+        assert(m);
+        assert(p);
+        assert(p->protocol == DNS_PROTOCOL_DNS);
+
+        /* Takes ownership of the *s stream object */
+
+        if (in_addr_is_localhost(p->family, &p->sender) <= 0 ||
+            in_addr_is_localhost(p->family, &p->destination) <= 0) {
+                log_error("Got packet on unexpected IP range, refusing.");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_SERVFAIL);
+                goto fail;
+        }
+
+        r = dns_packet_extract(p);
+        if (r < 0) {
+                log_debug_errno(r, "Failed to extract resources from incoming packet, ignoring packet: %m");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_FORMERR);
+                goto fail;
+        }
+
+        if (!DNS_PACKET_VERSION_SUPPORTED(p)) {
+                log_debug("Got EDNS OPT field with unsupported version number.");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_BADVERS);
+                goto fail;
+        }
+
+        if (dns_type_is_obsolete(p->question->keys[0]->type)) {
+                log_debug("Got message with obsolete key type, refusing.");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_NOTIMP);
+                goto fail;
+        }
+
+        if (dns_type_is_zone_transer(p->question->keys[0]->type)) {
+                log_debug("Got request for zone transfer, refusing.");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_NOTIMP);
+                goto fail;
+        }
+
+        if (!DNS_PACKET_RD(p))  {
+                /* If the "rd" bit is off (i.e. recursion was not requested), then refuse operation */
+                log_debug("Got request with recursion disabled, refusing.");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_REFUSED);
+                goto fail;
+        }
+
+        if (DNS_PACKET_DO(p) && DNS_PACKET_CD(p)) {
+                log_debug("Got request with DNSSEC CD bit set, refusing.");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_NOTIMP);
+                goto fail;
+        }
+
+        r = dns_query_new(m, &q, p->question, p->question, 0, SD_RESOLVED_PROTOCOLS_ALL|SD_RESOLVED_NO_SEARCH|SD_RESOLVED_NO_CNAME);
+        if (r < 0) {
+                log_error_errno(r, "Failed to generate query object: %m");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_SERVFAIL);
+                goto fail;
+        }
+
+        /* Request that the TTL is corrected by the cached time for this lookup, so that we return vaguely useful TTLs */
+        q->clamp_ttl = true;
+
+        q->request_dns_packet = dns_packet_ref(p);
+        q->request_dns_stream = dns_stream_ref(s); /* make sure the stream stays around until we can send a reply through it */
+        q->complete = dns_stub_query_complete;
+
+        if (s) {
+                s->on_packet = NULL;
+                s->complete = dns_stub_stream_complete;
+                s->query = q;
+        }
+
+        r = dns_query_go(q);
+        if (r < 0) {
+                log_error_errno(r, "Failed to start query: %m");
+                dns_stub_send_failure(m, s, p, DNS_RCODE_SERVFAIL);
+                goto fail;
+        }
+
+        log_info("Processing query...");
+        return;
+
+fail:
+        if (s && DNS_STREAM_QUEUED(s))
+                dns_stub_detach_stream(s);
+
+        dns_query_free(q);
+}
+
+static int on_dns_stub_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
+        _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
+        Manager *m = userdata;
+        int r;
+
+        r = manager_recv(m, fd, DNS_PROTOCOL_DNS, &p);
+        if (r <= 0)
+                return r;
+
+        if (dns_packet_validate_query(p) > 0) {
+                log_debug("Got DNS stub UDP query packet for id %u", DNS_PACKET_ID(p));
+
+                dns_stub_process_query(m, NULL, p);
+        } else
+                log_debug("Invalid DNS stub UDP packet, ignoring.");
+
+        return 0;
+}
+
+int manager_dns_stub_udp_fd(Manager *m) {
+        static const int one = 1;
+
+        union sockaddr_union sa = {
+                .in.sin_family = AF_INET,
+                .in.sin_port = htobe16(53),
+                .in.sin_addr.s_addr = htobe32(INADDR_DNS_STUB),
+        };
+
+        int r;
+
+        if (m->dns_stub_udp_fd >= 0)
+                return m->dns_stub_udp_fd;
+
+        m->dns_stub_udp_fd = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
+        if (m->dns_stub_udp_fd < 0)
+                return -errno;
+
+        r = setsockopt(m->dns_stub_udp_fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = setsockopt(m->dns_stub_udp_fd, IPPROTO_IP, IP_PKTINFO, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = setsockopt(m->dns_stub_udp_fd, IPPROTO_IP, IP_RECVTTL, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        /* Make sure no traffic from outside the local host can leak to onto this socket */
+        r = setsockopt(m->dns_stub_udp_fd, SOL_SOCKET, SO_BINDTODEVICE, "lo", 3);
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = bind(m->dns_stub_udp_fd, &sa.sa, sizeof(sa.in));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = sd_event_add_io(m->event, &m->dns_stub_udp_event_source, m->dns_stub_udp_fd, EPOLLIN, on_dns_stub_packet, m);
+        if (r < 0)
+                goto fail;
+
+        (void) sd_event_source_set_description(m->dns_stub_udp_event_source, "dns-stub-udp");
+
+        return m->dns_stub_udp_fd;
+
+fail:
+        m->dns_stub_udp_fd = safe_close(m->dns_stub_udp_fd);
+        return r;
+}
+
+static int on_dns_stub_stream_packet(DnsStream *s) {
+        assert(s);
+        assert(s->read_packet);
+
+        if (dns_packet_validate_query(s->read_packet) > 0) {
+                log_debug("Got DNS stub TCP query packet for id %u", DNS_PACKET_ID(s->read_packet));
+
+                dns_stub_process_query(s->manager, s, s->read_packet);
+        } else
+                log_debug("Invalid DNS stub TCP packet, ignoring.");
+
+        /* Drop the reference to the stream. Either a query was created and added its own reference to the stream now,
+         * or that didn't happen in which case we want to free the stream */
+        dns_stream_unref(s);
+
+        return 0;
+}
+
+static int on_dns_stub_stream(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
+        DnsStream *stream;
+        Manager *m = userdata;
+        int cfd, r;
+
+        cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
+        if (cfd < 0) {
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
+                return -errno;
+        }
+
+        r = dns_stream_new(m, &stream, DNS_PROTOCOL_DNS, cfd);
+        if (r < 0) {
+                safe_close(cfd);
+                return r;
+        }
+
+        stream->on_packet = on_dns_stub_stream_packet;
+
+        /* We let the reference to the stream dangling here, it will either be dropped by the default "complete" action
+         * of the stream, or by our packet callback, or when the manager is shut down. */
+
+        return 0;
+}
+
+int manager_dns_stub_tcp_fd(Manager *m) {
+        static const int one = 1;
+
+        union sockaddr_union sa = {
+                .in.sin_family = AF_INET,
+                .in.sin_addr.s_addr = htobe32(INADDR_DNS_STUB),
+                .in.sin_port = htobe16(53),
+        };
+
+        int r;
+
+        if (m->dns_stub_tcp_fd >= 0)
+                return m->dns_stub_tcp_fd;
+
+        m->dns_stub_tcp_fd = socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
+        if (m->dns_stub_tcp_fd < 0)
+                return -errno;
+
+        r = setsockopt(m->dns_stub_tcp_fd, IPPROTO_IP, IP_TTL, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = setsockopt(m->dns_stub_tcp_fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = setsockopt(m->dns_stub_tcp_fd, IPPROTO_IP, IP_PKTINFO, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = setsockopt(m->dns_stub_tcp_fd, IPPROTO_IP, IP_RECVTTL, &one, sizeof(one));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        /* Make sure no traffic from outside the local host can leak to onto this socket */
+        r = setsockopt(m->dns_stub_tcp_fd, SOL_SOCKET, SO_BINDTODEVICE, "lo", 3);
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = bind(m->dns_stub_tcp_fd, &sa.sa, sizeof(sa.in));
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = listen(m->dns_stub_tcp_fd, SOMAXCONN);
+        if (r < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        r = sd_event_add_io(m->event, &m->dns_stub_tcp_event_source, m->dns_stub_tcp_fd, EPOLLIN, on_dns_stub_stream, m);
+        if (r < 0)
+                goto fail;
+
+        (void) sd_event_source_set_description(m->dns_stub_tcp_event_source, "dns-stub-tcp");
+
+        return m->dns_stub_tcp_fd;
+
+fail:
+        m->dns_stub_tcp_fd = safe_close(m->dns_stub_tcp_fd);
+        return r;
+}
+
+int manager_dns_stub_start(Manager *m) {
+        int r;
+
+        assert(m);
+
+        r = manager_dns_stub_udp_fd(m);
+        if (r == -EADDRINUSE)
+                goto eaddrinuse;
+        if (r < 0)
+                return r;
+
+        r = manager_dns_stub_tcp_fd(m);
+        if (r == -EADDRINUSE)
+                goto eaddrinuse;
+        if (r < 0)
+                return r;
+
+        return 0;
+
+eaddrinuse:
+        log_warning("Another process is already listening on 127.0.0.53:53. Turning off local DNS stub support.");
+        manager_dns_stub_stop(m);
+
+        return 0;
+}
+
+void manager_dns_stub_stop(Manager *m) {
+        assert(m);
+
+        m->dns_stub_udp_event_source = sd_event_source_unref(m->dns_stub_udp_event_source);
+        m->dns_stub_tcp_event_source = sd_event_source_unref(m->dns_stub_tcp_event_source);
+
+        m->dns_stub_udp_fd = safe_close(m->dns_stub_udp_fd);
+        m->dns_stub_tcp_fd = safe_close(m->dns_stub_tcp_fd);
+}
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-stub.h b/src/grp-resolve/systemd-resolved/resolved-dns-stub.h
new file mode 100644
index 0000000000..fce4d25ede
--- /dev/null
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-stub.h
@@ -0,0 +1,31 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "resolved-manager.h"
+
+/* 127.0.0.53 in native endian */
+#define INADDR_DNS_STUB ((in_addr_t) 0x7f000035U)
+
+int manager_dns_stub_udp_fd(Manager *m);
+int manager_dns_stub_tcp_fd(Manager *m);
+
+void manager_dns_stub_stop(Manager *m);
+int manager_dns_stub_start(Manager *m);
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-transaction.c b/src/grp-resolve/systemd-resolved/resolved-dns-transaction.c
index 3a19b12b47..3cf72e0ff8 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-transaction.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-transaction.c
@@ -61,7 +61,14 @@ static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
 static void dns_transaction_close_connection(DnsTransaction *t) {
         assert(t);
 
-        t->stream = dns_stream_free(t->stream);
+        if (t->stream) {
+                /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
+                t->stream->complete = NULL;
+                t->stream->on_packet = NULL;
+                t->stream->transaction = NULL;
+                t->stream = dns_stream_unref(t->stream);
+        }
+
         t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
         t->dns_udp_fd = safe_close(t->dns_udp_fd);
 }
@@ -208,6 +215,7 @@ int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key)
         t->answer_nsec_ttl = (uint32_t) -1;
         t->key = dns_resource_key_ref(key);
         t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
+        t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
 
         t->id = pick_new_id(s->manager);
 
@@ -372,22 +380,38 @@ static int dns_transaction_pick_server(DnsTransaction *t) {
         assert(t);
         assert(t->scope->protocol == DNS_PROTOCOL_DNS);
 
+        /* Pick a DNS server and a feature level for it. */
+
         server = dns_scope_get_dns_server(t->scope);
         if (!server)
                 return -ESRCH;
 
+        /* If we changed the server invalidate the feature level clamping, as the new server might have completely
+         * different properties. */
+        if (server != t->server)
+                t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
+
         t->current_feature_level = dns_server_possible_feature_level(server);
 
+        /* Clamp the feature level if that is requested. */
+        if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
+            t->current_feature_level > t->clamp_feature_level)
+                t->current_feature_level = t->clamp_feature_level;
+
+        log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
+
         if (server == t->server)
                 return 0;
 
         dns_server_unref(t->server);
         t->server = dns_server_ref(server);
 
+        log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
+
         return 1;
 }
 
-static void dns_transaction_retry(DnsTransaction *t) {
+static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
         int r;
 
         assert(t);
@@ -395,7 +419,8 @@ static void dns_transaction_retry(DnsTransaction *t) {
         log_debug("Retrying transaction %" PRIu16 ".", t->id);
 
         /* Before we try again, switch to a new server. */
-        dns_scope_next_dns_server(t->scope);
+        if (next_server)
+                dns_scope_next_dns_server(t->scope);
 
         r = dns_transaction_go(t);
         if (r < 0) {
@@ -405,8 +430,12 @@ static void dns_transaction_retry(DnsTransaction *t) {
 }
 
 static int dns_transaction_maybe_restart(DnsTransaction *t) {
+        int r;
+
         assert(t);
 
+        /* Returns > 0 if the transaction was restarted, 0 if not */
+
         if (!t->server)
                 return 0;
 
@@ -421,7 +450,12 @@ static int dns_transaction_maybe_restart(DnsTransaction *t) {
 
         log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
         dns_transaction_shuffle_id(t);
-        return dns_transaction_go(t);
+
+        r = dns_transaction_go(t);
+        if (r < 0)
+                return r;
+
+        return 1;
 }
 
 static int on_stream_complete(DnsStream *s, int error) {
@@ -436,7 +470,7 @@ static int on_stream_complete(DnsStream *s, int error) {
         t = s->transaction;
         p = dns_packet_ref(s->read_packet);
 
-        t->stream = dns_stream_free(t->stream);
+        dns_transaction_close_connection(t);
 
         if (ERRNO_IS_DISCONNECT(error)) {
                 usec_t usec;
@@ -452,7 +486,7 @@ static int on_stream_complete(DnsStream *s, int error) {
                 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
                 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level, usec - t->start_usec);
 
-                dns_transaction_retry(t);
+                dns_transaction_retry(t, true);
                 return 0;
         }
         if (error != 0) {
@@ -548,7 +582,7 @@ static int dns_transaction_open_tcp(DnsTransaction *t) {
 
         r = dns_stream_write_packet(t->stream, t->sent);
         if (r < 0) {
-                t->stream = dns_stream_free(t->stream);
+                t->stream = dns_stream_unref(t->stream);
                 return r;
         }
 
@@ -558,8 +592,7 @@ static int dns_transaction_open_tcp(DnsTransaction *t) {
         /* The interface index is difficult to determine if we are
          * connecting to the local host, hence fill this in right away
          * instead of determining it from the socket */
-        if (t->scope->link)
-                t->stream->ifindex = t->scope->link->ifindex;
+        t->stream->ifindex = dns_scope_ifindex(t->scope);
 
         dns_transaction_reset_answer(t);
 
@@ -576,6 +609,10 @@ static void dns_transaction_cache_answer(DnsTransaction *t) {
         if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
                 return;
 
+        /* Caching disabled? */
+        if (!t->scope->manager->enable_cache)
+                return;
+
         /* We never cache if this packet is from the local host, under
          * the assumption that a locally running DNS server would
          * cache this anyway, and probably knows better when to flush
@@ -627,14 +664,15 @@ static int dns_transaction_dnssec_ready(DnsTransaction *t) {
                         return 0;
 
                 case DNS_TRANSACTION_RCODE_FAILURE:
-                        if (dt->answer_rcode != DNS_RCODE_NXDOMAIN) {
+                        if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
                                 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
                                 goto fail;
                         }
 
-                        /* Fall-through: NXDOMAIN is good enough for us. This is because some DNS servers erronously
-                         * return NXDOMAIN for empty non-terminals (Akamai...), and we need to handle that nicely, when
-                         * asking for parent SOA or similar RRs to make unsigned proofs. */
+                        /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
+                         * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
+                         * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
+                         * RRs to make unsigned proofs. */
 
                 case DNS_TRANSACTION_SUCCESS:
                         /* All good. */
@@ -799,12 +837,9 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
         switch (t->scope->protocol) {
 
         case DNS_PROTOCOL_LLMNR:
-                assert(t->scope->link);
+                /* For LLMNR we will not accept any packets from other interfaces */
 
-                /* For LLMNR we will not accept any packets from other
-                 * interfaces */
-
-                if (p->ifindex != t->scope->link->ifindex)
+                if (p->ifindex != dns_scope_ifindex(t->scope))
                         return;
 
                 if (p->family != t->scope->family)
@@ -821,10 +856,9 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
                 break;
 
         case DNS_PROTOCOL_MDNS:
-                assert(t->scope->link);
-
                 /* For mDNS we will not accept any packets from other interfaces */
-                if (p->ifindex != t->scope->link->ifindex)
+
+                if (p->ifindex != dns_scope_ifindex(t->scope))
                         return;
 
                 if (p->family != t->scope->family)
@@ -875,10 +909,22 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
                 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
 
                         /* Request failed, immediately try again with reduced features */
-                        log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
 
-                        dns_server_packet_failed(t->server, t->current_feature_level);
-                        dns_transaction_retry(t);
+                        if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_WORST) {
+                                /* This was already at the lowest possible feature level? If so, we can't downgrade
+                                 * this transaction anymore, hence let's process the response, and accept the rcode. */
+                                log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
+                                break;
+                        }
+
+                        /* Reduce this feature level by one and try again. */
+                        t->clamp_feature_level = t->current_feature_level - 1;
+
+                        log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
+                                  dns_rcode_to_string(DNS_PACKET_RCODE(p)),
+                                  dns_server_feature_level_to_string(t->clamp_feature_level));
+
+                        dns_transaction_retry(t, false /* use the same server */);
                         return;
                 } else if (DNS_PACKET_TC(p))
                         dns_server_packet_truncated(t->server, t->current_feature_level);
@@ -923,7 +969,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
                                 goto fail;
 
                         /* On DNS, couldn't send? Try immediately again, with a new server */
-                        dns_transaction_retry(t);
+                        dns_transaction_retry(t, true);
                 }
 
                 return;
@@ -936,11 +982,19 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
                 return;
         }
 
-        /* Report that the OPT RR was missing */
         if (t->server) {
+                /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
+                 * rcode and subsequently downgraded the protocol */
+
+                if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
+                    t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
+                        dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
+
+                /* Report that the OPT RR was missing */
                 if (!p->opt)
                         dns_server_packet_bad_opt(t->server, t->current_feature_level);
 
+                /* Report that we successfully received a packet */
                 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, ts - t->start_usec, p->size);
         }
 
@@ -1027,7 +1081,7 @@ static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *use
                 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
                 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level, usec - t->start_usec);
 
-                dns_transaction_retry(t);
+                dns_transaction_retry(t, true);
                 return 0;
         }
         if (r < 0) {
@@ -1136,7 +1190,7 @@ static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdat
 
         log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
 
-        dns_transaction_retry(t);
+        dns_transaction_retry(t, true);
         return 0;
 }
 
@@ -1247,7 +1301,7 @@ static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
          * for probing or verifying a zone item. */
         if (set_isempty(t->notify_zone_items)) {
 
-                r = dns_zone_lookup(&t->scope->zone, t->key, &t->answer, NULL, NULL);
+                r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
                 if (r < 0)
                         return r;
                 if (r > 0) {
@@ -1271,7 +1325,7 @@ static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
                 /* Let's then prune all outdated entries */
                 dns_cache_prune(&t->scope->cache);
 
-                r = dns_cache_lookup(&t->scope->cache, t->key, &t->answer_rcode, &t->answer, &t->answer_authenticated);
+                r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
                 if (r < 0)
                         return r;
                 if (r > 0) {
@@ -1427,6 +1481,9 @@ int dns_transaction_go(DnsTransaction *t) {
 
         assert(t);
 
+        /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
+         * now. */
+
         assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 
         r = dns_transaction_prepare(t, ts);
@@ -1764,8 +1821,10 @@ static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
         if (!t->server)
                 return true;
 
-        if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
-                return false;
+        /* Note that we do not check the feature level actually used for the transaction but instead the feature level
+         * the server is known to support currently, as the transaction feature level might be lower than what the
+         * server actually supports, since we might have downgraded this transaction's feature level because we got a
+         * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
 
         return dns_server_dnssec_supported(t->server);
 }
@@ -2857,7 +2916,7 @@ int dns_transaction_validate_dnssec(DnsTransaction *t) {
         if (!dns_transaction_dnssec_supported_full(t)) {
                 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
                 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
-                log_debug("Not validating response for %" PRIu16 ", server lacks DNSSEC support.", t->id);
+                log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
                 return 0;
         }
 
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-transaction.h b/src/grp-resolve/systemd-resolved/resolved-dns-transaction.h
index 96cedd7bc8..5837e982d4 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-transaction.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-transaction.h
@@ -77,6 +77,8 @@ struct DnsTransaction {
         bool initial_jitter_scheduled:1;
         bool initial_jitter_elapsed:1;
 
+        bool clamp_ttl:1;
+
         DnsPacket *sent, *received;
 
         DnsAnswer *answer;
@@ -118,6 +120,9 @@ struct DnsTransaction {
         /* The features of the DNS server at time of transaction start */
         DnsServerFeatureLevel current_feature_level;
 
+        /* If we got SERVFAIL back, we retry the lookup, using a lower feature level than we used before. */
+        DnsServerFeatureLevel clamp_feature_level;
+
         /* Query candidates this transaction is referenced by and that
          * shall be notified about this specific transaction
          * completing. */
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-zone.c b/src/grp-resolve/systemd-resolved/resolved-dns-zone.c
index 3d5bc9ea82..d3ef27fefd 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-zone.c
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-zone.c
@@ -288,13 +288,16 @@ int dns_zone_put(DnsZone *z, DnsScope *s, DnsResourceRecord *rr, bool probe) {
         return 0;
 }
 
-int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, DnsAnswer **ret_answer, DnsAnswer **ret_soa, bool *ret_tentative) {
+int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, int ifindex, DnsAnswer **ret_answer, DnsAnswer **ret_soa, bool *ret_tentative) {
         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;
         unsigned n_answer = 0;
         DnsZoneItem *j, *first;
         bool tentative = true, need_soa = false;
         int r;
 
+        /* Note that we don't actually need the ifindex for anything. However when it is passed we'll initialize the
+         * ifindex field in the answer with it */
+
         assert(z);
         assert(key);
         assert(ret_answer);
@@ -390,7 +393,7 @@ int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, DnsAnswer **ret_answer, Dns
                         if (k < 0)
                                 return k;
                         if (k > 0) {
-                                r = dns_answer_add(answer, j->rr, 0, DNS_ANSWER_AUTHENTICATED);
+                                r = dns_answer_add(answer, j->rr, ifindex, DNS_ANSWER_AUTHENTICATED);
                                 if (r < 0)
                                         return r;
 
@@ -399,7 +402,7 @@ int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, DnsAnswer **ret_answer, Dns
                 }
 
                 if (found && !added) {
-                        r = dns_answer_add_soa(soa, dns_resource_key_name(key), LLMNR_DEFAULT_TTL);
+                        r = dns_answer_add_soa(soa, dns_resource_key_name(key), LLMNR_DEFAULT_TTL, ifindex);
                         if (r < 0)
                                 return r;
                 }
@@ -416,7 +419,7 @@ int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, DnsAnswer **ret_answer, Dns
                         if (j->state != DNS_ZONE_ITEM_PROBING)
                                 tentative = false;
 
-                        r = dns_answer_add(answer, j->rr, 0, DNS_ANSWER_AUTHENTICATED);
+                        r = dns_answer_add(answer, j->rr, ifindex, DNS_ANSWER_AUTHENTICATED);
                         if (r < 0)
                                 return r;
                 }
@@ -436,7 +439,7 @@ int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, DnsAnswer **ret_answer, Dns
                         }
 
                         if (add_soa) {
-                                r = dns_answer_add_soa(soa, dns_resource_key_name(key), LLMNR_DEFAULT_TTL);
+                                r = dns_answer_add_soa(soa, dns_resource_key_name(key), LLMNR_DEFAULT_TTL, ifindex);
                                 if (r < 0)
                                         return r;
                         }
diff --git a/src/grp-resolve/systemd-resolved/resolved-dns-zone.h b/src/grp-resolve/systemd-resolved/resolved-dns-zone.h
index 0c43bf2b96..789fe24cde 100644
--- a/src/grp-resolve/systemd-resolved/resolved-dns-zone.h
+++ b/src/grp-resolve/systemd-resolved/resolved-dns-zone.h
@@ -66,7 +66,7 @@ void dns_zone_flush(DnsZone *z);
 int dns_zone_put(DnsZone *z, DnsScope *s, DnsResourceRecord *rr, bool probe);
 void dns_zone_remove_rr(DnsZone *z, DnsResourceRecord *rr);
 
-int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, DnsAnswer **answer, DnsAnswer **soa, bool *tentative);
+int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, int ifindex, DnsAnswer **answer, DnsAnswer **soa, bool *tentative);
 
 void dns_zone_item_conflict(DnsZoneItem *i);
 void dns_zone_item_notify(DnsZoneItem *i);
diff --git a/src/grp-resolve/systemd-resolved/resolved-gperf.gperf b/src/grp-resolve/systemd-resolved/resolved-gperf.gperf
index 7a0a3e3a3d..f3a7c48abc 100644
--- a/src/grp-resolve/systemd-resolved/resolved-gperf.gperf
+++ b/src/grp-resolve/systemd-resolved/resolved-gperf.gperf
@@ -21,3 +21,4 @@ Resolve.FallbackDNS,  config_parse_dns_servers,     DNS_SERVER_FALLBACK, 0
 Resolve.Domains,      config_parse_search_domains,  0,                   0
 Resolve.LLMNR,        config_parse_resolve_support, 0,                   offsetof(Manager, llmnr_support)
 Resolve.DNSSEC,       config_parse_dnssec_mode,     0,                   offsetof(Manager, dnssec_mode)
+Resolve.Cache,        config_parse_bool,            0,                   offsetof(Manager, enable_cache)
diff --git a/src/grp-resolve/systemd-resolved/resolved-link-bus.c b/src/grp-resolve/systemd-resolved/resolved-link-bus.c
index 122c4dd45d..9cbadece42 100644
--- a/src/grp-resolve/systemd-resolved/resolved-link-bus.c
+++ b/src/grp-resolve/systemd-resolved/resolved-link-bus.c
@@ -20,14 +20,32 @@
 #include "basic/alloc-util.h"
 #include "basic/parse-util.h"
 #include "basic/strv.h"
+#include "sd-bus/bus-common-errors.h"
 #include "shared/bus-util.h"
 #include "shared/resolve-util.h"
 
 #include "resolved-bus.h"
 #include "resolved-link-bus.h"
+#include "resolved-resolv-conf.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_resolve_support, resolve_support, ResolveSupport);
-static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_dnssec_mode, dnssec_mode, DnssecMode);
+
+static int property_get_dnssec_mode(
+                sd_bus *bus,
+                const char *path,
+                const char *interface,
+                const char *property,
+                sd_bus_message *reply,
+                void *userdata,
+                sd_bus_error *error) {
+
+        Link *l = userdata;
+
+        assert(reply);
+        assert(l);
+
+        return sd_bus_message_append(reply, "s", dnssec_mode_to_string(link_get_dnssec_mode(l)));
+}
 
 static int property_get_dns(
                 sd_bus *bus,
@@ -158,6 +176,17 @@ static int property_get_dnssec_supported(
         return sd_bus_message_append(reply, "b", link_dnssec_supported(l));
 }
 
+static int verify_unmanaged_link(Link *l, sd_bus_error *error) {
+        assert(l);
+
+        if (l->flags & IFF_LOOPBACK)
+                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is loopback device.", l->name);
+        if (l->is_managed)
+                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is managed.", l->name);
+
+        return 0;
+}
+
 int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ struct in_addr_data *dns = NULL;
         size_t allocated = 0, n = 0;
@@ -168,6 +197,10 @@ int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_enter_container(message, 'a', "(iay)");
         if (r < 0)
                 return r;
@@ -198,6 +231,9 @@ int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_
                 if (sz != FAMILY_ADDRESS_SIZE(family))
                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid address size");
 
+                if (!dns_server_address_valid(family, d))
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid DNS server address");
+
                 r = sd_bus_message_exit_container(message);
                 if (r < 0)
                         return r;
@@ -219,11 +255,11 @@ int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_
         for (i = 0; i < n; i++) {
                 DnsServer *s;
 
-                s = dns_server_find(l->dns_servers, dns[i].family, &dns[i].address);
+                s = dns_server_find(l->dns_servers, dns[i].family, &dns[i].address, 0);
                 if (s)
                         dns_server_move_back_and_unmark(s);
                 else {
-                        r = dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, dns[i].family, &dns[i].address);
+                        r = dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, dns[i].family, &dns[i].address, 0);
                         if (r < 0)
                                 goto clear;
                 }
@@ -233,6 +269,9 @@ int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_
         dns_server_unlink_marked(l->dns_servers);
         link_allocate_scopes(l);
 
+        (void) link_save_user(l);
+        (void) manager_write_resolv_conf(l->manager);
+
         return sd_bus_reply_method_return(message, NULL);
 
 clear:
@@ -247,6 +286,10 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_enter_container(message, 'a', "(sb)");
         if (r < 0)
                 return r;
@@ -307,6 +350,10 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_
                 goto clear;
 
         dns_search_domain_unlink_marked(l->search_domains);
+
+        (void) link_save_user(l);
+        (void) manager_write_resolv_conf(l->manager);
+
         return sd_bus_reply_method_return(message, NULL);
 
 clear:
@@ -323,6 +370,10 @@ int bus_link_method_set_llmnr(sd_bus_message *message, void *userdata, sd_bus_er
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read(message, "s", &llmnr);
         if (r < 0)
                 return r;
@@ -339,6 +390,8 @@ int bus_link_method_set_llmnr(sd_bus_message *message, void *userdata, sd_bus_er
         link_allocate_scopes(l);
         link_add_rrs(l, false);
 
+        (void) link_save_user(l);
+
         return sd_bus_reply_method_return(message, NULL);
 }
 
@@ -351,6 +404,10 @@ int bus_link_method_set_mdns(sd_bus_message *message, void *userdata, sd_bus_err
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read(message, "s", &mdns);
         if (r < 0)
                 return r;
@@ -367,6 +424,8 @@ int bus_link_method_set_mdns(sd_bus_message *message, void *userdata, sd_bus_err
         link_allocate_scopes(l);
         link_add_rrs(l, false);
 
+        (void) link_save_user(l);
+
         return sd_bus_reply_method_return(message, NULL);
 }
 
@@ -379,6 +438,10 @@ int bus_link_method_set_dnssec(sd_bus_message *message, void *userdata, sd_bus_e
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read(message, "s", &dnssec);
         if (r < 0)
                 return r;
@@ -393,6 +456,8 @@ int bus_link_method_set_dnssec(sd_bus_message *message, void *userdata, sd_bus_e
 
         link_set_dnssec_mode(l, mode);
 
+        (void) link_save_user(l);
+
         return sd_bus_reply_method_return(message, NULL);
 }
 
@@ -406,6 +471,10 @@ int bus_link_method_set_dnssec_negative_trust_anchors(sd_bus_message *message, v
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read_strv(message, &ntas);
         if (r < 0)
                 return r;
@@ -432,19 +501,29 @@ int bus_link_method_set_dnssec_negative_trust_anchors(sd_bus_message *message, v
         l->dnssec_negative_trust_anchors = ns;
         ns = NULL;
 
+        (void) link_save_user(l);
+
         return sd_bus_reply_method_return(message, NULL);
 }
 
 int bus_link_method_revert(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Link *l = userdata;
+        int r;
 
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         link_flush_settings(l);
         link_allocate_scopes(l);
         link_add_rrs(l, false);
 
+        (void) link_save_user(l);
+        (void) manager_write_resolv_conf(l->manager);
+
         return sd_bus_reply_method_return(message, NULL);
 }
 
@@ -456,7 +535,7 @@ const sd_bus_vtable link_vtable[] = {
         SD_BUS_PROPERTY("Domains", "a(sb)", property_get_domains, 0, 0),
         SD_BUS_PROPERTY("LLMNR", "s", property_get_resolve_support, offsetof(Link, llmnr_support), 0),
         SD_BUS_PROPERTY("MulticastDNS", "s", property_get_resolve_support, offsetof(Link, mdns_support), 0),
-        SD_BUS_PROPERTY("DNSSEC", "s", property_get_dnssec_mode, offsetof(Link, dnssec_mode), 0),
+        SD_BUS_PROPERTY("DNSSEC", "s", property_get_dnssec_mode, 0, 0),
         SD_BUS_PROPERTY("DNSSECNegativeTrustAnchors", "as", property_get_ntas, 0, 0),
         SD_BUS_PROPERTY("DNSSECSupported", "b", property_get_dnssec_supported, 0, 0),
 
diff --git a/src/grp-resolve/systemd-resolved/resolved-link.c b/src/grp-resolve/systemd-resolved/resolved-link.c
index 1d23e49172..d37ebbc419 100644
--- a/src/grp-resolve/systemd-resolved/resolved-link.c
+++ b/src/grp-resolve/systemd-resolved/resolved-link.c
@@ -20,7 +20,10 @@
 #include <net/if.h>
 
 #include "basic/alloc-util.h"
+#include "basic/fd-util.h"
+#include "basic/fileio.h"
 #include "basic/missing.h"
+#include "basic/mkdir.h"
 #include "basic/parse-util.h"
 #include "basic/string-util.h"
 #include "basic/strv.h"
@@ -49,6 +52,9 @@ int link_new(Manager *m, Link **ret, int ifindex) {
         l->dnssec_mode = _DNSSEC_MODE_INVALID;
         l->operstate = IF_OPER_UNKNOWN;
 
+        if (asprintf(&l->state_file, "/run/systemd/resolve/netif/%i", ifindex) < 0)
+                return -ENOMEM;
+
         r = hashmap_put(m->links, INT_TO_PTR(ifindex), l);
         if (r < 0)
                 return r;
@@ -93,6 +99,8 @@ Link *link_free(Link *l) {
         dns_scope_free(l->mdns_ipv4_scope);
         dns_scope_free(l->mdns_ipv6_scope);
 
+        free(l->state_file);
+
         free(l);
         return NULL;
 }
@@ -165,7 +173,7 @@ void link_add_rrs(Link *l, bool force_remove) {
                 link_address_add_rrs(a, force_remove);
 }
 
-int link_update_rtnl(Link *l, sd_netlink_message *m) {
+int link_process_rtnl(Link *l, sd_netlink_message *m) {
         const char *n = NULL;
         int r;
 
@@ -190,6 +198,27 @@ int link_update_rtnl(Link *l, sd_netlink_message *m) {
         return 0;
 }
 
+static int link_update_dns_server_one(Link *l, const char *name) {
+        union in_addr_union a;
+        DnsServer *s;
+        int family, r;
+
+        assert(l);
+        assert(name);
+
+        r = in_addr_from_string_auto(name, &family, &a);
+        if (r < 0)
+                return r;
+
+        s = dns_server_find(l->dns_servers, family, &a, 0);
+        if (s) {
+                dns_server_move_back_and_unmark(s);
+                return 0;
+        }
+
+        return dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, family, &a, 0);
+}
+
 static int link_update_dns_servers(Link *l) {
         _cleanup_strv_free_ char **nameservers = NULL;
         char **nameserver;
@@ -208,22 +237,9 @@ static int link_update_dns_servers(Link *l) {
         dns_server_mark_all(l->dns_servers);
 
         STRV_FOREACH(nameserver, nameservers) {
-                union in_addr_union a;
-                DnsServer *s;
-                int family;
-
-                r = in_addr_from_string_auto(*nameserver, &family, &a);
+                r = link_update_dns_server_one(l, *nameserver);
                 if (r < 0)
                         goto clear;
-
-                s = dns_server_find(l->dns_servers, family, &a);
-                if (s)
-                        dns_server_move_back_and_unmark(s);
-                else {
-                        r = dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, family, &a);
-                        if (r < 0)
-                                goto clear;
-                }
         }
 
         dns_server_unlink_marked(l->dns_servers);
@@ -341,7 +357,6 @@ clear:
 static int link_update_dnssec_negative_trust_anchors(Link *l) {
         _cleanup_strv_free_ char **ntas = NULL;
         _cleanup_set_free_free_ Set *ns = NULL;
-        char **i;
         int r;
 
         assert(l);
@@ -358,11 +373,9 @@ static int link_update_dnssec_negative_trust_anchors(Link *l) {
         if (!ns)
                 return -ENOMEM;
 
-        STRV_FOREACH(i, ntas) {
-                r = set_put_strdup(ns, *i);
-                if (r < 0)
-                        return r;
-        }
+        r = set_put_strdupv(ns, ntas);
+        if (r < 0)
+                return r;
 
         set_free_free(l->dnssec_negative_trust_anchors);
         l->dnssec_negative_trust_anchors = ns;
@@ -379,6 +392,9 @@ static int link_update_search_domain_one(Link *l, const char *name, bool route_o
         DnsSearchDomain *d;
         int r;
 
+        assert(l);
+        assert(name);
+
         r = dns_search_domain_find(l->search_domains, name, &d);
         if (r < 0)
                 return r;
@@ -439,7 +455,7 @@ clear:
         return r;
 }
 
-static int link_is_unmanaged(Link *l) {
+static int link_is_managed(Link *l) {
         _cleanup_free_ char *state = NULL;
         int r;
 
@@ -447,11 +463,11 @@ static int link_is_unmanaged(Link *l) {
 
         r = sd_network_link_get_setup_state(l->ifindex, &state);
         if (r == -ENODATA)
-                return 1;
+                return 0;
         if (r < 0)
                 return r;
 
-        return STR_IN_SET(state, "pending", "unmanaged");
+        return !STR_IN_SET(state, "pending", "unmanaged");
 }
 
 static void link_read_settings(Link *l) {
@@ -461,12 +477,12 @@ static void link_read_settings(Link *l) {
 
         /* Read settings from networkd, except when networkd is not managing this interface. */
 
-        r = link_is_unmanaged(l);
+        r = link_is_managed(l);
         if (r < 0) {
                 log_warning_errno(r, "Failed to determine whether interface %s is managed: %m", l->name);
                 return;
         }
-        if (r > 0) {
+        if (r == 0) {
 
                 /* If this link used to be managed, but is now unmanaged, flush all our settings — but only once. */
                 if (l->is_managed)
@@ -503,10 +519,11 @@ static void link_read_settings(Link *l) {
                 log_warning_errno(r, "Failed to read search domains for interface %s, ignoring: %m", l->name);
 }
 
-int link_update_monitor(Link *l) {
+int link_update(Link *l) {
         assert(l);
 
         link_read_settings(l);
+        link_load_user(l);
         link_allocate_scopes(l);
         link_add_rrs(l, false);
 
@@ -838,3 +855,261 @@ bool link_address_relevant(LinkAddress *a, bool local_multicast) {
 
         return true;
 }
+
+static bool link_needs_save(Link *l) {
+        assert(l);
+
+        /* Returns true if any of the settings where set different from the default */
+
+        if (l->is_managed)
+                return false;
+
+        if (l->llmnr_support != RESOLVE_SUPPORT_YES ||
+            l->mdns_support != RESOLVE_SUPPORT_NO ||
+            l->dnssec_mode != _DNSSEC_MODE_INVALID)
+                return true;
+
+        if (l->dns_servers ||
+            l->search_domains)
+                return true;
+
+        if (!set_isempty(l->dnssec_negative_trust_anchors))
+                return true;
+
+        return false;
+}
+
+int link_save_user(Link *l) {
+        _cleanup_free_ char *temp_path = NULL;
+        _cleanup_fclose_ FILE *f = NULL;
+        const char *v;
+        int r;
+
+        assert(l);
+        assert(l->state_file);
+
+        if (!link_needs_save(l)) {
+                (void) unlink(l->state_file);
+                return 0;
+        }
+
+        r = mkdir_parents(l->state_file, 0700);
+        if (r < 0)
+                goto fail;
+
+        r = fopen_temporary(l->state_file, &f, &temp_path);
+        if (r < 0)
+                goto fail;
+
+        fputs("# This is private data. Do not parse.\n", f);
+
+        v = resolve_support_to_string(l->llmnr_support);
+        if (v)
+                fprintf(f, "LLMNR=%s\n", v);
+
+        v = resolve_support_to_string(l->mdns_support);
+        if (v)
+                fprintf(f, "MDNS=%s\n", v);
+
+        v = dnssec_mode_to_string(l->dnssec_mode);
+        if (v)
+                fprintf(f, "DNSSEC=%s\n", v);
+
+        if (l->dns_servers) {
+                DnsServer *server;
+
+                fputs("SERVERS=", f);
+                LIST_FOREACH(servers, server, l->dns_servers) {
+
+                        if (server != l->dns_servers)
+                                fputc(' ', f);
+
+                        v = dns_server_string(server);
+                        if (!v) {
+                                r = -ENOMEM;
+                                goto fail;
+                        }
+
+                        fputs(v, f);
+                }
+                fputc('\n', f);
+        }
+
+        if (l->search_domains) {
+                DnsSearchDomain *domain;
+
+                fputs("DOMAINS=", f);
+                LIST_FOREACH(domains, domain, l->search_domains) {
+
+                        if (domain != l->search_domains)
+                                fputc(' ', f);
+
+                        if (domain->route_only)
+                                fputc('~', f);
+
+                        fputs(DNS_SEARCH_DOMAIN_NAME(domain), f);
+                }
+                fputc('\n', f);
+        }
+
+        if (!set_isempty(l->dnssec_negative_trust_anchors)) {
+                bool space = false;
+                Iterator i;
+                char *nta;
+
+                fputs("NTAS=", f);
+                SET_FOREACH(nta, l->dnssec_negative_trust_anchors, i) {
+
+                        if (space)
+                                fputc(' ', f);
+
+                        fputs(nta, f);
+                        space = true;
+                }
+                fputc('\n', f);
+        }
+
+        r = fflush_and_check(f);
+        if (r < 0)
+                goto fail;
+
+        if (rename(temp_path, l->state_file) < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        return 0;
+
+fail:
+        (void) unlink(l->state_file);
+
+        if (temp_path)
+                (void) unlink(temp_path);
+
+        return log_error_errno(r, "Failed to save link data %s: %m", l->state_file);
+}
+
+int link_load_user(Link *l) {
+        _cleanup_free_ char
+                *llmnr = NULL,
+                *mdns = NULL,
+                *dnssec = NULL,
+                *servers = NULL,
+                *domains = NULL,
+                *ntas = NULL;
+
+        ResolveSupport s;
+        int r;
+
+        assert(l);
+        assert(l->state_file);
+
+        /* Try to load only a single time */
+        if (l->loaded)
+                return 0;
+        l->loaded = true;
+
+        if (l->is_managed)
+                return 0; /* if the device is managed, then networkd is our configuration source, not the bus API */
+
+        r = parse_env_file(l->state_file, NEWLINE,
+                           "LLMNR", &llmnr,
+                           "MDNS", &mdns,
+                           "DNSSEC", &dnssec,
+                           "SERVERS", &servers,
+                           "DOMAINS", &domains,
+                           "NTAS", &ntas,
+                           NULL);
+        if (r == -ENOENT)
+                return 0;
+        if (r < 0)
+                goto fail;
+
+        link_flush_settings(l);
+
+        /* If we can't recognize the LLMNR or MDNS setting we don't override the default */
+        s = resolve_support_from_string(llmnr);
+        if (s >= 0)
+                l->llmnr_support = s;
+
+        s = resolve_support_from_string(mdns);
+        if (s >= 0)
+                l->mdns_support = s;
+
+        /* If we can't recognize the DNSSEC setting, then set it to invalid, so that the daemon default is used. */
+        l->dnssec_mode = dnssec_mode_from_string(dnssec);
+
+        if (servers) {
+                const char *p = servers;
+
+                for (;;) {
+                        _cleanup_free_ char *word = NULL;
+
+                        r = extract_first_word(&p, &word, NULL, 0);
+                        if (r < 0)
+                                goto fail;
+                        if (r == 0)
+                                break;
+
+                        r = link_update_dns_server_one(l, word);
+                        if (r < 0) {
+                                log_debug_errno(r, "Failed to load DNS server '%s', ignoring: %m", word);
+                                continue;
+                        }
+                }
+        }
+
+        if (domains) {
+                const char *p = domains;
+
+                for (;;) {
+                        _cleanup_free_ char *word = NULL;
+                        const char *n;
+                        bool is_route;
+
+                        r = extract_first_word(&p, &word, NULL, 0);
+                        if (r < 0)
+                                goto fail;
+                        if (r == 0)
+                                break;
+
+                        is_route = word[0] == '~';
+                        n = is_route ? word + 1 : word;
+
+                        r = link_update_search_domain_one(l, n, is_route);
+                        if (r < 0) {
+                                log_debug_errno(r, "Failed to load search domain '%s', ignoring: %m", word);
+                                continue;
+                        }
+                }
+        }
+
+        if (ntas) {
+                _cleanup_set_free_free_ Set *ns = NULL;
+
+                ns = set_new(&dns_name_hash_ops);
+                if (!ns) {
+                        r = -ENOMEM;
+                        goto fail;
+                }
+
+                r = set_put_strsplit(ns, ntas, NULL, 0);
+                if (r < 0)
+                        goto fail;
+
+                l->dnssec_negative_trust_anchors = ns;
+                ns = NULL;
+        }
+
+        return 0;
+
+fail:
+        return log_error_errno(r, "Failed to load link data %s: %m", l->state_file);
+}
+
+void link_remove_user(Link *l) {
+        assert(l);
+        assert(l->state_file);
+
+        (void) unlink(l->state_file);
+}
diff --git a/src/grp-resolve/systemd-resolved/resolved-link.h b/src/grp-resolve/systemd-resolved/resolved-link.h
index 98b440b563..def8b097e4 100644
--- a/src/grp-resolve/systemd-resolved/resolved-link.h
+++ b/src/grp-resolve/systemd-resolved/resolved-link.h
@@ -82,12 +82,15 @@ struct Link {
         char name[IF_NAMESIZE];
         uint32_t mtu;
         uint8_t operstate;
+
+        bool loaded;
+        char *state_file;
 };
 
 int link_new(Manager *m, Link **ret, int ifindex);
 Link *link_free(Link *l);
-int link_update_rtnl(Link *l, sd_netlink_message *m);
-int link_update_monitor(Link *l);
+int link_process_rtnl(Link *l, sd_netlink_message *m);
+int link_update(Link *l);
 bool link_relevant(Link *l, int family, bool local_multicast);
 LinkAddress* link_find_address(Link *l, int family, const union in_addr_union *in_addr);
 void link_add_rrs(Link *l, bool force_remove);
@@ -103,6 +106,10 @@ void link_next_dns_server(Link *l);
 DnssecMode link_get_dnssec_mode(Link *l);
 bool link_dnssec_supported(Link *l);
 
+int link_save_user(Link *l);
+int link_load_user(Link *l);
+void link_remove_user(Link *l);
+
 int link_address_new(Link *l, LinkAddress **ret, int family, const union in_addr_union *in_addr);
 LinkAddress *link_address_free(LinkAddress *a);
 int link_address_update_rtnl(LinkAddress *a, sd_netlink_message *m);
diff --git a/src/grp-resolve/systemd-resolved/resolved-llmnr.c b/src/grp-resolve/systemd-resolved/resolved-llmnr.c
index 24b7a4784f..1092b8b659 100644
--- a/src/grp-resolve/systemd-resolved/resolved-llmnr.c
+++ b/src/grp-resolve/systemd-resolved/resolved-llmnr.c
@@ -92,18 +92,19 @@ static int on_llmnr_packet(sd_event_source *s, int fd, uint32_t revents, void *u
         DnsScope *scope;
         int r;
 
+        assert(s);
+        assert(fd >= 0);
+        assert(m);
+
         r = manager_recv(m, fd, DNS_PROTOCOL_LLMNR, &p);
         if (r <= 0)
                 return r;
 
         scope = manager_find_scope(m, p);
-        if (!scope) {
+        if (!scope)
                 log_warning("Got LLMNR UDP packet on unknown scope. Ignoring.");
-                return 0;
-        }
-
-        if (dns_packet_validate_reply(p) > 0) {
-                log_debug("Got LLMNR reply packet for id %u", DNS_PACKET_ID(p));
+        else if (dns_packet_validate_reply(p) > 0) {
+                log_debug("Got LLMNR UDP reply packet for id %u", DNS_PACKET_ID(p));
 
                 dns_scope_check_conflicts(scope, p);
 
@@ -112,7 +113,7 @@ static int on_llmnr_packet(sd_event_source *s, int fd, uint32_t revents, void *u
                         dns_transaction_process_reply(t, p);
 
         } else if (dns_packet_validate_query(p) > 0)  {
-                log_debug("Got LLMNR query packet for id %u", DNS_PACKET_ID(p));
+                log_debug("Got LLMNR UDP query packet for id %u", DNS_PACKET_ID(p));
 
                 dns_scope_process_query(scope, NULL, p);
         } else
@@ -284,25 +285,19 @@ static int on_llmnr_stream_packet(DnsStream *s) {
         DnsScope *scope;
 
         assert(s);
+        assert(s->read_packet);
 
         scope = manager_find_scope(s->manager, s->read_packet);
-        if (!scope) {
+        if (!scope)
                 log_warning("Got LLMNR TCP packet on unknown scope. Ignoring.");
-                return 0;
-        }
-
-        if (dns_packet_validate_query(s->read_packet) > 0) {
-                log_debug("Got query packet for id %u", DNS_PACKET_ID(s->read_packet));
+        else if (dns_packet_validate_query(s->read_packet) > 0) {
+                log_debug("Got LLMNR TCP query packet for id %u", DNS_PACKET_ID(s->read_packet));
 
                 dns_scope_process_query(scope, s, s->read_packet);
-
-                /* If no reply packet was set, we free the stream */
-                if (s->write_packet)
-                        return 0;
         } else
-                log_debug("Invalid LLMNR TCP packet.");
+                log_debug("Invalid LLMNR TCP packet, ignoring.");
 
-        dns_stream_free(s);
+        dns_stream_unref(s);
         return 0;
 }
 
diff --git a/src/grp-resolve/systemd-resolved/resolved-manager.c b/src/grp-resolve/systemd-resolved/resolved-manager.c
index a326823c3a..0fff82bd98 100644
--- a/src/grp-resolve/systemd-resolved/resolved-manager.c
+++ b/src/grp-resolve/systemd-resolved/resolved-manager.c
@@ -23,6 +23,7 @@
 
 #include "basic/af-list.h"
 #include "basic/alloc-util.h"
+#include "basic/dirent-util.h"
 #include "basic/fd-util.h"
 #include "basic/fileio-label.h"
 #include "basic/hostname-util.h"
@@ -39,6 +40,7 @@
 
 #include "resolved-bus.h"
 #include "resolved-conf.h"
+#include "resolved-dns-stub.h"
 #include "resolved-etc-hosts.h"
 #include "resolved-llmnr.h"
 #include "resolved-manager.h"
@@ -78,11 +80,11 @@ static int manager_process_link(sd_netlink *rtnl, sd_netlink_message *mm, void *
                                 goto fail;
                 }
 
-                r = link_update_rtnl(l, mm);
+                r = link_process_rtnl(l, mm);
                 if (r < 0)
                         goto fail;
 
-                r = link_update_monitor(l);
+                r = link_update(l);
                 if (r < 0)
                         goto fail;
 
@@ -95,6 +97,7 @@ static int manager_process_link(sd_netlink *rtnl, sd_netlink_message *mm, void *
         case RTM_DELLINK:
                 if (l) {
                         log_debug("Removing link %i/%s", l->ifindex, l->name);
+                        link_remove_user(l);
                         link_free(l);
                 }
 
@@ -279,14 +282,12 @@ static int on_network_event(sd_event_source *s, int fd, uint32_t revents, void *
         sd_network_monitor_flush(m->network_monitor);
 
         HASHMAP_FOREACH(l, m->links, i) {
-                r = link_update_monitor(l);
+                r = link_update(l);
                 if (r < 0)
                         log_warning_errno(r, "Failed to update monitor information for %i: %m", l->ifindex);
         }
 
-        r = manager_write_resolv_conf(m);
-        if (r < 0)
-                log_warning_errno(r, "Could not update "PRIVATE_RESOLV_CONF": %m");
+        (void) manager_write_resolv_conf(m);
 
         return 0;
 }
@@ -468,6 +469,18 @@ static int manager_sigusr1(sd_event_source *s, const struct signalfd_siginfo *si
         return 0;
 }
 
+static int manager_sigusr2(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
+        Manager *m = userdata;
+
+        assert(s);
+        assert(si);
+        assert(m);
+
+        manager_flush_caches(m);
+
+        return 0;
+}
+
 int manager_new(Manager **ret) {
         _cleanup_(manager_freep) Manager *m = NULL;
         int r;
@@ -481,11 +494,13 @@ int manager_new(Manager **ret) {
         m->llmnr_ipv4_udp_fd = m->llmnr_ipv6_udp_fd = -1;
         m->llmnr_ipv4_tcp_fd = m->llmnr_ipv6_tcp_fd = -1;
         m->mdns_ipv4_fd = m->mdns_ipv6_fd = -1;
+        m->dns_stub_udp_fd = m->dns_stub_tcp_fd = -1;
         m->hostname_fd = -1;
 
         m->llmnr_support = RESOLVE_SUPPORT_YES;
         m->mdns_support = RESOLVE_SUPPORT_NO;
         m->dnssec_mode = DEFAULT_DNSSEC_MODE;
+        m->enable_cache = true;
         m->read_resolv_conf = true;
         m->need_builtin_fallbacks = true;
         m->etc_hosts_last = m->etc_hosts_mtime = USEC_INFINITY;
@@ -528,6 +543,9 @@ int manager_new(Manager **ret) {
                 return r;
 
         (void) sd_event_add_signal(m->event, &m->sigusr1_event_source, SIGUSR1, manager_sigusr1, m);
+        (void) sd_event_add_signal(m->event, &m->sigusr2_event_source, SIGUSR2, manager_sigusr2, m);
+
+        manager_cleanup_saved_user(m);
 
         *ret = m;
         m = NULL;
@@ -540,6 +558,10 @@ int manager_start(Manager *m) {
 
         assert(m);
 
+        r = manager_dns_stub_start(m);
+        if (r < 0)
+                return r;
+
         r = manager_llmnr_start(m);
         if (r < 0)
                 return r;
@@ -569,6 +591,11 @@ Manager *manager_free(Manager *m) {
 
         dns_scope_free(m->unicast_scope);
 
+        /* At this point only orphaned streams should remain. All others should have been freed already by their
+         * owners */
+        while (m->dns_streams)
+                dns_stream_unref(m->dns_streams);
+
         hashmap_free(m->links);
         hashmap_free(m->dns_transactions);
 
@@ -580,12 +607,14 @@ Manager *manager_free(Manager *m) {
 
         manager_llmnr_stop(m);
         manager_mdns_stop(m);
+        manager_dns_stub_stop(m);
 
         sd_bus_slot_unref(m->prepare_for_sleep_slot);
         sd_event_source_unref(m->bus_retry_event_source);
         sd_bus_unref(m->bus);
 
         sd_event_source_unref(m->sigusr1_event_source);
+        sd_event_source_unref(m->sigusr2_event_source);
 
         sd_event_unref(m->event);
 
@@ -643,6 +672,8 @@ int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret) {
         mh.msg_controllen = sizeof(control);
 
         l = recvmsg(fd, &mh, 0);
+        if (l == 0)
+                return 0;
         if (l < 0) {
                 if (errno == EAGAIN || errno == EINTR)
                         return 0;
@@ -650,9 +681,6 @@ int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret) {
                 return -errno;
         }
 
-        if (l <= 0)
-                return -EIO;
-
         assert(!(mh.msg_flags & MSG_CTRUNC));
         assert(!(mh.msg_flags & MSG_TRUNC));
 
@@ -794,7 +822,14 @@ int manager_write(Manager *m, int fd, DnsPacket *p) {
         return 0;
 }
 
-static int manager_ipv4_send(Manager *m, int fd, int ifindex, const struct in_addr *addr, uint16_t port, DnsPacket *p) {
+static int manager_ipv4_send(
+                Manager *m,
+                int fd,
+                int ifindex,
+                const struct in_addr *destination,
+                uint16_t port,
+                const struct in_addr *source,
+                DnsPacket *p) {
         union sockaddr_union sa = {
                 .in.sin_family = AF_INET,
         };
@@ -807,14 +842,14 @@ static int manager_ipv4_send(Manager *m, int fd, int ifindex, const struct in_ad
 
         assert(m);
         assert(fd >= 0);
-        assert(addr);
+        assert(destination);
         assert(port > 0);
         assert(p);
 
         iov.iov_base = DNS_PACKET_DATA(p);
         iov.iov_len = p->size;
 
-        sa.in.sin_addr = *addr;
+        sa.in.sin_addr = *destination;
         sa.in.sin_port = htobe16(port),
 
         mh.msg_iov = &iov;
@@ -838,12 +873,23 @@ static int manager_ipv4_send(Manager *m, int fd, int ifindex, const struct in_ad
 
                 pi = (struct in_pktinfo*) CMSG_DATA(cmsg);
                 pi->ipi_ifindex = ifindex;
+
+                if (source)
+                        pi->ipi_spec_dst = *source;
         }
 
         return sendmsg_loop(fd, &mh, 0);
 }
 
-static int manager_ipv6_send(Manager *m, int fd, int ifindex, const struct in6_addr *addr, uint16_t port, DnsPacket *p) {
+static int manager_ipv6_send(
+                Manager *m,
+                int fd,
+                int ifindex,
+                const struct in6_addr *destination,
+                uint16_t port,
+                const struct in6_addr *source,
+                DnsPacket *p) {
+
         union sockaddr_union sa = {
                 .in6.sin6_family = AF_INET6,
         };
@@ -856,14 +902,14 @@ static int manager_ipv6_send(Manager *m, int fd, int ifindex, const struct in6_a
 
         assert(m);
         assert(fd >= 0);
-        assert(addr);
+        assert(destination);
         assert(port > 0);
         assert(p);
 
         iov.iov_base = DNS_PACKET_DATA(p);
         iov.iov_len = p->size;
 
-        sa.in6.sin6_addr = *addr;
+        sa.in6.sin6_addr = *destination;
         sa.in6.sin6_port = htobe16(port),
         sa.in6.sin6_scope_id = ifindex;
 
@@ -888,24 +934,36 @@ static int manager_ipv6_send(Manager *m, int fd, int ifindex, const struct in6_a
 
                 pi = (struct in6_pktinfo*) CMSG_DATA(cmsg);
                 pi->ipi6_ifindex = ifindex;
+
+                if (source)
+                        pi->ipi6_addr = *source;
         }
 
         return sendmsg_loop(fd, &mh, 0);
 }
 
-int manager_send(Manager *m, int fd, int ifindex, int family, const union in_addr_union *addr, uint16_t port, DnsPacket *p) {
+int manager_send(
+                Manager *m,
+                int fd,
+                int ifindex,
+                int family,
+                const union in_addr_union *destination,
+                uint16_t port,
+                const union in_addr_union *source,
+                DnsPacket *p) {
+
         assert(m);
         assert(fd >= 0);
-        assert(addr);
+        assert(destination);
         assert(port > 0);
         assert(p);
 
         log_debug("Sending %s packet with id %" PRIu16 " on interface %i/%s.", DNS_PACKET_QR(p) ? "response" : "query", DNS_PACKET_ID(p), ifindex, af_to_name(family));
 
         if (family == AF_INET)
-                return manager_ipv4_send(m, fd, ifindex, &addr->in, port, p);
-        else if (family == AF_INET6)
-                return manager_ipv6_send(m, fd, ifindex, &addr->in6, port, p);
+                return manager_ipv4_send(m, fd, ifindex, &destination->in, port, &source->in, p);
+        if (family == AF_INET6)
+                return manager_ipv6_send(m, fd, ifindex, &destination->in6, port, &source->in6, p);
 
         return -EAFNOSUPPORT;
 }
@@ -1142,7 +1200,12 @@ int manager_compile_dns_servers(Manager *m, OrderedSet **dns) {
         return 0;
 }
 
-int manager_compile_search_domains(Manager *m, OrderedSet **domains) {
+/* filter_route is a tri-state:
+ *   < 0: no filtering
+ *   = 0 or false: return only domains which should be used for searching
+ *   > 0 or true: return only domains which are for routing only
+ */
+int manager_compile_search_domains(Manager *m, OrderedSet **domains, int filter_route) {
         DnsSearchDomain *d;
         Iterator i;
         Link *l;
@@ -1156,6 +1219,11 @@ int manager_compile_search_domains(Manager *m, OrderedSet **domains) {
                 return r;
 
         LIST_FOREACH(domains, d, m->search_domains) {
+
+                if (filter_route >= 0 &&
+                    d->route_only != !!filter_route)
+                        continue;
+
                 r = ordered_set_put(*domains, d->name);
                 if (r == -EEXIST)
                         continue;
@@ -1166,6 +1234,11 @@ int manager_compile_search_domains(Manager *m, OrderedSet **domains) {
         HASHMAP_FOREACH(l, m->links, i) {
 
                 LIST_FOREACH(domains, d, l->search_domains) {
+
+                        if (filter_route >= 0 &&
+                            d->route_only != !!filter_route)
+                                continue;
+
                         r = ordered_set_put(*domains, d->name);
                         if (r == -EEXIST)
                                 continue;
@@ -1237,3 +1310,69 @@ bool manager_routable(Manager *m, int family) {
 
         return false;
 }
+
+void manager_flush_caches(Manager *m) {
+        DnsScope *scope;
+
+        assert(m);
+
+        LIST_FOREACH(scopes, scope, m->dns_scopes)
+                dns_cache_flush(&scope->cache);
+
+        log_info("Flushed all caches.");
+}
+
+void manager_cleanup_saved_user(Manager *m) {
+        _cleanup_closedir_ DIR *d = NULL;
+        struct dirent *de;
+        int r;
+
+        assert(m);
+
+        /* Clean up all saved per-link files in /run/systemd/resolve/netif/ that don't have a matching interface
+         * anymore. These files are created to persist settings pushed in by the user via the bus, so that resolved can
+         * be restarted without losing this data. */
+
+        d = opendir("/run/systemd/resolve/netif/");
+        if (!d) {
+                if (errno == ENOENT)
+                        return;
+
+                log_warning_errno(errno, "Failed to open interface directory: %m");
+                return;
+        }
+
+        FOREACH_DIRENT_ALL(de, d, log_error_errno(errno, "Failed to read interface directory: %m")) {
+                _cleanup_free_ char *p = NULL;
+                int ifindex;
+                Link *l;
+
+                if (!IN_SET(de->d_type, DT_UNKNOWN, DT_REG))
+                        continue;
+
+                if (STR_IN_SET(de->d_name, ".", ".."))
+                        continue;
+
+                r = parse_ifindex(de->d_name, &ifindex);
+                if (r < 0) /* Probably some temporary file from a previous run. Delete it */
+                        goto rm;
+
+                l = hashmap_get(m->links, INT_TO_PTR(ifindex));
+                if (!l) /* link vanished */
+                        goto rm;
+
+                if (l->is_managed) /* now managed by networkd, hence the bus settings are useless */
+                        goto rm;
+
+                continue;
+
+        rm:
+                p = strappend("/run/systemd/resolve/netif/", de->d_name);
+                if (!p) {
+                        log_oom();
+                        return;
+                }
+
+                (void) unlink(p);
+        }
+}
diff --git a/src/grp-resolve/systemd-resolved/resolved-manager.h b/src/grp-resolve/systemd-resolved/resolved-manager.h
index dd2a534213..6c5274ce56 100644
--- a/src/grp-resolve/systemd-resolved/resolved-manager.h
+++ b/src/grp-resolve/systemd-resolved/resolved-manager.h
@@ -46,6 +46,7 @@ struct Manager {
         ResolveSupport llmnr_support;
         ResolveSupport mdns_support;
         DnssecMode dnssec_mode;
+        bool enable_cache;
 
         /* Network */
         Hashmap *links;
@@ -72,7 +73,6 @@ struct Manager {
 
         LIST_HEAD(DnsSearchDomain, search_domains);
         unsigned n_search_domains;
-        bool permit_domain_search;
 
         bool need_builtin_fallbacks:1;
 
@@ -120,6 +120,7 @@ struct Manager {
         sd_bus_slot *prepare_for_sleep_slot;
 
         sd_event_source *sigusr1_event_source;
+        sd_event_source *sigusr2_event_source;
 
         unsigned n_transactions_total;
         unsigned n_dnssec_verdict[_DNSSEC_VERDICT_MAX];
@@ -128,6 +129,13 @@ struct Manager {
         Set* etc_hosts_by_address;
         Hashmap* etc_hosts_by_name;
         usec_t etc_hosts_last, etc_hosts_mtime;
+
+        /* Local DNS stub on 127.0.0.53:53 */
+        int dns_stub_udp_fd;
+        int dns_stub_tcp_fd;
+
+        sd_event_source *dns_stub_udp_event_source;
+        sd_event_source *dns_stub_tcp_event_source;
 };
 
 /* Manager */
@@ -140,7 +148,7 @@ int manager_start(Manager *m);
 uint32_t manager_find_mtu(Manager *m);
 
 int manager_write(Manager *m, int fd, DnsPacket *p);
-int manager_send(Manager *m, int fd, int ifindex, int family, const union in_addr_union *addr, uint16_t port, DnsPacket *p);
+int manager_send(Manager *m, int fd, int ifindex, int family, const union in_addr_union *destination, uint16_t port, const union in_addr_union *source, DnsPacket *p);
 int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret);
 
 int manager_find_ifindex(Manager *m, int family, const union in_addr_union *in_addr);
@@ -161,7 +169,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(Manager*, manager_free);
 int manager_is_own_hostname(Manager *m, const char *name);
 
 int manager_compile_dns_servers(Manager *m, OrderedSet **servers);
-int manager_compile_search_domains(Manager *m, OrderedSet **domains);
+int manager_compile_search_domains(Manager *m, OrderedSet **domains, int filter_route);
 
 DnssecMode manager_get_dnssec_mode(Manager *m);
 bool manager_dnssec_supported(Manager *m);
@@ -169,3 +177,7 @@ bool manager_dnssec_supported(Manager *m);
 void manager_dnssec_verdict(Manager *m, DnssecVerdict verdict, const DnsResourceKey *key);
 
 bool manager_routable(Manager *m, int family);
+
+void manager_flush_caches(Manager *m);
+
+void manager_cleanup_saved_user(Manager *m);
diff --git a/src/grp-resolve/systemd-resolved/resolved-resolv-conf.c b/src/grp-resolve/systemd-resolved/resolved-resolv-conf.c
index c50796de2e..5d6b4203bc 100644
--- a/src/grp-resolve/systemd-resolved/resolved-resolv-conf.c
+++ b/src/grp-resolve/systemd-resolved/resolved-resolv-conf.c
@@ -93,7 +93,7 @@ int manager_read_resolv_conf(Manager *m) {
 
                 a = first_word(l, "nameserver");
                 if (a) {
-                        r = manager_add_dns_server_by_string(m, DNS_SERVER_SYSTEM, a);
+                        r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_SYSTEM, a);
                         if (r < 0)
                                 log_warning_errno(r, "Failed to parse DNS server address '%s', ignoring.", a);
 
@@ -150,9 +150,7 @@ static void write_resolv_conf_server(DnsServer *s, FILE *f, unsigned *count) {
         assert(f);
         assert(count);
 
-        (void) dns_server_string(s);
-
-        if (!s->server_string) {
+        if (!dns_server_string(s)) {
                 log_warning("Our of memory, or invalid DNS address. Ignoring server.");
                 return;
         }
@@ -161,44 +159,49 @@ static void write_resolv_conf_server(DnsServer *s, FILE *f, unsigned *count) {
                 fputs("# Too many DNS servers configured, the following entries may be ignored.\n", f);
         (*count)++;
 
-        fprintf(f, "nameserver %s\n", s->server_string);
+        fprintf(f, "nameserver %s\n", dns_server_string(s));
 }
 
 static void write_resolv_conf_search(
-                const char *domain,
-                FILE *f,
-                unsigned *count,
-                unsigned *length) {
+                OrderedSet *domains,
+                FILE *f) {
+        unsigned length = 0, count = 0;
+        Iterator i;
+        char *domain;
 
-        assert(domain);
+        assert(domains);
         assert(f);
-        assert(length);
 
-        if (*count >= MAXDNSRCH ||
-            *length + strlen(domain) > 256) {
-                if (*count == MAXDNSRCH)
-                        fputs(" # Too many search domains configured, remaining ones ignored.", f);
-                if (*length <= 256)
-                        fputs(" # Total length of all search domains is too long, remaining ones ignored.", f);
+        fputs("search", f);
 
-                return;
+        ORDERED_SET_FOREACH(domain, domains, i) {
+                if (++count > MAXDNSRCH) {
+                        fputs("\n# Too many search domains configured, remaining ones ignored.", f);
+                        break;
+                }
+                length += strlen(domain) + 1;
+                if (length > 256) {
+                        fputs("\n# Total length of all search domains is too long, remaining ones ignored.", f);
+                        break;
+                }
+                fputc(' ', f);
+                fputs(domain, f);
         }
 
-        (*length) += strlen(domain);
-        (*count)++;
-
-        fputc(' ', f);
-        fputs(domain, f);
+        fputs("\n", f);
 }
 
 static int write_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
         Iterator i;
 
         fputs("# This file is managed by systemd-resolved(8). Do not edit.\n#\n"
-              "# Third party programs must not access this file directly, but\n"
-              "# only through the symlink at /etc/resolv.conf. To manage\n"
-              "# resolv.conf(5) in a different way, replace the symlink by a\n"
-              "# static file or a different symlink.\n\n", f);
+              "# This is a dynamic resolv.conf file for connecting local clients directly to\n"
+              "# all known DNS servers.\n#\n"
+              "# Third party programs must not access this file directly, but only through the\n"
+              "# symlink at /etc/resolv.conf. To manage resolv.conf(5) in a different way,\n"
+              "# replace this symlink by a static file or a different symlink.\n#\n"
+              "# See systemd-resolved.service(8) for details about the supported modes of\n"
+              "# operation for /etc/resolv.conf.\n\n", f);
 
         if (ordered_set_isempty(dns))
                 fputs("# No DNS servers known.\n", f);
@@ -210,15 +213,8 @@ static int write_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *doma
                         write_resolv_conf_server(s, f, &count);
         }
 
-        if (!ordered_set_isempty(domains)) {
-                unsigned length = 0, count = 0;
-                char *domain;
-
-                fputs("search", f);
-                ORDERED_SET_FOREACH(domain, domains, i)
-                        write_resolv_conf_search(domain, f, &count, &length);
-                fputs("\n", f);
-        }
+        if (!ordered_set_isempty(domains))
+                write_resolv_conf_search(domains, f);
 
         return fflush_and_check(f);
 }
@@ -233,29 +229,31 @@ int manager_write_resolv_conf(Manager *m) {
         assert(m);
 
         /* Read the system /etc/resolv.conf first */
-        manager_read_resolv_conf(m);
+        (void) manager_read_resolv_conf(m);
 
         /* Add the full list to a set, to filter out duplicates */
         r = manager_compile_dns_servers(m, &dns);
         if (r < 0)
-                return r;
+                return log_warning_errno(r, "Failed to compile list of DNS servers: %m");
 
-        r = manager_compile_search_domains(m, &domains);
+        r = manager_compile_search_domains(m, &domains, false);
         if (r < 0)
-                return r;
+                return log_warning_errno(r, "Failed to compile list of search domains: %m");
 
         r = fopen_temporary_label(PRIVATE_RESOLV_CONF, PRIVATE_RESOLV_CONF, &f, &temp_path);
         if (r < 0)
-                return r;
+                return log_warning_errno(r, "Failed to open private resolv.conf file for writing: %m");
 
-        fchmod(fileno(f), 0644);
+        (void) fchmod(fileno(f), 0644);
 
         r = write_resolv_conf_contents(f, dns, domains);
-        if (r < 0)
+        if (r < 0) {
+                log_error_errno(r, "Failed to write private resolv.conf contents: %m");
                 goto fail;
+        }
 
         if (rename(temp_path, PRIVATE_RESOLV_CONF) < 0) {
-                r = -errno;
+                r = log_error_errno(errno, "Failed to move private resolv.conf file into place: %m");
                 goto fail;
         }
 
@@ -264,5 +262,6 @@ int manager_write_resolv_conf(Manager *m) {
 fail:
         (void) unlink(PRIVATE_RESOLV_CONF);
         (void) unlink(temp_path);
+
         return r;
 }
diff --git a/src/grp-resolve/systemd-resolved/resolved.c b/src/grp-resolve/systemd-resolved/resolved.c
index 07952227ce..39fa423eeb 100644
--- a/src/grp-resolve/systemd-resolved/resolved.c
+++ b/src/grp-resolve/systemd-resolved/resolved.c
@@ -68,11 +68,15 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        r = drop_privileges(uid, gid, 0);
+        /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */
+        r = drop_privileges(uid, gid,
+                            (UINT64_C(1) << CAP_NET_RAW)|          /* needed for SO_BINDTODEVICE */
+                            (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */
+                            (UINT64_C(1) << CAP_SETPCAP)           /* needed in order to drop the caps later */);
         if (r < 0)
                 goto finish;
 
-        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, -1) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, -1) >= 0);
 
         r = manager_new(&m);
         if (r < 0) {
@@ -86,11 +90,15 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        /* Write finish default resolv.conf to avoid a dangling
-         * symlink */
-        r = manager_write_resolv_conf(m);
-        if (r < 0)
-                log_warning_errno(r, "Could not create "PRIVATE_RESOLV_CONF": %m");
+        /* Write finish default resolv.conf to avoid a dangling symlink */
+        (void) manager_write_resolv_conf(m);
+
+        /* Let's drop the remaining caps now */
+        r = capability_bounding_set_drop(0, true);
+        if (r < 0) {
+                log_error_errno(r, "Failed to drop remaining caps: %m");
+                goto finish;
+        }
 
         sd_notify(false,
                   "READY=1\n"
diff --git a/src/grp-resolve/systemd-resolved/resolved.conf.in b/src/grp-resolve/systemd-resolved/resolved.conf.in
index a288588924..3bd8389c88 100644
--- a/src/grp-resolve/systemd-resolved/resolved.conf.in
+++ b/src/grp-resolve/systemd-resolved/resolved.conf.in
@@ -17,3 +17,4 @@
 #Domains=
 #LLMNR=yes
 #DNSSEC=@DEFAULT_DNSSEC_MODE@
+#Cache=yes
diff --git a/src/grp-resolve/systemd-resolved/resolved.conf.xml b/src/grp-resolve/systemd-resolved/resolved.conf.xml
index 920ce9e89b..7556c6ff31 100644
--- a/src/grp-resolve/systemd-resolved/resolved.conf.xml
+++ b/src/grp-resolve/systemd-resolved/resolved.conf.xml
@@ -202,6 +202,17 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>Cache=</varname></term>
+        <listitem><para>Takes a boolean argument. If "yes" (the default), resolving a domain name which already got
+        queried earlier will return the previous result as long as it is still valid, and thus does not result in a new
+        network request. Be aware that that turning off caching comes at a performance penalty, which is particularly
+        high when DNSSEC is used.</para>
+
+        <para>Note that caching is turned off implicitly if the configured DNS server is on a host-local IP address
+        (such as 127.0.0.1 or ::1), in order to avoid duplicate local caching.</para></listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 
diff --git a/src/grp-resolve/systemd-resolved/systemd-resolved.service.m4.in b/src/grp-resolve/systemd-resolved/systemd-resolved.service.m4.in
index 8e1c1dea79..15ab56a066 100644
--- a/src/grp-resolve/systemd-resolved/systemd-resolved.service.m4.in
+++ b/src/grp-resolve/systemd-resolved/systemd-resolved.service.m4.in
@@ -23,10 +23,12 @@ Type=notify
 Restart=always
 RestartSec=0
 ExecStart=@rootlibexecdir@/systemd-resolved
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_NET_RAW CAP_NET_BIND_SERVICE
 ProtectSystem=full
 ProtectHome=yes
 WatchdogSec=3min
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
 
 [Install]
 WantedBy=multi-user.target
diff --git a/src/grp-resolve/systemd-resolved/systemd-resolved.service.xml b/src/grp-resolve/systemd-resolved/systemd-resolved.service.xml
index 829729ca09..aa1c2365e5 100644
--- a/src/grp-resolve/systemd-resolved/systemd-resolved.service.xml
+++ b/src/grp-resolve/systemd-resolved/systemd-resolved.service.xml
@@ -58,27 +58,45 @@
 
     <para><command>systemd-resolved</command> is a system service that provides network name resolution to local
     applications. It implements a caching and validating DNS/DNSSEC stub resolver, as well as an LLMNR resolver and
-    responder. In addition it maintains the <filename>/run/systemd/resolve/resolv.conf</filename> file for
-    compatibility with traditional Linux programs. This file may be symlinked from
-    <filename>/etc/resolv.conf</filename>.</para>
-
-    <para>The glibc NSS module
-    <citerefentry><refentrytitle>nss-resolve</refentrytitle><manvolnum>8</manvolnum></citerefentry> is required to
-    permit glibc's NSS resolver functions to resolve host names via <command>systemd-resolved</command>.</para>
-
-    <para>The DNS servers contacted are determined from the global
-    settings in <filename>/etc/systemd/resolved.conf</filename>, the
-    per-link static settings in <filename>/etc/systemd/network/*.network</filename> files,
-    and the per-link dynamic settings received over DHCP. See
-    <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    and
-    <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    for details. To improve compatibility,
-    <filename>/etc/resolv.conf</filename> is read in order to discover
-    configured system DNS servers, but only if it is not a symlink
-    to <filename>/run/systemd/resolve/resolv.conf</filename> (see above).</para>
+    responder. Local applications may submit network name resolution requests via three interfaces:</para>
+
+    <itemizedlist>
+      <listitem><para>The native, fully-featured API <command>systemd-resolved</command> exposes on the bus. See the
+      <ulink url="http://www.freedesktop.org/wiki/Software/systemd/resolved">API Documentation</ulink> for
+      details. Usage of this API is generally recommended to clients as it is asynchronous and fully featured (for
+      example, properly returns DNSSEC validation status and interface scope for addresses as necessary for supporting
+      link-local networking).</para></listitem>
+
+      <listitem><para>The glibc
+      <citerefentry><refentrytitle>getaddrinfo</refentrytitle><manvolnum>3</manvolnum></citerefentry> API as defined
+      by <ulink url="https://tools.ietf.org/html/rfc3493">RFC3493</ulink> and its related resolver functions,
+      including <citerefentry><refentrytitle>gethostbyname</refentrytitle><manvolnum>3</manvolnum></citerefentry>. This
+      API is widely supported, including beyond the Linux platform. In its current form it does not expose DNSSEC
+      validation status information however, and is synchronous only. This API is backed by the glibc Name Service
+      Switch (<citerefentry><refentrytitle>nss</refentrytitle><manvolnum>5</manvolnum></citerefentry>). Usage of the
+      glibc NSS module <citerefentry><refentrytitle>nss-resolve</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      is required in order to allow glibc's NSS resolver functions to resolve host names via
+      <command>systemd-resolved</command>.</para></listitem>
+
+      <listitem><para>Additionally, <command>systemd-resolved</command> provides a local DNS stub listener on IP
+      address 127.0.0.53 on the local loopback interface. Programs issuing DNS requests directly, bypassing any local
+      API may be directed to this stub, in order to connect them to <command>systemd-resolved</command>. Note however
+      that it is strongly recommended that local programs use the glibc NSS or bus APIs instead (as described above),
+      as various network resolution concepts (such as link-local addressing, or LLMNR Unicode domains) cannot be mapped
+      to the unicast DNS protocol.</para></listitem>
+    </itemizedlist>
+
+    <para>The DNS servers contacted are determined from the global settings in
+    <filename>/etc/systemd/resolved.conf</filename>, the per-link static settings in
+    <filename>/etc/systemd/network/*.network</filename> files, the per-link dynamic settings received over DHCP and any
+    DNS server information made available by other system services. See
+    <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> and
+    <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details
+    about systemd's own configuration files for DNS servers. To improve compatibility,
+    <filename>/etc/resolv.conf</filename> is read in order to discover configured system DNS servers, but only if it is
+    not a symlink to <filename>/run/systemd/resolve/resolv.conf</filename> (see below).</para>
 
-    <para><command>systemd-resolved</command> synthesizes DNS RRs for the following cases:</para>
+    <para><command>systemd-resolved</command> synthesizes DNS resource records (RRs) for the following cases:</para>
 
     <itemizedlist>
       <listitem><para>The local, configured hostname is resolved to
@@ -137,15 +155,68 @@
     per-interface domains are exclusively routed to the matching
     interfaces.</para>
 
-    <para>Note that <filename>/run/systemd/resolve/resolv.conf</filename> should not be used directly by applications,
-    but only through a symlink from <filename>/etc/resolv.conf</filename>.</para>
-
     <para>See the <ulink url="http://www.freedesktop.org/wiki/Software/systemd/resolved"> resolved D-Bus API
     Documentation</ulink> for information about the APIs <filename>systemd-resolved</filename> provides.</para>
 
   </refsect1>
 
   <refsect1>
+    <title><filename>/etc/resolv.conf</filename></title>
+
+    <para>Three modes of handling <filename>/etc/resolv.conf</filename> (see
+    <citerefentry><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>) are
+    supported:</para>
+
+    <itemizedlist>
+      <listitem><para>A static file <filename>/usr/lib/systemd/resolv.conf</filename> is provided that lists
+      the 127.0.0.53 DNS stub (see above) as only DNS server. This file may be symlinked from
+      <filename>/etc/resolv.conf</filename> in order to connect all local clients that bypass local DNS APIs to
+      <command>systemd-resolved</command>. This mode of operation is recommended.</para></listitem>
+
+      <listitem><para><command>systemd-resolved</command> maintains the
+      <filename>/run/systemd/resolve/resolv.conf</filename> file for compatibility with traditional Linux
+      programs. This file may be symlinked from <filename>/etc/resolv.conf</filename> and is always kept up-to-date,
+      containing information about all known DNS servers. Note the file format's limitations: it does not know a
+      concept of per-interface DNS servers and hence only contains system-wide DNS server definitions. Note that
+      <filename>/run/systemd/resolve/resolv.conf</filename> should not be used directly by applications, but only
+      through a symlink from <filename>/etc/resolv.conf</filename>. If this mode of operation is used local clients
+      that bypass any local DNS API will also bypass <command>systemd-resolved</command> and will talk directly to the
+      known DNS servers.</para> </listitem>
+
+      <listitem><para>Alternatively, <filename>/etc/resolv.conf</filename> may be managed by other packages, in which
+      case <command>systemd-resolved</command> will read it for DNS configuration data. In this mode of operation
+      <command>systemd-resolved</command> is consumer rather than provider of this configuration
+      file. </para></listitem>
+    </itemizedlist>
+
+    <para>Note that the selected mode of operation for this file is detected fully automatically, depending on whether
+    <filename>/etc/resolv.conf</filename> is a symlink to <filename>/run/systemd/resolve/resolv.conf</filename> or
+    lists 127.0.0.53 as DNS server.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>Signals</title>
+
+    <variablelist>
+      <varlistentry>
+        <term><constant>SIGUSR1</constant></term>
+
+        <listitem><para>Upon reception of the SIGUSR1 process signal <command>systemd-resolved</command> will dump the
+        contents of all DNS resource record caches it maintains into the system logs.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><constant>SIGUSR2</constant></term>
+
+        <listitem><para>Upon reception of the SIGUSR2 process signal <command>systemd-resolved</command> will flush all
+        caches it maintains. Note that it should normally not be necessary to request this explicitly – except for
+        debugging purposes – as <command>systemd-resolved</command> flushes the caches automatically anyway any time
+        the host's network configuration changes.</para></listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
     <title>See Also</title>
     <para>
       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
diff --git a/src/grp-resolve/systemd-resolved/systemd-resolved.tmpfiles b/src/grp-resolve/systemd-resolved/systemd-resolved.tmpfiles
index 3160f5cf7e..760fe11412 100644
--- a/src/grp-resolve/systemd-resolved/systemd-resolved.tmpfiles
+++ b/src/grp-resolve/systemd-resolved/systemd-resolved.tmpfiles
@@ -7,4 +7,4 @@
 
 # See tmpfiles.d(5) for details
 
-L! /etc/resolv.conf - - - - ../run/systemd/resolve/resolv.conf
+L! /etc/resolv.conf - - - - ../usr/lib/systemd/resolv.conf
diff --git a/src/grp-system/grp-utils/systemd-analyze/analyze.c b/src/grp-system/grp-utils/systemd-analyze/analyze.c
index 41d3f0799a..e79a109651 100644
--- a/src/grp-system/grp-utils/systemd-analyze/analyze.c
+++ b/src/grp-system/grp-utils/systemd-analyze/analyze.c
@@ -759,9 +759,9 @@ static int list_dependencies_print(const char *name, unsigned int level, unsigne
 
         if (times) {
                 if (times->time)
-                        printf("%s%s @%s +%s%s", ANSI_HIGHLIGHT_RED, name,
+                        printf("%s%s @%s +%s%s", ansi_highlight_red(), name,
                                format_timespan(ts, sizeof(ts), times->activating - boot->userspace_time, USEC_PER_MSEC),
-                               format_timespan(ts2, sizeof(ts2), times->time, USEC_PER_MSEC), ANSI_NORMAL);
+                               format_timespan(ts2, sizeof(ts2), times->time, USEC_PER_MSEC), ansi_normal());
                 else if (times->activated > boot->userspace_time)
                         printf("%s @%s", name, format_timespan(ts, sizeof(ts), times->activated - boot->userspace_time, USEC_PER_MSEC));
                 else
@@ -927,8 +927,8 @@ static int list_dependencies(sd_bus *bus, const char *name) {
 
         if (times) {
                 if (times->time)
-                        printf("%s%s +%s%s\n", ANSI_HIGHLIGHT_RED, id,
-                               format_timespan(ts, sizeof(ts), times->time, USEC_PER_MSEC), ANSI_NORMAL);
+                        printf("%s%s +%s%s\n", ansi_highlight_red(), id,
+                               format_timespan(ts, sizeof(ts), times->time, USEC_PER_MSEC), ansi_normal());
                 else if (times->activated > boot->userspace_time)
                         printf("%s @%s\n", id, format_timespan(ts, sizeof(ts), times->activated - boot->userspace_time, USEC_PER_MSEC));
                 else
diff --git a/src/grp-system/grp-utils/systemd-delta/Makefile b/src/grp-system/grp-utils/systemd-delta/Makefile
index 4f5610d27a..7273647c52 100644
--- a/src/grp-system/grp-utils/systemd-delta/Makefile
+++ b/src/grp-system/grp-utils/systemd-delta/Makefile
@@ -28,6 +28,6 @@ systemd_delta_SOURCES = \
 	src/delta/delta.c
 
 systemd_delta_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-system/grp-utils/systemd-fstab-generator/Makefile b/src/grp-system/grp-utils/systemd-fstab-generator/Makefile
index 4f19808477..43475f69e1 100644
--- a/src/grp-system/grp-utils/systemd-fstab-generator/Makefile
+++ b/src/grp-system/grp-utils/systemd-fstab-generator/Makefile
@@ -29,6 +29,6 @@ systemd_fstab_generator_SOURCES = \
 	src/core/mount-setup.c
 
 systemd_fstab_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-system/grp-utils/systemd-fstab-generator/fstab-generator.c b/src/grp-system/grp-utils/systemd-fstab-generator/fstab-generator.c
index 49c8487935..70866cacda 100644
--- a/src/grp-system/grp-utils/systemd-fstab-generator/fstab-generator.c
+++ b/src/grp-system/grp-utils/systemd-fstab-generator/fstab-generator.c
@@ -86,13 +86,12 @@ static int add_swap(
                 return log_oom();
 
         f = fopen(unit, "wxe");
-        if (!f) {
-                if (errno == EEXIST)
-                        log_error("Failed to create swap unit file %s, as it already exists. Duplicate entry in /etc/fstab?", unit);
-                else
-                        log_error_errno(errno, "Failed to create unit file %s: %m", unit);
-                return -errno;
-        }
+        if (!f)
+                return log_error_errno(errno,
+                                       errno == EEXIST ?
+                                       "Failed to create swap unit file %s, as it already exists. Duplicate entry in /etc/fstab?" :
+                                       "Failed to create unit file %s: %m",
+                                       unit);
 
         fprintf(f,
                 "# Automatically generated by systemd-fstab-generator\n\n"
@@ -282,13 +281,12 @@ static int add_mount(
                 return log_oom();
 
         f = fopen(unit, "wxe");
-        if (!f) {
-                if (errno == EEXIST)
-                        log_error("Failed to create mount unit file %s, as it already exists. Duplicate entry in /etc/fstab?", unit);
-                else
-                        log_error_errno(errno, "Failed to create unit file %s: %m", unit);
-                return -errno;
-        }
+        if (!f)
+                return log_error_errno(errno,
+                                       errno == EEXIST ?
+                                       "Failed to create mount unit file %s, as it already exists. Duplicate entry in /etc/fstab?" :
+                                       "Failed to create unit file %s: %m",
+                                       unit);
 
         fprintf(f,
                 "# Automatically generated by systemd-fstab-generator\n\n"
@@ -418,8 +416,7 @@ static int parse_fstab(bool initrd) {
                 if (errno == ENOENT)
                         return 0;
 
-                log_error_errno(errno, "Failed to open %s: %m", fstab_path);
-                return -errno;
+                return log_error_errno(errno, "Failed to open %s: %m", fstab_path);
         }
 
         while ((me = getmntent(f))) {
@@ -497,6 +494,18 @@ static int add_sysroot_mount(void) {
                 return 0;
         }
 
+        if (streq(arg_root_what, "gpt-auto")) {
+                /* This is handled by the gpt-auto generator */
+                log_debug("Skipping root directory handling, as gpt-auto was requested.");
+                return 0;
+        }
+
+        if (path_equal(arg_root_what, "/dev/nfs")) {
+                /* This is handled by the kernel or the initrd */
+                log_debug("Skipping root directory handling, as /dev/nfs was requested.");
+                return 0;
+        }
+
         what = fstab_node_to_udev_node(arg_root_what);
         if (!what)
                 return log_oom();
@@ -521,10 +530,10 @@ static int add_sysroot_mount(void) {
                          "/sysroot",
                          arg_root_fstype,
                          opts,
-                         is_device_path(what) ? 1 : 0,
-                         false,
-                         false,
-                         false,
+                         is_device_path(what) ? 1 : 0, /* passno */
+                         false,                        /* noauto off */
+                         false,                        /* nofail off */
+                         false,                        /* automount off */
                          SPECIAL_INITRD_ROOT_FS_TARGET,
                          "/proc/cmdline");
 }
@@ -537,22 +546,20 @@ static int add_sysroot_usr_mount(void) {
                 return 0;
 
         if (arg_root_what && !arg_usr_what) {
+                /* Copy over the root device, in case the /usr mount just differs in a mount option (consider btrfs subvolumes) */
                 arg_usr_what = strdup(arg_root_what);
-
                 if (!arg_usr_what)
                         return log_oom();
         }
 
         if (arg_root_fstype && !arg_usr_fstype) {
                 arg_usr_fstype = strdup(arg_root_fstype);
-
                 if (!arg_usr_fstype)
                         return log_oom();
         }
 
         if (arg_root_options && !arg_usr_options) {
                 arg_usr_options = strdup(arg_root_options);
-
                 if (!arg_usr_options)
                         return log_oom();
         }
@@ -561,10 +568,8 @@ static int add_sysroot_usr_mount(void) {
                 return 0;
 
         what = fstab_node_to_udev_node(arg_usr_what);
-        if (!path_is_absolute(what)) {
-                log_debug("Skipping entry what=%s where=/sysroot/usr type=%s", what, strna(arg_usr_fstype));
-                return -1;
-        }
+        if (!what)
+                return log_oom();
 
         if (!arg_usr_options)
                 opts = arg_root_rw > 0 ? "rw" : "ro";
@@ -578,10 +583,10 @@ static int add_sysroot_usr_mount(void) {
                          "/sysroot/usr",
                          arg_usr_fstype,
                          opts,
-                         1,
-                         false,
-                         false,
-                         false,
+                         is_device_path(what) ? 1 : 0, /* passno */
+                         false,                        /* noauto off */
+                         false,                        /* nofail off */
+                         false,                        /* automount off */
                          SPECIAL_INITRD_FS_TARGET,
                          "/proc/cmdline");
 }
@@ -676,10 +681,15 @@ int main(int argc, char *argv[]) {
 
         /* Always honour root= and usr= in the kernel command line if we are in an initrd */
         if (in_initrd()) {
+                int k;
+
                 r = add_sysroot_mount();
-                if (r == 0)
-                        r = add_sysroot_usr_mount();
-        }
+
+                k = add_sysroot_usr_mount();
+                if (k < 0)
+                        r = k;
+        } else
+                r = 0;
 
         /* Honour /etc/fstab only when that's enabled */
         if (arg_fstab_enabled) {
diff --git a/src/grp-system/grp-utils/systemd-run/Makefile b/src/grp-system/grp-utils/systemd-run/Makefile
index 17d21167bc..9664591eb6 100644
--- a/src/grp-system/grp-utils/systemd-run/Makefile
+++ b/src/grp-system/grp-utils/systemd-run/Makefile
@@ -28,6 +28,6 @@ systemd_run_SOURCES = \
 	src/run/run.c
 
 systemd_run_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-system/grp-utils/systemd-run/run.c b/src/grp-system/grp-utils/systemd-run/run.c
index 10b6b4440f..4aaf446177 100644
--- a/src/grp-system/grp-utils/systemd-run/run.c
+++ b/src/grp-system/grp-utils/systemd-run/run.c
@@ -187,7 +187,7 @@ static int parse_argv(int argc, char *argv[]) {
         assert(argc >= 0);
         assert(argv);
 
-        while ((c = getopt_long(argc, argv, "+hrH:M:p:tq", options, NULL)) >= 0)
+        while ((c = getopt_long(argc, argv, "+hrH:M:E:p:tq", options, NULL)) >= 0)
 
                 switch (c) {
 
diff --git a/src/grp-system/grp-utils/systemd-run/systemd-run.completion.bash b/src/grp-system/grp-utils/systemd-run/systemd-run.completion.bash
index 8152b021e7..022331e6a9 100644
--- a/src/grp-system/grp-utils/systemd-run/systemd-run.completion.bash
+++ b/src/grp-system/grp-utils/systemd-run/systemd-run.completion.bash
@@ -84,8 +84,8 @@ _systemd_run() {
                          LimitNICE= LimitRTPRIO= LimitRTTIME= PrivateTmp= PrivateDevices=
                          PrivateNetwork= NoNewPrivileges= WorkingDirectory= RootDirectory=
                          TTYPath= SyslogIdentifier= SyslogLevelPrefix= SyslogLevel=
-                         SyslogFacility= TimerSlackNSec= OOMScoreAdjust= ReadWriteDirectories=
-                         ReadOnlyDirectories= InaccessibleDirectories= EnvironmentFile=
+                         SyslogFacility= TimerSlackNSec= OOMScoreAdjust= ReadWritePaths=
+                         ReadOnlyPaths= InaccessiblePaths= EnvironmentFile=
                          ProtectSystem= ProtectHome= RuntimeDirectory= PassEnvironment='
 
             COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
diff --git a/src/grp-system/grp-utils/systemd-run/systemd-run.completion.zsh b/src/grp-system/grp-utils/systemd-run/systemd-run.completion.zsh
index c425085cd8..6362b97766 100644
--- a/src/grp-system/grp-utils/systemd-run/systemd-run.completion.zsh
+++ b/src/grp-system/grp-utils/systemd-run/systemd-run.completion.zsh
@@ -37,8 +37,8 @@ _arguments \
                 LimitNICE= LimitRTPRIO= LimitRTTIME= PrivateTmp= PrivateDevices= \
                 PrivateNetwork= NoNewPrivileges= WorkingDirectory= RootDirectory= \
                 TTYPath= SyslogIdentifier= SyslogLevelPrefix= SyslogLevel= \
-                SyslogFacility= TimerSlackNSec= OOMScoreAdjust= ReadWriteDirectories= \
-                ReadOnlyDirectories= InaccessibleDirectories= EnvironmentFile= \
+                SyslogFacility= TimerSlackNSec= OOMScoreAdjust= ReadWritePaths= \
+                ReadOnlyPaths= InaccessiblePaths= EnvironmentFile= \
                 ProtectSystem= ProtectHome= RuntimeDirectory= PassEnvironment= \
                 ))' \
         '--description=[Description for unit]:description' \
diff --git a/src/grp-system/grp-utils/systemd-sysv-generator/sysv-generator.c b/src/grp-system/grp-utils/systemd-sysv-generator/sysv-generator.c
index 0fb1f0b8a3..de973034be 100644
--- a/src/grp-system/grp-utils/systemd-sysv-generator/sysv-generator.c
+++ b/src/grp-system/grp-utils/systemd-sysv-generator/sysv-generator.c
@@ -42,32 +42,19 @@
 #include "shared/install.h"
 #include "shared/path-lookup.h"
 
-typedef enum RunlevelType {
-        RUNLEVEL_UP,
-        RUNLEVEL_DOWN
-} RunlevelType;
-
 static const struct {
         const char *path;
         const char *target;
-        const RunlevelType type;
 } rcnd_table[] = {
         /* Standard SysV runlevels for start-up */
-        { "rc1.d",  SPECIAL_RESCUE_TARGET,     RUNLEVEL_UP },
-        { "rc2.d",  SPECIAL_MULTI_USER_TARGET, RUNLEVEL_UP },
-        { "rc3.d",  SPECIAL_MULTI_USER_TARGET, RUNLEVEL_UP },
-        { "rc4.d",  SPECIAL_MULTI_USER_TARGET, RUNLEVEL_UP },
-        { "rc5.d",  SPECIAL_GRAPHICAL_TARGET,  RUNLEVEL_UP },
-
-        /* Standard SysV runlevels for shutdown */
-        { "rc0.d",  SPECIAL_POWEROFF_TARGET,  RUNLEVEL_DOWN },
-        { "rc6.d",  SPECIAL_REBOOT_TARGET,    RUNLEVEL_DOWN }
-
-        /* Note that the order here matters, as we read the
-           directories in this order, and we want to make sure that
-           sysv_start_priority is known when we first load the
-           unit. And that value we only know from S links. Hence
-           UP must be read before DOWN */
+        { "rc1.d",  SPECIAL_RESCUE_TARGET     },
+        { "rc2.d",  SPECIAL_MULTI_USER_TARGET },
+        { "rc3.d",  SPECIAL_MULTI_USER_TARGET },
+        { "rc4.d",  SPECIAL_MULTI_USER_TARGET },
+        { "rc5.d",  SPECIAL_GRAPHICAL_TARGET  },
+
+        /* We ignore the SysV runlevels for shutdown here, as SysV services get default dependencies anyway, and that
+         * means they are shut down anyway at system power off if running. */
 };
 
 static const char *arg_dest = "/tmp";
@@ -82,7 +69,6 @@ typedef struct SysvStub {
         char **after;
         char **wants;
         char **wanted_by;
-        char **conflicts;
         bool has_lsb;
         bool reload;
         bool loaded;
@@ -100,7 +86,6 @@ static void free_sysvstub(SysvStub *s) {
         strv_free(s->after);
         strv_free(s->wants);
         strv_free(s->wanted_by);
-        strv_free(s->conflicts);
         free(s);
 }
 
@@ -199,8 +184,6 @@ static int generate_unit_file(SysvStub *s) {
                 fprintf(f, "After=%s\n", *p);
         STRV_FOREACH(p, s->wants)
                 fprintf(f, "Wants=%s\n", *p);
-        STRV_FOREACH(p, s->conflicts)
-                fprintf(f, "Conflicts=%s\n", *p);
 
         fprintf(f,
                 "\n[Service]\n"
@@ -527,9 +510,7 @@ static int load_sysv(SysvStub *s) {
                                         t[k-1] = 0;
                                 }
 
-                                j = strstrip(t+12);
-                                if (isempty(j))
-                                        j = NULL;
+                                j = empty_to_null(strstrip(t+12));
 
                                 r = free_and_strdup(&chkconfig_description, j);
                                 if (r < 0)
@@ -605,9 +586,7 @@ static int load_sysv(SysvStub *s) {
 
                                 state = LSB_DESCRIPTION;
 
-                                j = strstrip(t+12);
-                                if (isempty(j))
-                                        j = NULL;
+                                j = empty_to_null(strstrip(t+12));
 
                                 r = free_and_strdup(&long_description, j);
                                 if (r < 0)
@@ -618,9 +597,7 @@ static int load_sysv(SysvStub *s) {
 
                                 state = LSB;
 
-                                j = strstrip(t+18);
-                                if (isempty(j))
-                                        j = NULL;
+                                j = empty_to_null(strstrip(t+18));
 
                                 r = free_and_strdup(&short_description, j);
                                 if (r < 0)
@@ -841,7 +818,6 @@ static int enumerate_sysv(const LookupPaths *lp, Hashmap *all_services) {
 
 static int set_dependencies_from_rcnd(const LookupPaths *lp, Hashmap *all_services) {
         Set *runlevel_services[ELEMENTSOF(rcnd_table)] = {};
-        _cleanup_set_free_ Set *shutdown_services = NULL;
         _cleanup_strv_free_ char **sysvrcnd_path = NULL;
         SysvStub *service;
         unsigned i;
@@ -880,7 +856,7 @@ static int set_dependencies_from_rcnd(const LookupPaths *lp, Hashmap *all_servic
                                 _cleanup_free_ char *name = NULL, *fpath = NULL;
                                 int a, b;
 
-                                if (de->d_name[0] != 'S' && de->d_name[0] != 'K')
+                                if (de->d_name[0] != 'S')
                                         continue;
 
                                 if (strlen(de->d_name) < 4)
@@ -910,43 +886,23 @@ static int set_dependencies_from_rcnd(const LookupPaths *lp, Hashmap *all_servic
                                         continue;
                                 }
 
-                                if (de->d_name[0] == 'S')  {
-
-                                        if (rcnd_table[i].type == RUNLEVEL_UP)
-                                                service->sysv_start_priority = MAX(a*10 + b, service->sysv_start_priority);
+                                service->sysv_start_priority = MAX(a*10 + b, service->sysv_start_priority);
 
-                                        r = set_ensure_allocated(&runlevel_services[i], NULL);
-                                        if (r < 0) {
-                                                log_oom();
-                                                goto finish;
-                                        }
-
-                                        r = set_put(runlevel_services[i], service);
-                                        if (r < 0) {
-                                                log_oom();
-                                                goto finish;
-                                        }
-
-                                } else if (de->d_name[0] == 'K' &&
-                                           (rcnd_table[i].type == RUNLEVEL_DOWN)) {
-
-                                        r = set_ensure_allocated(&shutdown_services, NULL);
-                                        if (r < 0) {
-                                                log_oom();
-                                                goto finish;
-                                        }
+                                r = set_ensure_allocated(&runlevel_services[i], NULL);
+                                if (r < 0) {
+                                        log_oom();
+                                        goto finish;
+                                }
 
-                                        r = set_put(shutdown_services, service);
-                                        if (r < 0) {
-                                                log_oom();
-                                                goto finish;
-                                        }
+                                r = set_put(runlevel_services[i], service);
+                                if (r < 0) {
+                                        log_oom();
+                                        goto finish;
                                 }
                         }
                 }
         }
 
-
         for (i = 0; i < ELEMENTSOF(rcnd_table); i ++)
                 SET_FOREACH(service, runlevel_services[i], j) {
                         r = strv_extend(&service->before, rcnd_table[i].target);
@@ -961,19 +917,6 @@ static int set_dependencies_from_rcnd(const LookupPaths *lp, Hashmap *all_servic
                         }
                 }
 
-        SET_FOREACH(service, shutdown_services, j) {
-                r = strv_extend(&service->before, SPECIAL_SHUTDOWN_TARGET);
-                if (r < 0) {
-                        log_oom();
-                        goto finish;
-                }
-                r = strv_extend(&service->conflicts, SPECIAL_SHUTDOWN_TARGET);
-                if (r < 0) {
-                        log_oom();
-                        goto finish;
-                }
-        }
-
         r = 0;
 
 finish:
diff --git a/src/grp-system/kernel-command-line.xml b/src/grp-system/kernel-command-line.xml
index 9c04849f66..3ecc969c10 100644
--- a/src/grp-system/kernel-command-line.xml
+++ b/src/grp-system/kernel-command-line.xml
@@ -146,7 +146,9 @@
 
       <varlistentry>
         <term><varname>-b</varname></term>
+        <term><varname>rd.emergency</varname></term>
         <term><varname>emergency</varname></term>
+        <term><varname>rd.rescue</varname></term>
         <term><varname>rescue</varname></term>
         <term><varname>single</varname></term>
         <term><varname>s</varname></term>
@@ -158,7 +160,7 @@
         <term><varname>5</varname></term>
         <listitem>
           <para>Parameters understood by the system and service
-          manager, as compatibility options. For details, see
+          manager, as compatibility and convenience options. For details, see
           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
         </listitem>
       </varlistentry>
diff --git a/src/grp-system/libcore/Makefile b/src/grp-system/libcore/Makefile
index 1f19355412..b31d00fcdb 100644
--- a/src/grp-system/libcore/Makefile
+++ b/src/grp-system/libcore/Makefile
@@ -156,7 +156,7 @@ libcore_la_CFLAGS = \
 	$(SECCOMP_CFLAGS)
 
 libcore_la_LIBADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(PAM_LIBS) \
 	$(AUDIT_LIBS) \
 	$(KMOD_LIBS) \
diff --git a/src/grp-system/libcore/automount.c b/src/grp-system/libcore/automount.c
index 726a044030..30c30469ca 100644
--- a/src/grp-system/libcore/automount.c
+++ b/src/grp-system/libcore/automount.c
@@ -100,9 +100,6 @@ static void unmount_autofs(Automount *a) {
         if (a->pipe_fd < 0)
                 return;
 
-        automount_send_ready(a, a->tokens, -EHOSTDOWN);
-        automount_send_ready(a, a->expire_tokens, -EHOSTDOWN);
-
         a->pipe_event_source = sd_event_source_unref(a->pipe_event_source);
         a->pipe_fd = safe_close(a->pipe_fd);
 
@@ -111,6 +108,9 @@ static void unmount_autofs(Automount *a) {
         if (a->where &&
             (UNIT(a)->manager->exit_code != MANAGER_RELOAD &&
              UNIT(a)->manager->exit_code != MANAGER_REEXECUTE)) {
+                automount_send_ready(a, a->tokens, -EHOSTDOWN);
+                automount_send_ready(a, a->expire_tokens, -EHOSTDOWN);
+
                 r = repeat_unmount(a->where, MNT_DETACH);
                 if (r < 0)
                         log_error_errno(r, "Failed to unmount: %m");
@@ -504,6 +504,20 @@ static void automount_trigger_notify(Unit *u, Unit *other) {
                 automount_set_state(a, AUTOMOUNT_RUNNING);
         }
 
+        if (IN_SET(MOUNT(other)->state,
+                   MOUNT_MOUNTING, MOUNT_MOUNTING_DONE,
+                   MOUNT_MOUNTED, MOUNT_REMOUNTING,
+                   MOUNT_MOUNTING_SIGTERM, MOUNT_MOUNTING_SIGKILL,
+                   MOUNT_REMOUNTING_SIGTERM, MOUNT_REMOUNTING_SIGKILL,
+                   MOUNT_UNMOUNTING_SIGTERM, MOUNT_UNMOUNTING_SIGKILL,
+                   MOUNT_FAILED)) {
+
+                (void) automount_send_ready(a, a->expire_tokens, -ENODEV);
+        }
+
+        if (MOUNT(other)->state == MOUNT_DEAD)
+                (void) automount_send_ready(a, a->expire_tokens, 0);
+
         /* The mount is in some unhappy state now, let's unfreeze any waiting clients */
         if (IN_SET(MOUNT(other)->state,
                    MOUNT_DEAD, MOUNT_UNMOUNTING,
diff --git a/src/grp-system/libcore/busname.c b/src/grp-system/libcore/busname.c
index 5d85c20730..f21a2d23c1 100644
--- a/src/grp-system/libcore/busname.c
+++ b/src/grp-system/libcore/busname.c
@@ -999,12 +999,7 @@ static int busname_get_timeout(Unit *u, usec_t *timeout) {
 }
 
 static bool busname_supported(void) {
-        static int supported = -1;
-
-        if (supported < 0)
-                supported = is_kdbus_available();
-
-        return supported;
+        return false;
 }
 
 static int busname_control_pid(Unit *u) {
diff --git a/src/grp-system/libcore/cgroup.c b/src/grp-system/libcore/cgroup.c
index df850ec68f..0c1365f329 100644
--- a/src/grp-system/libcore/cgroup.c
+++ b/src/grp-system/libcore/cgroup.c
@@ -37,6 +37,21 @@
 
 #define CGROUP_CPU_QUOTA_PERIOD_USEC ((usec_t) 100 * USEC_PER_MSEC)
 
+static void cgroup_compat_warn(void) {
+        static bool cgroup_compat_warned = false;
+
+        if (cgroup_compat_warned)
+                return;
+
+        log_warning("cgroup compatibility translation between legacy and unified hierarchy settings activated. See cgroup-compat debug messages for details.");
+        cgroup_compat_warned = true;
+}
+
+#define log_cgroup_compat(unit, fmt, ...) do {                                  \
+                cgroup_compat_warn();                                           \
+                log_unit_debug(unit, "cgroup-compat: " fmt, ##__VA_ARGS__);     \
+        } while (false)
+
 void cgroup_context_init(CGroupContext *c) {
         assert(c);
 
@@ -47,7 +62,10 @@ void cgroup_context_init(CGroupContext *c) {
         c->startup_cpu_shares = CGROUP_CPU_SHARES_INVALID;
         c->cpu_quota_per_sec_usec = USEC_INFINITY;
 
-        c->memory_limit = (uint64_t) -1;
+        c->memory_high = CGROUP_LIMIT_MAX;
+        c->memory_max = CGROUP_LIMIT_MAX;
+
+        c->memory_limit = CGROUP_LIMIT_MAX;
 
         c->io_weight = CGROUP_WEIGHT_INVALID;
         c->startup_io_weight = CGROUP_WEIGHT_INVALID;
@@ -148,6 +166,9 @@ void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix) {
                 "%sStartupIOWeight=%" PRIu64 "\n"
                 "%sBlockIOWeight=%" PRIu64 "\n"
                 "%sStartupBlockIOWeight=%" PRIu64 "\n"
+                "%sMemoryLow=%" PRIu64 "\n"
+                "%sMemoryHigh=%" PRIu64 "\n"
+                "%sMemoryMax=%" PRIu64 "\n"
                 "%sMemoryLimit=%" PRIu64 "\n"
                 "%sTasksMax=%" PRIu64 "\n"
                 "%sDevicePolicy=%s\n"
@@ -164,6 +185,9 @@ void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix) {
                 prefix, c->startup_io_weight,
                 prefix, c->blockio_weight,
                 prefix, c->startup_blockio_weight,
+                prefix, c->memory_low,
+                prefix, c->memory_high,
+                prefix, c->memory_max,
                 prefix, c->memory_limit,
                 prefix, c->tasks_max,
                 prefix, cgroup_device_policy_to_string(c->device_policy),
@@ -405,7 +429,7 @@ static uint64_t cgroup_weight_io_to_blkio(uint64_t io_weight) {
                      CGROUP_BLKIO_WEIGHT_MIN, CGROUP_BLKIO_WEIGHT_MAX);
 }
 
-static void cgroup_apply_io_device_weight(const char *path, const char *dev_path, uint64_t io_weight) {
+static void cgroup_apply_io_device_weight(Unit *u, const char *dev_path, uint64_t io_weight) {
         char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
         dev_t dev;
         int r;
@@ -415,13 +439,13 @@ static void cgroup_apply_io_device_weight(const char *path, const char *dev_path
                 return;
 
         xsprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), io_weight);
-        r = cg_set_attribute("io", path, "io.weight", buf);
+        r = cg_set_attribute("io", u->cgroup_path, "io.weight", buf);
         if (r < 0)
-                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                               "Failed to set io.weight on %s: %m", path);
+                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                              "Failed to set io.weight: %m");
 }
 
-static void cgroup_apply_blkio_device_weight(const char *path, const char *dev_path, uint64_t blkio_weight) {
+static void cgroup_apply_blkio_device_weight(Unit *u, const char *dev_path, uint64_t blkio_weight) {
         char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
         dev_t dev;
         int r;
@@ -431,13 +455,13 @@ static void cgroup_apply_blkio_device_weight(const char *path, const char *dev_p
                 return;
 
         xsprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), blkio_weight);
-        r = cg_set_attribute("blkio", path, "blkio.weight_device", buf);
+        r = cg_set_attribute("blkio", u->cgroup_path, "blkio.weight_device", buf);
         if (r < 0)
-                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                               "Failed to set blkio.weight_device on %s: %m", path);
+                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                              "Failed to set blkio.weight_device: %m");
 }
 
-static unsigned cgroup_apply_io_device_limit(const char *path, const char *dev_path, uint64_t *limits) {
+static unsigned cgroup_apply_io_device_limit(Unit *u, const char *dev_path, uint64_t *limits) {
         char limit_bufs[_CGROUP_IO_LIMIT_TYPE_MAX][DECIMAL_STR_MAX(uint64_t)];
         char buf[DECIMAL_STR_MAX(dev_t)*2+2+(6+DECIMAL_STR_MAX(uint64_t)+1)*4];
         CGroupIOLimitType type;
@@ -461,14 +485,14 @@ static unsigned cgroup_apply_io_device_limit(const char *path, const char *dev_p
         xsprintf(buf, "%u:%u rbps=%s wbps=%s riops=%s wiops=%s\n", major(dev), minor(dev),
                  limit_bufs[CGROUP_IO_RBPS_MAX], limit_bufs[CGROUP_IO_WBPS_MAX],
                  limit_bufs[CGROUP_IO_RIOPS_MAX], limit_bufs[CGROUP_IO_WIOPS_MAX]);
-        r = cg_set_attribute("io", path, "io.max", buf);
+        r = cg_set_attribute("io", u->cgroup_path, "io.max", buf);
         if (r < 0)
-                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                               "Failed to set io.max on %s: %m", path);
+                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                              "Failed to set io.max: %m");
         return n;
 }
 
-static unsigned cgroup_apply_blkio_device_limit(const char *path, const char *dev_path, uint64_t rbps, uint64_t wbps) {
+static unsigned cgroup_apply_blkio_device_limit(Unit *u, const char *dev_path, uint64_t rbps, uint64_t wbps) {
         char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
         dev_t dev;
         unsigned n = 0;
@@ -481,26 +505,50 @@ static unsigned cgroup_apply_blkio_device_limit(const char *path, const char *de
         if (rbps != CGROUP_LIMIT_MAX)
                 n++;
         sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), rbps);
-        r = cg_set_attribute("blkio", path, "blkio.throttle.read_bps_device", buf);
+        r = cg_set_attribute("blkio", u->cgroup_path, "blkio.throttle.read_bps_device", buf);
         if (r < 0)
-                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                               "Failed to set blkio.throttle.read_bps_device on %s: %m", path);
+                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                              "Failed to set blkio.throttle.read_bps_device: %m");
 
         if (wbps != CGROUP_LIMIT_MAX)
                 n++;
         sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), wbps);
-        r = cg_set_attribute("blkio", path, "blkio.throttle.write_bps_device", buf);
+        r = cg_set_attribute("blkio", u->cgroup_path, "blkio.throttle.write_bps_device", buf);
         if (r < 0)
-                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                               "Failed to set blkio.throttle.write_bps_device on %s: %m", path);
+                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                              "Failed to set blkio.throttle.write_bps_device: %m");
 
         return n;
 }
 
-void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, ManagerState state) {
+static bool cgroup_context_has_unified_memory_config(CGroupContext *c) {
+        return c->memory_low > 0 || c->memory_high != CGROUP_LIMIT_MAX || c->memory_max != CGROUP_LIMIT_MAX;
+}
+
+static void cgroup_apply_unified_memory_limit(Unit *u, const char *file, uint64_t v) {
+        char buf[DECIMAL_STR_MAX(uint64_t) + 1] = "max";
+        int r;
+
+        if (v != CGROUP_LIMIT_MAX)
+                xsprintf(buf, "%" PRIu64 "\n", v);
+
+        r = cg_set_attribute("memory", u->cgroup_path, file, buf);
+        if (r < 0)
+                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                              "Failed to set %s: %m", file);
+}
+
+static void cgroup_context_apply(Unit *u, CGroupMask mask, ManagerState state) {
+        const char *path;
+        CGroupContext *c;
         bool is_root;
         int r;
 
+        assert(u);
+
+        c = unit_get_cgroup_context(u);
+        path = u->cgroup_path;
+
         assert(c);
         assert(path);
 
@@ -526,14 +574,14 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                         c->cpu_shares != CGROUP_CPU_SHARES_INVALID ? c->cpu_shares : CGROUP_CPU_SHARES_DEFAULT);
                 r = cg_set_attribute("cpu", path, "cpu.shares", buf);
                 if (r < 0)
-                        log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                       "Failed to set cpu.shares on %s: %m", path);
+                        log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                      "Failed to set cpu.shares: %m");
 
                 sprintf(buf, USEC_FMT "\n", CGROUP_CPU_QUOTA_PERIOD_USEC);
                 r = cg_set_attribute("cpu", path, "cpu.cfs_period_us", buf);
                 if (r < 0)
-                        log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                       "Failed to set cpu.cfs_period_us on %s: %m", path);
+                        log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                      "Failed to set cpu.cfs_period_us: %m");
 
                 if (c->cpu_quota_per_sec_usec != USEC_INFINITY) {
                         sprintf(buf, USEC_FMT "\n", c->cpu_quota_per_sec_usec * CGROUP_CPU_QUOTA_PERIOD_USEC / USEC_PER_SEC);
@@ -541,8 +589,8 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                 } else
                         r = cg_set_attribute("cpu", path, "cpu.cfs_quota_us", "-1");
                 if (r < 0)
-                        log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                       "Failed to set cpu.cfs_quota_us on %s: %m", path);
+                        log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                      "Failed to set cpu.cfs_quota_us: %m");
         }
 
         if (mask & CGROUP_MASK_IO) {
@@ -555,29 +603,40 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
 
                         if (has_io)
                                 weight = cgroup_context_io_weight(c, state);
-                        else if (has_blockio)
-                                weight = cgroup_weight_blkio_to_io(cgroup_context_blkio_weight(c, state));
-                        else
+                        else if (has_blockio) {
+                                uint64_t blkio_weight = cgroup_context_blkio_weight(c, state);
+
+                                weight = cgroup_weight_blkio_to_io(blkio_weight);
+
+                                log_cgroup_compat(u, "Applying [Startup]BlockIOWeight %" PRIu64 " as [Startup]IOWeight %" PRIu64,
+                                                  blkio_weight, weight);
+                        } else
                                 weight = CGROUP_WEIGHT_DEFAULT;
 
                         xsprintf(buf, "default %" PRIu64 "\n", weight);
                         r = cg_set_attribute("io", path, "io.weight", buf);
                         if (r < 0)
-                                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                               "Failed to set io.weight on %s: %m", path);
+                                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                              "Failed to set io.weight: %m");
 
                         if (has_io) {
                                 CGroupIODeviceWeight *w;
 
                                 /* FIXME: no way to reset this list */
                                 LIST_FOREACH(device_weights, w, c->io_device_weights)
-                                        cgroup_apply_io_device_weight(path, w->path, w->weight);
+                                        cgroup_apply_io_device_weight(u, w->path, w->weight);
                         } else if (has_blockio) {
                                 CGroupBlockIODeviceWeight *w;
 
                                 /* FIXME: no way to reset this list */
-                                LIST_FOREACH(device_weights, w, c->blockio_device_weights)
-                                        cgroup_apply_io_device_weight(path, w->path, cgroup_weight_blkio_to_io(w->weight));
+                                LIST_FOREACH(device_weights, w, c->blockio_device_weights) {
+                                        weight = cgroup_weight_blkio_to_io(w->weight);
+
+                                        log_cgroup_compat(u, "Applying BlockIODeviceWeight %" PRIu64 " as IODeviceWeight %" PRIu64 " for %s",
+                                                          w->weight, weight, w->path);
+
+                                        cgroup_apply_io_device_weight(u, w->path, weight);
+                                }
                         }
                 }
 
@@ -586,7 +645,7 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                         CGroupIODeviceLimit *l, *next;
 
                         LIST_FOREACH_SAFE(device_limits, l, next, c->io_device_limits) {
-                                if (!cgroup_apply_io_device_limit(path, l->path, l->limits))
+                                if (!cgroup_apply_io_device_limit(u, l->path, l->limits))
                                         cgroup_context_free_io_device_limit(c, l);
                         }
                 } else if (has_blockio) {
@@ -602,7 +661,10 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                                 limits[CGROUP_IO_RBPS_MAX] = b->rbps;
                                 limits[CGROUP_IO_WBPS_MAX] = b->wbps;
 
-                                if (!cgroup_apply_io_device_limit(path, b->path, limits))
+                                log_cgroup_compat(u, "Applying BlockIO{Read|Write}Bandwidth %" PRIu64 " %" PRIu64 " as IO{Read|Write}BandwidthMax for %s",
+                                                  b->rbps, b->wbps, b->path);
+
+                                if (!cgroup_apply_io_device_limit(u, b->path, limits))
                                         cgroup_context_free_blockio_device_bandwidth(c, b);
                         }
                 }
@@ -618,29 +680,40 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
 
                         if (has_blockio)
                                 weight = cgroup_context_blkio_weight(c, state);
-                        else if (has_io)
+                        else if (has_io) {
+                                uint64_t io_weight = cgroup_context_io_weight(c, state);
+
                                 weight = cgroup_weight_io_to_blkio(cgroup_context_io_weight(c, state));
-                        else
+
+                                log_cgroup_compat(u, "Applying [Startup]IOWeight %" PRIu64 " as [Startup]BlockIOWeight %" PRIu64,
+                                                  io_weight, weight);
+                        } else
                                 weight = CGROUP_BLKIO_WEIGHT_DEFAULT;
 
                         xsprintf(buf, "%" PRIu64 "\n", weight);
                         r = cg_set_attribute("blkio", path, "blkio.weight", buf);
                         if (r < 0)
-                                log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                               "Failed to set blkio.weight on %s: %m", path);
+                                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                              "Failed to set blkio.weight: %m");
 
                         if (has_blockio) {
                                 CGroupBlockIODeviceWeight *w;
 
                                 /* FIXME: no way to reset this list */
                                 LIST_FOREACH(device_weights, w, c->blockio_device_weights)
-                                        cgroup_apply_blkio_device_weight(path, w->path, w->weight);
+                                        cgroup_apply_blkio_device_weight(u, w->path, w->weight);
                         } else if (has_io) {
                                 CGroupIODeviceWeight *w;
 
                                 /* FIXME: no way to reset this list */
-                                LIST_FOREACH(device_weights, w, c->io_device_weights)
-                                        cgroup_apply_blkio_device_weight(path, w->path, cgroup_weight_io_to_blkio(w->weight));
+                                LIST_FOREACH(device_weights, w, c->io_device_weights) {
+                                        weight = cgroup_weight_io_to_blkio(w->weight);
+
+                                        log_cgroup_compat(u, "Applying IODeviceWeight %" PRIu64 " as BlockIODeviceWeight %" PRIu64 " for %s",
+                                                          w->weight, weight, w->path);
+
+                                        cgroup_apply_blkio_device_weight(u, w->path, weight);
+                                }
                         }
                 }
 
@@ -649,40 +722,59 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                         CGroupBlockIODeviceBandwidth *b, *next;
 
                         LIST_FOREACH_SAFE(device_bandwidths, b, next, c->blockio_device_bandwidths) {
-                                if (!cgroup_apply_blkio_device_limit(path, b->path, b->rbps, b->wbps))
+                                if (!cgroup_apply_blkio_device_limit(u, b->path, b->rbps, b->wbps))
                                         cgroup_context_free_blockio_device_bandwidth(c, b);
                         }
                 } else if (has_io) {
                         CGroupIODeviceLimit *l, *next;
 
                         LIST_FOREACH_SAFE(device_limits, l, next, c->io_device_limits) {
-                                if (!cgroup_apply_blkio_device_limit(path, l->path, l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX]))
+                                log_cgroup_compat(u, "Applying IO{Read|Write}Bandwidth %" PRIu64 " %" PRIu64 " as BlockIO{Read|Write}BandwidthMax for %s",
+                                                  l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX], l->path);
+
+                                if (!cgroup_apply_blkio_device_limit(u, l->path, l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX]))
                                         cgroup_context_free_io_device_limit(c, l);
                         }
                 }
         }
 
         if ((mask & CGROUP_MASK_MEMORY) && !is_root) {
-                if (c->memory_limit != (uint64_t) -1) {
-                        char buf[DECIMAL_STR_MAX(uint64_t) + 1];
+                if (cg_unified() > 0) {
+                        uint64_t max = c->memory_max;
 
-                        sprintf(buf, "%" PRIu64 "\n", c->memory_limit);
+                        if (cgroup_context_has_unified_memory_config(c))
+                                max = c->memory_max;
+                        else {
+                                max = c->memory_limit;
 
-                        if (cg_unified() <= 0)
-                                r = cg_set_attribute("memory", path, "memory.limit_in_bytes", buf);
-                        else
-                                r = cg_set_attribute("memory", path, "memory.max", buf);
+                                if (max != CGROUP_LIMIT_MAX)
+                                        log_cgroup_compat(u, "Applying MemoryLimit %" PRIu64 " as MemoryMax", max);
+                        }
 
+                        cgroup_apply_unified_memory_limit(u, "memory.low", c->memory_low);
+                        cgroup_apply_unified_memory_limit(u, "memory.high", c->memory_high);
+                        cgroup_apply_unified_memory_limit(u, "memory.max", max);
                 } else {
-                        if (cg_unified() <= 0)
-                                r = cg_set_attribute("memory", path, "memory.limit_in_bytes", "-1");
+                        char buf[DECIMAL_STR_MAX(uint64_t) + 1];
+                        uint64_t val = c->memory_limit;
+
+                        if (val == CGROUP_LIMIT_MAX) {
+                                val = c->memory_max;
+
+                                if (val != CGROUP_LIMIT_MAX)
+                                        log_cgroup_compat(u, "Applying MemoryMax %" PRIi64 " as MemoryLimit", c->memory_max);
+                        }
+
+                        if (val == CGROUP_LIMIT_MAX)
+                                strncpy(buf, "-1\n", sizeof(buf));
                         else
-                                r = cg_set_attribute("memory", path, "memory.max", "max");
-                }
+                                xsprintf(buf, "%" PRIu64 "\n", val);
 
-                if (r < 0)
-                        log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                       "Failed to set memory.limit_in_bytes/memory.max on %s: %m", path);
+                        r = cg_set_attribute("memory", path, "memory.limit_in_bytes", buf);
+                        if (r < 0)
+                                log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                              "Failed to set memory.limit_in_bytes: %m");
+                }
         }
 
         if ((mask & CGROUP_MASK_DEVICES) && !is_root) {
@@ -697,8 +789,8 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                 else
                         r = cg_set_attribute("devices", path, "devices.allow", "a");
                 if (r < 0)
-                        log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                       "Failed to reset devices.list on %s: %m", path);
+                        log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                      "Failed to reset devices.list: %m");
 
                 if (c->device_policy == CGROUP_CLOSED ||
                     (c->device_policy == CGROUP_AUTO && c->device_allow)) {
@@ -709,7 +801,10 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                                 "/dev/random\0" "rwm\0"
                                 "/dev/urandom\0" "rwm\0"
                                 "/dev/tty\0" "rwm\0"
-                                "/dev/pts/ptmx\0" "rw\0"; /* /dev/pts/ptmx may not be duplicated, but accessed */
+                                "/dev/pts/ptmx\0" "rw\0" /* /dev/pts/ptmx may not be duplicated, but accessed */
+                                /* Allow /run/systemd/inaccessible/{chr,blk} devices for mapping InaccessiblePaths */
+                                "/run/systemd/inaccessible/chr\0" "rwm\0"
+                                "/run/systemd/inaccessible/blk\0" "rwm\0";
 
                         const char *x, *y;
 
@@ -744,7 +839,7 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                         else if (startswith(a->path, "char-"))
                                 whitelist_major(path, a->path + 5, 'c', acc);
                         else
-                                log_debug("Ignoring device %s while writing cgroup attribute.", a->path);
+                                log_unit_debug(u, "Ignoring device %s while writing cgroup attribute.", a->path);
                 }
         }
 
@@ -759,8 +854,8 @@ void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, M
                         r = cg_set_attribute("pids", path, "pids.max", "max");
 
                 if (r < 0)
-                        log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
-                                       "Failed to set pids.max on %s: %m", path);
+                        log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
+                                      "Failed to set pids.max: %m");
         }
 }
 
@@ -779,7 +874,8 @@ CGroupMask cgroup_context_get_mask(CGroupContext *c) {
                 mask |= CGROUP_MASK_IO | CGROUP_MASK_BLKIO;
 
         if (c->memory_accounting ||
-            c->memory_limit != (uint64_t) -1)
+            c->memory_limit != CGROUP_LIMIT_MAX ||
+            cgroup_context_has_unified_memory_config(c))
                 mask |= CGROUP_MASK_MEMORY;
 
         if (c->device_allow ||
@@ -1044,7 +1140,7 @@ int unit_watch_cgroup(Unit *u) {
         /* Only applies to the unified hierarchy */
         r = cg_unified();
         if (r < 0)
-                return log_unit_error_errno(u, r, "Failed detect wether the unified hierarchy is used: %m");
+                return log_unit_error_errno(u, r, "Failed detect whether the unified hierarchy is used: %m");
         if (r == 0)
                 return 0;
 
@@ -1194,7 +1290,7 @@ static int unit_realize_cgroup_now(Unit *u, ManagerState state) {
                 return r;
 
         /* Finally, apply the necessary attributes. */
-        cgroup_context_apply(unit_get_cgroup_context(u), target_mask, u->cgroup_path, state);
+        cgroup_context_apply(u, target_mask, state);
 
         return 0;
 }
@@ -1325,7 +1421,7 @@ void unit_prune_cgroup(Unit *u) {
 
         r = cg_trim_everywhere(u->manager->cgroup_supported, u->cgroup_path, !is_root_slice);
         if (r < 0) {
-                log_debug_errno(r, "Failed to destroy cgroup %s, ignoring: %m", u->cgroup_path);
+                log_unit_debug_errno(u, r, "Failed to destroy cgroup %s, ignoring: %m", u->cgroup_path);
                 return;
         }
 
@@ -1566,7 +1662,7 @@ int manager_setup_cgroup(Manager *m) {
                 /* 3. Install agent */
                 if (unified) {
 
-                        /* In the unified hierarchy we can can get
+                        /* In the unified hierarchy we can get
                          * cgroup empty notifications via inotify. */
 
                         m->cgroup_inotify_event_source = sd_event_source_unref(m->cgroup_inotify_event_source);
@@ -1613,7 +1709,7 @@ int manager_setup_cgroup(Manager *m) {
 
                 /* also, move all other userspace processes remaining
                  * in the root cgroup into that scope. */
-                r = cg_migrate(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, SYSTEMD_CGROUP_CONTROLLER, scope_path, false);
+                r = cg_migrate(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
                 if (r < 0)
                         log_warning_errno(r, "Couldn't move remaining userspace processes, ignoring: %m");
 
@@ -1634,7 +1730,7 @@ int manager_setup_cgroup(Manager *m) {
                 return log_error_errno(r, "Failed to determine supported controllers: %m");
 
         for (c = 0; c < _CGROUP_CONTROLLER_MAX; c++)
-                log_debug("Controller '%s' supported: %s", cgroup_controller_to_string(c), yes_no(m->cgroup_supported & c));
+                log_debug("Controller '%s' supported: %s", cgroup_controller_to_string(c), yes_no(m->cgroup_supported & CGROUP_CONTROLLER_TO_MASK(c)));
 
         return 0;
 }
diff --git a/src/grp-system/libcore/cgroup.h b/src/grp-system/libcore/cgroup.h
index 36699fb21b..bf40c3cc74 100644
--- a/src/grp-system/libcore/cgroup.h
+++ b/src/grp-system/libcore/cgroup.h
@@ -94,6 +94,10 @@ struct CGroupContext {
         LIST_HEAD(CGroupIODeviceWeight, io_device_weights);
         LIST_HEAD(CGroupIODeviceLimit, io_device_limits);
 
+        uint64_t memory_low;
+        uint64_t memory_high;
+        uint64_t memory_max;
+
         /* For legacy hierarchies */
         uint64_t cpu_shares;
         uint64_t startup_cpu_shares;
@@ -120,7 +124,6 @@ struct CGroupContext {
 void cgroup_context_init(CGroupContext *c);
 void cgroup_context_done(CGroupContext *c);
 void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix);
-void cgroup_context_apply(CGroupContext *c, CGroupMask mask, const char *path, ManagerState state);
 
 CGroupMask cgroup_context_get_mask(CGroupContext *c);
 
diff --git a/src/grp-system/libcore/dbus-cgroup.c b/src/grp-system/libcore/dbus-cgroup.c
index d707ac51c3..da1c333043 100644
--- a/src/grp-system/libcore/dbus-cgroup.c
+++ b/src/grp-system/libcore/dbus-cgroup.c
@@ -229,6 +229,9 @@ const sd_bus_vtable bus_cgroup_vtable[] = {
         SD_BUS_PROPERTY("BlockIOReadBandwidth", "a(st)", property_get_blockio_device_bandwidths, 0, 0),
         SD_BUS_PROPERTY("BlockIOWriteBandwidth", "a(st)", property_get_blockio_device_bandwidths, 0, 0),
         SD_BUS_PROPERTY("MemoryAccounting", "b", bus_property_get_bool, offsetof(CGroupContext, memory_accounting), 0),
+        SD_BUS_PROPERTY("MemoryLow", "t", NULL, offsetof(CGroupContext, memory_low), 0),
+        SD_BUS_PROPERTY("MemoryHigh", "t", NULL, offsetof(CGroupContext, memory_high), 0),
+        SD_BUS_PROPERTY("MemoryMax", "t", NULL, offsetof(CGroupContext, memory_max), 0),
         SD_BUS_PROPERTY("MemoryLimit", "t", NULL, offsetof(CGroupContext, memory_limit), 0),
         SD_BUS_PROPERTY("DevicePolicy", "s", property_get_cgroup_device_policy, offsetof(CGroupContext, device_policy), 0),
         SD_BUS_PROPERTY("DeviceAllow", "a(ss)", property_get_device_allow, 0, 0),
@@ -624,7 +627,7 @@ int bus_cgroup_set_property(
                 if (r < 0)
                         return r;
 
-                if (CGROUP_BLKIO_WEIGHT_IS_OK(weight))
+                if (!CGROUP_BLKIO_WEIGHT_IS_OK(weight))
                         return sd_bus_error_set_errnof(error, EINVAL, "StartupBlockIOWeight value out of range");
 
                 if (mode != UNIT_CHECK) {
@@ -639,7 +642,7 @@ int bus_cgroup_set_property(
 
                 return 1;
 
-        } else if (streq(name, "BlockIOReadBandwidth") || streq(name, "BlockIOWriteBandwidth")) {
+        } else if (STR_IN_SET(name, "BlockIOReadBandwidth", "BlockIOWriteBandwidth")) {
                 const char *path;
                 bool read = true;
                 unsigned n = 0;
@@ -827,12 +830,74 @@ int bus_cgroup_set_property(
 
                 return 1;
 
+        } else if (STR_IN_SET(name, "MemoryLow", "MemoryHigh", "MemoryMax")) {
+                uint64_t v;
+
+                r = sd_bus_message_read(message, "t", &v);
+                if (r < 0)
+                        return r;
+                if (v <= 0)
+                        return sd_bus_error_set_errnof(error, EINVAL, "%s= is too small", name);
+
+                if (mode != UNIT_CHECK) {
+                        if (streq(name, "MemoryLow"))
+                                c->memory_low = v;
+                        else if (streq(name, "MemoryHigh"))
+                                c->memory_high = v;
+                        else
+                                c->memory_max = v;
+
+                        unit_invalidate_cgroup(u, CGROUP_MASK_MEMORY);
+
+                        if (v == CGROUP_LIMIT_MAX)
+                                unit_write_drop_in_private_format(u, mode, name, "%s=infinity", name);
+                        else
+                                unit_write_drop_in_private_format(u, mode, name, "%s=%" PRIu64, name, v);
+                }
+
+                return 1;
+
+        } else if (STR_IN_SET(name, "MemoryLowScale", "MemoryHighScale", "MemoryMaxScale")) {
+                uint32_t raw;
+                uint64_t v;
+
+                r = sd_bus_message_read(message, "u", &raw);
+                if (r < 0)
+                        return r;
+
+                v = physical_memory_scale(raw, UINT32_MAX);
+                if (v <= 0 || v == UINT64_MAX)
+                        return sd_bus_error_set_errnof(error, EINVAL, "%s= is out of range", name);
+
+                if (mode != UNIT_CHECK) {
+                        const char *e;
+
+                        /* Chop off suffix */
+                        assert_se(e = endswith(name, "Scale"));
+                        name = strndupa(name, e - name);
+
+                        if (streq(name, "MemoryLow"))
+                                c->memory_low = v;
+                        else if (streq(name, "MemoryHigh"))
+                                c->memory_high = v;
+                        else
+                                c->memory_max = v;
+
+                        unit_invalidate_cgroup(u, CGROUP_MASK_MEMORY);
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%" PRIu32 "%%", name,
+                                                          (uint32_t) (DIV_ROUND_UP((uint64_t) raw * 100U, (uint64_t) UINT32_MAX)));
+                }
+
+                return 1;
+
         } else if (streq(name, "MemoryLimit")) {
                 uint64_t limit;
 
                 r = sd_bus_message_read(message, "t", &limit);
                 if (r < 0)
                         return r;
+                if (limit <= 0)
+                        return sd_bus_error_set_errnof(error, EINVAL, "%s= is too small", name);
 
                 if (mode != UNIT_CHECK) {
                         c->memory_limit = limit;
@@ -846,6 +911,27 @@ int bus_cgroup_set_property(
 
                 return 1;
 
+        } else if (streq(name, "MemoryLimitScale")) {
+                uint64_t limit;
+                uint32_t raw;
+
+                r = sd_bus_message_read(message, "u", &raw);
+                if (r < 0)
+                        return r;
+
+                limit = physical_memory_scale(raw, UINT32_MAX);
+                if (limit <= 0 || limit == UINT64_MAX)
+                        return sd_bus_error_set_errnof(error, EINVAL, "%s= is out of range", name);
+
+                if (mode != UNIT_CHECK) {
+                        c->memory_limit = limit;
+                        unit_invalidate_cgroup(u, CGROUP_MASK_MEMORY);
+                        unit_write_drop_in_private_format(u, mode, "MemoryLimit", "MemoryLimit=%" PRIu32 "%%",
+                                                          (uint32_t) (DIV_ROUND_UP((uint64_t) raw * 100U, (uint64_t) UINT32_MAX)));
+                }
+
+                return 1;
+
         } else if (streq(name, "DevicePolicy")) {
                 const char *policy;
                 CGroupDevicePolicy p;
@@ -859,13 +945,9 @@ int bus_cgroup_set_property(
                         return -EINVAL;
 
                 if (mode != UNIT_CHECK) {
-                        char *buf;
-
                         c->device_policy = p;
                         unit_invalidate_cgroup(u, CGROUP_MASK_DEVICES);
-
-                        buf = strjoina("DevicePolicy=", policy);
-                        unit_write_drop_in_private(u, mode, name, buf);
+                        unit_write_drop_in_private_format(u, mode, name, "DevicePolicy=%s", policy);
                 }
 
                 return 1;
@@ -881,6 +963,7 @@ int bus_cgroup_set_property(
                 while ((r = sd_bus_message_read(message, "(ss)", &path, &rwm)) > 0) {
 
                         if ((!startswith(path, "/dev/") &&
+                             !startswith(path, "/run/systemd/inaccessible/") &&
                              !startswith(path, "block-") &&
                              !startswith(path, "char-")) ||
                             strpbrk(path, WHITESPACE))
@@ -980,6 +1063,8 @@ int bus_cgroup_set_property(
                 r = sd_bus_message_read(message, "t", &limit);
                 if (r < 0)
                         return r;
+                if (limit <= 0)
+                        return sd_bus_error_set_errnof(error, EINVAL, "%s= is too small", name);
 
                 if (mode != UNIT_CHECK) {
                         c->tasks_max = limit;
@@ -992,6 +1077,26 @@ int bus_cgroup_set_property(
                 }
 
                 return 1;
+        } else if (streq(name, "TasksMaxScale")) {
+                uint64_t limit;
+                uint32_t raw;
+
+                r = sd_bus_message_read(message, "u", &raw);
+                if (r < 0)
+                        return r;
+
+                limit = system_tasks_max_scale(raw, UINT32_MAX);
+                if (limit <= 0 || limit >= UINT64_MAX)
+                        return sd_bus_error_set_errnof(error, EINVAL, "%s= is out of range", name);
+
+                if (mode != UNIT_CHECK) {
+                        c->tasks_max = limit;
+                        unit_invalidate_cgroup(u, CGROUP_MASK_PIDS);
+                        unit_write_drop_in_private_format(u, mode, name, "TasksMax=%" PRIu32 "%%",
+                                                          (uint32_t) (DIV_ROUND_UP((uint64_t) raw * 100U, (uint64_t) UINT32_MAX)));
+                }
+
+                return 1;
         }
 
         if (u->transient && u->load_state == UNIT_STUB) {
diff --git a/src/grp-system/libcore/dbus-execute.c b/src/grp-system/libcore/dbus-execute.c
index fe1d9da440..f7c217efc1 100644
--- a/src/grp-system/libcore/dbus-execute.c
+++ b/src/grp-system/libcore/dbus-execute.c
@@ -696,9 +696,12 @@ const sd_bus_vtable bus_exec_vtable[] = {
         SD_BUS_PROPERTY("Group", "s", NULL, offsetof(ExecContext, group), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("SupplementaryGroups", "as", NULL, offsetof(ExecContext, supplementary_groups), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("PAMName", "s", NULL, offsetof(ExecContext, pam_name), SD_BUS_VTABLE_PROPERTY_CONST),
-        SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_dirs), SD_BUS_VTABLE_PROPERTY_CONST),
-        SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_dirs), SD_BUS_VTABLE_PROPERTY_CONST),
-        SD_BUS_PROPERTY("InaccessibleDirectories", "as", NULL, offsetof(ExecContext, inaccessible_dirs), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
+        SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
+        SD_BUS_PROPERTY("InaccessibleDirectories", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
+        SD_BUS_PROPERTY("ReadWritePaths", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("ReadOnlyPaths", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("InaccessiblePaths", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("MountFlags", "t", bus_property_get_ulong, offsetof(ExecContext, mount_flags), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("PrivateTmp", "b", bus_property_get_bool, offsetof(ExecContext, private_tmp), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("PrivateNetwork", "b", bus_property_get_bool, offsetof(ExecContext, private_network), SD_BUS_VTABLE_PROPERTY_CONST),
@@ -720,6 +723,8 @@ const sd_bus_vtable bus_exec_vtable[] = {
         SD_BUS_PROPERTY("RestrictAddressFamilies", "(bas)", property_get_address_families, 0, SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("RuntimeDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, runtime_directory_mode), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("RuntimeDirectory", "as", NULL, offsetof(ExecContext, runtime_directory), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("MemoryDenyWriteExecute", "b", bus_property_get_bool, offsetof(ExecContext, memory_deny_write_execute), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("RestrictRealtime", "b", bus_property_get_bool, offsetof(ExecContext, restrict_realtime), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_VTABLE_END
 };
 
@@ -843,7 +848,7 @@ int bus_exec_context_set_transient_property(
                         else if (free_and_strdup(&c->user, uu) < 0)
                                 return -ENOMEM;
 
-                        unit_write_drop_in_private_format(u, mode, name, "User=%s\n", uu);
+                        unit_write_drop_in_private_format(u, mode, name, "User=%s", uu);
                 }
 
                 return 1;
@@ -862,7 +867,7 @@ int bus_exec_context_set_transient_property(
                         else if (free_and_strdup(&c->group, gg) < 0)
                                 return -ENOMEM;
 
-                        unit_write_drop_in_private_format(u, mode, name, "Group=%s\n", gg);
+                        unit_write_drop_in_private_format(u, mode, name, "Group=%s", gg);
                 }
 
                 return 1;
@@ -880,7 +885,7 @@ int bus_exec_context_set_transient_property(
                         else if (free_and_strdup(&c->syslog_identifier, id) < 0)
                                 return -ENOMEM;
 
-                        unit_write_drop_in_private_format(u, mode, name, "SyslogIdentifier=%s\n", id);
+                        unit_write_drop_in_private_format(u, mode, name, "SyslogIdentifier=%s", id);
                 }
 
                 return 1;
@@ -896,7 +901,7 @@ int bus_exec_context_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         c->syslog_priority = (c->syslog_priority & LOG_FACMASK) | level;
-                        unit_write_drop_in_private_format(u, mode, name, "SyslogLevel=%i\n", level);
+                        unit_write_drop_in_private_format(u, mode, name, "SyslogLevel=%i", level);
                 }
 
                 return 1;
@@ -912,7 +917,7 @@ int bus_exec_context_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         c->syslog_priority = (facility << 3) | LOG_PRI(c->syslog_priority);
-                        unit_write_drop_in_private_format(u, mode, name, "SyslogFacility=%i\n", facility);
+                        unit_write_drop_in_private_format(u, mode, name, "SyslogFacility=%i", facility);
                 }
 
                 return 1;
@@ -928,7 +933,7 @@ int bus_exec_context_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         c->nice = n;
-                        unit_write_drop_in_private_format(u, mode, name, "Nice=%i\n", n);
+                        unit_write_drop_in_private_format(u, mode, name, "Nice=%i", n);
                 }
 
                 return 1;
@@ -953,7 +958,7 @@ int bus_exec_context_set_transient_property(
                         if (r < 0)
                                 return r;
 
-                        unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, s);
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, s);
                 }
 
                 return 1;
@@ -1008,7 +1013,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->std_input = p;
 
-                        unit_write_drop_in_private_format(u, mode, name, "StandardInput=%s\n", exec_input_to_string(p));
+                        unit_write_drop_in_private_format(u, mode, name, "StandardInput=%s", exec_input_to_string(p));
                 }
 
                 return 1;
@@ -1029,7 +1034,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->std_output = p;
 
-                        unit_write_drop_in_private_format(u, mode, name, "StandardOutput=%s\n", exec_output_to_string(p));
+                        unit_write_drop_in_private_format(u, mode, name, "StandardOutput=%s", exec_output_to_string(p));
                 }
 
                 return 1;
@@ -1049,7 +1054,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->std_error = p;
 
-                        unit_write_drop_in_private_format(u, mode, name, "StandardError=%s\n", exec_output_to_string(p));
+                        unit_write_drop_in_private_format(u, mode, name, "StandardError=%s", exec_output_to_string(p));
                 }
 
                 return 1;
@@ -1057,7 +1062,7 @@ int bus_exec_context_set_transient_property(
         } else if (STR_IN_SET(name,
                               "IgnoreSIGPIPE", "TTYVHangup", "TTYReset",
                               "PrivateTmp", "PrivateDevices", "PrivateNetwork",
-                              "NoNewPrivileges", "SyslogLevelPrefix")) {
+                              "NoNewPrivileges", "SyslogLevelPrefix", "MemoryDenyWriteExecute", "RestrictRealtime")) {
                 int b;
 
                 r = sd_bus_message_read(message, "b", &b);
@@ -1081,8 +1086,12 @@ int bus_exec_context_set_transient_property(
                                 c->no_new_privileges = b;
                         else if (streq(name, "SyslogLevelPrefix"))
                                 c->syslog_level_prefix = b;
+                        else if (streq(name, "MemoryDenyWriteExecute"))
+                                c->memory_deny_write_execute = b;
+                        else if (streq(name, "RestrictRealtime"))
+                                c->restrict_realtime = b;
 
-                        unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, yes_no(b));
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, yes_no(b));
                 }
 
                 return 1;
@@ -1100,7 +1109,7 @@ int bus_exec_context_set_transient_property(
                         else if (free_and_strdup(&c->utmp_id, id) < 0)
                                 return -ENOMEM;
 
-                        unit_write_drop_in_private_format(u, mode, name, "UtmpIdentifier=%s\n", strempty(id));
+                        unit_write_drop_in_private_format(u, mode, name, "UtmpIdentifier=%s", strempty(id));
                 }
 
                 return 1;
@@ -1120,7 +1129,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->utmp_mode = m;
 
-                        unit_write_drop_in_private_format(u, mode, name, "UtmpMode=%s\n", exec_utmp_mode_to_string(m));
+                        unit_write_drop_in_private_format(u, mode, name, "UtmpMode=%s", exec_utmp_mode_to_string(m));
                 }
 
                 return 1;
@@ -1138,7 +1147,7 @@ int bus_exec_context_set_transient_property(
                         else if (free_and_strdup(&c->pam_name, n) < 0)
                                 return -ENOMEM;
 
-                        unit_write_drop_in_private_format(u, mode, name, "PAMName=%s\n", strempty(n));
+                        unit_write_drop_in_private_format(u, mode, name, "PAMName=%s", strempty(n));
                 }
 
                 return 1;
@@ -1160,7 +1169,7 @@ int bus_exec_context_set_transient_property(
 
                         if (strv_length(l) == 0) {
                                 c->environment = strv_free(c->environment);
-                                unit_write_drop_in_private_format(u, mode, name, "Environment=\n");
+                                unit_write_drop_in_private_format(u, mode, name, "Environment=");
                         } else {
                                 e = strv_env_merge(2, c->environment, l);
                                 if (!e)
@@ -1173,7 +1182,7 @@ int bus_exec_context_set_transient_property(
                                 if (!joined)
                                         return -ENOMEM;
 
-                                unit_write_drop_in_private_format(u, mode, name, "Environment=%s\n", joined);
+                                unit_write_drop_in_private_format(u, mode, name, "Environment=%s", joined);
                         }
                 }
 
@@ -1189,7 +1198,7 @@ int bus_exec_context_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         c->timer_slack_nsec = n;
-                        unit_write_drop_in_private_format(u, mode, name, "TimerSlackNSec=" NSEC_FMT "\n", n);
+                        unit_write_drop_in_private_format(u, mode, name, "TimerSlackNSec=" NSEC_FMT, n);
                 }
 
                 return 1;
@@ -1207,7 +1216,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->oom_score_adjust = oa;
                         c->oom_score_adjust_set = true;
-                        unit_write_drop_in_private_format(u, mode, name, "OOMScoreAdjust=%i\n", oa);
+                        unit_write_drop_in_private_format(u, mode, name, "OOMScoreAdjust=%i", oa);
                 }
 
                 return 1;
@@ -1229,7 +1238,7 @@ int bus_exec_context_set_transient_property(
                         return -ENOMEM;
 
                 STRV_FOREACH(i, c->environment_files)
-                        fprintf(f, "EnvironmentFile=%s\n", *i);
+                        fprintf(f, "EnvironmentFile=%s", *i);
 
                 while ((r = sd_bus_message_enter_container(message, 'r', "sb")) > 0) {
                         const char *path;
@@ -1253,7 +1262,7 @@ int bus_exec_context_set_transient_property(
                                 if (!buf)
                                         return -ENOMEM;
 
-                                fprintf(f, "EnvironmentFile=%s\n", buf);
+                                fprintf(f, "EnvironmentFile=%s", buf);
 
                                 r = strv_consume(&l, buf);
                                 if (r < 0)
@@ -1274,7 +1283,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         if (strv_isempty(l)) {
                                 c->environment_files = strv_free(c->environment_files);
-                                unit_write_drop_in_private(u, mode, name, "EnvironmentFile=\n");
+                                unit_write_drop_in_private(u, mode, name, "EnvironmentFile=");
                         } else {
                                 r = strv_extend_strv(&c->environment_files, l, true);
                                 if (r < 0)
@@ -1300,7 +1309,7 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         if (strv_isempty(l)) {
                                 c->pass_environment = strv_free(c->pass_environment);
-                                unit_write_drop_in_private_format(u, mode, name, "PassEnvironment=\n");
+                                unit_write_drop_in_private_format(u, mode, name, "PassEnvironment=");
                         } else {
                                 _cleanup_free_ char *joined = NULL;
 
@@ -1312,14 +1321,14 @@ int bus_exec_context_set_transient_property(
                                 if (!joined)
                                         return -ENOMEM;
 
-                                unit_write_drop_in_private_format(u, mode, name, "PassEnvironment=%s\n", joined);
+                                unit_write_drop_in_private_format(u, mode, name, "PassEnvironment=%s", joined);
                         }
                 }
 
                 return 1;
 
-        } else if (STR_IN_SET(name, "ReadWriteDirectories", "ReadOnlyDirectories", "InaccessibleDirectories")) {
-
+        } else if (STR_IN_SET(name, "ReadWriteDirectories", "ReadOnlyDirectories", "InaccessibleDirectories",
+                              "ReadWritePaths", "ReadOnlyPaths", "InaccessiblePaths")) {
                 _cleanup_strv_free_ char **l = NULL;
                 char ***dirs;
                 char **p;
@@ -1341,16 +1350,16 @@ int bus_exec_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         _cleanup_free_ char *joined = NULL;
 
-                        if (streq(name, "ReadWriteDirectories"))
-                                dirs = &c->read_write_dirs;
-                        else if (streq(name, "ReadOnlyDirectories"))
-                                dirs = &c->read_only_dirs;
-                        else /* "InaccessibleDirectories" */
-                                dirs = &c->inaccessible_dirs;
+                        if (STR_IN_SET(name, "ReadWriteDirectories", "ReadWritePaths"))
+                                dirs = &c->read_write_paths;
+                        else if (STR_IN_SET(name, "ReadOnlyDirectories", "ReadOnlyPaths"))
+                                dirs = &c->read_only_paths;
+                        else /* "InaccessiblePaths" */
+                                dirs = &c->inaccessible_paths;
 
                         if (strv_length(l) == 0) {
                                 *dirs = strv_free(*dirs);
-                                unit_write_drop_in_private_format(u, mode, name, "%s=\n", name);
+                                unit_write_drop_in_private_format(u, mode, name, "%s=", name);
                         } else {
                                 r = strv_extend_strv(dirs, l, true);
 
@@ -1361,7 +1370,7 @@ int bus_exec_context_set_transient_property(
                                 if (!joined)
                                         return -ENOMEM;
 
-                                unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, joined);
+                                unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, joined);
                         }
 
                 }
@@ -1389,7 +1398,7 @@ int bus_exec_context_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         c->protect_system = ps;
-                        unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, s);
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, s);
                 }
 
                 return 1;
@@ -1415,7 +1424,7 @@ int bus_exec_context_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         c->protect_home = ph;
-                        unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, s);
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, s);
                 }
 
                 return 1;
@@ -1438,7 +1447,7 @@ int bus_exec_context_set_transient_property(
 
                         if (strv_isempty(l)) {
                                 c->runtime_directory = strv_free(c->runtime_directory);
-                                unit_write_drop_in_private_format(u, mode, name, "%s=\n", name);
+                                unit_write_drop_in_private_format(u, mode, name, "%s=", name);
                         } else {
                                 r = strv_extend_strv(&c->runtime_directory, l, true);
 
@@ -1449,7 +1458,7 @@ int bus_exec_context_set_transient_property(
                                 if (!joined)
                                         return -ENOMEM;
 
-                                unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, joined);
+                                unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, joined);
                         }
                 }
 
@@ -1468,7 +1477,7 @@ int bus_exec_context_set_transient_property(
                         else if (free_and_strdup(&c->selinux_context, s) < 0)
                                 return -ENOMEM;
 
-                        unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, strempty(s));
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, strempty(s));
                 }
 
                 return 1;
@@ -1536,7 +1545,7 @@ int bus_exec_context_set_transient_property(
                                         return -ENOMEM;
                         }
 
-                        unit_write_drop_in_private_format(u, mode, name, "%s=%s\n", name, f);
+                        unit_write_drop_in_private_format(u, mode, name, "%s=%s", name, f);
                 }
 
                 return 1;
diff --git a/src/grp-system/libcore/dbus-kill.c b/src/grp-system/libcore/dbus-kill.c
index ba7a3f3b72..44bc2db7e2 100644
--- a/src/grp-system/libcore/dbus-kill.c
+++ b/src/grp-system/libcore/dbus-kill.c
@@ -64,7 +64,7 @@ int bus_kill_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->kill_mode = k;
 
-                        unit_write_drop_in_private_format(u, mode, name, "KillMode=%s\n", kill_mode_to_string(k));
+                        unit_write_drop_in_private_format(u, mode, name, "KillMode=%s", kill_mode_to_string(k));
                 }
 
                 return 1;
@@ -82,7 +82,7 @@ int bus_kill_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->kill_signal = sig;
 
-                        unit_write_drop_in_private_format(u, mode, name, "KillSignal=%s\n", signal_to_string(sig));
+                        unit_write_drop_in_private_format(u, mode, name, "KillSignal=%s", signal_to_string(sig));
                 }
 
                 return 1;
@@ -97,7 +97,7 @@ int bus_kill_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->send_sighup = b;
 
-                        unit_write_drop_in_private_format(u, mode, name, "SendSIGHUP=%s\n", yes_no(b));
+                        unit_write_drop_in_private_format(u, mode, name, "SendSIGHUP=%s", yes_no(b));
                 }
 
                 return 1;
@@ -112,7 +112,7 @@ int bus_kill_context_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         c->send_sigkill = b;
 
-                        unit_write_drop_in_private_format(u, mode, name, "SendSIGKILL=%s\n", yes_no(b));
+                        unit_write_drop_in_private_format(u, mode, name, "SendSIGKILL=%s", yes_no(b));
                 }
 
                 return 1;
diff --git a/src/grp-system/libcore/dbus-manager.c b/src/grp-system/libcore/dbus-manager.c
index b2ca867987..c5684014d3 100644
--- a/src/grp-system/libcore/dbus-manager.c
+++ b/src/grp-system/libcore/dbus-manager.c
@@ -782,6 +782,7 @@ static int transient_unit_from_message(
                 return r;
 
         /* Now load the missing bits of the unit we just created */
+        unit_add_to_load_queue(u);
         manager_dispatch_load_queue(m);
 
         *unit = u;
diff --git a/src/grp-system/libcore/dbus-scope.c b/src/grp-system/libcore/dbus-scope.c
index 9ecc01d275..d319597c10 100644
--- a/src/grp-system/libcore/dbus-scope.c
+++ b/src/grp-system/libcore/dbus-scope.c
@@ -148,7 +148,7 @@ static int bus_scope_set_transient_property(
                         if (r < 0)
                                 return r;
 
-                        unit_write_drop_in_format(UNIT(s), mode, name, "[Scope]\nTimeoutStopSec="USEC_FMT"us\n", s->timeout_stop_usec);
+                        unit_write_drop_in_private_format(UNIT(s), mode, name, "TimeoutStopSec="USEC_FMT"us", s->timeout_stop_usec);
                 } else {
                         r = sd_bus_message_skip(message, "t");
                         if (r < 0)
@@ -226,5 +226,5 @@ int bus_scope_send_request_stop(Scope *s) {
         if (r < 0)
                 return r;
 
-        return sd_bus_send_to(UNIT(s)->manager->api_bus, m, /* s->controller */ NULL, NULL);
+        return sd_bus_send_to(UNIT(s)->manager->api_bus, m, s->controller, NULL);
 }
diff --git a/src/grp-system/libcore/dbus-service.c b/src/grp-system/libcore/dbus-service.c
index a666c9db95..a3524815bd 100644
--- a/src/grp-system/libcore/dbus-service.c
+++ b/src/grp-system/libcore/dbus-service.c
@@ -103,7 +103,7 @@ static int bus_service_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         s->remain_after_exit = b;
-                        unit_write_drop_in_private_format(UNIT(s), mode, name, "RemainAfterExit=%s\n", yes_no(b));
+                        unit_write_drop_in_private_format(UNIT(s), mode, name, "RemainAfterExit=%s", yes_no(b));
                 }
 
                 return 1;
@@ -122,7 +122,7 @@ static int bus_service_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         s->type = k;
-                        unit_write_drop_in_private_format(UNIT(s), mode, name, "Type=%s\n", service_type_to_string(s->type));
+                        unit_write_drop_in_private_format(UNIT(s), mode, name, "Type=%s", service_type_to_string(s->type));
                 }
 
                 return 1;
@@ -135,7 +135,7 @@ static int bus_service_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         s->runtime_max_usec = u;
-                        unit_write_drop_in_private_format(UNIT(s), mode, name, "RuntimeMaxSec=" USEC_FMT "us\n", u);
+                        unit_write_drop_in_private_format(UNIT(s), mode, name, "RuntimeMaxSec=" USEC_FMT "us", u);
                 }
 
                 return 1;
diff --git a/src/grp-system/libcore/dbus-timer.c b/src/grp-system/libcore/dbus-timer.c
index 02036de42f..ce454385f8 100644
--- a/src/grp-system/libcore/dbus-timer.c
+++ b/src/grp-system/libcore/dbus-timer.c
@@ -221,7 +221,7 @@ static int bus_timer_set_transient_property(
                 if (mode != UNIT_CHECK) {
                         char time[FORMAT_TIMESPAN_MAX];
 
-                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s\n", name, format_timespan(time, sizeof(time), u, USEC_PER_MSEC));
+                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s", name, format_timespan(time, sizeof(time), u, USEC_PER_MSEC));
 
                         v = new0(TimerValue, 1);
                         if (!v)
@@ -250,7 +250,7 @@ static int bus_timer_set_transient_property(
                         if (r < 0)
                                 return r;
 
-                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s\n", name, str);
+                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s", name, str);
 
                         v = new0(TimerValue, 1);
                         if (!v) {
@@ -278,7 +278,7 @@ static int bus_timer_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         t->accuracy_usec = u;
-                        unit_write_drop_in_private_format(UNIT(t), mode, name, "AccuracySec=" USEC_FMT "us\n", u);
+                        unit_write_drop_in_private_format(UNIT(t), mode, name, "AccuracySec=" USEC_FMT "us", u);
                 }
 
                 return 1;
@@ -292,7 +292,7 @@ static int bus_timer_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         t->random_usec = u;
-                        unit_write_drop_in_private_format(UNIT(t), mode, name, "RandomizedDelaySec=" USEC_FMT "us\n", u);
+                        unit_write_drop_in_private_format(UNIT(t), mode, name, "RandomizedDelaySec=" USEC_FMT "us", u);
                 }
 
                 return 1;
@@ -306,7 +306,7 @@ static int bus_timer_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         t->wake_system = b;
-                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s\n", name, yes_no(b));
+                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s", name, yes_no(b));
                 }
 
                 return 1;
@@ -320,7 +320,7 @@ static int bus_timer_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         t->remain_after_elapse = b;
-                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s\n", name, yes_no(b));
+                        unit_write_drop_in_private_format(UNIT(t), mode, name, "%s=%s", name, yes_no(b));
                 }
 
                 return 1;
diff --git a/src/grp-system/libcore/dbus-unit.c b/src/grp-system/libcore/dbus-unit.c
index 31fbb0d54d..7e2a63b434 100644
--- a/src/grp-system/libcore/dbus-unit.c
+++ b/src/grp-system/libcore/dbus-unit.c
@@ -1206,7 +1206,7 @@ static int bus_unit_set_transient_property(
                         if (r < 0)
                                 return r;
 
-                        unit_write_drop_in_format(u, mode, name, "[Unit]\nDescription=%s\n", d);
+                        unit_write_drop_in_format(u, mode, name, "[Unit]\nDescription=%s", d);
                 }
 
                 return 1;
@@ -1220,7 +1220,7 @@ static int bus_unit_set_transient_property(
 
                 if (mode != UNIT_CHECK) {
                         u->default_dependencies = b;
-                        unit_write_drop_in_format(u, mode, name, "[Unit]\nDefaultDependencies=%s\n", yes_no(b));
+                        unit_write_drop_in_format(u, mode, name, "[Unit]\nDefaultDependencies=%s", yes_no(b));
                 }
 
                 return 1;
@@ -1258,7 +1258,7 @@ static int bus_unit_set_transient_property(
                         if (r < 0)
                                 return r;
 
-                        unit_write_drop_in_private_format(u, mode, name, "Slice=%s\n", s);
+                        unit_write_drop_in_private_format(u, mode, name, "Slice=%s", s);
                 }
 
                 return 1;
@@ -1306,7 +1306,7 @@ static int bus_unit_set_transient_property(
                                 if (!label)
                                         return -ENOMEM;
 
-                                unit_write_drop_in_format(u, mode, label, "[Unit]\n%s=%s\n", name, other);
+                                unit_write_drop_in_format(u, mode, label, "[Unit]\n%s=%s", name, other);
                         }
 
                 }
diff --git a/src/grp-system/libcore/execute.c b/src/grp-system/libcore/execute.c
index b19473c6a5..b73577817f 100644
--- a/src/grp-system/libcore/execute.c
+++ b/src/grp-system/libcore/execute.c
@@ -25,6 +25,7 @@
 #include <signal.h>
 #include <string.h>
 #include <sys/capability.h>
+#include <sys/mman.h>
 #include <sys/personality.h>
 #include <sys/prctl.h>
 #include <sys/socket.h>
@@ -290,7 +291,15 @@ static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
         return r;
 }
 
-static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd, uid_t uid, gid_t gid) {
+static int connect_logger_as(
+                Unit *unit,
+                const ExecContext *context,
+                ExecOutput output,
+                const char *ident,
+                int nfd,
+                uid_t uid,
+                gid_t gid) {
+
         int fd, r;
 
         assert(context);
@@ -311,7 +320,7 @@ static int connect_logger_as(const ExecContext *context, ExecOutput output, cons
                 return -errno;
         }
 
-        fd_inc_sndbuf(fd, SNDBUF_SIZE);
+        (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 
         dprintf(fd,
                 "%s\n"
@@ -322,18 +331,18 @@ static int connect_logger_as(const ExecContext *context, ExecOutput output, cons
                 "%i\n"
                 "%i\n",
                 context->syslog_identifier ? context->syslog_identifier : ident,
-                unit_id,
+                unit->id,
                 context->syslog_priority,
                 !!context->syslog_level_prefix,
                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
                 is_terminal_output(output));
 
-        if (fd != nfd) {
-                r = dup2(fd, nfd) < 0 ? -errno : nfd;
-                safe_close(fd);
-        } else
-                r = nfd;
+        if (fd == nfd)
+                return nfd;
+
+        r = dup2(fd, nfd) < 0 ? -errno : nfd;
+        safe_close(fd);
 
         return r;
 }
@@ -447,7 +456,10 @@ static int setup_output(
                 int fileno,
                 int socket_fd,
                 const char *ident,
-                uid_t uid, gid_t gid) {
+                uid_t uid,
+                gid_t gid,
+                dev_t *journal_stream_dev,
+                ino_t *journal_stream_ino) {
 
         ExecOutput o;
         ExecInput i;
@@ -457,6 +469,8 @@ static int setup_output(
         assert(context);
         assert(params);
         assert(ident);
+        assert(journal_stream_dev);
+        assert(journal_stream_ino);
 
         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 
@@ -532,10 +546,21 @@ static int setup_output(
         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
         case EXEC_OUTPUT_JOURNAL:
         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
-                r = connect_logger_as(context, o, ident, unit->id, fileno, uid, gid);
+                r = connect_logger_as(unit, context, o, ident, fileno, uid, gid);
                 if (r < 0) {
                         log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
                         r = open_null_as(O_WRONLY, fileno);
+                } else {
+                        struct stat st;
+
+                        /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
+                         * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
+                         * services to detect whether they are connected to the journal or not. */
+
+                        if (fstat(fileno, &st) >= 0) {
+                                *journal_stream_dev = st.st_dev;
+                                *journal_stream_ino = st.st_ino;
+                        }
                 }
                 return r;
 
@@ -553,6 +578,10 @@ static int chown_terminal(int fd, uid_t uid) {
 
         assert(fd >= 0);
 
+        /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
+        if (isatty(fd) < 1)
+                return 0;
+
         /* This might fail. What matters are the results. */
         (void) fchown(fd, uid, -1);
         (void) fchmod(fd, TTY_MODE);
@@ -796,7 +825,7 @@ static int setup_pam(
                 const char *user,
                 uid_t uid,
                 const char *tty,
-                char ***pam_env,
+                char ***env,
                 int fds[], unsigned n_fds) {
 
         static const struct pam_conv conv = {
@@ -808,14 +837,14 @@ static int setup_pam(
         pam_handle_t *handle = NULL;
         sigset_t old_ss;
         int pam_code = PAM_SUCCESS, r;
-        char **e = NULL;
+        char **nv, **e = NULL;
         bool close_session = false;
         pid_t pam_pid = 0, parent_pid;
         int flags = 0;
 
         assert(name);
         assert(user);
-        assert(pam_env);
+        assert(env);
 
         /* We set up PAM in the parent process, then fork. The child
          * will then stay around until killed via PR_GET_PDEATHSIG or
@@ -843,6 +872,12 @@ static int setup_pam(
                         goto fail;
         }
 
+        STRV_FOREACH(nv, *env) {
+                pam_code = pam_putenv(handle, *nv);
+                if (pam_code != PAM_SUCCESS)
+                        goto fail;
+        }
+
         pam_code = pam_acct_mgmt(handle, flags);
         if (pam_code != PAM_SUCCESS)
                 goto fail;
@@ -963,8 +998,8 @@ static int setup_pam(
         if (!barrier_place_and_sync(&barrier))
                 log_error("PAM initialization failed");
 
-        *pam_env = e;
-        e = NULL;
+        strv_free(*env);
+        *env = e;
 
         return 0;
 
@@ -1192,6 +1227,115 @@ finish:
         return r;
 }
 
+static int apply_memory_deny_write_execute(const ExecContext *c) {
+        scmp_filter_ctx *seccomp;
+        int r;
+
+        assert(c);
+
+        seccomp = seccomp_init(SCMP_ACT_ALLOW);
+        if (!seccomp)
+                return -ENOMEM;
+
+        r = seccomp_rule_add(
+                        seccomp,
+                        SCMP_ACT_ERRNO(EPERM),
+                        SCMP_SYS(mmap),
+                        1,
+                        SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
+        if (r < 0)
+                goto finish;
+
+        r = seccomp_rule_add(
+                        seccomp,
+                        SCMP_ACT_ERRNO(EPERM),
+                        SCMP_SYS(mprotect),
+                        1,
+                        SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
+        if (r < 0)
+                goto finish;
+
+        r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+        if (r < 0)
+                goto finish;
+
+        r = seccomp_load(seccomp);
+
+finish:
+        seccomp_release(seccomp);
+        return r;
+}
+
+static int apply_restrict_realtime(const ExecContext *c) {
+        static const int permitted_policies[] = {
+                SCHED_OTHER,
+                SCHED_BATCH,
+                SCHED_IDLE,
+        };
+
+        scmp_filter_ctx *seccomp;
+        unsigned i;
+        int r, p, max_policy = 0;
+
+        assert(c);
+
+        seccomp = seccomp_init(SCMP_ACT_ALLOW);
+        if (!seccomp)
+                return -ENOMEM;
+
+        /* Determine the highest policy constant we want to allow */
+        for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
+                if (permitted_policies[i] > max_policy)
+                        max_policy = permitted_policies[i];
+
+        /* Go through all policies with lower values than that, and block them -- unless they appear in the
+         * whitelist. */
+        for (p = 0; p < max_policy; p++) {
+                bool good = false;
+
+                /* Check if this is in the whitelist. */
+                for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
+                        if (permitted_policies[i] == p) {
+                                good = true;
+                                break;
+                        }
+
+                if (good)
+                        continue;
+
+                /* Deny this policy */
+                r = seccomp_rule_add(
+                                seccomp,
+                                SCMP_ACT_ERRNO(EPERM),
+                                SCMP_SYS(sched_setscheduler),
+                                1,
+                                SCMP_A1(SCMP_CMP_EQ, p));
+                if (r < 0)
+                        goto finish;
+        }
+
+        /* Blacklist all other policies, i.e. the ones with higher values. Note that all comparisons are unsigned here,
+         * hence no need no check for < 0 values. */
+        r = seccomp_rule_add(
+                        seccomp,
+                        SCMP_ACT_ERRNO(EPERM),
+                        SCMP_SYS(sched_setscheduler),
+                        1,
+                        SCMP_A1(SCMP_CMP_GT, max_policy));
+        if (r < 0)
+                goto finish;
+
+        r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+        if (r < 0)
+                goto finish;
+
+        r = seccomp_load(seccomp);
+
+finish:
+        seccomp_release(seccomp);
+        return r;
+}
+
 #endif
 
 static void do_idle_pipe_dance(int idle_pipe[4]) {
@@ -1230,6 +1374,8 @@ static int build_environment(
                 const char *home,
                 const char *username,
                 const char *shell,
+                dev_t journal_stream_dev,
+                ino_t journal_stream_ino,
                 char ***ret) {
 
         _cleanup_strv_free_ char **our_env = NULL;
@@ -1239,7 +1385,7 @@ static int build_environment(
         assert(c);
         assert(ret);
 
-        our_env = new0(char*, 11);
+        our_env = new0(char*, 12);
         if (!our_env)
                 return -ENOMEM;
 
@@ -1311,8 +1457,15 @@ static int build_environment(
                 our_env[n_env++] = x;
         }
 
+        if (journal_stream_dev != 0 && journal_stream_ino != 0) {
+                if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
+                        return -ENOMEM;
+
+                our_env[n_env++] = x;
+        }
+
         our_env[n_env++] = NULL;
-        assert(n_env <= 11);
+        assert(n_env <= 12);
 
         *ret = our_env;
         our_env = NULL;
@@ -1356,9 +1509,9 @@ static bool exec_needs_mount_namespace(
         assert(context);
         assert(params);
 
-        if (!strv_isempty(context->read_write_dirs) ||
-            !strv_isempty(context->read_only_dirs) ||
-            !strv_isempty(context->inaccessible_dirs))
+        if (!strv_isempty(context->read_write_paths) ||
+            !strv_isempty(context->read_only_paths) ||
+            !strv_isempty(context->inaccessible_paths))
                 return true;
 
         if (context->mount_flags != 0)
@@ -1422,13 +1575,15 @@ static int exec_child(
                 char **files_env,
                 int *exit_status) {
 
-        _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
+        _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
         _cleanup_free_ char *mac_selinux_context_net = NULL;
         const char *username = NULL, *home = NULL, *shell = NULL, *wd;
+        dev_t journal_stream_dev = 0;
+        ino_t journal_stream_ino = 0;
+        bool needs_mount_namespace;
         uid_t uid = UID_INVALID;
         gid_t gid = GID_INVALID;
         int i, r;
-        bool needs_mount_namespace;
 
         assert(unit);
         assert(command);
@@ -1528,13 +1683,13 @@ static int exec_child(
                 return r;
         }
 
-        r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, basename(command->path), uid, gid);
+        r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
         if (r < 0) {
                 *exit_status = EXIT_STDOUT;
                 return r;
         }
 
-        r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, basename(command->path), uid, gid);
+        r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
         if (r < 0) {
                 *exit_status = EXIT_STDERR;
                 return r;
@@ -1673,9 +1828,43 @@ static int exec_child(
                 }
         }
 
+        r = build_environment(
+                        context,
+                        params,
+                        n_fds,
+                        home,
+                        username,
+                        shell,
+                        journal_stream_dev,
+                        journal_stream_ino,
+                        &our_env);
+        if (r < 0) {
+                *exit_status = EXIT_MEMORY;
+                return r;
+        }
+
+        r = build_pass_environment(context, &pass_env);
+        if (r < 0) {
+                *exit_status = EXIT_MEMORY;
+                return r;
+        }
+
+        accum_env = strv_env_merge(5,
+                                   params->environment,
+                                   our_env,
+                                   pass_env,
+                                   context->environment,
+                                   files_env,
+                                   NULL);
+        if (!accum_env) {
+                *exit_status = EXIT_MEMORY;
+                return -ENOMEM;
+        }
+        accum_env = strv_env_clean(accum_env);
+
         umask(context->umask);
 
-        if (params->apply_permissions) {
+        if (params->apply_permissions && !command->privileged) {
                 r = enforce_groups(context, username, gid);
                 if (r < 0) {
                         *exit_status = EXIT_GROUP;
@@ -1709,7 +1898,7 @@ static int exec_child(
 #endif
 #ifdef HAVE_PAM
                 if (context->pam_name && username) {
-                        r = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+                        r = setup_pam(context->pam_name, username, uid, context->tty_path, &accum_env, fds, n_fds);
                         if (r < 0) {
                                 *exit_status = EXIT_PAM;
                                 return r;
@@ -1746,9 +1935,9 @@ static int exec_child(
 
                 r = setup_namespace(
                                 params->apply_chroot ? context->root_directory : NULL,
-                                context->read_write_dirs,
-                                context->read_only_dirs,
-                                context->inaccessible_dirs,
+                                context->read_write_paths,
+                                context->read_only_paths,
+                                context->inaccessible_paths,
                                 tmp,
                                 var,
                                 context->private_devices,
@@ -1800,7 +1989,7 @@ static int exec_child(
         }
 
 #ifdef HAVE_SELINUX
-        if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
+        if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0 && !command->privileged) {
                 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
                 if (r < 0) {
                         *exit_status = EXIT_SELINUX_CONTEXT;
@@ -1825,7 +2014,7 @@ static int exec_child(
                 return r;
         }
 
-        if (params->apply_permissions) {
+        if (params->apply_permissions && !command->privileged) {
 
                 bool use_address_families = context->address_families_whitelist ||
                         !set_isempty(context->address_families);
@@ -1835,10 +2024,20 @@ static int exec_child(
                 int secure_bits = context->secure_bits;
 
                 for (i = 0; i < _RLIMIT_MAX; i++) {
+
                         if (!context->rlimit[i])
                                 continue;
 
-                        if (setrlimit_closest(i, context->rlimit[i]) < 0) {
+                        r = setrlimit_closest(i, context->rlimit[i]);
+                        if (r < 0) {
+                                *exit_status = EXIT_LIMITS;
+                                return r;
+                        }
+                }
+
+                /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
+                if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
+                        if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
                                 *exit_status = EXIT_LIMITS;
                                 return -errno;
                         }
@@ -1899,7 +2098,7 @@ static int exec_child(
                         }
 
                 if (context->no_new_privileges ||
-                    (!have_effective_cap(CAP_SYS_ADMIN) && (use_address_families || use_syscall_filter)))
+                    (!have_effective_cap(CAP_SYS_ADMIN) && (use_address_families || context->memory_deny_write_execute || context->restrict_realtime || use_syscall_filter)))
                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
                                 return -errno;
@@ -1914,6 +2113,22 @@ static int exec_child(
                         }
                 }
 
+                if (context->memory_deny_write_execute) {
+                        r = apply_memory_deny_write_execute(context);
+                        if (r < 0) {
+                                *exit_status = EXIT_SECCOMP;
+                                return r;
+                        }
+                }
+
+                if (context->restrict_realtime) {
+                        r = apply_restrict_realtime(context);
+                        if (r < 0) {
+                                *exit_status = EXIT_SECCOMP;
+                                return r;
+                        }
+                }
+
                 if (use_syscall_filter) {
                         r = apply_seccomp(context);
                         if (r < 0) {
@@ -1948,39 +2163,12 @@ static int exec_child(
 #endif
         }
 
-        r = build_environment(context, params, n_fds, home, username, shell, &our_env);
-        if (r < 0) {
-                *exit_status = EXIT_MEMORY;
-                return r;
-        }
-
-        r = build_pass_environment(context, &pass_env);
-        if (r < 0) {
-                *exit_status = EXIT_MEMORY;
-                return r;
-        }
-
-        final_env = strv_env_merge(6,
-                                   params->environment,
-                                   our_env,
-                                   pass_env,
-                                   context->environment,
-                                   files_env,
-                                   pam_env,
-                                   NULL);
-        if (!final_env) {
-                *exit_status = EXIT_MEMORY;
-                return -ENOMEM;
-        }
-
-        final_argv = replace_env_argv(argv, final_env);
+        final_argv = replace_env_argv(argv, accum_env);
         if (!final_argv) {
                 *exit_status = EXIT_MEMORY;
                 return -ENOMEM;
         }
 
-        final_env = strv_env_clean(final_env);
-
         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
                 _cleanup_free_ char *line;
 
@@ -1996,7 +2184,7 @@ static int exec_child(
                 }
         }
 
-        execve(command->path, final_argv, final_env);
+        execve(command->path, final_argv, accum_env);
         *exit_status = EXIT_EXEC;
         return -errno;
 }
@@ -2138,9 +2326,9 @@ void exec_context_done(ExecContext *c) {
 
         c->pam_name = mfree(c->pam_name);
 
-        c->read_only_dirs = strv_free(c->read_only_dirs);
-        c->read_write_dirs = strv_free(c->read_write_dirs);
-        c->inaccessible_dirs = strv_free(c->inaccessible_dirs);
+        c->read_only_paths = strv_free(c->read_only_paths);
+        c->read_write_paths = strv_free(c->read_write_paths);
+        c->inaccessible_paths = strv_free(c->inaccessible_paths);
 
         if (c->cpuset)
                 CPU_FREE(c->cpuset);
@@ -2373,7 +2561,9 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
                 "%sPrivateDevices: %s\n"
                 "%sProtectHome: %s\n"
                 "%sProtectSystem: %s\n"
-                "%sIgnoreSIGPIPE: %s\n",
+                "%sIgnoreSIGPIPE: %s\n"
+                "%sMemoryDenyWriteExecute: %s\n"
+                "%sRestrictRealtime: %s\n",
                 prefix, c->umask,
                 prefix, c->working_directory ? c->working_directory : "/",
                 prefix, c->root_directory ? c->root_directory : "/",
@@ -2383,7 +2573,9 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
                 prefix, yes_no(c->private_devices),
                 prefix, protect_home_to_string(c->protect_home),
                 prefix, protect_system_to_string(c->protect_system),
-                prefix, yes_no(c->ignore_sigpipe));
+                prefix, yes_no(c->ignore_sigpipe),
+                prefix, yes_no(c->memory_deny_write_execute),
+                prefix, yes_no(c->restrict_realtime));
 
         STRV_FOREACH(e, c->environment)
                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
@@ -2542,21 +2734,21 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
         if (c->pam_name)
                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
 
-        if (strv_length(c->read_write_dirs) > 0) {
-                fprintf(f, "%sReadWriteDirs:", prefix);
-                strv_fprintf(f, c->read_write_dirs);
+        if (strv_length(c->read_write_paths) > 0) {
+                fprintf(f, "%sReadWritePaths:", prefix);
+                strv_fprintf(f, c->read_write_paths);
                 fputs("\n", f);
         }
 
-        if (strv_length(c->read_only_dirs) > 0) {
-                fprintf(f, "%sReadOnlyDirs:", prefix);
-                strv_fprintf(f, c->read_only_dirs);
+        if (strv_length(c->read_only_paths) > 0) {
+                fprintf(f, "%sReadOnlyPaths:", prefix);
+                strv_fprintf(f, c->read_only_paths);
                 fputs("\n", f);
         }
 
-        if (strv_length(c->inaccessible_dirs) > 0) {
-                fprintf(f, "%sInaccessibleDirs:", prefix);
-                strv_fprintf(f, c->inaccessible_dirs);
+        if (strv_length(c->inaccessible_paths) > 0) {
+                fprintf(f, "%sInaccessiblePaths:", prefix);
+                strv_fprintf(f, c->inaccessible_paths);
                 fputs("\n", f);
         }
 
@@ -2637,7 +2829,7 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
 bool exec_context_maintains_privileges(ExecContext *c) {
         assert(c);
 
-        /* Returns true if the process forked off would run run under
+        /* Returns true if the process forked off would run under
          * an unchanged UID or as root. */
 
         if (!c->user)
@@ -2872,7 +3064,7 @@ int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
                 return r;
 
         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
-                if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
+                if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, (*rt)->netns_storage_socket) < 0)
                         return -errno;
         }
 
diff --git a/src/grp-system/libcore/execute.h b/src/grp-system/libcore/execute.h
index 18d6f0e4a3..cf5e7e4617 100644
--- a/src/grp-system/libcore/execute.h
+++ b/src/grp-system/libcore/execute.h
@@ -24,9 +24,10 @@
 #include <stdio.h>
 #include <sys/capability.h>
 
-#include "basic/fdset.h"
+#include "basic/cgroup-util.h"
 #include "basic/list.h"
 #include "basic/missing.h"
+#include "shared/fdset.h"
 
 typedef struct ExecCommand ExecCommand;
 typedef struct ExecContext ExecContext;
@@ -82,7 +83,8 @@ struct ExecCommand {
         char **argv;
         ExecStatus exec_status;
         LIST_FIELDS(ExecCommand, command); /* useful for chaining commands */
-        bool ignore;
+        bool ignore:1;
+        bool privileged:1;
 };
 
 struct ExecRuntime {
@@ -130,7 +132,7 @@ struct ExecContext {
 
         bool ignore_sigpipe;
 
-        /* Since resolving these names might might involve socket
+        /* Since resolving these names might involve socket
          * connections and we don't want to deadlock ourselves these
          * names are resolved on execution only and in the child
          * process. */
@@ -152,7 +154,7 @@ struct ExecContext {
         bool smack_process_label_ignore;
         char *smack_process_label;
 
-        char **read_write_dirs, **read_only_dirs, **inaccessible_dirs;
+        char **read_write_paths, **read_only_paths, **inaccessible_paths;
         unsigned long mount_flags;
 
         uint64_t capability_bounding_set;
@@ -193,6 +195,9 @@ struct ExecContext {
         char **runtime_directory;
         mode_t runtime_directory_mode;
 
+        bool memory_deny_write_execute;
+        bool restrict_realtime;
+
         bool oom_score_adjust_set:1;
         bool nice_set:1;
         bool ioprio_set:1;
@@ -200,10 +205,6 @@ struct ExecContext {
         bool no_new_privileges_set:1;
 };
 
-#include "basic/cgroup-util.h"
-
-#include "cgroup.h"
-
 struct ExecParameters {
         char **argv;
         char **environment;
@@ -234,6 +235,8 @@ struct ExecParameters {
         int stderr_fd;
 };
 
+#include "unit.h"
+
 int exec_spawn(Unit *unit,
                ExecCommand *command,
                const ExecContext *context,
diff --git a/src/grp-system/libcore/killall.c b/src/grp-system/libcore/killall.c
index bc4d67ae21..27946f1f84 100644
--- a/src/grp-system/libcore/killall.c
+++ b/src/grp-system/libcore/killall.c
@@ -23,6 +23,7 @@
 #include <unistd.h>
 
 #include "basic/alloc-util.h"
+#include "basic/def.h"
 #include "basic/fd-util.h"
 #include "basic/formats-util.h"
 #include "basic/parse-util.h"
@@ -34,8 +35,6 @@
 
 #include "killall.h"
 
-#define TIMEOUT_USEC (10 * USEC_PER_SEC)
-
 static bool ignore_proc(pid_t pid, bool warn_rootfs) {
         _cleanup_fclose_ FILE *f = NULL;
         char c;
@@ -81,7 +80,7 @@ static bool ignore_proc(pid_t pid, bool warn_rootfs) {
                 get_process_comm(pid, &comm);
 
                 if (r)
-                        log_notice("Process " PID_FMT " (%s) has been been marked to be excluded from killing. It is "
+                        log_notice("Process " PID_FMT " (%s) has been marked to be excluded from killing. It is "
                                    "running from the root file system, and thus likely to block re-mounting of the "
                                    "root file system to read-only. Please consider moving it into an initrd file "
                                    "system instead.", pid, strna(comm));
@@ -100,7 +99,7 @@ static void wait_for_children(Set *pids, sigset_t *mask) {
         if (set_isempty(pids))
                 return;
 
-        until = now(CLOCK_MONOTONIC) + TIMEOUT_USEC;
+        until = now(CLOCK_MONOTONIC) + DEFAULT_TIMEOUT_USEC;
         for (;;) {
                 struct timespec ts;
                 int k;
diff --git a/src/grp-system/libcore/kmod-setup.c b/src/grp-system/libcore/kmod-setup.c
index a6fa6a32fb..c91c280e7d 100644
--- a/src/grp-system/libcore/kmod-setup.c
+++ b/src/grp-system/libcore/kmod-setup.c
@@ -65,9 +65,6 @@ int kmod_setup(void) {
                 /* this should never be a module */
                 { "unix",      "/proc/net/unix",            true,   true,    NULL      },
 
-                /* IPC is needed before we bring up any other services */
-                { "kdbus",     "/sys/fs/kdbus",             false,  false,   is_kdbus_wanted },
-
 #ifdef HAVE_LIBIPTC
                 /* netfilter is needed by networkd, nspawn among others, and cannot be autoloaded */
                 { "ip_tables", "/proc/net/ip_tables_names", false,  false,   NULL      },
diff --git a/src/grp-system/libcore/load-fragment-gperf.gperf.m4 b/src/grp-system/libcore/load-fragment-gperf.gperf.m4
index c9f6e6acf7..ac4598f4c2 100644
--- a/src/grp-system/libcore/load-fragment-gperf.gperf.m4
+++ b/src/grp-system/libcore/load-fragment-gperf.gperf.m4
@@ -55,10 +55,14 @@ m4_ifdef(`HAVE_SECCOMP',
 `$1.SystemCallFilter,            config_parse_syscall_filter,        0,                             offsetof($1, exec_context)
 $1.SystemCallArchitectures,      config_parse_syscall_archs,         0,                             offsetof($1, exec_context.syscall_archs)
 $1.SystemCallErrorNumber,        config_parse_syscall_errno,         0,                             offsetof($1, exec_context)
+$1.MemoryDenyWriteExecute,       config_parse_bool,                  0,                             offsetof($1, exec_context.memory_deny_write_execute)
+$1.RestrictRealtime,             config_parse_bool,                  0,                             offsetof($1, exec_context.restrict_realtime)
 $1.RestrictAddressFamilies,      config_parse_address_families,      0,                             offsetof($1, exec_context)',
 `$1.SystemCallFilter,            config_parse_warn_compat,           DISABLED_CONFIGURATION,        0
 $1.SystemCallArchitectures,      config_parse_warn_compat,           DISABLED_CONFIGURATION,        0
 $1.SystemCallErrorNumber,        config_parse_warn_compat,           DISABLED_CONFIGURATION,        0
+$1.MemoryDenyWriteExecute,       config_parse_warn_compat,           DISABLED_CONFIGURATION,        0
+$1.RestrictRealtime,             config_parse_warn_compat,           DISABLED_CONFIGURATION,        0
 $1.RestrictAddressFamilies,      config_parse_warn_compat,           DISABLED_CONFIGURATION,        0')
 $1.LimitCPU,                     config_parse_limit,                 RLIMIT_CPU,                    offsetof($1, exec_context.rlimit)
 $1.LimitFSIZE,                   config_parse_limit,                 RLIMIT_FSIZE,                  offsetof($1, exec_context.rlimit)
@@ -76,9 +80,12 @@ $1.LimitMSGQUEUE,                config_parse_limit,                 RLIMIT_MSGQ
 $1.LimitNICE,                    config_parse_limit,                 RLIMIT_NICE,                   offsetof($1, exec_context.rlimit)
 $1.LimitRTPRIO,                  config_parse_limit,                 RLIMIT_RTPRIO,                 offsetof($1, exec_context.rlimit)
 $1.LimitRTTIME,                  config_parse_limit,                 RLIMIT_RTTIME,                 offsetof($1, exec_context.rlimit)
-$1.ReadWriteDirectories,         config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.read_write_dirs)
-$1.ReadOnlyDirectories,          config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.read_only_dirs)
-$1.InaccessibleDirectories,      config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.inaccessible_dirs)
+$1.ReadWriteDirectories,         config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.read_write_paths)
+$1.ReadOnlyDirectories,          config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.read_only_paths)
+$1.InaccessibleDirectories,      config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.inaccessible_paths)
+$1.ReadWritePaths,               config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.read_write_paths)
+$1.ReadOnlyPaths,                config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.read_only_paths)
+$1.InaccessiblePaths,            config_parse_namespace_path_strv,   0,                             offsetof($1, exec_context.inaccessible_paths)
 $1.PrivateTmp,                   config_parse_bool,                  0,                             offsetof($1, exec_context.private_tmp)
 $1.PrivateNetwork,               config_parse_bool,                  0,                             offsetof($1, exec_context.private_network)
 $1.PrivateDevices,               config_parse_bool,                  0,                             offsetof($1, exec_context.private_devices)
@@ -117,6 +124,9 @@ $1.CPUShares,                    config_parse_cpu_shares,            0,
 $1.StartupCPUShares,             config_parse_cpu_shares,            0,                             offsetof($1, cgroup_context.startup_cpu_shares)
 $1.CPUQuota,                     config_parse_cpu_quota,             0,                             offsetof($1, cgroup_context)
 $1.MemoryAccounting,             config_parse_bool,                  0,                             offsetof($1, cgroup_context.memory_accounting)
+$1.MemoryLow,                    config_parse_memory_limit,          0,                             offsetof($1, cgroup_context)
+$1.MemoryHigh,                   config_parse_memory_limit,          0,                             offsetof($1, cgroup_context)
+$1.MemoryMax,                    config_parse_memory_limit,          0,                             offsetof($1, cgroup_context)
 $1.MemoryLimit,                  config_parse_memory_limit,          0,                             offsetof($1, cgroup_context)
 $1.DeviceAllow,                  config_parse_device_allow,          0,                             offsetof($1, cgroup_context)
 $1.DevicePolicy,                 config_parse_device_policy,         0,                             offsetof($1, cgroup_context.device_policy)
diff --git a/src/grp-system/libcore/load-fragment.c b/src/grp-system/libcore/load-fragment.c
index bb12b6cbfe..9a6ffc8bff 100644
--- a/src/grp-system/libcore/load-fragment.c
+++ b/src/grp-system/libcore/load-fragment.c
@@ -599,7 +599,7 @@ int config_parse_exec(
         p = rvalue;
         do {
                 _cleanup_free_ char *path = NULL, *firstword = NULL;
-                bool separate_argv0 = false, ignore = false;
+                bool separate_argv0 = false, ignore = false, privileged = false;
                 _cleanup_free_ ExecCommand *nce = NULL;
                 _cleanup_strv_free_ char **n = NULL;
                 size_t nlen = 0, nbufsize = 0;
@@ -613,14 +613,18 @@ int config_parse_exec(
                         return 0;
 
                 f = firstword;
-                for (i = 0; i < 2; i++) {
-                        /* We accept an absolute path as first argument, or
-                         * alternatively an absolute prefixed with @ to allow
-                         * overriding of argv[0]. */
+                for (i = 0; i < 3; i++) {
+                        /* We accept an absolute path as first argument.
+                         * If it's prefixed with - and the path doesn't exist,
+                         * we ignore it instead of erroring out;
+                         * if it's prefixed with @, we allow overriding of argv[0];
+                         * and if it's prefixed with !, it will be run with full privileges */
                         if (*f == '-' && !ignore)
                                 ignore = true;
                         else if (*f == '@' && !separate_argv0)
                                 separate_argv0 = true;
+                        else if (*f == '+' && !privileged)
+                                privileged = true;
                         else
                                 break;
                         f++;
@@ -718,6 +722,7 @@ int config_parse_exec(
                 nce->argv = n;
                 nce->path = path;
                 nce->ignore = ignore;
+                nce->privileged = privileged;
 
                 exec_command_append_list(e, nce);
 
@@ -2399,6 +2404,55 @@ int config_parse_documentation(const char *unit,
 }
 
 #ifdef HAVE_SECCOMP
+static int syscall_filter_parse_one(
+                const char *unit,
+                const char *filename,
+                unsigned line,
+                ExecContext *c,
+                bool invert,
+                const char *t,
+                bool warn) {
+        int r;
+
+        if (*t == '@') {
+                const SystemCallFilterSet *set;
+
+                for (set = syscall_filter_sets; set->set_name; set++)
+                        if (streq(set->set_name, t)) {
+                                const char *sys;
+
+                                NULSTR_FOREACH(sys, set->value) {
+                                        r = syscall_filter_parse_one(unit, filename, line, c, invert, sys, false);
+                                        if (r < 0)
+                                                return r;
+                                }
+                                break;
+                        }
+        } else {
+                int id;
+
+                id = seccomp_syscall_resolve_name(t);
+                if (id == __NR_SCMP_ERROR)  {
+                        if (warn)
+                                log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to parse system call, ignoring: %s", t);
+                        return 0;
+                }
+
+                /* If we previously wanted to forbid a syscall and now
+                 * we want to allow it, then remove it from the list
+                 */
+                if (!invert == c->syscall_whitelist) {
+                        r = set_put(c->syscall_filter, INT_TO_PTR(id + 1));
+                        if (r == 0)
+                                return 0;
+                        if (r < 0)
+                                return log_oom();
+                } else
+                        set_remove(c->syscall_filter, INT_TO_PTR(id + 1));
+        }
+        return 0;
+}
+
 int config_parse_syscall_filter(
                 const char *unit,
                 const char *filename,
@@ -2411,13 +2465,6 @@ int config_parse_syscall_filter(
                 void *data,
                 void *userdata) {
 
-        static const char default_syscalls[] =
-                "execve\0"
-                "exit\0"
-                "exit_group\0"
-                "rt_sigreturn\0"
-                "sigreturn\0";
-
         ExecContext *c = data;
         Unit *u = userdata;
         bool invert = false;
@@ -2451,53 +2498,26 @@ int config_parse_syscall_filter(
                         /* Allow everything but the ones listed */
                         c->syscall_whitelist = false;
                 else {
-                        const char *i;
-
                         /* Allow nothing but the ones listed */
                         c->syscall_whitelist = true;
 
                         /* Accept default syscalls if we are on a whitelist */
-                        NULSTR_FOREACH(i, default_syscalls)  {
-                                int id;
-
-                                id = seccomp_syscall_resolve_name(i);
-                                if (id < 0)
-                                        continue;
-
-                                r = set_put(c->syscall_filter, INT_TO_PTR(id + 1));
-                                if (r == 0)
-                                        continue;
-                                if (r < 0)
-                                        return log_oom();
-                        }
+                        r = syscall_filter_parse_one(unit, filename, line, c, false, "@default", false);
+                        if (r < 0)
+                                return r;
                 }
         }
 
         FOREACH_WORD_QUOTED(word, l, rvalue, state) {
                 _cleanup_free_ char *t = NULL;
-                int id;
 
                 t = strndup(word, l);
                 if (!t)
                         return log_oom();
 
-                id = seccomp_syscall_resolve_name(t);
-                if (id < 0)  {
-                        log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to parse system call, ignoring: %s", t);
-                        continue;
-                }
-
-                /* If we previously wanted to forbid a syscall and now
-                 * we want to allow it, then remove it from the list
-                 */
-                if (!invert == c->syscall_whitelist)  {
-                        r = set_put(c->syscall_filter, INT_TO_PTR(id + 1));
-                        if (r == 0)
-                                continue;
-                        if (r < 0)
-                                return log_oom();
-                } else
-                        set_remove(c->syscall_filter, INT_TO_PTR(id + 1));
+                r = syscall_filter_parse_one(unit, filename, line, c, invert, t, true);
+                if (r < 0)
+                        return r;
         }
         if (!isempty(state))
                 log_syntax(unit, LOG_ERR, filename, line, 0, "Trailing garbage, ignoring.");
@@ -2757,7 +2777,7 @@ int config_parse_cpu_quota(
                 void *userdata) {
 
         CGroupContext *c = data;
-        double percent;
+        int r;
 
         assert(filename);
         assert(lvalue);
@@ -2768,18 +2788,13 @@ int config_parse_cpu_quota(
                 return 0;
         }
 
-        if (!endswith(rvalue, "%")) {
-                log_syntax(unit, LOG_ERR, filename, line, 0, "CPU quota '%s' not ending in '%%'. Ignoring.", rvalue);
+        r = parse_percent(rvalue);
+        if (r <= 0) {
+                log_syntax(unit, LOG_ERR, filename, line, r, "CPU quota '%s' invalid. Ignoring.", rvalue);
                 return 0;
         }
 
-        if (sscanf(rvalue, "%lf%%", &percent) != 1 || percent <= 0) {
-                log_syntax(unit, LOG_ERR, filename, line, 0, "CPU quota '%s' invalid. Ignoring.", rvalue);
-                return 0;
-        }
-
-        c->cpu_quota_per_sec_usec = (usec_t) (percent * USEC_PER_SEC / 100);
-
+        c->cpu_quota_per_sec_usec = ((usec_t) r * USEC_PER_SEC) / 100U;
         return 0;
 }
 
@@ -2796,21 +2811,36 @@ int config_parse_memory_limit(
                 void *userdata) {
 
         CGroupContext *c = data;
-        uint64_t bytes;
+        uint64_t bytes = CGROUP_LIMIT_MAX;
         int r;
 
-        if (isempty(rvalue) || streq(rvalue, "infinity")) {
-                c->memory_limit = (uint64_t) -1;
-                return 0;
-        }
+        if (!isempty(rvalue) && !streq(rvalue, "infinity")) {
 
-        r = parse_size(rvalue, 1024, &bytes);
-        if (r < 0 || bytes < 1) {
-                log_syntax(unit, LOG_ERR, filename, line, r, "Memory limit '%s' invalid. Ignoring.", rvalue);
-                return 0;
+                r = parse_percent(rvalue);
+                if (r < 0) {
+                        r = parse_size(rvalue, 1024, &bytes);
+                        if (r < 0) {
+                                log_syntax(unit, LOG_ERR, filename, line, r, "Memory limit '%s' invalid. Ignoring.", rvalue);
+                                return 0;
+                        }
+                } else
+                        bytes = physical_memory_scale(r, 100U);
+
+                if (bytes <= 0 || bytes >= UINT64_MAX) {
+                        log_syntax(unit, LOG_ERR, filename, line, 0, "Memory limit '%s' out of range. Ignoring.", rvalue);
+                        return 0;
+                }
         }
 
-        c->memory_limit = bytes;
+        if (streq(lvalue, "MemoryLow"))
+                c->memory_low = bytes;
+        else if (streq(lvalue, "MemoryHigh"))
+                c->memory_high = bytes;
+        else if (streq(lvalue, "MemoryMax"))
+                c->memory_max = bytes;
+        else
+                c->memory_limit = bytes;
+
         return 0;
 }
 
@@ -2834,9 +2864,18 @@ int config_parse_tasks_max(
                 return 0;
         }
 
-        r = safe_atou64(rvalue, &u);
-        if (r < 0 || u < 1) {
-                log_syntax(unit, LOG_ERR, filename, line, r, "Maximum tasks value '%s' invalid. Ignoring.", rvalue);
+        r = parse_percent(rvalue);
+        if (r < 0) {
+                r = safe_atou64(rvalue, &u);
+                if (r < 0) {
+                        log_syntax(unit, LOG_ERR, filename, line, r, "Maximum tasks value '%s' invalid. Ignoring.", rvalue);
+                        return 0;
+                }
+        } else
+                u = system_tasks_max_scale(r, 100U);
+
+        if (u <= 0 || u >= UINT64_MAX) {
+                log_syntax(unit, LOG_ERR, filename, line, 0, "Maximum tasks value '%s' out of range. Ignoring.", rvalue);
                 return 0;
         }
 
@@ -3063,7 +3102,7 @@ int config_parse_io_limit(
                 return 0;
         }
 
-        if (streq("max", limit)) {
+        if (streq("infinity", limit)) {
                 num = CGROUP_LIMIT_MAX;
         } else {
                 r = parse_size(limit, 1000, &num);
@@ -3567,7 +3606,7 @@ int config_parse_protect_home(
         assert(data);
 
         /* Our enum shall be a superset of booleans, hence first try
-         * to parse as as boolean, and then as enum */
+         * to parse as boolean, and then as enum */
 
         k = parse_boolean(rvalue);
         if (k > 0)
@@ -3610,7 +3649,7 @@ int config_parse_protect_system(
         assert(data);
 
         /* Our enum shall be a superset of booleans, hence first try
-         * to parse as as boolean, and then as enum */
+         * to parse as boolean, and then as enum */
 
         k = parse_boolean(rvalue);
         if (k > 0)
@@ -3726,7 +3765,7 @@ static int merge_by_names(Unit **u, Set *names, const char *id) {
 
                         /* If the symlink name we are looking at is unit template, then
                            we must search for instance of this template */
-                        if (unit_name_is_valid(k, UNIT_NAME_TEMPLATE)) {
+                        if (unit_name_is_valid(k, UNIT_NAME_TEMPLATE) && (*u)->instance) {
                                 _cleanup_free_ char *instance = NULL;
 
                                 r = unit_name_replace_instance(k, (*u)->instance, &instance);
@@ -3808,7 +3847,15 @@ static int load_from_path(Unit *u, const char *path) {
                         if (r >= 0)
                                 break;
                         filename = mfree(filename);
-                        if (r != -ENOENT)
+
+                        /* ENOENT means that the file is missing or is a dangling symlink.
+                         * ENOTDIR means that one of paths we expect to be is a directory
+                         * is not a directory, we should just ignore that.
+                         * EACCES means that the directory or file permissions are wrong.
+                         */
+                        if (r == -EACCES)
+                                log_debug_errno(r, "Cannot access \"%s\": %m", filename);
+                        else if (!IN_SET(r, -ENOENT, -ENOTDIR))
                                 return r;
 
                         /* Empty the symlink names for the next run */
diff --git a/src/grp-system/libcore/machine-id-setup.c b/src/grp-system/libcore/machine-id-setup.c
index 28722b46f0..0b65583686 100644
--- a/src/grp-system/libcore/machine-id-setup.c
+++ b/src/grp-system/libcore/machine-id-setup.c
@@ -17,11 +17,8 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include <errno.h>
 #include <fcntl.h>
 #include <sched.h>
-#include <stdio.h>
-#include <string.h>
 #include <sys/mount.h>
 #include <unistd.h>
 
@@ -29,10 +26,7 @@
 
 #include "basic/alloc-util.h"
 #include "basic/fd-util.h"
-#include "basic/fileio.h"
 #include "basic/fs-util.h"
-#include "basic/hexdecoct.h"
-#include "basic/io-util.h"
 #include "basic/log.h"
 #include "basic/macro.h"
 #include "basic/mkdir.h"
@@ -44,104 +38,27 @@
 #include "basic/umask-util.h"
 #include "basic/util.h"
 #include "basic/virt.h"
+#include "sd-id128/id128-util.h"
 
 #include "machine-id-setup.h"
 
-static int shorten_uuid(char destination[34], const char source[36]) {
-        unsigned i, j;
-
-        assert(destination);
-        assert(source);
-
-        /* Converts a UUID into a machine ID, by lowercasing it and
-         * removing dashes. Validates everything. */
-
-        for (i = 0, j = 0; i < 36 && j < 32; i++) {
-                int t;
-
-                t = unhexchar(source[i]);
-                if (t < 0)
-                        continue;
-
-                destination[j++] = hexchar(t);
-        }
-
-        if (i != 36 || j != 32)
-                return -EINVAL;
-
-        destination[32] = '\n';
-        destination[33] = 0;
-        return 0;
-}
-
-static int read_machine_id(int fd, char id[34]) {
-        char id_to_validate[34];
-        int r;
-
-        assert(fd >= 0);
-        assert(id);
-
-        /* Reads a machine ID from a file, validates it, and returns
-         * it. The returned ID ends in a newline. */
-
-        r = loop_read_exact(fd, id_to_validate, 33, false);
-        if (r < 0)
-                return r;
-
-        if (id_to_validate[32] != '\n')
-                return -EINVAL;
-
-        id_to_validate[32] = 0;
-
-        if (!id128_is_valid(id_to_validate))
-                return -EINVAL;
-
-        memcpy(id, id_to_validate, 32);
-        id[32] = '\n';
-        id[33] = 0;
-        return 0;
-}
-
-static int write_machine_id(int fd, const char id[34]) {
-        int r;
-
-        assert(fd >= 0);
-        assert(id);
-
-        if (lseek(fd, 0, SEEK_SET) < 0)
-                return -errno;
-
-        r = loop_write(fd, id, 33, false);
-        if (r < 0)
-                return r;
-
-        if (fsync(fd) < 0)
-                return -errno;
-
-        return 0;
-}
-
-static int generate_machine_id(char id[34], const char *root) {
-        int fd, r;
-        unsigned char *p;
-        sd_id128_t buf;
-        char  *q;
+static int generate_machine_id(const char *root, sd_id128_t *ret) {
         const char *dbus_machine_id;
+        _cleanup_close_ int fd = -1;
+        int r;
 
-        assert(id);
-
-        dbus_machine_id = prefix_roota(root, "/var/lib/dbus/machine-id");
+        assert(ret);
 
         /* First, try reading the D-Bus machine id, unless it is a symlink */
+        dbus_machine_id = prefix_roota(root, "/var/lib/dbus/machine-id");
         fd = open(dbus_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
         if (fd >= 0) {
-                r = read_machine_id(fd, id);
-                safe_close(fd);
-
-                if (r >= 0) {
+                if (id128_read_fd(fd, ID128_PLAIN, ret) >= 0) {
                         log_info("Initializing machine ID from D-Bus machine ID.");
                         return 0;
                 }
+
+                fd = safe_close(fd);
         }
 
         if (isempty(root)) {
@@ -152,13 +69,10 @@ static int generate_machine_id(char id[34], const char *root) {
                 if (detect_container() > 0) {
                         _cleanup_free_ char *e = NULL;
 
-                        r = getenv_for_pid(1, "container_uuid", &e);
-                        if (r > 0) {
-                                r = shorten_uuid(id, e);
-                                if (r >= 0) {
-                                        log_info("Initializing machine ID from container UUID.");
-                                        return 0;
-                                }
+                        if (getenv_for_pid(1, "container_uuid", &e) > 0 &&
+                            sd_id128_from_string(e, ret) >= 0) {
+                                log_info("Initializing machine ID from container UUID.");
+                                return 0;
                         }
 
                 } else if (detect_vm() == VIRTUALIZATION_KVM) {
@@ -167,51 +81,29 @@ static int generate_machine_id(char id[34], const char *root) {
                          * running in qemu/kvm and a machine ID was passed in
                          * via -uuid on the qemu/kvm command line */
 
-                        char uuid[36];
-
-                        fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
-                        if (fd >= 0) {
-                                r = loop_read_exact(fd, uuid, 36, false);
-                                safe_close(fd);
-
-                                if (r >= 0) {
-                                        r = shorten_uuid(id, uuid);
-                                        if (r >= 0) {
-                                                log_info("Initializing machine ID from KVM UUID.");
-                                                return 0;
-                                        }
-                                }
+                        if (id128_read("/sys/class/dmi/id/product_uuid", ID128_UUID, ret) >= 0) {
+                                log_info("Initializing machine ID from KVM UUID.");
+                                return 0;
                         }
                 }
         }
 
         /* If that didn't work, generate a random machine id */
-        r = sd_id128_randomize(&buf);
+        r = sd_id128_randomize(ret);
         if (r < 0)
-                return log_error_errno(r, "Failed to open /dev/urandom: %m");
-
-        for (p = buf.bytes, q = id; p < buf.bytes + sizeof(buf); p++, q += 2) {
-                q[0] = hexchar(*p >> 4);
-                q[1] = hexchar(*p & 15);
-        }
-
-        id[32] = '\n';
-        id[33] = 0;
+                return log_error_errno(r, "Failed to generate randomized : %m");
 
         log_info("Initializing machine ID from random generator.");
-
         return 0;
 }
 
-int machine_id_setup(const char *root, sd_id128_t machine_id) {
+int machine_id_setup(const char *root, sd_id128_t machine_id, sd_id128_t *ret) {
         const char *etc_machine_id, *run_machine_id;
         _cleanup_close_ int fd = -1;
-        bool writable = true;
-        char id[34]; /* 32 + \n + \0 */
+        bool writable;
         int r;
 
         etc_machine_id = prefix_roota(root, "/etc/machine-id");
-        run_machine_id = prefix_roota(root, "/run/machine-id");
 
         RUN_WITH_UMASK(0000) {
                 /* We create this 0444, to indicate that this isn't really
@@ -219,7 +111,7 @@ int machine_id_setup(const char *root, sd_id128_t machine_id) {
                  * will be owned by root it doesn't matter much, but maybe
                  * people look. */
 
-                mkdir_parents(etc_machine_id, 0755);
+                (void) mkdir_parents(etc_machine_id, 0755);
                 fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
                 if (fd < 0) {
                         int old_errno = errno;
@@ -240,41 +132,41 @@ int machine_id_setup(const char *root, sd_id128_t machine_id) {
                         }
 
                         writable = false;
-                }
+                } else
+                        writable = true;
         }
 
-        /* A machine id argument overrides all other machined-ids */
-        if (!sd_id128_is_null(machine_id)) {
-                sd_id128_to_string(machine_id, id);
-                id[32] = '\n';
-                id[33] = 0;
-        } else {
-                if (read_machine_id(fd, id) >= 0)
-                        return 0;
+        /* A we got a valid machine ID argument, that's what counts */
+        if (sd_id128_is_null(machine_id)) {
 
-                /* Hmm, so, the id currently stored is not useful, then let's
-                 * generate one */
+                /* Try to read any existing machine ID */
+                if (id128_read_fd(fd, ID128_PLAIN, ret) >= 0)
+                        return 0;
 
-                r = generate_machine_id(id, root);
+                /* Hmm, so, the id currently stored is not useful, then let's generate one */
+                r = generate_machine_id(root, &machine_id);
                 if (r < 0)
                         return r;
+
+                if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
+                        return log_error_errno(errno, "Failed to seek: %m");
         }
 
         if (writable)
-                if (write_machine_id(fd, id) >= 0)
-                        return 0;
+                if (id128_write_fd(fd, ID128_PLAIN, machine_id, true) >= 0)
+                        goto finish;
 
         fd = safe_close(fd);
 
-        /* Hmm, we couldn't write it? So let's write it to
-         * /run/machine-id as a replacement */
+        /* Hmm, we couldn't write it? So let's write it to /run/machine-id as a replacement */
 
-        RUN_WITH_UMASK(0022) {
-                r = write_string_file(run_machine_id, id, WRITE_STRING_FILE_CREATE);
-                if (r < 0) {
-                        (void) unlink(run_machine_id);
-                        return log_error_errno(r, "Cannot write %s: %m", run_machine_id);
-                }
+        run_machine_id = prefix_roota(root, "/run/machine-id");
+
+        RUN_WITH_UMASK(0022)
+                r = id128_write(run_machine_id, ID128_PLAIN, machine_id, false);
+        if (r < 0) {
+                (void) unlink(run_machine_id);
+                return log_error_errno(r, "Cannot write %s: %m", run_machine_id);
         }
 
         /* And now, let's mount it over */
@@ -287,7 +179,11 @@ int machine_id_setup(const char *root, sd_id128_t machine_id) {
 
         /* Mark the mount read-only */
         if (mount(NULL, etc_machine_id, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL) < 0)
-                log_warning_errno(errno, "Failed to make transient %s read-only: %m", etc_machine_id);
+                log_warning_errno(errno, "Failed to make transient %s read-only, ignoring: %m", etc_machine_id);
+
+finish:
+        if (ret)
+                *ret = machine_id;
 
         return 0;
 }
@@ -295,16 +191,20 @@ int machine_id_setup(const char *root, sd_id128_t machine_id) {
 int machine_id_commit(const char *root) {
         _cleanup_close_ int fd = -1, initial_mntns_fd = -1;
         const char *etc_machine_id;
-        char id[34]; /* 32 + \n + \0 */
+        sd_id128_t id;
         int r;
 
+        /* Replaces a tmpfs bind mount of /etc/machine-id by a proper file, atomically. For this, the umount is removed
+         * in a mount namespace, a new file is created at the right place. Afterwards the mount is also removed in the
+         * original mount namespace, thus revealing the file that was just created. */
+
         etc_machine_id = prefix_roota(root, "/etc/machine-id");
 
         r = path_is_mount_point(etc_machine_id, 0);
         if (r < 0)
                 return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", etc_machine_id);
         if (r == 0) {
-                log_debug("%s is is not a mount point. Nothing to do.", etc_machine_id);
+                log_debug("%s is not a mount point. Nothing to do.", etc_machine_id);
                 return 0;
         }
 
@@ -313,10 +213,6 @@ int machine_id_commit(const char *root) {
         if (fd < 0)
                 return log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
 
-        r = read_machine_id(fd, id);
-        if (r < 0)
-                return log_error_errno(r, "We didn't find a valid machine ID in %s.", etc_machine_id);
-
         r = fd_is_temporary_fs(fd);
         if (r < 0)
                 return log_error_errno(r, "Failed to determine whether %s is on a temporary file system: %m", etc_machine_id);
@@ -325,6 +221,10 @@ int machine_id_commit(const char *root) {
                 return -EROFS;
         }
 
+        r = id128_read_fd(fd, ID128_PLAIN, &id);
+        if (r < 0)
+                return log_error_errno(r, "We didn't find a valid machine ID in %s.", etc_machine_id);
+
         fd = safe_close(fd);
 
         /* Store current mount namespace */
@@ -343,15 +243,9 @@ int machine_id_commit(const char *root) {
                 return log_error_errno(errno, "Failed to unmount transient %s file in our private namespace: %m", etc_machine_id);
 
         /* Update a persistent version of etc_machine_id */
-        fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
-        if (fd < 0)
-                return log_error_errno(errno, "Cannot open for writing %s. This is mandatory to get a persistent machine-id: %m", etc_machine_id);
-
-        r = write_machine_id(fd, id);
+        r = id128_write(etc_machine_id, ID128_PLAIN, id, true);
         if (r < 0)
-                return log_error_errno(r, "Cannot write %s: %m", etc_machine_id);
-
-        fd = safe_close(fd);
+                return log_error_errno(r, "Cannot write %s. This is mandatory to get a persistent machine ID: %m", etc_machine_id);
 
         /* Return to initial namespace and proceed a lazy tmpfs unmount */
         r = namespace_enter(-1, initial_mntns_fd, -1, -1, -1);
diff --git a/src/grp-system/libcore/machine-id-setup.h b/src/grp-system/libcore/machine-id-setup.h
index c5dd8d7790..88830ecc42 100644
--- a/src/grp-system/libcore/machine-id-setup.h
+++ b/src/grp-system/libcore/machine-id-setup.h
@@ -22,4 +22,4 @@
 #include <systemd/sd-id128.h>
 
 int machine_id_commit(const char *root);
-int machine_id_setup(const char *root, sd_id128_t machine_id);
+int machine_id_setup(const char *root, sd_id128_t requested, sd_id128_t *ret);
diff --git a/src/grp-system/libcore/manager.c b/src/grp-system/libcore/manager.c
index 29dbf092d7..26395bc2b3 100644
--- a/src/grp-system/libcore/manager.c
+++ b/src/grp-system/libcore/manager.c
@@ -137,23 +137,28 @@ static void draw_cylon(char buffer[], size_t buflen, unsigned width, unsigned po
         if (pos > 1) {
                 if (pos > 2)
                         p = mempset(p, ' ', pos-2);
-                p = stpcpy(p, ANSI_RED);
+                if (log_get_show_color())
+                        p = stpcpy(p, ANSI_RED);
                 *p++ = '*';
         }
 
         if (pos > 0 && pos <= width) {
-                p = stpcpy(p, ANSI_HIGHLIGHT_RED);
+                if (log_get_show_color())
+                        p = stpcpy(p, ANSI_HIGHLIGHT_RED);
                 *p++ = '*';
         }
 
-        p = stpcpy(p, ANSI_NORMAL);
+        if (log_get_show_color())
+                p = stpcpy(p, ANSI_NORMAL);
 
         if (pos < width) {
-                p = stpcpy(p, ANSI_RED);
+                if (log_get_show_color())
+                        p = stpcpy(p, ANSI_RED);
                 *p++ = '*';
                 if (pos < width-1)
                         p = mempset(p, ' ', width-1-pos);
-                strcpy(p, ANSI_NORMAL);
+                if (log_get_show_color())
+                        strcpy(p, ANSI_NORMAL);
         }
 }
 
@@ -566,7 +571,7 @@ int manager_new(UnitFileScope scope, bool test_run, Manager **_m) {
         m->exit_code = _MANAGER_EXIT_CODE_INVALID;
         m->default_timer_accuracy_usec = USEC_PER_MINUTE;
         m->default_tasks_accounting = true;
-        m->default_tasks_max = UINT64_C(512);
+        m->default_tasks_max = UINT64_MAX;
 
 #ifdef ENABLE_EFI
         if (MANAGER_IS_SYSTEM(m) && detect_container() <= 0)
@@ -810,28 +815,6 @@ static int manager_setup_cgroups_agent(Manager *m) {
         return 0;
 }
 
-static int manager_setup_kdbus(Manager *m) {
-        _cleanup_free_ char *p = NULL;
-
-        assert(m);
-
-        if (m->test_run || m->kdbus_fd >= 0)
-                return 0;
-        if (!is_kdbus_available())
-                return -ESOCKTNOSUPPORT;
-
-        m->kdbus_fd = bus_kernel_create_bus(
-                        MANAGER_IS_SYSTEM(m) ? "system" : "user",
-                        MANAGER_IS_SYSTEM(m), &p);
-
-        if (m->kdbus_fd < 0)
-                return log_debug_errno(m->kdbus_fd, "Failed to set up kdbus: %m");
-
-        log_debug("Successfully set up kdbus on %s", p);
-
-        return 0;
-}
-
 static int manager_connect_bus(Manager *m, bool reexecuting) {
         bool try_bus_connect;
 
@@ -873,6 +856,19 @@ enum {
         _GC_OFFSET_MAX
 };
 
+static void unit_gc_mark_good(Unit *u, unsigned gc_marker)
+{
+        Iterator i;
+        Unit *other;
+
+        u->gc_marker = gc_marker + GC_OFFSET_GOOD;
+
+        /* Recursively mark referenced units as GOOD as well */
+        SET_FOREACH(other, u->dependencies[UNIT_REFERENCES], i)
+                if (other->gc_marker == gc_marker + GC_OFFSET_UNSURE)
+                        unit_gc_mark_good(other, gc_marker);
+}
+
 static void unit_gc_sweep(Unit *u, unsigned gc_marker) {
         Iterator i;
         Unit *other;
@@ -882,6 +878,7 @@ static void unit_gc_sweep(Unit *u, unsigned gc_marker) {
 
         if (u->gc_marker == gc_marker + GC_OFFSET_GOOD ||
             u->gc_marker == gc_marker + GC_OFFSET_BAD ||
+            u->gc_marker == gc_marker + GC_OFFSET_UNSURE ||
             u->gc_marker == gc_marker + GC_OFFSET_IN_PATH)
                 return;
 
@@ -922,7 +919,7 @@ bad:
         return;
 
 good:
-        u->gc_marker = gc_marker + GC_OFFSET_GOOD;
+        unit_gc_mark_good(u, gc_marker);
 }
 
 static unsigned manager_dispatch_gc_queue(Manager *m) {
@@ -1226,7 +1223,6 @@ int manager_startup(Manager *m, FILE *serialization, FDSet *fds) {
 
         /* We might have deserialized the kdbus control fd, but if we
          * didn't, then let's create the bus now. */
-        manager_setup_kdbus(m);
         manager_connect_bus(m, !!serialization);
         bus_track_coldplug(m, &m->subscribed, &m->deserialized_subscribed);
 
@@ -1611,9 +1607,9 @@ static void manager_invoke_notify_message(Manager *m, Unit *u, pid_t pid, const
 }
 
 static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
+
         _cleanup_fdset_free_ FDSet *fds = NULL;
         Manager *m = userdata;
-
         char buf[NOTIFY_BUFFER_MAX+1];
         struct iovec iovec = {
                 .iov_base = buf,
@@ -1721,16 +1717,28 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
 }
 
 static void invoke_sigchld_event(Manager *m, Unit *u, const siginfo_t *si) {
+        uint64_t iteration;
+
         assert(m);
         assert(u);
         assert(si);
 
+        sd_event_get_iteration(m->event, &iteration);
+
         log_unit_debug(u, "Child "PID_FMT" belongs to %s", si->si_pid, u->id);
 
         unit_unwatch_pid(u, si->si_pid);
 
-        if (UNIT_VTABLE(u)->sigchld_event)
-                UNIT_VTABLE(u)->sigchld_event(u, si->si_pid, si->si_code, si->si_status);
+        if (UNIT_VTABLE(u)->sigchld_event) {
+                if (set_size(u->pids) <= 1 ||
+                    iteration != u->sigchldgen ||
+                    unit_main_pid(u) == si->si_pid ||
+                    unit_control_pid(u) == si->si_pid) {
+                        UNIT_VTABLE(u)->sigchld_event(u, si->si_pid, si->si_code, si->si_status);
+                        u->sigchldgen = iteration;
+                } else
+                        log_debug("%s already issued a sigchld this iteration %" PRIu64 ", skipping. Pids still being watched %d", u->id, iteration, set_size(u->pids));
+         }
 }
 
 static int manager_dispatch_sigchld(Manager *m) {
diff --git a/src/grp-system/libcore/manager.h b/src/grp-system/libcore/manager.h
index fedf39ddcd..252919c27f 100644
--- a/src/grp-system/libcore/manager.h
+++ b/src/grp-system/libcore/manager.h
@@ -27,10 +27,10 @@
 #include <systemd/sd-event.h>
 
 #include "basic/cgroup-util.h"
-#include "basic/fdset.h"
 #include "basic/hashmap.h"
 #include "basic/list.h"
 #include "basic/ratelimit.h"
+#include "shared/fdset.h"
 
 /* Enforce upper limit how many names we allow */
 #define MANAGER_MAX_NAMES 131072 /* 128K */
diff --git a/src/grp-system/libcore/mount-setup.c b/src/grp-system/libcore/mount-setup.c
index e90f0e918a..0de1c63b3e 100644
--- a/src/grp-system/libcore/mount-setup.c
+++ b/src/grp-system/libcore/mount-setup.c
@@ -25,6 +25,7 @@
 
 #include "basic/alloc-util.h"
 #include "basic/cgroup-util.h"
+#include "basic/fs-util.h"
 #include "basic/label.h"
 #include "basic/log.h"
 #include "basic/macro.h"
@@ -109,8 +110,6 @@ static const MountPoint mount_table[] = {
         { "efivarfs",    "/sys/firmware/efi/efivars", "efivarfs",   NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
           is_efi_boot,   MNT_NONE                   },
 #endif
-        { "kdbusfs",    "/sys/fs/kdbus",             "kdbusfs",    NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
-          is_kdbus_wanted,       MNT_IN_CONTAINER },
 };
 
 /* These are API file systems that might be mounted by other software,
@@ -406,9 +405,16 @@ int mount_setup(bool loaded_policy) {
          * really needs to stay for good, otherwise software that
          * copied sd-daemon.c into their sources will misdetect
          * systemd. */
-        mkdir_label("/run/systemd", 0755);
-        mkdir_label("/run/systemd/system", 0755);
-        mkdir_label("/run/systemd/inaccessible", 0000);
+        (void) mkdir_label("/run/systemd", 0755);
+        (void) mkdir_label("/run/systemd/system", 0755);
+        (void) mkdir_label("/run/systemd/inaccessible", 0000);
+        /* Set up inaccessible items */
+        (void) mknod("/run/systemd/inaccessible/reg", S_IFREG | 0000, 0);
+        (void) mkdir_label("/run/systemd/inaccessible/dir", 0000);
+        (void) mknod("/run/systemd/inaccessible/chr", S_IFCHR | 0000, makedev(0, 0));
+        (void) mknod("/run/systemd/inaccessible/blk", S_IFBLK | 0000, makedev(0, 0));
+        (void) mkfifo("/run/systemd/inaccessible/fifo", 0000);
+        (void) mknod("/run/systemd/inaccessible/sock", S_IFSOCK | 0000, 0);
 
         return 0;
 }
diff --git a/src/grp-system/libcore/mount.c b/src/grp-system/libcore/mount.c
index d4af6c65f6..bc5f29692d 100644
--- a/src/grp-system/libcore/mount.c
+++ b/src/grp-system/libcore/mount.c
@@ -1707,6 +1707,7 @@ static int mount_dispatch_io(sd_event_source *source, int fd, uint32_t revents,
                                 /* This has just been unmounted by
                                  * somebody else, follow the state
                                  * change. */
+                                mount->result = MOUNT_SUCCESS; /* make sure we forget any earlier umount failures */
                                 mount_enter_dead(mount, MOUNT_SUCCESS);
                                 break;
 
diff --git a/src/grp-system/libcore/namespace.c b/src/grp-system/libcore/namespace.c
index db60336a60..f76a0a7fbf 100644
--- a/src/grp-system/libcore/namespace.c
+++ b/src/grp-system/libcore/namespace.c
@@ -280,6 +280,7 @@ static int apply_mount(
 
         const char *what;
         int r;
+        struct stat target;
 
         assert(m);
 
@@ -289,12 +290,21 @@ static int apply_mount(
 
                 /* First, get rid of everything that is below if there
                  * is anything... Then, overmount it with an
-                 * inaccessible directory. */
+                 * inaccessible path. */
                 umount_recursive(m->path, 0);
 
-                what = "/run/systemd/inaccessible";
-                break;
+                if (lstat(m->path, &target) < 0) {
+                        if (m->ignore && errno == ENOENT)
+                                return 0;
+                        return -errno;
+                }
 
+                what = mode_to_inaccessible_node(target.st_mode);
+                if (!what) {
+                        log_debug("File type not supported for inaccessible mounts. Note that symlinks are not allowed");
+                        return -ELOOP;
+                }
+                break;
         case READONLY:
         case READWRITE:
                 /* Nothing to mount here, we just later toggle the
@@ -319,12 +329,14 @@ static int apply_mount(
         assert(what);
 
         r = mount(what, m->path, NULL, MS_BIND|MS_REC, NULL);
-        if (r >= 0)
+        if (r >= 0) {
                 log_debug("Successfully mounted %s to %s", what, m->path);
-        else if (m->ignore && errno == ENOENT)
-                return 0;
-
-        return r;
+                return r;
+        } else {
+                if (m->ignore && errno == ENOENT)
+                        return 0;
+                return log_debug_errno(errno, "Failed to mount %s to %s: %m", what, m->path);
+        }
 }
 
 static int make_read_only(BindMount *m) {
@@ -337,7 +349,8 @@ static int make_read_only(BindMount *m) {
         else if (IN_SET(m->mode, READWRITE, PRIVATE_TMP, PRIVATE_VAR_TMP, PRIVATE_DEV)) {
                 r = bind_remount_recursive(m->path, false);
                 if (r == 0 && m->mode == PRIVATE_DEV) /* can be readonly but the submounts can't*/
-                        r = mount(NULL, m->path, NULL, MS_REMOUNT|DEV_MOUNT_OPTIONS|MS_RDONLY, NULL);
+                        if (mount(NULL, m->path, NULL, MS_REMOUNT|DEV_MOUNT_OPTIONS|MS_RDONLY, NULL) < 0)
+                                r = -errno;
         } else
                 r = 0;
 
@@ -349,9 +362,9 @@ static int make_read_only(BindMount *m) {
 
 int setup_namespace(
                 const char* root_directory,
-                char** read_write_dirs,
-                char** read_only_dirs,
-                char** inaccessible_dirs,
+                char** read_write_paths,
+                char** read_only_paths,
+                char** inaccessible_paths,
                 const char* tmp_dir,
                 const char* var_tmp_dir,
                 bool private_dev,
@@ -370,9 +383,9 @@ int setup_namespace(
                 return -errno;
 
         n = !!tmp_dir + !!var_tmp_dir +
-                strv_length(read_write_dirs) +
-                strv_length(read_only_dirs) +
-                strv_length(inaccessible_dirs) +
+                strv_length(read_write_paths) +
+                strv_length(read_only_paths) +
+                strv_length(inaccessible_paths) +
                 private_dev +
                 (protect_home != PROTECT_HOME_NO ? 3 : 0) +
                 (protect_system != PROTECT_SYSTEM_NO ? 2 : 0) +
@@ -380,15 +393,15 @@ int setup_namespace(
 
         if (n > 0) {
                 m = mounts = (BindMount *) alloca0(n * sizeof(BindMount));
-                r = append_mounts(&m, read_write_dirs, READWRITE);
+                r = append_mounts(&m, read_write_paths, READWRITE);
                 if (r < 0)
                         return r;
 
-                r = append_mounts(&m, read_only_dirs, READONLY);
+                r = append_mounts(&m, read_only_paths, READONLY);
                 if (r < 0)
                         return r;
 
-                r = append_mounts(&m, inaccessible_dirs, INACCESSIBLE);
+                r = append_mounts(&m, inaccessible_paths, INACCESSIBLE);
                 if (r < 0)
                         return r;
 
@@ -631,7 +644,7 @@ int setup_netns(int netns_storage_socket[2]) {
         }
 
 fail:
-        lockf(netns_storage_socket[0], F_ULOCK, 0);
+        (void) lockf(netns_storage_socket[0], F_ULOCK, 0);
         return r;
 }
 
diff --git a/src/grp-system/libcore/namespace.h b/src/grp-system/libcore/namespace.h
index 03097327dd..1ae206efd1 100644
--- a/src/grp-system/libcore/namespace.h
+++ b/src/grp-system/libcore/namespace.h
@@ -40,9 +40,9 @@ typedef enum ProtectSystem {
 } ProtectSystem;
 
 int setup_namespace(const char *chroot,
-                    char **read_write_dirs,
-                    char **read_only_dirs,
-                    char **inaccessible_dirs,
+                    char **read_write_paths,
+                    char **read_only_paths,
+                    char **inaccessible_paths,
                     const char *tmp_dir,
                     const char *var_tmp_dir,
                     bool private_dev,
diff --git a/src/grp-system/libcore/scope.c b/src/grp-system/libcore/scope.c
index c290529e14..8998f751f5 100644
--- a/src/grp-system/libcore/scope.c
+++ b/src/grp-system/libcore/scope.c
@@ -241,7 +241,7 @@ static void scope_enter_signal(Scope *s, ScopeState state, ScopeResult f) {
 
         /* If we have a controller set let's ask the controller nicely
          * to terminate the scope, instead of us going directly into
-         * SIGTERM beserk mode */
+         * SIGTERM berserk mode */
         if (state == SCOPE_STOP_SIGTERM)
                 skip_signal = bus_scope_send_request_stop(s) > 0;
 
@@ -249,7 +249,9 @@ static void scope_enter_signal(Scope *s, ScopeState state, ScopeResult f) {
                 r = unit_kill_context(
                                 UNIT(s),
                                 &s->kill_context,
-                                state != SCOPE_STOP_SIGTERM ? KILL_KILL : KILL_TERMINATE,
+                                state != SCOPE_STOP_SIGTERM ? KILL_KILL :
+                                s->was_abandoned            ? KILL_TERMINATE_AND_LOG :
+                                                              KILL_TERMINATE,
                                 -1, -1, false);
                 if (r < 0)
                         goto fail;
@@ -370,6 +372,7 @@ static int scope_serialize(Unit *u, FILE *f, FDSet *fds) {
         assert(fds);
 
         unit_serialize_item(u, f, "state", scope_state_to_string(s->state));
+        unit_serialize_item(u, f, "was-abandoned", yes_no(s->was_abandoned));
         return 0;
 }
 
@@ -390,6 +393,14 @@ static int scope_deserialize_item(Unit *u, const char *key, const char *value, F
                 else
                         s->deserialized_state = state;
 
+        } else if (streq(key, "was-abandoned")) {
+                int k;
+
+                k = parse_boolean(value);
+                if (k < 0)
+                        log_unit_debug(u, "Failed to parse boolean value: %s", value);
+                else
+                        s->was_abandoned = k;
         } else
                 log_unit_debug(u, "Unknown serialization key: %s", key);
 
@@ -429,8 +440,9 @@ static void scope_sigchld_event(Unit *u, pid_t pid, int code, int status) {
         unit_tidy_watch_pids(u, 0, 0);
         unit_watch_all_pids(u);
 
-        /* If the PID set is empty now, then let's finish this off */
-        if (set_isempty(u->pids))
+        /* If the PID set is empty now, then let's finish this off
+           (On unified we use proper notifications) */
+        if (cg_unified() <= 0 && set_isempty(u->pids))
                 scope_notify_cgroup_empty_event(u);
 }
 
@@ -474,6 +486,7 @@ int scope_abandon(Scope *s) {
         if (!IN_SET(s->state, SCOPE_RUNNING, SCOPE_ABANDONED))
                 return -ESTALE;
 
+        s->was_abandoned = true;
         s->controller = mfree(s->controller);
 
         /* The client is no longer watching the remaining processes,
diff --git a/src/grp-system/libcore/scope.h b/src/grp-system/libcore/scope.h
index f0cb3bd3e2..eaf8e8b447 100644
--- a/src/grp-system/libcore/scope.h
+++ b/src/grp-system/libcore/scope.h
@@ -21,6 +21,7 @@
 
 typedef struct Scope Scope;
 
+#include "cgroup.h"
 #include "kill.h"
 #include "unit.h"
 
@@ -44,6 +45,7 @@ struct Scope {
         usec_t timeout_stop_usec;
 
         char *controller;
+        bool was_abandoned;
 
         sd_event_source *timer_event_source;
 };
diff --git a/src/grp-system/libcore/selinux-access.c b/src/grp-system/libcore/selinux-access.c
index ce2ef2db1c..f6dbfa64b7 100644
--- a/src/grp-system/libcore/selinux-access.c
+++ b/src/grp-system/libcore/selinux-access.c
@@ -192,7 +192,7 @@ int mac_selinux_generic_access_check(
         const char *tclass = NULL, *scon = NULL;
         struct audit_info audit_info = {};
         _cleanup_free_ char *cl = NULL;
-        security_context_t fcon = NULL;
+        char *fcon = NULL;
         char **cmdline = NULL;
         int r = 0;
 
diff --git a/src/grp-system/libcore/selinux-setup.c b/src/grp-system/libcore/selinux-setup.c
index 314d8edbaa..08c61af146 100644
--- a/src/grp-system/libcore/selinux-setup.c
+++ b/src/grp-system/libcore/selinux-setup.c
@@ -45,7 +45,7 @@ int mac_selinux_setup(bool *loaded_policy) {
 #ifdef HAVE_SELINUX
         int enforce = 0;
         usec_t before_load, after_load;
-        security_context_t con;
+        char *con;
         int r;
         union selinux_callback cb;
         bool initialized = false;
diff --git a/src/grp-system/libcore/service.c b/src/grp-system/libcore/service.c
index 9b7f7bd68c..43d195bbba 100644
--- a/src/grp-system/libcore/service.c
+++ b/src/grp-system/libcore/service.c
@@ -201,16 +201,27 @@ static void service_stop_watchdog(Service *s) {
         s->watchdog_timestamp = DUAL_TIMESTAMP_NULL;
 }
 
+static usec_t service_get_watchdog_usec(Service *s) {
+        assert(s);
+
+        if (s->watchdog_override_enable)
+                return s->watchdog_override_usec;
+        else
+                return s->watchdog_usec;
+}
+
 static void service_start_watchdog(Service *s) {
         int r;
+        usec_t watchdog_usec;
 
         assert(s);
 
-        if (s->watchdog_usec <= 0)
+        watchdog_usec = service_get_watchdog_usec(s);
+        if (watchdog_usec == 0 || watchdog_usec == USEC_INFINITY)
                 return;
 
         if (s->watchdog_event_source) {
-                r = sd_event_source_set_time(s->watchdog_event_source, usec_add(s->watchdog_timestamp.monotonic, s->watchdog_usec));
+                r = sd_event_source_set_time(s->watchdog_event_source, usec_add(s->watchdog_timestamp.monotonic, watchdog_usec));
                 if (r < 0) {
                         log_unit_warning_errno(UNIT(s), r, "Failed to reset watchdog timer: %m");
                         return;
@@ -222,7 +233,7 @@ static void service_start_watchdog(Service *s) {
                                 UNIT(s)->manager->event,
                                 &s->watchdog_event_source,
                                 CLOCK_MONOTONIC,
-                                usec_add(s->watchdog_timestamp.monotonic, s->watchdog_usec), 0,
+                                usec_add(s->watchdog_timestamp.monotonic, watchdog_usec), 0,
                                 service_dispatch_watchdog, s);
                 if (r < 0) {
                         log_unit_warning_errno(UNIT(s), r, "Failed to add watchdog timer: %m");
@@ -247,6 +258,17 @@ static void service_reset_watchdog(Service *s) {
         service_start_watchdog(s);
 }
 
+static void service_reset_watchdog_timeout(Service *s, usec_t watchdog_override_usec) {
+        assert(s);
+
+        s->watchdog_override_enable = true;
+        s->watchdog_override_usec = watchdog_override_usec;
+        service_reset_watchdog(s);
+
+        log_unit_debug(UNIT(s), "watchdog_usec="USEC_FMT, s->watchdog_usec);
+        log_unit_debug(UNIT(s), "watchdog_override_usec="USEC_FMT, s->watchdog_override_usec);
+}
+
 static void service_fd_store_unlink(ServiceFDStore *fs) {
 
         if (!fs)
@@ -575,20 +597,9 @@ static int service_setup_bus_name(Service *s) {
         if (!s->bus_name)
                 return 0;
 
-        if (is_kdbus_available()) {
-                const char *n;
-
-                n = strjoina(s->bus_name, ".busname");
-                r = unit_add_dependency_by_name(UNIT(s), UNIT_AFTER, n, NULL, true);
-                if (r < 0)
-                        return log_unit_error_errno(UNIT(s), r, "Failed to add dependency to .busname unit: %m");
-
-        } else {
-                /* If kdbus is not available, we know the dbus socket is required, hence pull it in, and require it */
-                r = unit_add_dependency_by_name(UNIT(s), UNIT_REQUIRES, SPECIAL_DBUS_SOCKET, NULL, true);
-                if (r < 0)
-                        return log_unit_error_errno(UNIT(s), r, "Failed to add dependency on " SPECIAL_DBUS_SOCKET ": %m");
-        }
+        r = unit_add_dependency_by_name(UNIT(s), UNIT_REQUIRES, SPECIAL_DBUS_SOCKET, NULL, true);
+        if (r < 0)
+                return log_unit_error_errno(UNIT(s), r, "Failed to add dependency on " SPECIAL_DBUS_SOCKET ": %m");
 
         /* Regardless if kdbus is used or not, we always want to be ordered against dbus.socket if both are in the transaction. */
         r = unit_add_dependency_by_name(UNIT(s), UNIT_AFTER, SPECIAL_DBUS_SOCKET, NULL, true);
@@ -1664,7 +1675,7 @@ static void service_kill_control_processes(Service *s) {
                 return;
 
         p = strjoina(UNIT(s)->cgroup_path, "/control");
-        cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, p, SIGKILL, true, true, true, NULL);
+        cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, p, SIGKILL, CGROUP_SIGCONT|CGROUP_IGNORE_SELF|CGROUP_REMOVE, NULL, NULL, NULL);
 }
 
 static void service_enter_start(Service *s) {
@@ -2004,6 +2015,9 @@ static int service_start(Unit *u) {
 
         s->notify_state = NOTIFY_UNKNOWN;
 
+        s->watchdog_override_enable = false;
+        s->watchdog_override_usec = 0;
+
         service_enter_start_pre(s);
         return 1;
 }
@@ -2135,6 +2149,9 @@ static int service_serialize(Unit *u, FILE *f, FDSet *fds) {
 
         unit_serialize_item(u, f, "forbid-restart", yes_no(s->forbid_restart));
 
+        if (s->watchdog_override_enable)
+               unit_serialize_item_format(u, f, "watchdog-override-usec", USEC_FMT, s->watchdog_override_usec);
+
         return 0;
 }
 
@@ -2329,6 +2346,14 @@ static int service_deserialize_item(Unit *u, const char *key, const char *value,
                         s->stderr_fd = fdset_remove(fds, fd);
                         s->exec_context.stdio_as_fds = true;
                 }
+        } else if (streq(key, "watchdog-override-usec")) {
+                usec_t watchdog_override_usec;
+                if (timestamp_deserialize(value, &watchdog_override_usec) < 0)
+                        log_unit_debug(u, "Failed to parse watchdog_override_usec value: %s", value);
+                else {
+                        s->watchdog_override_enable = true;
+                        s->watchdog_override_usec = watchdog_override_usec;
+                }
         } else
                 log_unit_debug(u, "Unknown serialization key: %s", key);
 
@@ -2801,8 +2826,9 @@ static void service_sigchld_event(Unit *u, pid_t pid, int code, int status) {
         unit_tidy_watch_pids(u, s->main_pid, s->control_pid);
         unit_watch_all_pids(u);
 
-        /* If the PID set is empty now, then let's finish this off */
-        if (set_isempty(u->pids))
+        /* If the PID set is empty now, then let's finish this off
+           (On unified we use proper notifications) */
+        if (cg_unified() <= 0 && set_isempty(u->pids))
                 service_notify_cgroup_empty_event(u);
 }
 
@@ -2906,12 +2932,15 @@ static int service_dispatch_timer(sd_event_source *source, usec_t usec, void *us
 static int service_dispatch_watchdog(sd_event_source *source, usec_t usec, void *userdata) {
         Service *s = SERVICE(userdata);
         char t[FORMAT_TIMESPAN_MAX];
+        usec_t watchdog_usec;
 
         assert(s);
         assert(source == s->watchdog_event_source);
 
+        watchdog_usec = service_get_watchdog_usec(s);
+
         log_unit_error(UNIT(s), "Watchdog timeout (limit %s)!",
-                       format_timespan(t, sizeof(t), s->watchdog_usec, 1));
+                       format_timespan(t, sizeof(t), watchdog_usec, 1));
 
         service_enter_signal(s, SERVICE_STOP_SIGABRT, SERVICE_FAILURE_WATCHDOG);
 
@@ -3048,6 +3077,15 @@ static void service_notify_message(Unit *u, pid_t pid, char **tags, FDSet *fds)
                 service_add_fd_store_set(s, fds, name);
         }
 
+        e = strv_find_startswith(tags, "WATCHDOG_USEC=");
+        if (e) {
+                usec_t watchdog_override_usec;
+                if (safe_atou64(e, &watchdog_override_usec) < 0)
+                        log_unit_warning(u, "Failed to parse WATCHDOG_USEC=%s", e);
+                else
+                        service_reset_watchdog_timeout(s, watchdog_override_usec);
+        }
+
         /* Notify clients about changed status or main pid */
         if (notify_dbus)
                 unit_add_to_dbus_queue(u);
diff --git a/src/grp-system/libcore/service.h b/src/grp-system/libcore/service.h
index aa7d1de8b6..4dcf5ecf78 100644
--- a/src/grp-system/libcore/service.h
+++ b/src/grp-system/libcore/service.h
@@ -122,6 +122,8 @@ struct Service {
 
         dual_timestamp watchdog_timestamp;
         usec_t watchdog_usec;
+        usec_t watchdog_override_usec;
+        bool watchdog_override_enable;
         sd_event_source *watchdog_event_source;
 
         ExecCommand* exec_command[_SERVICE_EXEC_COMMAND_MAX];
diff --git a/src/grp-system/libcore/socket.c b/src/grp-system/libcore/socket.c
index 051cbdab8b..3e0b3e2e49 100644
--- a/src/grp-system/libcore/socket.c
+++ b/src/grp-system/libcore/socket.c
@@ -732,16 +732,16 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
 
         case AF_INET: {
                 uint32_t
-                        a = ntohl(local.in.sin_addr.s_addr),
-                        b = ntohl(remote.in.sin_addr.s_addr);
+                        a = be32toh(local.in.sin_addr.s_addr),
+                        b = be32toh(remote.in.sin_addr.s_addr);
 
                 if (asprintf(&r,
                              "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
                              nr,
                              a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
-                             ntohs(local.in.sin_port),
+                             be16toh(local.in.sin_port),
                              b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
-                             ntohs(remote.in.sin_port)) < 0)
+                             be16toh(remote.in.sin_port)) < 0)
                         return -ENOMEM;
 
                 break;
@@ -762,9 +762,9 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
                                      "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
                                      nr,
                                      a[0], a[1], a[2], a[3],
-                                     ntohs(local.in6.sin6_port),
+                                     be16toh(local.in6.sin6_port),
                                      b[0], b[1], b[2], b[3],
-                                     ntohs(remote.in6.sin6_port)) < 0)
+                                     be16toh(remote.in6.sin6_port)) < 0)
                                 return -ENOMEM;
                 } else {
                         char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
@@ -773,9 +773,9 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
                                      "%u-%s:%u-%s:%u",
                                      nr,
                                      inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
-                                     ntohs(local.in6.sin6_port),
+                                     be16toh(local.in6.sin6_port),
                                      inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
-                                     ntohs(remote.in6.sin6_port)) < 0)
+                                     be16toh(remote.in6.sin6_port)) < 0)
                                 return -ENOMEM;
                 }
 
diff --git a/src/grp-system/libcore/transaction.c b/src/grp-system/libcore/transaction.c
index d19e19f978..aa57eee556 100644
--- a/src/grp-system/libcore/transaction.c
+++ b/src/grp-system/libcore/transaction.c
@@ -374,7 +374,7 @@ static int transaction_verify_order_one(Transaction *tr, Job *j, Job *from, unsi
                 delete = NULL;
                 for (k = from; k; k = ((k->generation == generation && k->marker != k) ? k->marker : NULL)) {
 
-                        /* logging for j not k here here to provide consistent narrative */
+                        /* logging for j not k here to provide consistent narrative */
                         log_unit_warning(j->unit,
                                          "Found dependency on %s/%s",
                                          k->unit->id, job_type_to_string(k->type));
@@ -393,7 +393,7 @@ static int transaction_verify_order_one(Transaction *tr, Job *j, Job *from, unsi
 
                 if (delete) {
                         const char *status;
-                        /* logging for j not k here here to provide consistent narrative */
+                        /* logging for j not k here to provide consistent narrative */
                         log_unit_warning(j->unit,
                                          "Breaking ordering cycle by deleting job %s/%s",
                                          delete->unit->id, job_type_to_string(delete->type));
@@ -592,6 +592,9 @@ static int transaction_apply(Transaction *tr, Manager *m, JobMode mode) {
                 HASHMAP_FOREACH(j, m->jobs, i) {
                         assert(j->installed);
 
+                        if (j->unit->ignore_on_isolate)
+                                continue;
+
                         if (hashmap_get(tr->jobs, j->unit))
                                 continue;
 
diff --git a/src/grp-system/libcore/unit.c b/src/grp-system/libcore/unit.c
index f539c3971d..aff4dbd2ca 100644
--- a/src/grp-system/libcore/unit.c
+++ b/src/grp-system/libcore/unit.c
@@ -101,6 +101,7 @@ Unit *unit_new(Manager *m, size_t size) {
         u->on_failure_job_mode = JOB_REPLACE;
         u->cgroup_inotify_wd = -1;
         u->job_timeout = USEC_INFINITY;
+        u->sigchldgen = 0;
 
         RATELIMIT_INIT(u->start_limit, m->default_start_limit_interval, m->default_start_limit_burst);
         RATELIMIT_INIT(u->auto_stop_ratelimit, 10 * USEC_PER_SEC, 16);
@@ -1683,7 +1684,7 @@ static void unit_check_unneeded(Unit *u) {
                         if (unit_active_or_pending(other))
                                 return;
 
-        /* If stopping a unit fails continously we might enter a stop
+        /* If stopping a unit fails continuously we might enter a stop
          * loop here, hence stop acting on the service being
          * unnecessary after a while. */
         if (!ratelimit_test(&u->auto_stop_ratelimit)) {
@@ -1728,7 +1729,7 @@ static void unit_check_binds_to(Unit *u) {
         if (!stop)
                 return;
 
-        /* If stopping a unit fails continously we might enter a stop
+        /* If stopping a unit fails continuously we might enter a stop
          * loop here, hence stop acting on the service being
          * unnecessary after a while. */
         if (!ratelimit_test(&u->auto_stop_ratelimit)) {
@@ -3144,7 +3145,7 @@ int unit_kill_common(
                 if (!pid_set)
                         return -ENOMEM;
 
-                q = cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, signo, false, false, false, pid_set);
+                q = cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, signo, 0, pid_set, NULL, NULL);
                 if (q < 0 && q != -EAGAIN && q != -ESRCH && q != -ENOENT)
                         r = q;
                 else
@@ -3356,7 +3357,7 @@ static const char* unit_drop_in_dir(Unit *u, UnitSetPropertiesMode mode) {
 
 int unit_write_drop_in(Unit *u, UnitSetPropertiesMode mode, const char *name, const char *data) {
         _cleanup_free_ char *p = NULL, *q = NULL;
-        const char *dir, *prefixed;
+        const char *dir, *wrapped;
         int r;
 
         assert(u);
@@ -3365,6 +3366,7 @@ int unit_write_drop_in(Unit *u, UnitSetPropertiesMode mode, const char *name, co
                 /* When this is a transient unit file in creation, then let's not create a new drop-in but instead
                  * write to the transient unit file. */
                 fputs(data, u->transient_file);
+                fputc('\n', u->transient_file);
                 return 0;
         }
 
@@ -3375,15 +3377,17 @@ int unit_write_drop_in(Unit *u, UnitSetPropertiesMode mode, const char *name, co
         if (!dir)
                 return -EINVAL;
 
-        prefixed = strjoina("# This is a drop-in unit file extension, created via \"systemctl set-property\" or an equivalent operation. Do not edit.\n",
-                            data);
+        wrapped = strjoina("# This is a drop-in unit file extension, created via \"systemctl set-property\"\n"
+                           "# or an equivalent operation. Do not edit.\n",
+                           data,
+                           "\n");
 
         r = drop_in_file(dir, u->id, 50, name, &p, &q);
         if (r < 0)
                 return r;
 
         (void) mkdir_p(p, 0755);
-        r = write_string_file_atomic_label(q, prefixed);
+        r = write_string_file_atomic_label(q, wrapped);
         if (r < 0)
                 return r;
 
@@ -3502,7 +3506,6 @@ int unit_make_transient(Unit *u) {
 
         unit_add_to_dbus_queue(u);
         unit_add_to_gc_queue(u);
-        unit_add_to_load_queue(u);
 
         fputs("# This is a transient unit file, created programmatically via the systemd API. Do not edit.\n",
               u->transient_file);
@@ -3510,6 +3513,43 @@ int unit_make_transient(Unit *u) {
         return 0;
 }
 
+static void log_kill(pid_t pid, int sig, void *userdata) {
+        _cleanup_free_ char *comm = NULL;
+
+        (void) get_process_comm(pid, &comm);
+
+        /* Don't log about processes marked with brackets, under the assumption that these are temporary processes
+           only, like for example systemd's own PAM stub process. */
+        if (comm && comm[0] == '(')
+                return;
+
+        log_unit_notice(userdata,
+                        "Killing process " PID_FMT " (%s) with signal SIG%s.",
+                        pid,
+                        strna(comm),
+                        signal_to_string(sig));
+}
+
+static int operation_to_signal(KillContext *c, KillOperation k) {
+        assert(c);
+
+        switch (k) {
+
+        case KILL_TERMINATE:
+        case KILL_TERMINATE_AND_LOG:
+                return c->kill_signal;
+
+        case KILL_KILL:
+                return SIGKILL;
+
+        case KILL_ABORT:
+                return SIGABRT;
+
+        default:
+                assert_not_reached("KillOperation unknown");
+        }
+}
+
 int unit_kill_context(
                 Unit *u,
                 KillContext *c,
@@ -3518,58 +3558,63 @@ int unit_kill_context(
                 pid_t control_pid,
                 bool main_pid_alien) {
 
-        bool wait_for_exit = false;
+        bool wait_for_exit = false, send_sighup;
+        cg_kill_log_func_t log_func;
         int sig, r;
 
         assert(u);
         assert(c);
 
+        /* Kill the processes belonging to this unit, in preparation for shutting the unit down. Returns > 0 if we
+         * killed something worth waiting for, 0 otherwise. */
+
         if (c->kill_mode == KILL_NONE)
                 return 0;
 
-        switch (k) {
-        case KILL_KILL:
-                sig = SIGKILL;
-                break;
-        case KILL_ABORT:
-                sig = SIGABRT;
-                break;
-        case KILL_TERMINATE:
-                sig = c->kill_signal;
-                break;
-        default:
-                assert_not_reached("KillOperation unknown");
-        }
+        sig = operation_to_signal(c, k);
+
+        send_sighup =
+                c->send_sighup &&
+                IN_SET(k, KILL_TERMINATE, KILL_TERMINATE_AND_LOG) &&
+                sig != SIGHUP;
+
+        log_func =
+                k != KILL_TERMINATE ||
+                IN_SET(sig, SIGKILL, SIGABRT) ? log_kill : NULL;
 
         if (main_pid > 0) {
-                r = kill_and_sigcont(main_pid, sig);
+                if (log_func)
+                        log_func(main_pid, sig, u);
 
+                r = kill_and_sigcont(main_pid, sig);
                 if (r < 0 && r != -ESRCH) {
                         _cleanup_free_ char *comm = NULL;
-                        get_process_comm(main_pid, &comm);
+                        (void) get_process_comm(main_pid, &comm);
 
                         log_unit_warning_errno(u, r, "Failed to kill main process " PID_FMT " (%s), ignoring: %m", main_pid, strna(comm));
                 } else {
                         if (!main_pid_alien)
                                 wait_for_exit = true;
 
-                        if (c->send_sighup && k == KILL_TERMINATE)
+                        if (r != -ESRCH && send_sighup)
                                 (void) kill(main_pid, SIGHUP);
                 }
         }
 
         if (control_pid > 0) {
-                r = kill_and_sigcont(control_pid, sig);
+                if (log_func)
+                        log_func(control_pid, sig, u);
 
+                r = kill_and_sigcont(control_pid, sig);
                 if (r < 0 && r != -ESRCH) {
                         _cleanup_free_ char *comm = NULL;
-                        get_process_comm(control_pid, &comm);
+                        (void) get_process_comm(control_pid, &comm);
 
                         log_unit_warning_errno(u, r, "Failed to kill control process " PID_FMT " (%s), ignoring: %m", control_pid, strna(comm));
                 } else {
                         wait_for_exit = true;
 
-                        if (c->send_sighup && k == KILL_TERMINATE)
+                        if (r != -ESRCH && send_sighup)
                                 (void) kill(control_pid, SIGHUP);
                 }
         }
@@ -3583,7 +3628,11 @@ int unit_kill_context(
                 if (!pid_set)
                         return -ENOMEM;
 
-                r = cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, sig, true, k != KILL_TERMINATE, false, pid_set);
+                r = cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path,
+                                      sig,
+                                      CGROUP_SIGCONT|CGROUP_IGNORE_SELF,
+                                      pid_set,
+                                      log_func, u);
                 if (r < 0) {
                         if (r != -EAGAIN && r != -ESRCH && r != -ENOENT)
                                 log_unit_warning_errno(u, r, "Failed to kill control group %s, ignoring: %m", u->cgroup_path);
@@ -3608,14 +3657,18 @@ int unit_kill_context(
                              (detect_container() == 0 && !unit_cgroup_delegate(u)))
                                 wait_for_exit = true;
 
-                        if (c->send_sighup && k != KILL_KILL) {
+                        if (send_sighup) {
                                 set_free(pid_set);
 
                                 pid_set = unit_pid_set(main_pid, control_pid);
                                 if (!pid_set)
                                         return -ENOMEM;
 
-                                cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, SIGHUP, false, true, false, pid_set);
+                                cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path,
+                                                  SIGHUP,
+                                                  CGROUP_IGNORE_SELF,
+                                                  pid_set,
+                                                  NULL, NULL);
                         }
                 }
         }
@@ -3788,7 +3841,7 @@ bool unit_is_pristine(Unit *u) {
         /* Check if the unit already exists or is already around,
          * in a number of different ways. Note that to cater for unit
          * types such as slice, we are generally fine with units that
-         * are marked UNIT_LOADED even even though nothing was
+         * are marked UNIT_LOADED even though nothing was
          * actually loaded, as those unit types don't require a file
          * on disk to validly load. */
 
diff --git a/src/grp-system/libcore/unit.h b/src/grp-system/libcore/unit.h
index 72ceed1fef..3e25bfd32a 100644
--- a/src/grp-system/libcore/unit.h
+++ b/src/grp-system/libcore/unit.h
@@ -37,6 +37,7 @@ typedef struct UnitVTable UnitVTable;
 
 typedef enum KillOperation {
         KILL_TERMINATE,
+        KILL_TERMINATE_AND_LOG,
         KILL_KILL,
         KILL_ABORT,
         _KILL_OPERATION_MAX,
@@ -163,6 +164,9 @@ struct Unit {
          * process SIGCHLD for */
         Set *pids;
 
+        /* Used in sigchld event invocation to avoid repeat events being invoked */
+        uint64_t sigchldgen;
+
         /* Used during GC sweeps */
         unsigned gc_marker;
 
diff --git a/src/grp-system/systemctl/Makefile b/src/grp-system/systemctl/Makefile
index 114e58cb27..afc8ea62cd 100644
--- a/src/grp-system/systemctl/Makefile
+++ b/src/grp-system/systemctl/Makefile
@@ -28,7 +28,7 @@ systemctl_SOURCES = \
 	src/systemctl/systemctl.c
 
 systemctl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 files.out.all += systemctl.completion.bash
 files.out.all += systemctl.completion.zsh
diff --git a/src/grp-system/systemctl/systemctl.c b/src/grp-system/systemctl/systemctl.c
index 63818d07b8..0f115db14c 100644
--- a/src/grp-system/systemctl/systemctl.c
+++ b/src/grp-system/systemctl/systemctl.c
@@ -58,6 +58,7 @@
 #include "basic/process-util.h"
 #include "basic/rlimit-util.h"
 #include "basic/set.h"
+#include "basic/sigbus.h"
 #include "basic/signal-util.h"
 #include "basic/socket-util.h"
 #include "basic/special.h"
@@ -86,6 +87,25 @@
 #include "shared/spawn-polkit-agent.h"
 #include "shared/utmp-wtmp.h"
 
+/* The init script exit status codes
+   0       program is running or service is OK
+   1       program is dead and /var/run pid file exists
+   2       program is dead and /var/lock lock file exists
+   3       program is not running
+   4       program or service status is unknown
+   5-99    reserved for future LSB use
+   100-149 reserved for distribution use
+   150-199 reserved for application use
+   200-254 reserved
+*/
+enum {
+        EXIT_PROGRAM_RUNNING_OR_SERVICE_OK        = 0,
+        EXIT_PROGRAM_DEAD_AND_PID_EXISTS          = 1,
+        EXIT_PROGRAM_DEAD_AND_LOCK_FILE_EXISTS    = 2,
+        EXIT_PROGRAM_NOT_RUNNING                  = 3,
+        EXIT_PROGRAM_OR_SERVICES_STATUS_UNKNOWN   = 4,
+};
+
 static char **arg_types = NULL;
 static char **arg_states = NULL;
 static char **arg_properties = NULL;
@@ -155,6 +175,7 @@ static bool arg_firmware_setup = false;
 static bool arg_now = false;
 
 static int daemon_reload(int argc, char *argv[], void* userdata);
+static int trivial_method(int argc, char *argv[], void *userdata);
 static int halt_now(enum action a);
 static int get_state_one_unit(sd_bus *bus, const char *name, UnitActiveState *active_state);
 
@@ -204,6 +225,21 @@ static void release_busses(void) {
                 busses[w] = sd_bus_flush_close_unref(busses[w]);
 }
 
+static int map_string_no_copy(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_error *error, void *userdata) {
+        char *s;
+        const char **p = userdata;
+        int r;
+
+        r = sd_bus_message_read_basic(m, SD_BUS_TYPE_STRING, &s);
+        if (r < 0)
+                return r;
+
+        if (!isempty(s))
+                *p = s;
+
+        return 0;
+}
+
 static void ask_password_agent_open_if_enabled(void) {
 
         /* Open the password agent as a child process if necessary */
@@ -568,7 +604,8 @@ static int get_unit_list(
                 return bus_log_create_error(r);
 
         r = sd_bus_call(bus, m, 0, &error, &reply);
-        if (r < 0 && sd_bus_error_has_name(&error, SD_BUS_ERROR_UNKNOWN_METHOD)) {
+        if (r < 0 && (sd_bus_error_has_name(&error, SD_BUS_ERROR_UNKNOWN_METHOD) ||
+                      sd_bus_error_has_name(&error, SD_BUS_ERROR_ACCESS_DENIED))) {
                 /* Fallback to legacy ListUnitsFiltered method */
                 fallback = true;
                 log_debug_errno(r, "Failed to list units: %s Falling back to ListUnitsFiltered method.", bus_error_message(&error, r));
@@ -714,12 +751,12 @@ static int list_units(int argc, char *argv[], void *userdata) {
         sd_bus *bus;
         int r;
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        pager_open(arg_no_pager, false);
+
         r = get_unit_list_recursive(bus, strv_skip(argv, 1), &unit_infos, &replies, &machines);
         if (r < 0)
                 return r;
@@ -926,12 +963,12 @@ static int list_sockets(int argc, char *argv[], void *userdata) {
         int r = 0, n;
         sd_bus *bus;
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        pager_open(arg_no_pager, false);
+
         n = get_unit_list_recursive(bus, strv_skip(argv, 1), &unit_infos, &replies, &machines);
         if (n < 0)
                 return n;
@@ -1233,12 +1270,12 @@ static int list_timers(int argc, char *argv[], void *userdata) {
         sd_bus *bus;
         int r = 0;
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        pager_open(arg_no_pager, false);
+
         n = get_unit_list_recursive(bus, strv_skip(argv, 1), &unit_infos, &replies, &machines);
         if (n < 0)
                 return n;
@@ -1404,8 +1441,6 @@ static int list_unit_files(int argc, char *argv[], void *userdata) {
         int r;
         bool fallback = false;
 
-        pager_open(arg_no_pager, false);
-
         if (install_client_side()) {
                 Hashmap *h;
                 UnitFileList *u;
@@ -1520,6 +1555,8 @@ static int list_unit_files(int argc, char *argv[], void *userdata) {
                         return bus_log_parse_error(r);
         }
 
+        pager_open(arg_no_pager, false);
+
         qsort_safe(units, c, sizeof(UnitFileList), compare_unit_file_list);
         output_unit_file_list(units, c);
 
@@ -1768,12 +1805,12 @@ static int list_dependencies(int argc, char *argv[], void *userdata) {
         } else
                 u = SPECIAL_DEFAULT_TARGET;
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        pager_open(arg_no_pager, false);
+
         puts(u);
 
         return list_dependencies_one(bus, u, 0, &units, 0);
@@ -1799,12 +1836,12 @@ static const struct bus_properties_map machine_info_property_map[] = {
 };
 
 static void machine_info_clear(struct machine_info *info) {
-        if (info) {
-                free(info->name);
-                free(info->state);
-                free(info->control_group);
-                zero(*info);
-        }
+        assert(info);
+
+        free(info->name);
+        free(info->state);
+        free(info->control_group);
+        zero(*info);
 }
 
 static void free_machines_list(struct machine_info *machine_infos, int n) {
@@ -1999,8 +2036,6 @@ static int list_machines(int argc, char *argv[], void *userdata) {
                 return -EPERM;
         }
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
@@ -2009,6 +2044,8 @@ static int list_machines(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return r;
 
+        pager_open(arg_no_pager, false);
+
         qsort_safe(machine_infos, r, sizeof(struct machine_info), compare_machine_info);
         output_machines_list(machine_infos, r);
         free_machines_list(machine_infos, r);
@@ -2212,8 +2249,6 @@ static int list_jobs(int argc, char *argv[], void *userdata) {
         int r;
         bool skipped = false;
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
@@ -2254,6 +2289,8 @@ static int list_jobs(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return bus_log_parse_error(r);
 
+        pager_open(arg_no_pager, false);
+
         output_jobs_list(jobs, c, skipped);
         return 0;
 }
@@ -2264,14 +2301,14 @@ static int cancel_job(int argc, char *argv[], void *userdata) {
         int r = 0;
 
         if (argc <= 1)
-                return daemon_reload(argc, argv, userdata);
-
-        polkit_agent_open_if_enabled();
+                return trivial_method(argc, argv, userdata);
 
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        polkit_agent_open_if_enabled();
+
         STRV_FOREACH(name, strv_skip(argv, 1)) {
                 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
                 uint32_t id;
@@ -2478,7 +2515,7 @@ static int unit_find_paths(
                 r = 1;
         }
 
-        if (r == 0)
+        if (r == 0 && !arg_force)
                 log_error("No files found for %s.", unit_name);
 
         return r;
@@ -2674,10 +2711,9 @@ static int start_unit_one(
         if (r < 0) {
                 const char *verb;
 
-                if (r == -ENOENT && arg_action != ACTION_SYSTEMCTL)
-                        /* There's always a fallback possible for
-                         * legacy actions. */
-                        return -EADDRNOTAVAIL;
+                /* There's always a fallback possible for legacy actions. */
+                if (arg_action != ACTION_SYSTEMCTL)
+                        return r;
 
                 verb = method_to_verb(method);
 
@@ -2808,13 +2844,13 @@ static int start_unit(int argc, char *argv[], void *userdata) {
         char **name;
         int r = 0;
 
-        ask_password_agent_open_if_enabled();
-        polkit_agent_open_if_enabled();
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        ask_password_agent_open_if_enabled();
+        polkit_agent_open_if_enabled();
+
         if (arg_action == ACTION_SYSTEMCTL) {
                 enum action action;
 
@@ -2934,9 +2970,6 @@ static int logind_reboot(enum action a) {
         sd_bus *bus;
         int r;
 
-        polkit_agent_open_if_enabled();
-        (void) logind_set_wall_message();
-
         r = acquire_bus(BUS_FULL, &bus);
         if (r < 0)
                 return r;
@@ -2972,6 +3005,9 @@ static int logind_reboot(enum action a) {
                 return -EINVAL;
         }
 
+        polkit_agent_open_if_enabled();
+        (void) logind_set_wall_message();
+
         r = sd_bus_call_method(
                         bus,
                         "org.freedesktop.login1",
@@ -3013,6 +3049,9 @@ static int logind_check_inhibitors(enum action a) {
         if (!on_tty())
                 return 0;
 
+        if (arg_transport != BUS_TRANSPORT_LOCAL)
+                return 0;
+
         r = acquire_bus(BUS_FULL, &bus);
         if (r < 0)
                 return r;
@@ -3233,7 +3272,7 @@ static int start_special(int argc, char *argv[], void *userdata) {
                    ACTION_REBOOT,
                    ACTION_KEXEC,
                    ACTION_EXIT))
-                return daemon_reload(argc, argv, userdata);
+                return trivial_method(argc, argv, userdata);
 
         /* First try logind, to allow authentication with polkit */
         if (IN_SET(a,
@@ -3255,6 +3294,18 @@ static int start_special(int argc, char *argv[], void *userdata) {
         return start_unit(argc, argv, userdata);
 }
 
+static int start_system_special(int argc, char *argv[], void *userdata) {
+        /* Like start_special above, but raises an error when running in user mode */
+
+        if (arg_scope != UNIT_FILE_SYSTEM) {
+                log_error("Bad action for %s mode.",
+                          arg_scope == UNIT_FILE_GLOBAL ? "--global" : "--user");
+                return -EINVAL;
+        }
+
+        return start_special(argc, argv, userdata);
+}
+
 static int check_unit_generic(int code, const UnitActiveState good_states[], int nb_states, char **args) {
         _cleanup_strv_free_ char **names = NULL;
         UnitActiveState active_state;
@@ -3292,12 +3343,12 @@ static int check_unit_generic(int code, const UnitActiveState good_states[], int
 static int check_unit_active(int argc, char *argv[], void *userdata) {
         const UnitActiveState states[] = { UNIT_ACTIVE, UNIT_RELOADING };
         /* According to LSB: 3, "program is not running" */
-        return check_unit_generic(3, states, ELEMENTSOF(states), strv_skip(argv, 1));
+        return check_unit_generic(EXIT_PROGRAM_NOT_RUNNING, states, ELEMENTSOF(states), strv_skip(argv, 1));
 }
 
 static int check_unit_failed(int argc, char *argv[], void *userdata) {
         const UnitActiveState states[] = { UNIT_FAILED };
-        return check_unit_generic(1, states, ELEMENTSOF(states), strv_skip(argv, 1));
+        return check_unit_generic(EXIT_PROGRAM_DEAD_AND_PID_EXISTS, states, ELEMENTSOF(states), strv_skip(argv, 1));
 }
 
 static int kill_unit(int argc, char *argv[], void *userdata) {
@@ -3306,12 +3357,12 @@ static int kill_unit(int argc, char *argv[], void *userdata) {
         sd_bus *bus;
         int r, q;
 
-        polkit_agent_open_if_enabled();
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        polkit_agent_open_if_enabled();
+
         if (!arg_kill_who)
                 arg_kill_who = "all";
 
@@ -3423,6 +3474,27 @@ static int exec_status_info_deserialize(sd_bus_message *m, ExecStatusInfo *i) {
         return 1;
 }
 
+typedef struct UnitCondition {
+        char *name;
+        char *param;
+        bool trigger;
+        bool negate;
+        int tristate;
+
+        LIST_FIELDS(struct UnitCondition, conditions);
+} UnitCondition;
+
+static void unit_condition_free(UnitCondition *c) {
+        if (!c)
+                return;
+
+        free(c->name);
+        free(c->param);
+        free(c);
+}
+
+DEFINE_TRIVIAL_CLEANUP_FUNC(UnitCondition*, unit_condition_free);
+
 typedef struct UnitStatusInfo {
         const char *id;
         const char *load_state;
@@ -3469,10 +3541,7 @@ typedef struct UnitStatusInfo {
 
         usec_t condition_timestamp;
         bool condition_result;
-        bool failed_condition_trigger;
-        bool failed_condition_negate;
-        const char *failed_condition;
-        const char *failed_condition_parameter;
+        LIST_HEAD(UnitCondition, conditions);
 
         usec_t assert_timestamp;
         bool assert_result;
@@ -3500,6 +3569,9 @@ typedef struct UnitStatusInfo {
 
         /* CGroup */
         uint64_t memory_current;
+        uint64_t memory_low;
+        uint64_t memory_high;
+        uint64_t memory_max;
         uint64_t memory_limit;
         uint64_t cpu_usage_nsec;
         uint64_t tasks_current;
@@ -3508,6 +3580,25 @@ typedef struct UnitStatusInfo {
         LIST_HEAD(ExecStatusInfo, exec);
 } UnitStatusInfo;
 
+static void unit_status_info_free(UnitStatusInfo *info) {
+        ExecStatusInfo *p;
+        UnitCondition *c;
+
+        strv_free(info->documentation);
+        strv_free(info->dropin_paths);
+        strv_free(info->listen);
+
+        while ((c = info->conditions)) {
+                LIST_REMOVE(conditions, info->conditions, c);
+                unit_condition_free(c);
+        }
+
+        while ((p = info->exec)) {
+                LIST_REMOVE(exec, info->exec, p);
+                exec_status_info_free(p);
+        }
+}
+
 static void print_status_info(
                 sd_bus *bus,
                 UnitStatusInfo *i,
@@ -3629,19 +3720,28 @@ static void print_status_info(
                 printf("\n");
 
         if (!i->condition_result && i->condition_timestamp > 0) {
+                UnitCondition *c;
+                int n = 0;
+
                 s1 = format_timestamp_relative(since1, sizeof(since1), i->condition_timestamp);
                 s2 = format_timestamp(since2, sizeof(since2), i->condition_timestamp);
 
                 printf("Condition: start %scondition failed%s at %s%s%s\n",
                        ansi_highlight_yellow(), ansi_normal(),
                        s2, s1 ? "; " : "", strempty(s1));
-                if (i->failed_condition_trigger)
-                        printf("           none of the trigger conditions were met\n");
-                else if (i->failed_condition)
-                        printf("           %s=%s%s was not met\n",
-                               i->failed_condition,
-                               i->failed_condition_negate ? "!" : "",
-                               i->failed_condition_parameter);
+
+                LIST_FOREACH(conditions, c, i->conditions)
+                        if (c->tristate < 0)
+                                n++;
+
+                LIST_FOREACH(conditions, c, i->conditions)
+                        if (c->tristate < 0)
+                                printf("           %s %s=%s%s%s was not met\n",
+                                       --n ? special_glyph(TREE_BRANCH) : special_glyph(TREE_RIGHT),
+                                       c->name,
+                                       c->trigger ? "|" : "",
+                                       c->negate ? "!" : "",
+                                       c->param);
         }
 
         if (!i->assert_result && i->assert_timestamp > 0) {
@@ -3726,7 +3826,7 @@ static void print_status_info(
 
                         if (i->running) {
                                 _cleanup_free_ char *comm = NULL;
-                                get_process_comm(i->main_pid, &comm);
+                                (void) get_process_comm(i->main_pid, &comm);
                                 if (comm)
                                         printf(" (%s)", comm);
                         } else if (i->exit_code > 0) {
@@ -3745,17 +3845,19 @@ static void print_status_info(
                                         printf("signal=%s", signal_to_string(i->exit_status));
                                 printf(")");
                         }
-
-                        if (i->control_pid > 0)
-                                printf(";");
                 }
 
                 if (i->control_pid > 0) {
                         _cleanup_free_ char *c = NULL;
 
-                        printf(" %8s: "PID_FMT, i->main_pid ? "" : " Control", i->control_pid);
+                        if (i->main_pid > 0)
+                                fputs("; Control PID: ", stdout);
+                        else
+                                fputs("Cntrl PID: ", stdout); /* if first in column, abbreviated so it fits alignment */
 
-                        get_process_comm(i->control_pid, &c);
+                        printf(PID_FMT, i->control_pid);
+
+                        (void) get_process_comm(i->control_pid, &c);
                         if (c)
                                 printf(" (%s)", c);
                 }
@@ -3772,7 +3874,7 @@ static void print_status_info(
                 printf("    Tasks: %" PRIu64, i->tasks_current);
 
                 if (i->tasks_max != (uint64_t) -1)
-                        printf(" (limit: %" PRIi64 ")\n", i->tasks_max);
+                        printf(" (limit: %" PRIu64 ")\n", i->tasks_max);
                 else
                         printf("\n");
         }
@@ -3782,10 +3884,30 @@ static void print_status_info(
 
                 printf("   Memory: %s", format_bytes(buf, sizeof(buf), i->memory_current));
 
-                if (i->memory_limit != (uint64_t) -1)
-                        printf(" (limit: %s)\n", format_bytes(buf, sizeof(buf), i->memory_limit));
-                else
-                        printf("\n");
+                if (i->memory_low > 0 || i->memory_high != CGROUP_LIMIT_MAX || i->memory_max != CGROUP_LIMIT_MAX ||
+                    i->memory_limit != CGROUP_LIMIT_MAX) {
+                        const char *prefix = "";
+
+                        printf(" (");
+                        if (i->memory_low > 0) {
+                                printf("%slow: %s", prefix, format_bytes(buf, sizeof(buf), i->memory_low));
+                                prefix = " ";
+                        }
+                        if (i->memory_high != CGROUP_LIMIT_MAX) {
+                                printf("%shigh: %s", prefix, format_bytes(buf, sizeof(buf), i->memory_high));
+                                prefix = " ";
+                        }
+                        if (i->memory_max != CGROUP_LIMIT_MAX) {
+                                printf("%smax: %s", prefix, format_bytes(buf, sizeof(buf), i->memory_max));
+                                prefix = " ";
+                        }
+                        if (i->memory_limit != CGROUP_LIMIT_MAX) {
+                                printf("%slimit: %s", prefix, format_bytes(buf, sizeof(buf), i->memory_limit));
+                                prefix = " ";
+                        }
+                        printf(")");
+                }
+                printf("\n");
         }
 
         if (i->cpu_usage_nsec != (uint64_t) -1) {
@@ -3793,14 +3915,13 @@ static void print_status_info(
                 printf("      CPU: %s\n", format_timespan(buf, sizeof(buf), i->cpu_usage_nsec / NSEC_PER_USEC, USEC_PER_MSEC));
         }
 
-        if (i->control_group)
-                printf("   CGroup: %s\n", i->control_group);
-
-        {
+        if (i->control_group) {
                 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
                 static const char prefix[] = "           ";
                 unsigned c;
 
+                printf("   CGroup: %s\n", i->control_group);
+
                 c = columns();
                 if (c > sizeof(prefix) - 1)
                         c -= sizeof(prefix) - 1;
@@ -4014,6 +4135,12 @@ static int status_property(const char *name, sd_bus_message *m, UnitStatusInfo *
                         i->assert_timestamp = (usec_t) u;
                 else if (streq(name, "MemoryCurrent"))
                         i->memory_current = u;
+                else if (streq(name, "MemoryLow"))
+                        i->memory_low = u;
+                else if (streq(name, "MemoryHigh"))
+                        i->memory_high = u;
+                else if (streq(name, "MemoryMax"))
+                        i->memory_max = u;
                 else if (streq(name, "MemoryLimit"))
                         i->memory_limit = u;
                 else if (streq(name, "TasksCurrent"))
@@ -4109,13 +4236,25 @@ static int status_property(const char *name, sd_bus_message *m, UnitStatusInfo *
                                 return bus_log_parse_error(r);
 
                         while ((r = sd_bus_message_read(m, "(sbbsi)", &cond, &trigger, &negate, &param, &state)) > 0) {
-                                log_debug("%s %d %d %s %d", cond, trigger, negate, param, state);
-                                if (state < 0 && (!trigger || !i->failed_condition)) {
-                                        i->failed_condition = cond;
-                                        i->failed_condition_trigger = trigger;
-                                        i->failed_condition_negate = negate;
-                                        i->failed_condition_parameter = param;
-                                }
+                                _cleanup_(unit_condition_freep) UnitCondition *c = NULL;
+
+                                log_debug("%s trigger=%d negate=%d %s →%d", cond, trigger, negate, param, state);
+
+                                c = new0(UnitCondition, 1);
+                                if (!c)
+                                        return log_oom();
+
+                                c->name = strdup(cond);
+                                c->param = strdup(param);
+                                if (!c->name || !c->param)
+                                        return log_oom();
+
+                                c->trigger = trigger;
+                                c->negate = negate;
+                                c->tristate = state;
+
+                                LIST_PREPEND(conditions, i->conditions, c);
+                                c = NULL;
                         }
                         if (r < 0)
                                 return bus_log_parse_error(r);
@@ -4307,7 +4446,7 @@ static int print_property(const char *name, sd_bus_message *m, const char *conte
                                 return bus_log_parse_error(r);
 
                         while ((r = sd_bus_message_read(m, "(sb)", &path, &ignore)) > 0)
-                                print_prop("EnvironmentFile", "%s (ignore_errors=%s)\n", path, yes_no(ignore));
+                                print_prop("EnvironmentFile", "%s (ignore_errors=%s)", path, yes_no(ignore));
 
                         if (r < 0)
                                 return bus_log_parse_error(r);
@@ -4499,20 +4638,29 @@ static int show_one(
                 const char *verb,
                 sd_bus *bus,
                 const char *path,
+                const char *unit,
                 bool show_properties,
                 bool *new_line,
                 bool *ellipsized) {
 
+        static const struct bus_properties_map property_map[] = {
+                { "LoadState",   "s", map_string_no_copy, offsetof(UnitStatusInfo, load_state)   },
+                { "ActiveState", "s", map_string_no_copy, offsetof(UnitStatusInfo, active_state) },
+                {}
+        };
+
         _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
-        UnitStatusInfo info = {
+        _cleanup_set_free_ Set *found_properties = NULL;
+        _cleanup_(unit_status_info_free) UnitStatusInfo info = {
                 .memory_current = (uint64_t) -1,
+                .memory_high = CGROUP_LIMIT_MAX,
+                .memory_max = CGROUP_LIMIT_MAX,
                 .memory_limit = (uint64_t) -1,
                 .cpu_usage_nsec = (uint64_t) -1,
                 .tasks_current = (uint64_t) -1,
                 .tasks_max = (uint64_t) -1,
         };
-        ExecStatusInfo *p;
         int r;
 
         assert(path);
@@ -4532,6 +4680,25 @@ static int show_one(
         if (r < 0)
                 return log_error_errno(r, "Failed to get properties: %s", bus_error_message(&error, r));
 
+        if (unit) {
+                r = bus_message_map_all_properties(reply, property_map, &info);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to map properties: %s", bus_error_message(&error, r));
+
+                if (streq_ptr(info.load_state, "not-found") && streq_ptr(info.active_state, "inactive")) {
+                        log_error("Unit %s could not be found.", unit);
+
+                        if (streq(verb, "status"))
+                                return EXIT_PROGRAM_OR_SERVICES_STATUS_UNKNOWN;
+
+                        return -ENOENT;
+                }
+
+                r = sd_bus_message_rewind(reply, true);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to rewind: %s", bus_error_message(&error, r));
+        }
+
         r = sd_bus_message_enter_container(reply, SD_BUS_TYPE_ARRAY, "{sv}");
         if (r < 0)
                 return bus_log_parse_error(r);
@@ -4556,9 +4723,17 @@ static int show_one(
                 if (r < 0)
                         return bus_log_parse_error(r);
 
-                if (show_properties)
+                if (show_properties) {
+                        r = set_ensure_allocated(&found_properties, &string_hash_ops);
+                        if (r < 0)
+                                return log_oom();
+
+                        r = set_put(found_properties, name);
+                        if (r < 0 && r != EEXIST)
+                                return log_oom();
+
                         r = print_property(name, reply, contents);
-                else
+                } else
                         r = status_property(name, reply, &info, contents);
                 if (r < 0)
                         return r;
@@ -4579,37 +4754,24 @@ static int show_one(
                 return bus_log_parse_error(r);
 
         r = 0;
+        if (show_properties) {
+                char **pp;
 
-        if (!show_properties) {
-                if (streq(verb, "help"))
-                        show_unit_help(&info);
-                else
-                        print_status_info(bus, &info, ellipsized);
-        }
-
-        strv_free(info.documentation);
-        strv_free(info.dropin_paths);
-        strv_free(info.listen);
-
-        if (!streq_ptr(info.active_state, "active") &&
-            !streq_ptr(info.active_state, "reloading") &&
-            streq(verb, "status")) {
-                /* According to LSB: "program not running" */
-                /* 0: program is running or service is OK
-                 * 1: program is dead and /run PID file exists
-                 * 2: program is dead and /run/lock lock file exists
-                 * 3: program is not running
-                 * 4: program or service status is unknown
-                 */
-                if (info.pid_file && access(info.pid_file, F_OK) == 0)
-                        r = 1;
-                else
-                        r = 3;
-        }
+                STRV_FOREACH(pp, arg_properties)
+                        if (!set_contains(found_properties, *pp)) {
+                                log_warning("Property %s does not exist.", *pp);
+                                r = -ENXIO;
+                        }
 
-        while ((p = info.exec)) {
-                LIST_REMOVE(exec, info.exec, p);
-                exec_status_info_free(p);
+        } else if (streq(verb, "help"))
+                show_unit_help(&info);
+        else if (streq(verb, "status")) {
+                print_status_info(bus, &info, ellipsized);
+
+                if (info.active_state && STR_IN_SET(info.active_state, "inactive", "failed"))
+                        r = EXIT_PROGRAM_NOT_RUNNING;
+                else
+                        r = EXIT_PROGRAM_RUNNING_OR_SERVICE_OK;
         }
 
         return r;
@@ -4679,7 +4841,7 @@ static int show_all(
                 if (!p)
                         return log_oom();
 
-                r = show_one(verb, bus, p, show_properties, new_line, ellipsized);
+                r = show_one(verb, bus, p, u->id, show_properties, new_line, ellipsized);
                 if (r < 0)
                         return r;
                 else if (r > 0 && ret == 0)
@@ -4761,6 +4923,10 @@ static int show(int argc, char *argv[], void *userdata) {
                 return -EINVAL;
         }
 
+        r = acquire_bus(BUS_MANAGER, &bus);
+        if (r < 0)
+                return r;
+
         pager_open(arg_no_pager, false);
 
         if (show_status)
@@ -4769,17 +4935,12 @@ static int show(int argc, char *argv[], void *userdata) {
                  * be split up into many files. */
                 setrlimit_closest(RLIMIT_NOFILE, &RLIMIT_MAKE_CONST(16384));
 
-        r = acquire_bus(BUS_MANAGER, &bus);
-        if (r < 0)
-                return r;
-
         /* If no argument is specified inspect the manager itself */
         if (show_properties && argc <= 1)
-                return show_one(argv[0], bus, "/org/freedesktop/systemd1", show_properties, &new_line, &ellipsized);
+                return show_one(argv[0], bus, "/org/freedesktop/systemd1", NULL, show_properties, &new_line, &ellipsized);
 
         if (show_status && argc <= 1) {
 
-                pager_open(arg_no_pager, false);
                 show_system_status(bus);
                 new_line = true;
 
@@ -4790,7 +4951,7 @@ static int show(int argc, char *argv[], void *userdata) {
                 char **name;
 
                 STRV_FOREACH(name, strv_skip(argv, 1)) {
-                        _cleanup_free_ char *unit = NULL;
+                        _cleanup_free_ char *path = NULL, *unit = NULL;
                         uint32_t id;
 
                         if (safe_atou32(*name, &id) < 0) {
@@ -4800,19 +4961,23 @@ static int show(int argc, char *argv[], void *userdata) {
                                 continue;
                         } else if (show_properties) {
                                 /* Interpret as job id */
-                                if (asprintf(&unit, "/org/freedesktop/systemd1/job/%u", id) < 0)
+                                if (asprintf(&path, "/org/freedesktop/systemd1/job/%u", id) < 0)
                                         return log_oom();
 
                         } else {
                                 /* Interpret as PID */
-                                r = get_unit_dbus_path_by_pid(bus, id, &unit);
+                                r = get_unit_dbus_path_by_pid(bus, id, &path);
                                 if (r < 0) {
                                         ret = r;
                                         continue;
                                 }
+
+                                r = unit_name_from_dbus_path(path, &unit);
+                                if (r < 0)
+                                        return log_oom();
                         }
 
-                        r = show_one(argv[0], bus, unit, show_properties, &new_line, &ellipsized);
+                        r = show_one(argv[0], bus, path, unit, show_properties, &new_line, &ellipsized);
                         if (r < 0)
                                 return r;
                         else if (r > 0 && ret == 0)
@@ -4827,16 +4992,16 @@ static int show(int argc, char *argv[], void *userdata) {
                                 return log_error_errno(r, "Failed to expand names: %m");
 
                         STRV_FOREACH(name, names) {
-                                _cleanup_free_ char *unit;
+                                _cleanup_free_ char *path;
 
-                                unit = unit_dbus_path_from_name(*name);
-                                if (!unit)
+                                path = unit_dbus_path_from_name(*name);
+                                if (!path)
                                         return log_oom();
 
-                                r = show_one(argv[0], bus, unit, show_properties, &new_line, &ellipsized);
+                                r = show_one(argv[0], bus, path, *name, show_properties, &new_line, &ellipsized);
                                 if (r < 0)
                                         return r;
-                                else if (r > 0 && ret == 0)
+                                if (r > 0 && ret == 0)
                                         ret = r;
                         }
                 }
@@ -4932,12 +5097,12 @@ static int set_property(int argc, char *argv[], void *userdata) {
         char **i;
         int r;
 
-        polkit_agent_open_if_enabled();
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        polkit_agent_open_if_enabled();
+
         r = sd_bus_message_new_method_call(
                         bus,
                         &m,
@@ -4979,36 +5144,87 @@ static int set_property(int argc, char *argv[], void *userdata) {
 
 static int daemon_reload(int argc, char *argv[], void *userdata) {
         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+        _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
         const char *method;
         sd_bus *bus;
         int r;
 
-        polkit_agent_open_if_enabled();
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
-        if (arg_action == ACTION_RELOAD)
+        polkit_agent_open_if_enabled();
+
+        switch (arg_action) {
+
+        case ACTION_RELOAD:
                 method = "Reload";
-        else if (arg_action == ACTION_REEXEC)
+                break;
+
+        case ACTION_REEXEC:
                 method = "Reexecute";
-        else {
-                assert(arg_action == ACTION_SYSTEMCTL);
+                break;
 
-                method =
-                        streq(argv[0], "clear-jobs")    ||
-                        streq(argv[0], "cancel")        ? "ClearJobs" :
-                        streq(argv[0], "daemon-reexec") ? "Reexecute" :
-                        streq(argv[0], "reset-failed")  ? "ResetFailed" :
-                        streq(argv[0], "halt")          ? "Halt" :
-                        streq(argv[0], "poweroff")      ? "PowerOff" :
-                        streq(argv[0], "reboot")        ? "Reboot" :
-                        streq(argv[0], "kexec")         ? "KExec" :
-                        streq(argv[0], "exit")          ? "Exit" :
-                                    /* "daemon-reload" */ "Reload";
+        case ACTION_SYSTEMCTL:
+                method = streq(argv[0], "daemon-reexec") ? "Reexecute" :
+                                     /* "daemon-reload" */ "Reload";
+                break;
+
+        default:
+                assert_not_reached("Unexpected action");
         }
 
+        r = sd_bus_message_new_method_call(
+                        bus,
+                        &m,
+                        "org.freedesktop.systemd1",
+                        "/org/freedesktop/systemd1",
+                        "org.freedesktop.systemd1.Manager",
+                        method);
+        if (r < 0)
+                return bus_log_create_error(r);
+
+        /* Note we use an extra-long timeout here. This is because a reload or reexec means generators are rerun which
+         * are timed out after DEFAULT_TIMEOUT_USEC. Let's use twice that time here, so that the generators can have
+         * their timeout, and for everything else there's the same time budget in place. */
+
+        r = sd_bus_call(bus, m, DEFAULT_TIMEOUT_USEC * 2, &error, NULL);
+
+        /* On reexecution, we expect a disconnect, not a reply */
+        if (IN_SET(r, -ETIMEDOUT, -ECONNRESET) && streq(method, "Reexecute"))
+                r = 0;
+
+        if (r < 0 && arg_action == ACTION_SYSTEMCTL)
+                return log_error_errno(r, "Failed to reload daemon: %s", bus_error_message(&error, r));
+
+        /* Note that for the legacy commands (i.e. those with action != ACTION_SYSTEMCTL) we support fallbacks to the
+         * old ways of doing things, hence don't log any error in that case here. */
+
+        return r < 0 ? r : 0;
+}
+
+static int trivial_method(int argc, char *argv[], void *userdata) {
+        _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+        const char *method;
+        sd_bus *bus;
+        int r;
+
+        r = acquire_bus(BUS_MANAGER, &bus);
+        if (r < 0)
+                return r;
+
+        polkit_agent_open_if_enabled();
+
+        method =
+                streq(argv[0], "clear-jobs")    ||
+                streq(argv[0], "cancel")        ? "ClearJobs" :
+                streq(argv[0], "reset-failed")  ? "ResetFailed" :
+                streq(argv[0], "halt")          ? "Halt" :
+                streq(argv[0], "reboot")        ? "Reboot" :
+                streq(argv[0], "kexec")         ? "KExec" :
+                streq(argv[0], "exit")          ? "Exit" :
+                             /* poweroff */       "PowerOff";
+
         r = sd_bus_call_method(
                         bus,
                         "org.freedesktop.systemd1",
@@ -5018,16 +5234,11 @@ static int daemon_reload(int argc, char *argv[], void *userdata) {
                         &error,
                         NULL,
                         NULL);
-        if (r == -ENOENT && arg_action != ACTION_SYSTEMCTL)
-                /* There's always a fallback possible for
-                 * legacy actions. */
-                r = -EADDRNOTAVAIL;
-        else if ((r == -ETIMEDOUT || r == -ECONNRESET) && streq(method, "Reexecute"))
-                /* On reexecution, we expect a disconnect, not a
-                 * reply */
-                r = 0;
-        else if (r < 0)
-                return log_error_errno(r, "Failed to reload daemon: %s", bus_error_message(&error, r));
+        if (r < 0 && arg_action == ACTION_SYSTEMCTL)
+                return log_error_errno(r, "Failed to execute operation: %s", bus_error_message(&error, r));
+
+        /* Note that for the legacy commands (i.e. those with action != ACTION_SYSTEMCTL) we support fallbacks to the
+         * old ways of doing things, hence don't log any error in that case here. */
 
         return r < 0 ? r : 0;
 }
@@ -5039,14 +5250,14 @@ static int reset_failed(int argc, char *argv[], void *userdata) {
         int r, q;
 
         if (argc <= 1)
-                return daemon_reload(argc, argv, userdata);
-
-        polkit_agent_open_if_enabled();
+                return trivial_method(argc, argv, userdata);
 
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        polkit_agent_open_if_enabled();
+
         r = expand_names(bus, strv_skip(argv, 1), NULL, &names);
         if (r < 0)
                 return log_error_errno(r, "Failed to expand names: %m");
@@ -5080,12 +5291,12 @@ static int show_environment(int argc, char *argv[], void *userdata) {
         sd_bus *bus;
         int r;
 
-        pager_open(arg_no_pager, false);
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        pager_open(arg_no_pager, false);
+
         r = sd_bus_get_property(
                         bus,
                         "org.freedesktop.systemd1",
@@ -5145,9 +5356,7 @@ static int switch_root(int argc, char *argv[], void *userdata) {
                 init = cmdline_init;
         }
 
-        if (isempty(init))
-                init = NULL;
-
+        init = empty_to_null(init);
         if (init) {
                 const char *root_systemd_path = NULL, *root_init_path = NULL;
 
@@ -5191,12 +5400,12 @@ static int set_environment(int argc, char *argv[], void *userdata) {
         assert(argc > 1);
         assert(argv);
 
-        polkit_agent_open_if_enabled();
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        polkit_agent_open_if_enabled();
+
         method = streq(argv[0], "set-environment")
                 ? "SetEnvironment"
                 : "UnsetEnvironment";
@@ -5228,12 +5437,12 @@ static int import_environment(int argc, char *argv[], void *userdata) {
         sd_bus *bus;
         int r;
 
-        polkit_agent_open_if_enabled();
-
         r = acquire_bus(BUS_MANAGER, &bus);
         if (r < 0)
                 return r;
 
+        polkit_agent_open_if_enabled();
+
         r = sd_bus_message_new_method_call(
                         bus,
                         &m,
@@ -5391,10 +5600,8 @@ static int enable_sysv_units(const char *verb, char **args) {
                 }
 
                 j = wait_for_terminate(pid, &status);
-                if (j < 0) {
-                        log_error_errno(j, "Failed to wait for child: %m");
-                        return j;
-                }
+                if (j < 0)
+                        return log_error_errno(j, "Failed to wait for child: %m");
 
                 if (status.si_code == CLD_EXITED) {
                         if (streq(verb, "is-enabled")) {
@@ -5464,6 +5671,46 @@ static int mangle_names(char **original_names, char ***mangled_names) {
         return 0;
 }
 
+static int unit_exists(const char *unit) {
+        _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
+        _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+        _cleanup_free_ char *path = NULL;
+        static const struct bus_properties_map property_map[] = {
+                { "LoadState",   "s", map_string_no_copy, offsetof(UnitStatusInfo, load_state)  },
+                { "ActiveState", "s", map_string_no_copy, offsetof(UnitStatusInfo, active_state)},
+                {},
+        };
+        UnitStatusInfo info = {};
+        sd_bus *bus;
+        int r;
+
+        path = unit_dbus_path_from_name(unit);
+        if (!path)
+                return log_oom();
+
+        r = acquire_bus(BUS_MANAGER, &bus);
+        if (r < 0)
+                return r;
+
+        r = sd_bus_call_method(
+                        bus,
+                        "org.freedesktop.systemd1",
+                        path,
+                        "org.freedesktop.DBus.Properties",
+                        "GetAll",
+                        &error,
+                        &reply,
+                        "s", "");
+        if (r < 0)
+                return log_error_errno(r, "Failed to get properties: %s", bus_error_message(&error, r));
+
+        r = bus_message_map_all_properties(reply, property_map, &info);
+        if (r < 0)
+                return log_error_errno(r, "Failed to map properties: %s", bus_error_message(&error, r));
+
+        return !streq_ptr(info.load_state, "not-found") || !streq_ptr(info.active_state, "inactive");
+}
+
 static int enable_unit(int argc, char *argv[], void *userdata) {
         _cleanup_strv_free_ char **names = NULL;
         const char *verb = argv[0];
@@ -5515,7 +5762,7 @@ static int enable_unit(int argc, char *argv[], void *userdata) {
 
                 unit_file_dump_changes(r, verb, changes, n_changes, arg_quiet);
                 if (r < 0)
-                        return r;
+                        goto finish;
                 r = 0;
         } else {
                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL, *m = NULL;
@@ -5525,12 +5772,20 @@ static int enable_unit(int argc, char *argv[], void *userdata) {
                 const char *method;
                 sd_bus *bus;
 
-                polkit_agent_open_if_enabled();
+                if (STR_IN_SET(verb, "mask", "unmask")) {
+                        r = unit_exists(*names);
+                        if (r < 0)
+                                return r;
+                        if (r == 0)
+                                log_notice("Unit %s does not exist, proceeding anyway.", *names);
+                }
 
                 r = acquire_bus(BUS_MANAGER, &bus);
                 if (r < 0)
                         return r;
 
+                polkit_agent_open_if_enabled();
+
                 if (streq(verb, "enable")) {
                         method = "EnableUnitFiles";
                         expect_carries_install_info = true;
@@ -5607,7 +5862,7 @@ static int enable_unit(int argc, char *argv[], void *userdata) {
 
                 r = bus_deserialize_and_dump_unit_file_changes(reply, arg_quiet, &changes, &n_changes);
                 if (r < 0)
-                        return r;
+                        goto finish;
 
                 /* Try to reload if enabled */
                 if (!arg_no_reload)
@@ -5691,12 +5946,12 @@ static int add_dependency(int argc, char *argv[], void *userdata) {
                 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
                 sd_bus *bus;
 
-                polkit_agent_open_if_enabled();
-
                 r = acquire_bus(BUS_MANAGER, &bus);
                 if (r < 0)
                         return r;
 
+                polkit_agent_open_if_enabled();
+
                 r = sd_bus_message_new_method_call(
                                 bus,
                                 &m,
@@ -5753,12 +6008,12 @@ static int preset_all(int argc, char *argv[], void *userdata) {
                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
                 sd_bus *bus;
 
-                polkit_agent_open_if_enabled();
-
                 r = acquire_bus(BUS_MANAGER, &bus);
                 if (r < 0)
                         return r;
 
+                polkit_agent_open_if_enabled();
+
                 r = sd_bus_call_method(
                                 bus,
                                 "org.freedesktop.systemd1",
@@ -5929,7 +6184,7 @@ static int create_edit_temp_file(const char *new_path, const char *original_path
                         return log_error_errno(r, "Failed to create temporary file \"%s\": %m", t);
 
         } else if (r < 0)
-                return log_error_errno(r, "Failed to copy \"%s\" to \"%s\": %m", original_path, t);
+                return log_error_errno(r, "Failed to create temporary file for \"%s\": %m", new_path);
 
         *ret_tmp_fn = t;
         t = NULL;
@@ -5952,7 +6207,7 @@ static int get_file_to_edit(
                 return log_oom();
 
         if (arg_runtime) {
-                run = strjoin(paths->runtime_config, name, NULL);
+                run = strjoin(paths->runtime_config, "/", name, NULL);
                 if (!run)
                         return log_oom();
         }
@@ -5973,9 +6228,10 @@ static int get_file_to_edit(
         return 0;
 }
 
-static int unit_file_create_dropin(
+static int unit_file_create_new(
                 const LookupPaths *paths,
                 const char *unit_name,
+                const char *suffix,
                 char **ret_new_path,
                 char **ret_tmp_path) {
 
@@ -5986,7 +6242,7 @@ static int unit_file_create_dropin(
         assert(ret_new_path);
         assert(ret_tmp_path);
 
-        ending = strjoina(unit_name, ".d/override.conf");
+        ending = strjoina(unit_name, suffix);
         r = get_file_to_edit(paths, ending, &tmp_new_path);
         if (r < 0)
                 return r;
@@ -6033,13 +6289,12 @@ static int unit_file_create_copy(
                 if (response != 'y') {
                         log_warning("%s ignored", unit_name);
                         free(tmp_new_path);
-                        return -1;
+                        return -EKEYREJECTED;
                 }
         }
 
         r = create_edit_temp_file(tmp_new_path, fragment_path, &tmp_tmp_path);
         if (r < 0) {
-                log_error_errno(r, "Failed to create temporary file for \"%s\": %m", tmp_new_path);
                 free(tmp_new_path);
                 return r;
         }
@@ -6150,18 +6405,24 @@ static int find_paths_to_edit(sd_bus *bus, char **names, char ***paths) {
                 r = unit_find_paths(bus, *name, &lp, &path, NULL);
                 if (r < 0)
                         return r;
-                else if (r == 0)
-                        return -ENOENT;
-                else if (!path) {
-                        // FIXME: support units with path==NULL (no FragmentPath)
-                        log_error("No fragment exists for %s.", *name);
-                        return -ENOENT;
+                else if (!arg_force) {
+                        if (r == 0) {
+                                log_error("Run 'systemctl edit --force %s' to create a new unit.", *name);
+                                return -ENOENT;
+                        } else if (!path) {
+                                // FIXME: support units with path==NULL (no FragmentPath)
+                                log_error("No fragment exists for %s.", *name);
+                                return -ENOENT;
+                        }
                 }
 
-                if (arg_full)
-                        r = unit_file_create_copy(&lp, *name, path, &new_path, &tmp_path);
-                else
-                        r = unit_file_create_dropin(&lp, *name, &new_path, &tmp_path);
+                if (path) {
+                        if (arg_full)
+                                r = unit_file_create_copy(&lp, *name, path, &new_path, &tmp_path);
+                        else
+                                r = unit_file_create_new(&lp, *name, ".d/override.conf", &new_path, &tmp_path);
+                } else
+                        r = unit_file_create_new(&lp, *name, NULL, &new_path, &tmp_path);
                 if (r < 0)
                         return r;
 
@@ -6335,7 +6596,7 @@ static void systemctl_help(void) {
                "                                  unit is required or wanted\n\n"
                "Unit File Commands:\n"
                "  list-unit-files [PATTERN...]    List installed unit files\n"
-               "  enable NAME...                  Enable one or more unit files\n"
+               "  enable [NAME...|PATH...]        Enable one or more unit files\n"
                "  disable NAME...                 Disable one or more unit files\n"
                "  reenable NAME...                Reenable one or more unit files\n"
                "  preset NAME...                  Enable/disable one or more unit files\n"
@@ -7421,71 +7682,71 @@ static int systemctl_main(int argc, char *argv[]) {
 
         static const Verb verbs[] = {
                 { "list-units",            VERB_ANY, VERB_ANY, VERB_DEFAULT|VERB_NOCHROOT, list_units },
-                { "list-unit-files",       VERB_ANY, VERB_ANY, 0,             list_unit_files   },
-                { "list-sockets",          VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_sockets      },
-                { "list-timers",           VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_timers       },
-                { "list-jobs",             VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_jobs         },
-                { "list-machines",         VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_machines     },
-                { "clear-jobs",            VERB_ANY, 1,        VERB_NOCHROOT, daemon_reload     },
-                { "cancel",                VERB_ANY, VERB_ANY, VERB_NOCHROOT, cancel_job        },
-                { "start",                 2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "stop",                  2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "condstop",              2,        VERB_ANY, VERB_NOCHROOT, start_unit        }, /* For compatibility with ALTLinux */
-                { "reload",                2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "restart",               2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "try-restart",           2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "reload-or-restart",     2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "reload-or-try-restart", 2,        VERB_ANY, VERB_NOCHROOT, start_unit        }, /* For compatbility with old systemctl <= 228 */
-                { "try-reload-or-restart", 2,        VERB_ANY, VERB_NOCHROOT, start_unit        },
-                { "force-reload",          2,        VERB_ANY, VERB_NOCHROOT, start_unit        }, /* For compatibility with SysV */
-                { "condreload",            2,        VERB_ANY, VERB_NOCHROOT, start_unit        }, /* For compatibility with ALTLinux */
-                { "condrestart",           2,        VERB_ANY, VERB_NOCHROOT, start_unit        }, /* For compatibility with RH */
-                { "isolate",               2,        2,        VERB_NOCHROOT, start_unit        },
-                { "kill",                  2,        VERB_ANY, VERB_NOCHROOT, kill_unit         },
-                { "is-active",             2,        VERB_ANY, VERB_NOCHROOT, check_unit_active },
-                { "check",                 2,        VERB_ANY, VERB_NOCHROOT, check_unit_active },
-                { "is-failed",             2,        VERB_ANY, VERB_NOCHROOT, check_unit_failed },
-                { "show",                  VERB_ANY, VERB_ANY, VERB_NOCHROOT, show              },
-                { "cat",                   2,        VERB_ANY, VERB_NOCHROOT, cat               },
-                { "status",                VERB_ANY, VERB_ANY, VERB_NOCHROOT, show              },
-                { "help",                  VERB_ANY, VERB_ANY, VERB_NOCHROOT, show              },
-                { "daemon-reload",         VERB_ANY, 1,        VERB_NOCHROOT, daemon_reload     },
-                { "daemon-reexec",         VERB_ANY, 1,        VERB_NOCHROOT, daemon_reload     },
-                { "show-environment",      VERB_ANY, 1,        VERB_NOCHROOT, show_environment  },
-                { "set-environment",       2,        VERB_ANY, VERB_NOCHROOT, set_environment   },
-                { "unset-environment",     2,        VERB_ANY, VERB_NOCHROOT, set_environment   },
-                { "import-environment",    VERB_ANY, VERB_ANY, VERB_NOCHROOT, import_environment},
-                { "halt",                  VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "poweroff",              VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "reboot",                VERB_ANY, 2,        VERB_NOCHROOT, start_special     },
-                { "kexec",                 VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "suspend",               VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "hibernate",             VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "hybrid-sleep",          VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "default",               VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "rescue",                VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "emergency",             VERB_ANY, 1,        VERB_NOCHROOT, start_special     },
-                { "exit",                  VERB_ANY, 2,        VERB_NOCHROOT, start_special     },
-                { "reset-failed",          VERB_ANY, VERB_ANY, VERB_NOCHROOT, reset_failed      },
-                { "enable",                2,        VERB_ANY, 0,             enable_unit       },
-                { "disable",               2,        VERB_ANY, 0,             enable_unit       },
-                { "is-enabled",            2,        VERB_ANY, 0,             unit_is_enabled   },
-                { "reenable",              2,        VERB_ANY, 0,             enable_unit       },
-                { "preset",                2,        VERB_ANY, 0,             enable_unit       },
-                { "preset-all",            VERB_ANY, 1,        0,             preset_all        },
-                { "mask",                  2,        VERB_ANY, 0,             enable_unit       },
-                { "unmask",                2,        VERB_ANY, 0,             enable_unit       },
-                { "link",                  2,        VERB_ANY, 0,             enable_unit       },
-                { "revert",                2,        VERB_ANY, 0,             enable_unit       },
-                { "switch-root",           2,        VERB_ANY, VERB_NOCHROOT, switch_root       },
-                { "list-dependencies",     VERB_ANY, 2,        VERB_NOCHROOT, list_dependencies },
-                { "set-default",           2,        2,        0,             set_default       },
-                { "get-default",           VERB_ANY, 1,        0,             get_default,      },
-                { "set-property",          3,        VERB_ANY, VERB_NOCHROOT, set_property      },
-                { "is-system-running",     VERB_ANY, 1,        0,             is_system_running },
-                { "add-wants",             3,        VERB_ANY, 0,             add_dependency    },
-                { "add-requires",          3,        VERB_ANY, 0,             add_dependency    },
-                { "edit",                  2,        VERB_ANY, VERB_NOCHROOT, edit              },
+                { "list-unit-files",       VERB_ANY, VERB_ANY, 0,             list_unit_files      },
+                { "list-sockets",          VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_sockets         },
+                { "list-timers",           VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_timers          },
+                { "list-jobs",             VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_jobs            },
+                { "list-machines",         VERB_ANY, VERB_ANY, VERB_NOCHROOT, list_machines        },
+                { "clear-jobs",            VERB_ANY, 1,        VERB_NOCHROOT, trivial_method       },
+                { "cancel",                VERB_ANY, VERB_ANY, VERB_NOCHROOT, cancel_job           },
+                { "start",                 2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "stop",                  2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "condstop",              2,        VERB_ANY, VERB_NOCHROOT, start_unit           }, /* For compatibility with ALTLinux */
+                { "reload",                2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "restart",               2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "try-restart",           2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "reload-or-restart",     2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "reload-or-try-restart", 2,        VERB_ANY, VERB_NOCHROOT, start_unit           }, /* For compatbility with old systemctl <= 228 */
+                { "try-reload-or-restart", 2,        VERB_ANY, VERB_NOCHROOT, start_unit           },
+                { "force-reload",          2,        VERB_ANY, VERB_NOCHROOT, start_unit           }, /* For compatibility with SysV */
+                { "condreload",            2,        VERB_ANY, VERB_NOCHROOT, start_unit           }, /* For compatibility with ALTLinux */
+                { "condrestart",           2,        VERB_ANY, VERB_NOCHROOT, start_unit           }, /* For compatibility with RH */
+                { "isolate",               2,        2,        VERB_NOCHROOT, start_unit           },
+                { "kill",                  2,        VERB_ANY, VERB_NOCHROOT, kill_unit            },
+                { "is-active",             2,        VERB_ANY, VERB_NOCHROOT, check_unit_active    },
+                { "check",                 2,        VERB_ANY, VERB_NOCHROOT, check_unit_active    },
+                { "is-failed",             2,        VERB_ANY, VERB_NOCHROOT, check_unit_failed    },
+                { "show",                  VERB_ANY, VERB_ANY, VERB_NOCHROOT, show                 },
+                { "cat",                   2,        VERB_ANY, VERB_NOCHROOT, cat                  },
+                { "status",                VERB_ANY, VERB_ANY, VERB_NOCHROOT, show                 },
+                { "help",                  VERB_ANY, VERB_ANY, VERB_NOCHROOT, show                 },
+                { "daemon-reload",         VERB_ANY, 1,        VERB_NOCHROOT, daemon_reload        },
+                { "daemon-reexec",         VERB_ANY, 1,        VERB_NOCHROOT, daemon_reload        },
+                { "show-environment",      VERB_ANY, 1,        VERB_NOCHROOT, show_environment     },
+                { "set-environment",       2,        VERB_ANY, VERB_NOCHROOT, set_environment      },
+                { "unset-environment",     2,        VERB_ANY, VERB_NOCHROOT, set_environment      },
+                { "import-environment",    VERB_ANY, VERB_ANY, VERB_NOCHROOT, import_environment   },
+                { "halt",                  VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "poweroff",              VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "reboot",                VERB_ANY, 2,        VERB_NOCHROOT, start_system_special },
+                { "kexec",                 VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "suspend",               VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "hibernate",             VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "hybrid-sleep",          VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "default",               VERB_ANY, 1,        VERB_NOCHROOT, start_special        },
+                { "rescue",                VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "emergency",             VERB_ANY, 1,        VERB_NOCHROOT, start_system_special },
+                { "exit",                  VERB_ANY, 2,        VERB_NOCHROOT, start_special        },
+                { "reset-failed",          VERB_ANY, VERB_ANY, VERB_NOCHROOT, reset_failed         },
+                { "enable",                2,        VERB_ANY, 0,             enable_unit          },
+                { "disable",               2,        VERB_ANY, 0,             enable_unit          },
+                { "is-enabled",            2,        VERB_ANY, 0,             unit_is_enabled      },
+                { "reenable",              2,        VERB_ANY, 0,             enable_unit          },
+                { "preset",                2,        VERB_ANY, 0,             enable_unit          },
+                { "preset-all",            VERB_ANY, 1,        0,             preset_all           },
+                { "mask",                  2,        VERB_ANY, 0,             enable_unit          },
+                { "unmask",                2,        VERB_ANY, 0,             enable_unit          },
+                { "link",                  2,        VERB_ANY, 0,             enable_unit          },
+                { "revert",                2,        VERB_ANY, 0,             enable_unit          },
+                { "switch-root",           2,        VERB_ANY, VERB_NOCHROOT, switch_root          },
+                { "list-dependencies",     VERB_ANY, 2,        VERB_NOCHROOT, list_dependencies    },
+                { "set-default",           2,        2,        0,             set_default          },
+                { "get-default",           VERB_ANY, 1,        0,             get_default          },
+                { "set-property",          3,        VERB_ANY, VERB_NOCHROOT, set_property         },
+                { "is-system-running",     VERB_ANY, 1,        0,             is_system_running    },
+                { "add-wants",             3,        VERB_ANY, 0,             add_dependency       },
+                { "add-requires",          3,        VERB_ANY, 0,             add_dependency       },
+                { "edit",                  2,        VERB_ANY, VERB_NOCHROOT, edit                 },
                 {}
         };
 
@@ -7499,7 +7760,7 @@ static int reload_with_fallback(void) {
                 return 0;
 
         /* Nothing else worked, so let's try signals */
-        assert(arg_action == ACTION_RELOAD || arg_action == ACTION_REEXEC);
+        assert(IN_SET(arg_action, ACTION_RELOAD, ACTION_REEXEC));
 
         if (kill(1, arg_action == ACTION_RELOAD ? SIGHUP : SIGTERM) < 0)
                 return log_error_errno(errno, "kill() failed: %m");
@@ -7513,8 +7774,7 @@ static int start_with_fallback(void) {
         if (start_unit(0, NULL, NULL) >= 0)
                 return 0;
 
-        /* Nothing else worked, so let's try
-         * /dev/initctl */
+        /* Nothing else worked, so let's try /dev/initctl */
         if (talk_initctl() > 0)
                 return 0;
 
@@ -7580,8 +7840,6 @@ static int logind_schedule_shutdown(void) {
         sd_bus *bus;
         int r;
 
-        (void) logind_set_wall_message();
-
         r = acquire_bus(BUS_FULL, &bus);
         if (r < 0)
                 return r;
@@ -7608,6 +7866,8 @@ static int logind_schedule_shutdown(void) {
         if (arg_dry)
                 action = strjoina("dry-", action);
 
+        (void) logind_set_wall_message();
+
         r = sd_bus_call_method(
                         bus,
                         "org.freedesktop.login1",
@@ -7736,6 +7996,7 @@ int main(int argc, char*argv[]) {
         setlocale(LC_ALL, "");
         log_parse_environment();
         log_open();
+        sigbus_install();
 
         /* Explicitly not on_tty() to avoid setting cached value.
          * This becomes relevant for piping output which might be
@@ -7797,6 +8058,8 @@ int main(int argc, char*argv[]) {
         }
 
 finish:
+        release_busses();
+
         pager_close();
         ask_password_agent_close();
         polkit_agent_close();
@@ -7808,9 +8071,6 @@ finish:
         strv_free(arg_wall);
         free(arg_root);
 
-        release_busses();
-
         /* Note that we return r here, not EXIT_SUCCESS, so that we can implement the LSB-like return codes */
-
         return r < 0 ? EXIT_FAILURE : r;
 }
diff --git a/src/grp-system/systemctl/systemctl.xml b/src/grp-system/systemctl/systemctl.xml
index 991e9bafaf..e7880d24f7 100644
--- a/src/grp-system/systemctl/systemctl.xml
+++ b/src/grp-system/systemctl/systemctl.xml
@@ -150,11 +150,11 @@
         <term><option>--all</option></term>
 
         <listitem>
-          <para>When listing units, show all loaded units, regardless
-          of their state, including inactive units. When showing
-          unit/job/manager properties, show all properties regardless
-          whether they are set or not.</para>
-          <para>To list all units installed on the system, use the
+          <para>When listing units with <command>list-units</command>, also show inactive units and
+          units which are following other units. When showing unit/job/manager properties, show all
+          properties regardless whether they are set or not.</para>
+
+          <para>To list all units installed in the file system, use the
           <command>list-unit-files</command> command instead.</para>
         </listitem>
       </varlistentry>
@@ -481,19 +481,19 @@
           <para>When used with <command>enable</command>, overwrite
           any existing conflicting symlinks.</para>
 
-          <para>When used with <command>halt</command>,
-          <command>poweroff</command>, <command>reboot</command> or
-          <command>kexec</command>, execute the selected operation
-          without shutting down all units. However, all processes will
-          be killed forcibly and all file systems are unmounted or
-          remounted read-only. This is hence a drastic but relatively
-          safe option to request an immediate reboot. If
-          <option>--force</option> is specified twice for these
-          operations, they will be executed immediately without
-          terminating any processes or unmounting any file
-          systems. Warning: specifying <option>--force</option> twice
-          with any of these operations might result in data
-          loss.</para>
+          <para>When used with <command>edit</command>, create all of the
+          specified units which do not already exist.</para>
+
+          <para>When used with <command>halt</command>, <command>poweroff</command>, <command>reboot</command> or
+          <command>kexec</command>, execute the selected operation without shutting down all units. However, all
+          processes will be killed forcibly and all file systems are unmounted or remounted read-only. This is hence a
+          drastic but relatively safe option to request an immediate reboot. If <option>--force</option> is specified
+          twice for these operations (with the exception of <command>kexec</command>), they will be executed
+          immediately, without terminating any processes or unmounting any file systems. Warning: specifying
+          <option>--force</option> twice with any of these operations might result in data loss. Note that when
+          <option>--force</option> is specified twice the selected operation is executed by
+          <command>systemctl</command> itself, and the system manager is not contacted. This means the command should
+          succeed even when the system manager hangs or crashed.</para>
         </listitem>
       </varlistentry>
 
@@ -638,10 +638,13 @@
           <term><command>list-units <optional><replaceable>PATTERN</replaceable>...</optional></command></term>
 
           <listitem>
-            <para>List known units (subject to limitations specified
-            with <option>-t</option>). If one or more
-            <replaceable>PATTERN</replaceable>s are specified, only
-            units matching one of them are shown.</para>
+            <para>List units that <command>systemd</command> has loaded. This includes units that
+            are either referenced directly or through a dependency, or units that were active in the
+            past and have failed. By default only units which are active, have pending jobs, or have
+            failed are shown; this can be changed with option <option>--all</option>. If one or more
+            <replaceable>PATTERN</replaceable>s are specified, only units matching one of them are
+            shown. The units that are shown are additionally filtered by <option>--type=</option>
+            and <option>--state=</option> if those options are specified.</para>
 
             <para>This is the default command.</para>
           </listitem>
@@ -970,71 +973,61 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
           <term><command>list-unit-files <optional><replaceable>PATTERN...</replaceable></optional></command></term>
 
           <listitem>
-            <para>List installed unit files and their enablement state
-            (as reported by <command>is-enabled</command>). If one or
-            more <replaceable>PATTERN</replaceable>s are specified,
-            only units whose filename (just the last component of the
-            path) matches one of them are shown.</para>
+            <para>List unit files installed on the system, in combination with their enablement state (as reported by
+            <command>is-enabled</command>). If one or more <replaceable>PATTERN</replaceable>s are specified, only unit
+            files whose name matches one of them are shown (patterns matching unit file system paths are not
+            supported).</para>
           </listitem>
         </varlistentry>
 
         <varlistentry>
           <term><command>enable <replaceable>NAME</replaceable>...</command></term>
+          <term><command>enable <replaceable>PATH</replaceable>...</command></term>
 
           <listitem>
-            <para>Enable one or more unit files or unit file instances,
-            as specified on the command line. This will create a number
-            of symlinks as encoded in the <literal>[Install]</literal>
-            sections of the unit files. After the symlinks have been
-            created, the systemd configuration is reloaded (in a way that
-            is equivalent to <command>daemon-reload</command>) to ensure
-            the changes are taken into account immediately. Note that
-            this does <emphasis>not</emphasis> have the effect of also
-            starting any of the units being enabled. If this
-            is desired, either <option>--now</option> should be used
-            together with this command, or an additional <command>start</command>
-            command must be invoked for the unit. Also note that, in case of
-            instance enablement, symlinks named the same as instances
-            are created in the install location, however they all point to the
-            same template unit file.</para>
-
-            <para>This command will print the actions executed. This
-            output may be suppressed by passing <option>--quiet</option>.
+            <para>Enable one or more units or unit instances. This will create a set of symlinks, as encoded in the
+            <literal>[Install]</literal> sections of the indicated unit files. After the symlinks have been created,
+            the system manager configuration is reloaded (in a way equivalent to <command>daemon-reload</command>), in
+            order to ensure the changes are taken into account immediately. Note that this does
+            <emphasis>not</emphasis> have the effect of also starting any of the units being enabled. If this is
+            desired, combine this command with the <option>--now</option> switch, or invoke <command>start</command>
+            with appropriate arguments later. Note that in case of unit instance enablement (i.e. enablement of units of
+            the form <filename>foo@bar.service</filename>), symlinks named the same as instances are created in the
+            unit configuration diectory, however they point to the single template unit file they are instantiated
+            from.</para>
+
+            <para>This command expects either valid unit names (in which case various unit file directories are
+            automatically searched for unit files with appropriate names), or absolute paths to unit files (in which
+            case these files are read directly). If a specified unit file is located outside of the usual unit file
+            directories, an additional symlink is created, linking it into the unit configuration path, thus ensuring
+            it is found when requested by commands such as <command>start</command>.</para>
+
+            <para>This command will print the file system operations executed. This output may be suppressed by passing
+            <option>--quiet</option>.
             </para>
 
-            <para>Note that this operation creates only the suggested
-            symlinks for the units. While this command is the
-            recommended way to manipulate the unit configuration
-            directory, the administrator is free to make additional
-            changes manually by placing or removing symlinks in the
-            directory. This is particularly useful to create
-            configurations that deviate from the suggested default
-            installation. In this case, the administrator must make sure
-            to invoke <command>daemon-reload</command> manually as
-            necessary to ensure the changes are taken into account.
+            <para>Note that this operation creates only the symlinks suggested in the <literal>[Install]</literal>
+            section of the unit files. While this command is the recommended way to manipulate the unit configuration
+            directory, the administrator is free to make additional changes manually by placing or removing symlinks
+            below this directory. This is particularly useful to create configurations that deviate from the suggested
+            default installation. In this case, the administrator must make sure to invoke
+            <command>daemon-reload</command> manually as necessary, in order to ensure the changes are taken into
+            account.
             </para>
 
-            <para>Enabling units should not be confused with starting
-            (activating) units, as done by the <command>start</command>
-            command. Enabling and starting units is orthogonal: units
-            may be enabled without being started and started without
-            being enabled. Enabling simply hooks the unit into various
-            suggested places (for example, so that the unit is
-            automatically started on boot or when a particular kind of
-            hardware is plugged in). Starting actually spawns the daemon
-            process (in case of service units), or binds the socket (in
-            case of socket units), and so on.</para>
-
-            <para>Depending on whether <option>--system</option>,
-            <option>--user</option>, <option>--runtime</option>,
-            or <option>--global</option> is specified, this enables the unit
-            for the system, for the calling user only, for only this boot of
-            the system, or for all future logins of all users, or only this
-            boot.  Note that in the last case, no systemd daemon
-            configuration is reloaded.</para>
-
-            <para>Using <command>enable</command> on masked units
-            results in an error.</para>
+            <para>Enabling units should not be confused with starting (activating) units, as done by the
+            <command>start</command> command. Enabling and starting units is orthogonal: units may be enabled without
+            being started and started without being enabled. Enabling simply hooks the unit into various suggested
+            places (for example, so that the unit is automatically started on boot or when a particular kind of
+            hardware is plugged in). Starting actually spawns the daemon process (in case of service units), or binds
+            the socket (in case of socket units), and so on.</para>
+
+            <para>Depending on whether <option>--system</option>, <option>--user</option>, <option>--runtime</option>,
+            or <option>--global</option> is specified, this enables the unit for the system, for the calling user only,
+            for only this boot of the system, or for all future logins of all users, or only this boot.  Note that in
+            the last case, no systemd daemon configuration is reloaded.</para>
+
+            <para>Using <command>enable</command> on masked units is not supported and results in an error.</para>
           </listitem>
         </varlistentry>
 
@@ -1042,28 +1035,31 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
           <term><command>disable <replaceable>NAME</replaceable>...</command></term>
 
           <listitem>
-            <para>Disables one or more units. This removes all symlinks
-            to the specified unit files from the unit configuration
-            directory, and hence undoes the changes made by
-            <command>enable</command>. Note however that this removes
-            all symlinks to the unit files (i.e. including manual
-            additions), not just those actually created by
-            <command>enable</command>. This call implicitly reloads the
-            systemd daemon configuration after completing the disabling
-            of the units. Note that this command does not implicitly
-            stop the units that are being disabled. If this is desired, either
-            <option>--now</option> should be used together with this command, or
-            an additional <command>stop</command> command should be executed
-            afterwards.</para>
-
-            <para>This command will print the actions executed. This
-            output may be suppressed by passing <option>--quiet</option>.
+            <para>Disables one or more units. This removes all symlinks to the unit files backing the specified units
+            from the unit configuration directory, and hence undoes any changes made by <command>enable</command> or
+            <command>link</command>. Note that this removes <emphasis>all</emphasis> symlinks to matching unit files,
+            including manually created symlinks, and not just those actually created by <command>enable</command> or
+            <command>link</command>. Note that while <command>disable</command> undoes the effect of
+            <command>enable</command>, the two commands are otherwise not symmetric, as <command>disable</command> may
+            remove more symlinks than a prior <command>enable</command> invocation of the same unit created.</para>
+
+            <para>This command expects valid unit names only, it does not accept paths to unit files.</para>
+
+            <para>In addition to the units specified as arguments, all units are disabled that are listed in the
+            <varname>Also=</varname> setting contained in the <literal>[Install]</literal> section of any of the unit
+            files being operated on.</para>
+
+            <para>This command implicitly reloads the system manager configuration after completing the operation. Note
+            that this command does not implicitly stop the units that are being disabled. If this is desired, either
+            combine this command with the <option>--now</option> switch, or invoke the <command>stop</command> command
+            with appropriate arguments later.</para>
+
+            <para>This command will print information about the file system operations (symlink removals)
+            executed. This output may be suppressed by passing <option>--quiet</option>.
             </para>
 
-            <para>This command honors <option>--system</option>,
-            <option>--user</option>, <option>--runtime</option> and
-            <option>--global</option> in a similar way as
-            <command>enable</command>.</para>
+            <para>This command honors <option>--system</option>, <option>--user</option>, <option>--runtime</option>
+            and <option>--global</option> in a similar way as <command>enable</command>.</para>
           </listitem>
         </varlistentry>
 
@@ -1071,12 +1067,10 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
           <term><command>reenable <replaceable>NAME</replaceable>...</command></term>
 
           <listitem>
-            <para>Reenable one or more unit files, as specified on the
-            command line. This is a combination of
-            <command>disable</command> and <command>enable</command> and
-            is useful to reset the symlinks a unit is enabled with to
-            the defaults configured in the <literal>[Install]</literal>
-            section of the unit file.</para>
+            <para>Reenable one or more units, as specified on the command line. This is a combination of
+            <command>disable</command> and <command>enable</command> and is useful to reset the symlinks a unit file is
+            enabled with to the defaults configured in its <literal>[Install]</literal> section. This commands expects
+            a unit uname only, it does not accept paths to unit files.</para>
           </listitem>
         </varlistentry>
 
@@ -1207,16 +1201,13 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
           <term><command>mask <replaceable>NAME</replaceable>...</command></term>
 
           <listitem>
-            <para>Mask one or more unit files, as specified on the
-            command line. This will link these units to
-            <filename>/dev/null</filename>, making it impossible to
-            start them. This is a stronger version of
-            <command>disable</command>, since it prohibits all kinds of
-            activation of the unit, including enablement and manual
-            activation. Use this option with care. This honors the
-            <option>--runtime</option> option to only mask temporarily
-            until the next reboot of the system. The <option>--now</option>
-            option can be used to ensure that the units are also stopped.</para>
+            <para>Mask one or more units, as specified on the command line. This will link these unit files to
+            <filename>/dev/null</filename>, making it impossible to start them. This is a stronger version of
+            <command>disable</command>, since it prohibits all kinds of activation of the unit, including enablement
+            and manual activation. Use this option with care. This honors the <option>--runtime</option> option to only
+            mask temporarily until the next reboot of the system. The <option>--now</option> option may be used to
+            ensure that the units are also stopped. This command expects valid unit names only, it does not accept unit
+            file paths.</para>
           </listitem>
         </varlistentry>
 
@@ -1224,23 +1215,20 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
           <term><command>unmask <replaceable>NAME</replaceable>...</command></term>
 
           <listitem>
-            <para>Unmask one or more unit files, as specified on the
-            command line. This will undo the effect of
-            <command>mask</command>.</para>
+            <para>Unmask one or more unit files, as specified on the command line. This will undo the effect of
+            <command>mask</command>. This command expects valid unit names only, it does not accept unit file
+            paths.</para>
           </listitem>
         </varlistentry>
 
         <varlistentry>
-          <term><command>link <replaceable>FILENAME</replaceable>...</command></term>
+          <term><command>link <replaceable>PATH</replaceable>...</command></term>
 
           <listitem>
-            <para>Link a unit file that is not in the unit file search
-            paths into the unit file search path. This requires an
-            absolute path to a unit file. The effect of this can be
-            undone with <command>disable</command>. The effect of this
-            command is that a unit file is available for
-            <command>start</command> and other commands although it
-            is not installed directly in the unit search path.</para>
+            <para>Link a unit file that is not in the unit file search paths into the unit file search path. This
+            command expects an absolute path to a unit file. The effect of this may be undone with
+            <command>disable</command>. The effect of this command is that a unit file is made available for commands
+            such as <command>start</command>, even though it is not installed directly in the unit search path.</para>
           </listitem>
         </varlistentry>
 
@@ -1304,6 +1292,9 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
             <para>If <option>--full</option> is specified, this will copy the
             original units instead of creating drop-in files.</para>
 
+            <para>If <option>--force</option> is specified and any units do
+            not already exist, new unit files will be opened for editing.</para>
+
             <para>If <option>--runtime</option> is specified, the changes will
             be made temporarily in <filename>/run</filename> and they will be
             lost on the next reboot.</para>
@@ -1600,48 +1591,45 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
           <term><command>halt</command></term>
 
           <listitem>
-            <para>Shut down and halt the system. This is mostly equivalent to
-            <command>start halt.target --job-mode=replace-irreversibly</command>, but also
-            prints a wall message to all users.  If combined with
-            <option>--force</option>, shutdown of all running services is
-            skipped, however all processes are killed and all file
-            systems are unmounted or mounted read-only, immediately
-            followed by the system halt.  If <option>--force</option> is
-            specified twice, the operation is immediately executed
-            without terminating any processes or unmounting any file
-            systems. This may result in data loss.</para>
+            <para>Shut down and halt the system. This is mostly equivalent to <command>start halt.target
+            --job-mode=replace-irreversibly</command>, but also prints a wall message to all users.  If combined with
+            <option>--force</option>, shutdown of all running services is skipped, however all processes are killed and
+            all file systems are unmounted or mounted read-only, immediately followed by the system halt.  If
+            <option>--force</option> is specified twice, the operation is immediately executed without terminating any
+            processes or unmounting any file systems. This may result in data loss. Note that when
+            <option>--force</option> is specified twice the halt operation is executed by
+            <command>systemctl</command> itself, and the system manager is not contacted. This means the command should
+            succeed even when the system manager hangs or crashed.</para>
           </listitem>
         </varlistentry>
         <varlistentry>
           <term><command>poweroff</command></term>
 
           <listitem>
-            <para>Shut down and power-off the system. This is mostly
-            equivalent to <command>start poweroff.target --job-mode=replace-irreversibly</command>,
-            but also prints a wall message to all users. If combined with
-            <option>--force</option>, shutdown of all running services is
-            skipped, however all processes are killed and all file
-            systems are unmounted or mounted read-only, immediately
-            followed by the powering off. If <option>--force</option> is
-            specified twice, the operation is immediately executed
-            without terminating any processes or unmounting any file
-            systems. This may result in data loss.</para>
+            <para>Shut down and power-off the system. This is mostly equivalent to <command>start poweroff.target
+            --job-mode=replace-irreversibly</command>, but also prints a wall message to all users. If combined with
+            <option>--force</option>, shutdown of all running services is skipped, however all processes are killed and
+            all file systems are unmounted or mounted read-only, immediately followed by the powering off. If
+            <option>--force</option> is specified twice, the operation is immediately executed without terminating any
+            processes or unmounting any file systems. This may result in data loss. Note that when
+            <option>--force</option> is specified twice the power-off operation is executed by
+            <command>systemctl</command> itself, and the system manager is not contacted. This means the command should
+            succeed even when the system manager hangs or crashed.</para>
           </listitem>
         </varlistentry>
         <varlistentry>
           <term><command>reboot <optional><replaceable>arg</replaceable></optional></command></term>
 
           <listitem>
-            <para>Shut down and reboot the system. This is mostly
-            equivalent to <command>start reboot.target --job-mode=replace-irreversibly</command>,
-            but also prints a wall message to all users. If combined with
-            <option>--force</option>, shutdown of all running services is
-            skipped, however all processes are killed and all file
-            systems are unmounted or mounted read-only, immediately
-            followed by the reboot. If <option>--force</option> is
-            specified twice, the operation is immediately executed
-            without terminating any processes or unmounting any file
-            systems. This may result in data loss.</para>
+            <para>Shut down and reboot the system. This is mostly equivalent to <command>start reboot.target
+            --job-mode=replace-irreversibly</command>, but also prints a wall message to all users. If combined with
+            <option>--force</option>, shutdown of all running services is skipped, however all processes are killed and
+            all file systems are unmounted or mounted read-only, immediately followed by the reboot. If
+            <option>--force</option> is specified twice, the operation is immediately executed without terminating any
+            processes or unmounting any file systems. This may result in data loss. Note that when
+            <option>--force</option> is specified twice the reboot operation is executed by
+            <command>systemctl</command> itself, and the system manager is not contacted. This means the command should
+            succeed even when the system manager hangs or crashed.</para>
 
             <para>If the optional argument
             <replaceable>arg</replaceable> is given, it will be passed
diff --git a/src/grp-system/systemd-shutdown/Makefile b/src/grp-system/systemd-shutdown/Makefile
index 257a057823..c56f0f9adc 100644
--- a/src/grp-system/systemd-shutdown/Makefile
+++ b/src/grp-system/systemd-shutdown/Makefile
@@ -34,7 +34,7 @@ systemd_shutdown_SOURCES = \
 	src/core/killall.c
 
 systemd_shutdown_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 sd.CPPFLAGS += -DSYSTEM_SHUTDOWN_PATH=\"$(systemshutdowndir)\"
 sd.CPPFLAGS += -DKEXEC=\"$(KEXEC)\"
diff --git a/src/grp-system/systemd-shutdown/shutdown.c b/src/grp-system/systemd-shutdown/shutdown.c
index bf74b5ec99..093b6eea87 100644
--- a/src/grp-system/systemd-shutdown/shutdown.c
+++ b/src/grp-system/systemd-shutdown/shutdown.c
@@ -159,7 +159,6 @@ static int switch_root_initramfs(void) {
         return switch_root("/run/initramfs", "/oldroot", false, MS_BIND);
 }
 
-
 int main(int argc, char *argv[]) {
         bool need_umount, need_swapoff, need_loop_detach, need_dm_detach;
         bool in_container, use_watchdog = false;
@@ -205,20 +204,25 @@ int main(int argc, char *argv[]) {
         }
 
         (void) cg_get_root_path(&cgroup);
+        in_container = detect_container() > 0;
 
         use_watchdog = !!getenv("WATCHDOG_USEC");
 
-        /* lock us into memory */
+        /* Lock us into memory */
         mlockall(MCL_CURRENT|MCL_FUTURE);
 
+        /* Synchronize everything that is not written to disk yet at this point already. This is a good idea so that
+         * slow IO is processed here already and the final process killing spree is not impacted by processes
+         * desperately trying to sync IO to disk within their timeout. */
+        if (!in_container)
+                sync();
+
         log_info("Sending SIGTERM to remaining processes...");
         broadcast_signal(SIGTERM, true, true);
 
         log_info("Sending SIGKILL to remaining processes...");
         broadcast_signal(SIGKILL, true, false);
 
-        in_container = detect_container() > 0;
-
         need_umount = !in_container;
         need_swapoff = !in_container;
         need_loop_detach = !in_container;
@@ -347,10 +351,10 @@ int main(int argc, char *argv[]) {
                           need_loop_detach ? " loop devices," : "",
                           need_dm_detach ? " DM devices," : "");
 
-        /* The kernel will automaticall flush ATA disks and suchlike
-         * on reboot(), but the file systems need to be synce'd
-         * explicitly in advance. So let's do this here, but not
-         * needlessly slow down containers. */
+        /* The kernel will automatically flush ATA disks and suchlike on reboot(), but the file systems need to be
+         * sync'ed explicitly in advance. So let's do this here, but not needlessly slow down containers. Note that we
+         * sync'ed things already once above, but we did some more work since then which might have caused IO, hence
+         * let's doit once more. */
         if (!in_container)
                 sync();
 
diff --git a/src/grp-system/systemd-shutdown/systemd-shutdown.xml b/src/grp-system/systemd-shutdown/systemd-shutdown.xml
index 749158e5da..b1d1f87ce9 100644
--- a/src/grp-system/systemd-shutdown/systemd-shutdown.xml
+++ b/src/grp-system/systemd-shutdown/systemd-shutdown.xml
@@ -57,6 +57,7 @@
     <para><filename>systemd-reboot.service</filename></para>
     <para><filename>systemd-kexec.service</filename></para>
     <para><filename>/usr/lib/systemd/systemd-shutdown</filename></para>
+    <para><filename>/usr/lib/systemd/system-shutdown/</filename></para>
   </refsynopsisdiv>
 
   <refsect1>
diff --git a/src/grp-system/systemd/Makefile b/src/grp-system/systemd/Makefile
index 3efc406281..2f9d9ac819 100644
--- a/src/grp-system/systemd/Makefile
+++ b/src/grp-system/systemd/Makefile
@@ -66,6 +66,9 @@ EXTRA_DIST += \
 	src/core/macros.systemd.in \
 	src/core/triggers.systemd.in
 
+dist_xinitrc_SCRIPTS = \
+	xorg/50-systemd-user.sh
+
 dist_systemunit_DATA_busnames += \
 	units/org.freedesktop.systemd1.busname
 
diff --git a/src/grp-system/systemd/macros.systemd.in b/src/grp-system/systemd/macros.systemd.in
index 2cace3d3ba..6e8a3b3e3d 100644
--- a/src/grp-system/systemd/macros.systemd.in
+++ b/src/grp-system/systemd/macros.systemd.in
@@ -29,6 +29,8 @@
 %_sysusersdir @sysusersdir@
 %_sysctldir @sysctldir@
 %_binfmtdir @binfmtdir@
+%_systemdgeneratordir @systemgeneratordir@
+%_systemdusergeneratordir @usergeneratordir@
 
 %systemd_requires \
 Requires(post): systemd \
@@ -36,6 +38,12 @@ Requires(preun): systemd \
 Requires(postun): systemd \
 %{nil}
 
+%systemd_ordering \
+OrderWithRequires(post): systemd \
+OrderWithRequires(preun): systemd \
+OrderWithRequires(postun): systemd \
+%{nil}
+
 %systemd_post() \
 if [ $1 -eq 1 ] ; then \
         # Initial installation \
diff --git a/src/grp-system/systemd/main.c b/src/grp-system/systemd/main.c
index aa7c126fcf..c558a4b21c 100644
--- a/src/grp-system/systemd/main.c
+++ b/src/grp-system/systemd/main.c
@@ -47,7 +47,6 @@
 #include "basic/def.h"
 #include "basic/env-util.h"
 #include "basic/fd-util.h"
-#include "basic/fdset.h"
 #include "basic/fileio.h"
 #include "basic/formats-util.h"
 #include "basic/fs-util.h"
@@ -56,6 +55,7 @@
 #include "basic/parse-util.h"
 #include "basic/proc-cmdline.h"
 #include "basic/process-util.h"
+#include "basic/raw-clone.h"
 #include "basic/rlimit-util.h"
 #include "basic/selinux-util.h"
 #include "basic/signal-util.h"
@@ -81,6 +81,7 @@
 #include "selinux-setup.h"
 #include "shared/bus-util.h"
 #include "shared/conf-parser.h"
+#include "shared/fdset.h"
 #include "shared/pager.h"
 #include "shared/switch-root.h"
 #include "shared/watchdog.h"
@@ -126,7 +127,7 @@ static bool arg_default_io_accounting = false;
 static bool arg_default_blockio_accounting = false;
 static bool arg_default_memory_accounting = false;
 static bool arg_default_tasks_accounting = true;
-static uint64_t arg_default_tasks_max = UINT64_C(512);
+static uint64_t arg_default_tasks_max = UINT64_MAX;
 static sd_id128_t arg_machine_id = {};
 
 noreturn static void freeze_or_reboot(void) {
@@ -162,7 +163,7 @@ noreturn static void crash(int sig) {
                 /* We want to wait for the core process, hence let's enable SIGCHLD */
                 (void) sigaction(SIGCHLD, &sa, NULL);
 
-                pid = raw_clone(SIGCHLD, NULL);
+                pid = raw_clone(SIGCHLD);
                 if (pid < 0)
                         log_emergency_errno(errno, "Caught <%s>, cannot fork for core dump: %m", signal_to_string(sig));
                 else if (pid == 0) {
@@ -221,7 +222,7 @@ noreturn static void crash(int sig) {
                 log_notice("Executing crash shell in 10s...");
                 (void) sleep(10);
 
-                pid = raw_clone(SIGCHLD, NULL);
+                pid = raw_clone(SIGCHLD);
                 if (pid < 0)
                         log_emergency_errno(errno, "Failed to fork off crash shell: %m");
                 else if (pid == 0) {
@@ -290,14 +291,16 @@ static int parse_crash_chvt(const char *value) {
 }
 
 static int set_machine_id(const char *m) {
+        sd_id128_t t;
         assert(m);
 
-        if (sd_id128_from_string(m, &arg_machine_id) < 0)
+        if (sd_id128_from_string(m, &t) < 0)
                 return -EINVAL;
 
-        if (sd_id128_is_null(arg_machine_id))
+        if (sd_id128_is_null(t))
                 return -EINVAL;
 
+        arg_machine_id = t;
         return 0;
 }
 
@@ -408,7 +411,7 @@ static int parse_proc_cmdline_item(const char *key, const char *value) {
                 if (detect_container() > 0)
                         log_set_target(LOG_TARGET_CONSOLE);
 
-        } else if (!in_initrd() && !value) {
+        } else if (!value) {
                 const char *target;
 
                 /* SysV compatibility */
@@ -1293,6 +1296,40 @@ static int bump_unix_max_dgram_qlen(void) {
         return 1;
 }
 
+static int fixup_environment(void) {
+        _cleanup_free_ char *term = NULL;
+        int r;
+
+        /* We expect the environment to be set correctly
+         * if run inside a container. */
+        if (detect_container() > 0)
+                return 0;
+
+        /* When started as PID1, the kernel uses /dev/console
+         * for our stdios and uses TERM=linux whatever the
+         * backend device used by the console. We try to make
+         * a better guess here since some consoles might not
+         * have support for color mode for example.
+         *
+         * However if TERM was configured through the kernel
+         * command line then leave it alone. */
+
+        r = get_proc_cmdline_key("TERM=", &term);
+        if (r < 0)
+                return r;
+
+        if (r == 0) {
+                term = strdup(default_term_for_tty("/dev/console") + 5);
+                if (!term)
+                        return -ENOMEM;
+        }
+
+        if (setenv("TERM", term, 1) < 0)
+                return -errno;
+
+        return 0;
+}
+
 int main(int argc, char *argv[]) {
         Manager *m = NULL;
         int r, retval = EXIT_FAILURE;
@@ -1352,7 +1389,6 @@ int main(int argc, char *argv[]) {
         saved_argv = argv;
         saved_argc = argc;
 
-        log_show_color(colors_enabled());
         log_set_upgrade_syslog_to_journal(true);
 
         /* Disable the umask logic */
@@ -1363,7 +1399,6 @@ int main(int argc, char *argv[]) {
 
                 /* Running outside of a container as PID 1 */
                 arg_system = true;
-                make_null_stdio();
                 log_set_target(LOG_TARGET_KMSG);
                 log_open();
 
@@ -1416,7 +1451,7 @@ int main(int argc, char *argv[]) {
                                 /*
                                  * Do a dummy very first call to seal the kernel's time warp magic.
                                  *
-                                 * Do not call this this from inside the initrd. The initrd might not
+                                 * Do not call this from inside the initrd. The initrd might not
                                  * carry /etc/adjtime with LOCAL, but the real system could be set up
                                  * that way. In such case, we need to delay the time-warp or the sealing
                                  * until we reach the real system.
@@ -1479,6 +1514,19 @@ int main(int argc, char *argv[]) {
                         (void) write_string_file("/proc/sys/kernel/core_pattern", "|/bin/false", 0);
         }
 
+        if (arg_system) {
+                if (fixup_environment() < 0) {
+                        error_message = "Failed to fix up PID1 environment";
+                        goto finish;
+                }
+
+                /* Try to figure out if we can use colors with the console. No
+                 * need to do that for user instances since they never log
+                 * into the console. */
+                log_show_color(colors_enabled());
+                make_null_stdio();
+        }
+
         /* Initialize default unit */
         r = free_and_strdup(&arg_default_unit, SPECIAL_DEFAULT_TARGET);
         if (r < 0) {
@@ -1512,6 +1560,8 @@ int main(int argc, char *argv[]) {
         (void) reset_all_signal_handlers();
         (void) ignore_signals(SIGNALS_IGNORE, -1);
 
+        arg_default_tasks_max = system_tasks_max_scale(15U, 100U); /* 15% the system PIDs equals 4915 by default. */
+
         if (parse_config_file() < 0) {
                 error_message = "Failed to parse config file";
                 goto finish;
@@ -1673,7 +1723,7 @@ int main(int argc, char *argv[]) {
                         status_welcome();
 
                 hostname_setup();
-                machine_id_setup(NULL, arg_machine_id);
+                machine_id_setup(NULL, arg_machine_id, NULL);
                 loopback_setup();
                 bump_unix_max_dgram_qlen();
 
@@ -1966,6 +2016,9 @@ finish:
                                 log_error_errno(r, "Failed to switch root, trying to continue: %m");
                 }
 
+                /* Reopen the console */
+                (void) make_console_stdio();
+
                 args_size = MAX(6, argc+1);
                 args = newa(const char*, args_size);
 
@@ -1991,10 +2044,6 @@ finish:
                         args[i++] = sfd;
                         args[i++] = NULL;
 
-                        /* do not pass along the environment we inherit from the kernel or initrd */
-                        if (switch_root_dir)
-                                (void) clearenv();
-
                         assert(i <= args_size);
 
                         /*
@@ -2017,9 +2066,6 @@ finish:
                 arg_serialization = safe_fclose(arg_serialization);
                 fds = fdset_free(fds);
 
-                /* Reopen the console */
-                (void) make_console_stdio();
-
                 for (j = 1, i = 1; j < (unsigned) argc; j++)
                         args[i++] = argv[j];
                 args[i++] = NULL;
diff --git a/src/grp-system/systemd/system.conf b/src/grp-system/systemd/system.conf
index db8b7acd78..c6bb050aac 100644
--- a/src/grp-system/systemd/system.conf
+++ b/src/grp-system/systemd/system.conf
@@ -42,7 +42,7 @@
 #DefaultBlockIOAccounting=no
 #DefaultMemoryAccounting=no
 #DefaultTasksAccounting=yes
-#DefaultTasksMax=512
+#DefaultTasksMax=15%
 #DefaultLimitCPU=
 #DefaultLimitFSIZE=
 #DefaultLimitDATA=
diff --git a/src/grp-system/systemd/systemd-system.conf.xml b/src/grp-system/systemd/systemd-system.conf.xml
index 8833e73c72..1bb40fd234 100644
--- a/src/grp-system/systemd/systemd-system.conf.xml
+++ b/src/grp-system/systemd/systemd-system.conf.xml
@@ -325,12 +325,11 @@
       <varlistentry>
         <term><varname>DefaultTasksMax=</varname></term>
 
-        <listitem><para>Configure the default value for the per-unit
-        <varname>TasksMax=</varname> setting. See
+        <listitem><para>Configure the default value for the per-unit <varname>TasksMax=</varname> setting. See
         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-        for details. This setting applies to all unit types that
-        support resource control settings, with the exception of slice
-        units. Defaults to 512.</para></listitem>
+        for details. This setting applies to all unit types that support resource control settings, with the exception
+        of slice units. Defaults to 15%, which equals 4915 with the kernel's defaults on the host, but might be smaller
+        in OS containers.</para></listitem>
       </varlistentry>
 
       <varlistentry>
diff --git a/src/grp-system/systemd/systemd.exec.xml b/src/grp-system/systemd/systemd.exec.xml
index 3cf6de8256..41ae6e76de 100644
--- a/src/grp-system/systemd/systemd.exec.xml
+++ b/src/grp-system/systemd/systemd.exec.xml
@@ -107,7 +107,8 @@
       <varlistentry>
         <term><varname>WorkingDirectory=</varname></term>
 
-        <listitem><para>Takes an absolute directory path, or the
+        <listitem><para>Takes a directory path relative to the service's root
+        directory specified by <varname>RootDirectory=</varname>, or the
         special value <literal>~</literal>. Sets the working directory
         for executed processes. If set to <literal>~</literal>, the
         home directory of the user specified in
@@ -116,7 +117,10 @@
         and the respective user's home directory if run as user. If
         the setting is prefixed with the <literal>-</literal>
         character, a missing working directory is not considered
-        fatal. Note that setting this parameter might result in
+        fatal. If <varname>RootDirectory=</varname> is not set, then
+        <varname>WorkingDirectory=</varname> is relative to the root of
+        the system running the service manager.
+        Note that setting this parameter might result in
         additional dependencies to be added to the unit (see
         above).</para></listitem>
       </varlistentry>
@@ -124,7 +128,8 @@
       <varlistentry>
         <term><varname>RootDirectory=</varname></term>
 
-        <listitem><para>Takes an absolute directory path. Sets the
+        <listitem><para>Takes a directory path relative to the host's root directory
+        (i.e. the root of the system running the service manager). Sets the
         root directory for executed processes, with the <citerefentry
         project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
         system call. If this is used, it must be ensured that the
@@ -141,7 +146,7 @@
         <listitem><para>Sets the Unix user or group that the processes
         are executed as, respectively. Takes a single user or group
         name or ID as argument. If no group is set, the default group
-        of the user is chosen.</para></listitem>
+        of the user is chosen. These do not affect commands prefixed with <literal>+</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -156,7 +161,7 @@
         this one will have no effect. In any way, this option does not
         override, but extends the list of supplementary groups
         configured in the system group database for the
-        user.</para></listitem>
+        user. This does not affect commands prefixed with <literal>+</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -790,7 +795,8 @@
         process are enforced. This option may appear more than once, in which case the bounding sets are merged. If the
         empty string is assigned to this option, the bounding set is reset to the empty capability set, and all prior
         settings have no effect.  If set to <literal>~</literal> (without any further argument), the bounding set is
-        reset to the full set of available capabilities, also undoing any previous settings.</para></listitem>
+        reset to the full set of available capabilities, also undoing any previous settings. This does not affect
+        commands prefixed with <literal>+</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -819,7 +825,8 @@
         as a non-privileged user but still want to give it some capabilities.
         Note that in this case option <constant>keep-caps</constant> is
         automatically added to <varname>SecureBits=</varname> to retain the
-        capabilities over the user change.</para></listitem>
+        capabilities over the user change. <varname>AmbientCapabilities=</varname> does not affect
+        commands prefixed with <literal>+</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -835,43 +842,46 @@
         <option>noroot-locked</option>.
         This option may appear more than once, in which case the secure
         bits are ORed. If the empty string is assigned to this option,
-        the bits are reset to 0. See
-        <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+        the bits are reset to 0. This does not affect commands prefixed with <literal>+</literal>.
+        See <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
         for details.</para></listitem>
       </varlistentry>
 
       <varlistentry>
-        <term><varname>ReadWriteDirectories=</varname></term>
-        <term><varname>ReadOnlyDirectories=</varname></term>
-        <term><varname>InaccessibleDirectories=</varname></term>
+        <term><varname>ReadWritePaths=</varname></term>
+        <term><varname>ReadOnlyPaths=</varname></term>
+        <term><varname>InaccessiblePaths=</varname></term>
 
         <listitem><para>Sets up a new file system namespace for
         executed processes. These options may be used to limit access
         a process might have to the main file system hierarchy. Each
-        setting takes a space-separated list of absolute directory
-        paths. Directories listed in
-        <varname>ReadWriteDirectories=</varname> are accessible from
+        setting takes a space-separated list of paths relative to
+        the host's root directory (i.e. the system running the service manager).
+        Note that if entries contain symlinks, they are resolved from the host's root directory as well.
+        Entries (files or directories) listed in
+        <varname>ReadWritePaths=</varname> are accessible from
         within the namespace with the same access rights as from
-        outside. Directories listed in
-        <varname>ReadOnlyDirectories=</varname> are accessible for
+        outside. Entries listed in
+        <varname>ReadOnlyPaths=</varname> are accessible for
         reading only, writing will be refused even if the usual file
-        access controls would permit this. Directories listed in
-        <varname>InaccessibleDirectories=</varname> will be made
+        access controls would permit this. Entries listed in
+        <varname>InaccessiblePaths=</varname> will be made
         inaccessible for processes inside the namespace, and may not
         countain any other mountpoints, including those specified by
-        <varname>ReadWriteDirectories=</varname> or
-        <varname>ReadOnlyDirectories=</varname>.
+        <varname>ReadWritePaths=</varname> or
+        <varname>ReadOnlyPaths=</varname>.
         Note that restricting access with these options does not extend
-        to submounts of a directory that are created later on. These
+        to submounts of a directory that are created later on.
+        Non-directory paths can be specified as well. These
         options may be specified more than once, in which case all
-        directories listed will have limited access from within the
+        paths listed will have limited access from within the
         namespace. If the empty string is assigned to this option, the
         specific list is reset, and all prior assignments have no
         effect.</para>
         <para>Paths in
-        <varname>ReadOnlyDirectories=</varname>
+        <varname>ReadOnlyPaths=</varname>
         and
-        <varname>InaccessibleDirectories=</varname>
+        <varname>InaccessiblePaths=</varname>
         may be prefixed with
         <literal>-</literal>, in which case
         they will be ignored when they do not
@@ -1026,9 +1036,9 @@
         <varname>PrivateDevices=</varname>,
         <varname>ProtectSystem=</varname>,
         <varname>ProtectHome=</varname>,
-        <varname>ReadOnlyDirectories=</varname>,
-        <varname>InaccessibleDirectories=</varname> and
-        <varname>ReadWriteDirectories=</varname>) require that mount
+        <varname>ReadOnlyPaths=</varname>,
+        <varname>InaccessiblePaths=</varname> and
+        <varname>ReadWritePaths=</varname>) require that mount
         and unmount propagation from the unit's file system namespace
         is disabled, and hence downgrade <option>shared</option> to
         <option>slave</option>. </para></listitem>
@@ -1091,8 +1101,8 @@
         domain transition. However, the policy still needs to
         authorize the transition. This directive is ignored if SELinux
         is disabled. If prefixed by <literal>-</literal>, all errors
-        will be ignored. See
-        <citerefentry project='die-net'><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+        will be ignored. This does not affect commands prefixed with <literal>+</literal>.
+        See <citerefentry project='die-net'><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>
         for details.</para></listitem>
       </varlistentry>
 
@@ -1104,7 +1114,7 @@
         Profiles must already be loaded in the kernel, or the unit
         will fail. This result in a non operation if AppArmor is not
         enabled. If prefixed by <literal>-</literal>, all errors will
-        be ignored. </para></listitem>
+        be ignored. This does not affect commands prefixed with <literal>+</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -1123,7 +1133,8 @@
 
         <para>The value may be prefixed by <literal>-</literal>, in
         which case all errors will be ignored. An empty value may be
-        specified to unset previous assignments.</para>
+        specified to unset previous assignments. This does not affect
+        commands prefixed with <literal>+</literal>.</para>
         </listitem>
       </varlistentry>
 
@@ -1160,7 +1171,7 @@
         effect is inverted: only the listed system calls will result
         in immediate process termination (blacklisting). If running in
         user mode, or in system mode, but without the
-        <constant>CAP_SYS_ADMIN</constant> capabiblity (e.g. setting
+        <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
         <varname>User=nobody</varname>),
         <varname>NoNewPrivileges=yes</varname> is implied. This
         feature makes use of the Secure Computing Mode 2 interfaces of
@@ -1174,7 +1185,7 @@
         listed explicitly. This option may be specified more than once,
         in which case the filter masks are merged. If the empty string
         is assigned, the filter is reset, all prior assignments will
-        have no effect.</para>
+        have no effect. This does not affect commands prefixed with <literal>+</literal>.</para>
 
         <para>If you specify both types of this option (i.e.
         whitelisting and blacklisting), the first encountered will
@@ -1187,7 +1198,84 @@
         <function>read</function> and <function>write</function>, and
         right after it add a blacklisting of
         <function>write</function>, then <function>write</function>
-        will be removed from the set.) </para></listitem>
+        will be removed from the set.)</para>
+
+        <para>As the number of possible system
+        calls is large, predefined sets of system calls are provided.
+        A set starts with <literal>@</literal> character, followed by
+        name of the set.
+
+        <table>
+          <title>Currently predefined system call sets</title>
+
+          <tgroup cols='2'>
+            <colspec colname='set' />
+            <colspec colname='description' />
+            <thead>
+              <row>
+                <entry>Set</entry>
+                <entry>Description</entry>
+              </row>
+            </thead>
+            <tbody>
+              <row>
+                <entry>@clock</entry>
+                <entry>System calls for changing the system clock (<citerefentry project='man-pages'><refentrytitle>adjtimex</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>settimeofday</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
+              </row>
+              <row>
+                <entry>@cpu-emulation</entry>
+                <entry>System calls for CPU emulation functionality (<citerefentry project='man-pages'><refentrytitle>vm86</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
+              </row>
+              <row>
+                <entry>@debug</entry>
+                <entry>Debugging, performance monitoring and tracing functionality (<citerefentry project='man-pages'><refentrytitle>ptrace</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>perf_event_open</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
+              </row>
+              <row>
+                <entry>@io-event</entry>
+                <entry>Event loop system calls (<citerefentry project='man-pages'><refentrytitle>poll</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>select</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>epoll</refentrytitle><manvolnum>7</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>eventfd</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
+              </row>
+              <row>
+                <entry>@ipc</entry>
+                <entry>SysV IPC, POSIX Message Queues or other IPC (<citerefentry project='man-pages'><refentrytitle>mq_overview</refentrytitle><manvolnum>7</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>svipc</refentrytitle><manvolnum>7</manvolnum></citerefentry>)</entry>
+              </row>
+              <row>
+                <entry>@keyring</entry>
+                <entry>Kernel keyring access (<citerefentry project='man-pages'><refentrytitle>keyctl</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
+              </row>
+              <row>
+                <entry>@module</entry>
+                <entry>Kernel module control (<citerefentry project='man-pages'><refentrytitle>init_module</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>delete_module</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
+              </row>
+              <row>
+                <entry>@mount</entry>
+                <entry>File system mounting and unmounting (<citerefentry project='man-pages'><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
+              </row>
+              <row>
+                <entry>@network-io</entry>
+                <entry>Socket I/O (including local AF_UNIX): <citerefentry project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>unix</refentrytitle><manvolnum>7</manvolnum></citerefentry></entry>
+              </row>
+              <row>
+                <entry>@obsolete</entry>
+                <entry>Unusual, obsolete or unimplemented (<citerefentry project='man-pages'><refentrytitle>create_module</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>gtty</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)</entry>
+              </row>
+              <row>
+                <entry>@privileged</entry>
+                <entry>All system calls which need super-user capabilities (<citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>)</entry>
+              </row>
+              <row>
+                <entry>@process</entry>
+                <entry>Process control, execution, namespaces (<citerefentry project='man-pages'><refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>kill</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …</entry>
+              </row>
+              <row>
+                <entry>@raw-io</entry>
+                <entry>Raw I/O port access (<citerefentry project='man-pages'><refentrytitle>ioperm</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>iopl</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <function>pciconfig_read()</function>, …</entry>
+              </row>
+            </tbody>
+          </tgroup>
+        </table>
+
+        Note, that as new system calls are added to the kernel, additional system calls might be added to the groups
+        above, so the contents of the sets may change between systemd versions.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -1222,7 +1310,7 @@
         more strictly: to the architecture the system manager is
         compiled for). If running in user mode, or in system mode,
         but without the <constant>CAP_SYS_ADMIN</constant>
-        capabiblity (e.g. setting <varname>User=nobody</varname>),
+        capability (e.g. setting <varname>User=nobody</varname>),
         <varname>NoNewPrivileges=yes</varname> is implied. Note
         that setting this option to a non-empty list implies that
         <constant>native</constant> is included too. By default, this
@@ -1254,7 +1342,7 @@
         has no effect on 32-bit x86 and is ignored (but works
         correctly on x86-64). If running in user mode, or in system
         mode, but without the <constant>CAP_SYS_ADMIN</constant>
-        capabiblity (e.g. setting <varname>User=nobody</varname>),
+        capability (e.g. setting <varname>User=nobody</varname>),
         <varname>NoNewPrivileges=yes</varname> is implied. By
         default, no restriction applies, all address families are
         accessible to processes. If assigned the empty string, any
@@ -1266,7 +1354,7 @@
         family should be included in the configured whitelist as it is
         frequently used for local communication, including for
         <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry>
-        logging.</para></listitem>
+        logging. This does not affect commands prefixed with <literal>+</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -1311,6 +1399,35 @@
         <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>MemoryDenyWriteExecute=</varname></term>
+
+        <listitem><para>Takes a boolean argument. If set, attempts to create memory mappings that are writable and
+        executable at the same time, or to change existing memory mappings to become executable are prohibited.
+        Specifically, a system call filter is added that rejects
+        <citerefentry><refentrytitle>mmap</refentrytitle><manvolnum>2</manvolnum></citerefentry>
+        system calls with both <constant>PROT_EXEC</constant> and <constant>PROT_WRITE</constant> set
+        and <citerefentry><refentrytitle>mprotect</refentrytitle><manvolnum>2</manvolnum></citerefentry>
+        system calls with <constant>PROT_EXEC</constant> set. Note that this option is incompatible with programs
+        that generate program code dynamically at runtime, such as JIT execution engines, or programs compiled making
+        use of the code "trampoline" feature of various C compilers. This option improves service security, as it makes
+        harder for software exploits to change running code dynamically.
+        </para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>RestrictRealtime=</varname></term>
+
+        <listitem><para>Takes a boolean argument. If set, any attempts to enable realtime scheduling in a process of
+        the unit are refused. This restricts access to realtime task scheduling policies such as
+        <constant>SCHED_FIFO</constant>, <constant>SCHED_RR</constant> or <constant>SCHED_DEADLINE</constant>. See
+        <citerefentry><refentrytitle>sched</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details about
+        these scheduling policies. Realtime scheduling policies may be used to monopolize CPU time for longer periods
+        of time, and may hence be used to lock up or otherwise trigger Denial-of-Service situations on the system. It
+        is hence recommended to restrict access to realtime scheduling to the few programs that actually require
+        them. Defaults to off.</para></listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 
@@ -1437,6 +1554,26 @@
         <citerefentry project='man-pages'><refentrytitle>termcap</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
         </para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>$JOURNAL_STREAM</varname></term>
+
+        <listitem><para>If the standard output or standard error output of the executed processes are connected to the
+        journal (for example, by setting <varname>StandardError=journal</varname>) <varname>$JOURNAL_STREAM</varname>
+        contains the device and inode numbers of the connection file descriptor, formatted in decimal, separated by a
+        colon (<literal>:</literal>). This permits invoked processes to safely detect whether their standard output or
+        standard error output are connected to the journal. The device and inode numbers of the file descriptors should
+        be compared with the values set in the environment variable to determine whether the process output is still
+        connected to the journal. Note that it is generally not sufficient to only check whether
+        <varname>$JOURNAL_STREAM</varname> is set at all as services might invoke external processes replacing their
+        standard output or standard error output, without unsetting the environment variable.</para>
+
+        <para>This environment variable is primarily useful to allow services to optionally upgrade their used log
+        protocol to the native journal protocol (using
+        <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> and other
+        functions) if their standard output or standard error output is connected to the journal anyway, thus enabling
+        delivery of structured metadata along with logged messages.</para></listitem>
+      </varlistentry>
     </variablelist>
 
     <para>Additional variables may be configured by the following
diff --git a/src/grp-system/systemd/systemd.generator.xml b/src/grp-system/systemd/systemd.generator.xml
index 4b80dab108..b268104c9d 100644
--- a/src/grp-system/systemd/systemd.generator.xml
+++ b/src/grp-system/systemd/systemd.generator.xml
@@ -166,7 +166,7 @@
             process. That includes simple things such as logging to
             <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
             or <command>systemd</command> itself (this means: no
-            <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>)!.
+            <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>)!
             Non-essential file systems like
             <filename>/var</filename> and <filename>/home</filename>
             are mounted after generators have run. Generators
@@ -309,12 +309,12 @@
 
       <para><citerefentry><refentrytitle>systemd-system-update-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
       temporarily redirects <filename>default.target</filename> to
-      <filename>system-update.target</filename> if a system update is
+      <filename>system-update.target</filename>, if a system update is
       scheduled. Since this needs to override the default user
       configuration for <filename>default.target</filename>, it uses
       argv[2]. For details about this logic, see
-      <ulink url="http://www.freedesktop.org/wiki/Software/systemd/SystemUpdates">Implementing
-      Offline System Updates</ulink>.</para>
+      <citerefentry><refentrytitle>systemd.offline-updates</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
+      </para>
     </example>
 
     <example>
diff --git a/src/grp-system/systemd/systemd.netdev.xml b/src/grp-system/systemd/systemd.netdev.xml
index 8d12c305d2..a5c6f0fa40 100644
--- a/src/grp-system/systemd/systemd.netdev.xml
+++ b/src/grp-system/systemd/systemd.netdev.xml
@@ -124,7 +124,7 @@
           <entry>An IPv4 or IPv6 tunnel over IPv6</entry></row>
 
           <row><entry><varname>ip6gretap</varname></entry>
-          <entry>An Level 2 GRE tunnel over IPv6.</entry></row>
+          <entry>A Level 2 GRE tunnel over IPv6.</entry></row>
 
           <row><entry><varname>ipip</varname></entry>
           <entry>An IPv4 over IPv4 tunnel.</entry></row>
@@ -161,6 +161,10 @@
 
           <row><entry><varname>vxlan</varname></entry>
           <entry>A virtual extensible LAN (vxlan), for connecting Cloud computing deployments.</entry></row>
+
+          <row><entry><varname>vrf</varname></entry>
+            <entry>A Virtual Routing and Forwarding (<ulink url="https://www.kernel.org/doc/Documentation/networking/vrf.txt">VRF</ulink>) interface to create separate routing and forwarding domains.</entry></row>
+
         </tbody>
       </tgroup>
     </table>
@@ -330,6 +334,15 @@
             </para>
           </listitem>
         </varlistentry>
+        <varlistentry>
+          <term><varname>VLANFiltering=</varname></term>
+          <listitem>
+            <para>A boolean. This setting controls the IFLA_BR_VLAN_FILTERING option in the kernel.
+            If enabled, the bridge will be started in VLAN-filtering mode. When unset, the kernel's
+            default setting applies.
+            </para>
+          </listitem>
+        </varlistentry>
       </variablelist>
 
   </refsect1>
@@ -630,6 +643,33 @@
         </listitem>
       </varlistentry>
       <varlistentry>
+        <term><varname>Key=</varname></term>
+        <listitem>
+          <para>The <varname>Key=</varname> parameter specifies the same key to use in
+          both directions (<varname>InputKey=</varname> and <varname>OutputKey=</varname>).
+          The <varname>Key=</varname> is either a number or an IPv4 address-like dotted quad.
+          It is used as mark-configured SAD/SPD entry as part of the lookup key (both in data
+          and control path) in ip xfrm (framework used to implement IPsec protocol).
+          See <ulink url="http://man7.org/linux/man-pages/man8/ip-xfrm.8.html">
+          ip-xfrm — transform configuration</ulink> for details. It is only used for VTI/VTI6
+          tunnels.</para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>InputKey=</varname></term>
+        <listitem>
+          <para>The <varname>InputKey=</varname> parameter specifies the key to use for input.
+          The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6 tunnels.</para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>OutputKey=</varname></term>
+        <listitem>
+          <para>The <varname>OutputKey=</varname> parameter specifies the key to use for output.
+          The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6 tunnels.</para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
         <term><varname>Mode=</varname></term>
         <listitem>
           <para>An <literal>ip6tnl</literal> tunnel can be in one of three
@@ -768,8 +808,7 @@
           <literal>layer2</literal>,
           <literal>layer3+4</literal>,
           <literal>layer2+3</literal>,
-          <literal>encap2+3</literal>,
-          <literal>802.3ad</literal>, and
+          <literal>encap2+3</literal>, and
           <literal>encap3+4</literal>.
           </para>
         </listitem>
@@ -1101,7 +1140,16 @@ Name=dummy-test
 Kind=dummy
 MACAddress=12:34:56:78:9a:bc</programlisting>
     </example>
+    <example>
+      <title>/etc/systemd/network/25-vrf.netdev</title>
+      <para>Create a VRF interface with table 42.</para>
+      <programlisting>[NetDev]
+Name=vrf-test
+Kind=vrf
 
+[VRF]
+TableId=42</programlisting>
+    </example>
   </refsect1>
   <refsect1>
     <title>See Also</title>
diff --git a/src/grp-system/systemd/systemd.network.xml b/src/grp-system/systemd/systemd.network.xml
index 821e22aff8..4541a55490 100644
--- a/src/grp-system/systemd/systemd.network.xml
+++ b/src/grp-system/systemd/systemd.network.xml
@@ -240,7 +240,7 @@
             By enabling DHCPv6 support explicitly, the DHCPv6 client will
             be started regardless of the presence of routers on the link,
             or what flags the routers pass. See
-            <literal>IPv6AcceptRouterAdvertisements=</literal>.</para>
+            <literal>IPv6AcceptRA=</literal>.</para>
 
             <para>Furthermore, note that by default the domain name
             specified through DHCP is not used for name resolution.
@@ -527,24 +527,20 @@
           <literal>no</literal>.</para></listitem>
         </varlistentry>
         <varlistentry>
-          <term><varname>IPv6AcceptRouterAdvertisements=</varname></term>
-          <listitem><para>Force the setting of the <filename>accept_ra</filename>
-          (router advertisements) setting for the interface.
-          When unset, the kernel default is used, and router
-          advertisements are accepted only when local forwarding
-          is disabled for that interface.
-          When router advertisements are accepted, they will
-          trigger the start of the DHCPv6 client if the relevant
-          flags are passed, or if no routers are found on the link.
-          Takes a boolean. If true, router advertisements are
-          accepted, when false, router advertisements are ignored,
-          independently of the local forwarding state.</para>
-
-          <para>See
-          <ulink url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink>
-          in the kernel documentation, but note that systemd's
-          setting of <constant>1</constant> corresponds to
-          kernel's setting of <constant>2</constant>.</para>
+          <term><varname>IPv6AcceptRA=</varname></term>
+          <listitem><para>Enable or disable IPv6 Router Advertisement (RA) reception support for the interface.  Takes
+          a boolean parameter. If true, RAs are accepted; if false, RAs are ignored, independently of the local
+          forwarding state. When not set, the kernel default is used, and RAs are accepted only when local forwarding
+          is disabled for that interface.  When RAs are accepted, they may trigger the start of the DHCPv6 client if
+          the relevant flags are set in the RA data, or if no routers are found on the link.</para>
+
+          <para>Further settings for the IPv6 RA support may be configured in the
+          <literal>[IPv6AcceptRA]</literal> section, see below.</para>
+
+          <para>Also see <ulink
+          url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt">ip-sysctl.txt</ulink> in the kernel
+          documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
+          <constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
         </listitem>
         </varlistentry>
         <varlistentry>
@@ -583,6 +579,12 @@
           </listitem>
         </varlistentry>
         <varlistentry>
+          <term><varname>VRF=</varname></term>
+          <listitem>
+            <para>The name of the VRF to add the link to.</para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
           <term><varname>VLAN=</varname></term>
           <listitem>
             <para>The name of a VLAN to create on the link. This
@@ -799,7 +801,7 @@
             false.</para>
 
             <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
-            of all host names, in particular to single-label names. It is generally safer to use the supplied domain
+            of all host names, in particular of single-label names. It is generally safer to use the supplied domain
             only as routing domain, rather than as search domain, in order to not have it affect local resolution of
             single-label names.</para>
 
@@ -839,7 +841,7 @@
           <term><varname>ClientIdentifier=</varname></term>
           <listitem>
             <para>The DHCPv4 client identifier to use. Either <literal>mac</literal> to use the MAC address of the link
-            or <literal>duid</literal> (the default, see below) to use a RFC4361-compliant Client ID.</para>
+            or <literal>duid</literal> (the default, see below) to use an RFC4361-compliant Client ID.</para>
           </listitem>
         </varlistentry>
 
@@ -899,6 +901,47 @@
     </refsect1>
 
   <refsect1>
+    <title>[IPv6AcceptRA] Section Options</title>
+      <para>The <literal>[IPv6AcceptRA]</literal> section configures the IPv6 Router Advertisement
+      (RA) client, if it is enabled with the <varname>IPv6AcceptRA=</varname> setting described
+      above:</para>
+
+      <variablelist class='network-directives'>
+        <varlistentry>
+          <term><varname>UseDNS=</varname></term>
+          <listitem>
+            <para>When true (the default), the DNS servers received in the Router Advertisement will be used and take
+            precedence over any statically configured ones.</para>
+
+            <para>This corresponds to the <option>nameserver</option> option in <citerefentry
+            project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><varname>UseDomains=</varname></term>
+          <listitem>
+            <para>Takes a boolean argument, or the special value <literal>route</literal>. When true, the domain name
+            received via IPv6 Router Advertisement (RA) will be used as DNS search domain over this link, similar to
+            the effect of the <option>Domains=</option> setting. If set to <literal>route</literal>, the domain name
+            received via IPv6 RA will be used for routing DNS queries only, but not for searching, similar to the
+            effect of the <option>Domains=</option> setting when the argument is prefixed with
+            <literal>~</literal>. Defaults to false.</para>
+
+            <para>It is recommended to enable this option only on trusted networks, as setting this affects resolution
+            of all host names, in particular of single-label names. It is generally safer to use the supplied domain
+            only as routing domain, rather than as search domain, in order to not have it affect local resolution of
+            single-label names.</para>
+
+            <para>When set to true, this setting corresponds to the <option>domain</option> option in <citerefentry
+            project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+  </refsect1>
+
+
+  <refsect1>
     <title>[DHCPServer] Section Options</title>
     <para>The <literal>[DHCPServer]</literal> section contains
     settings for the DHCP server, if enabled via the
@@ -1093,6 +1136,39 @@
         </varlistentry>
       </variablelist>
   </refsect1>
+  <refsect1>
+    <title>[BridgeVLAN] Section Options</title>
+      <para>The <literal>[BridgeVLAN]</literal> section manages the VLAN ID configuration of a bridge port and accepts
+      the following keys. Specify several <literal>[BridgeVLAN]</literal> sections to configure several VLAN entries.
+      The <varname>VLANFiltering=</varname> option has to be enabled, see <literal>[Bridge]</literal> section in
+      <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+
+      <variablelist class='network-directives'>
+        <varlistentry>
+          <term><varname>VLAN=</varname></term>
+          <listitem>
+            <para>The VLAN ID allowed on the port. This can be either a single ID or a range M-N. VLAN IDs are valid
+            from 1 to 4094.</para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>EgressUntagged=</varname></term>
+          <listitem>
+            <para>The VLAN ID specified here will be used to untag frames on egress. Configuring
+            <varname>EgressUntagged=</varname> implicates the use of <varname>VLAN=</varname> above and will enable the
+            VLAN ID for ingress as well. This can be either a single ID or a range M-N.</para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>PVID=</varname></term>
+          <listitem>
+            <para>The Port VLAN ID specified here is assigned to all untagged frames at ingress.
+            <varname>PVID=</varname> can be used only once. Configuring <varname>PVID=</varname> implicates the use of
+            <varname>VLAN=</varname> above and will enable the VLAN ID for ingress as well.</para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+  </refsect1>
 
   <refsect1>
     <title>Example</title>
@@ -1139,6 +1215,26 @@ Name=enp2s0
 Bridge=bridge0</programlisting>
     </example>
     <example>
+      <title>/etc/systemd/network/25-bridge-slave-interface-vlan.network</title>
+
+      <programlisting>[Match]
+Name=enp2s0
+
+[Network]
+Bridge=bridge0
+
+[BridgeVLAN]
+VLAN=1-32
+PVID=42
+EgressUntagged=42
+
+[BridgeVLAN]
+VLAN=100-200
+
+[BridgeVLAN]
+EgressUntagged=300-400</programlisting>
+    </example>
+    <example>
       <title>/etc/systemd/network/25-ipip.network</title>
 
       <programlisting>[Match]
@@ -1189,6 +1285,17 @@ DHCP=yes
 </programlisting>
     </example>
 
+    <example>
+      <title>/etc/systemd/network/25-vrf.network</title>
+      <para>Add the bond1 interface to the VRF master interface vrf-test. This will redirect routes generated on this interface to be within the routing table defined during VRF creation. Traffic won't be redirected towards the VRFs routing table unless specific ip-rules are added.</para>
+      <programlisting>[Match]
+Name=bond1
+
+[Network]
+VRF=vrf-test
+</programlisting>
+    </example>
+
   </refsect1>
 
   <refsect1>
diff --git a/src/grp-system/systemd/systemd.nspawn.xml b/src/grp-system/systemd/systemd.nspawn.xml
index 3683412c14..b1344d6c10 100644
--- a/src/grp-system/systemd/systemd.nspawn.xml
+++ b/src/grp-system/systemd/systemd.nspawn.xml
@@ -146,7 +146,8 @@
         specified parameters using <varname>Parameters=</varname> are passed as additional arguments to the
         <filename>init</filename> process. This setting corresponds to the <option>--boot</option> switch on the
         <command>systemd-nspawn</command> command line. This option may not be combined with
-        <varname>ProcessTwo=yes</varname>.</para></listitem>
+        <varname>ProcessTwo=yes</varname>. This option is the default if the
+        <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -257,7 +258,17 @@
 
         <listitem><para>Configures support for usernamespacing. This is equivalent to the
         <option>--private-users=</option> command line switch, and takes the same options. This option is privileged
-        (see above). </para></listitem>
+        (see above). This option is the default if the <filename>systemd-nspawn@.service</filename> template unit file
+        is used.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>NotifyReady=</varname></term>
+
+        <listitem><para>Configures support for notifications from the container's init process.
+        This is equivalent to use <option>--notify-ready=</option> command line switch,
+        and takes the same options. See <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+        for details about the specific options supported.</para></listitem>
       </varlistentry>
     </variablelist>
   </refsect1>
@@ -358,13 +369,11 @@
       <varlistentry>
         <term><varname>VirtualEthernet=</varname></term>
 
-        <listitem><para>Takes a boolean argument. Configures whether
-        to create a virtual Ethernet connection
-        (<literal>veth</literal>) between host and the container. This
-        setting implies <varname>Private=yes</varname>. This setting
-        corresponds to the <option>--network-veth</option> command
-        line switch. This option is privileged (see
-        above).</para></listitem>
+        <listitem><para>Takes a boolean argument. Configures whether to create a virtual Ethernet connection
+        (<literal>veth</literal>) between host and the container. This setting implies
+        <varname>Private=yes</varname>. This setting corresponds to the <option>--network-veth</option> command line
+        switch. This option is privileged (see above). This option is the default if the
+        <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
       </varlistentry>
 
       <varlistentry>
diff --git a/src/grp-system/systemd/systemd.offline-updates.xml b/src/grp-system/systemd/systemd.offline-updates.xml
index 946234ad90..ae53b8552d 100644
--- a/src/grp-system/systemd/systemd.offline-updates.xml
+++ b/src/grp-system/systemd/systemd.offline-updates.xml
@@ -93,7 +93,7 @@
 
       <listitem>
         <para>As the first step, the update script should check if the
-        <filename>/system-update</filename> symlink points to the the location used by that update
+        <filename>/system-update</filename> symlink points to the location used by that update
         script. In case it does not exists or points to a different location, the script must exit
         without error. It is possible for multiple update services to be installed, and for multiple
         update scripts to be launched in parallel, and only the one that corresponds to the tool
diff --git a/src/grp-system/systemd/systemd.resource-control.xml b/src/grp-system/systemd/systemd.resource-control.xml
index 066f2cc19b..bf44a68345 100644
--- a/src/grp-system/systemd/systemd.resource-control.xml
+++ b/src/grp-system/systemd/systemd.resource-control.xml
@@ -92,16 +92,14 @@
   <refsect1>
     <title>Automatic Dependencies</title>
 
-    <para>Units with the <varname>Slice=</varname> setting set get
-    automatic <varname>Requires=</varname> and
-    <varname>After=</varname> dependencies on the specified slice
-    unit.</para>
+    <para>Units with the <varname>Slice=</varname> setting set automatically acquire <varname>Requires=</varname> and
+    <varname>After=</varname> dependencies on the specified slice unit.</para>
   </refsect1>
 
   <refsect1>
     <title>Unified and Legacy Control Group Hierarchies</title>
 
-    <para>Unified control group hierarchy is the new version of kernel control group interface. Depending on the
+    <para>The unified control group hierarchy is the new version of kernel control group interface. Depending on the
     resource type, there are differences in resource control capabilities.  Also, because of interface changes, some
     resource types have a separate set of options on the unified hierarchy.</para>
 
@@ -114,6 +112,13 @@
             prefixed ones. On unified hierarchy, IO resource control also applies to buffered writes.</para>
           </listitem>
         </varlistentry>
+        <varlistentry>
+          <term><option>Memory</option></term>
+          <listitem>
+            <para><varname>MemoryMax=</varname> replaces <varname>MemoryLimit=</varname>. <varname>MemoryLow=</varname>
+            and <varname>MemoryHigh=</varname> are effective only on unified hierarchy.</para>
+          </listitem>
+        </varlistentry>
       </variablelist>
     </para>
 
@@ -213,23 +218,89 @@
       </varlistentry>
 
       <varlistentry>
+        <term><varname>MemoryLow=<replaceable>bytes</replaceable></varname></term>
+
+        <listitem>
+          <para>Specify the best-effort memory usage protection of the executed processes in this unit. If the memory
+          usages of this unit and all its ancestors are below their low boundaries, this unit's memory won't be
+          reclaimed as long as memory can be reclaimed from unprotected units.</para>
+
+          <para>Takes a memory size in bytes. If the value is suffixed with K, M, G or T, the specified memory size is
+          parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
+          percentage value may be specified, which is taken relative to the installed physical memory on the
+          system. This controls the <literal>memory.low</literal> control group attribute. For details about this
+          control group attribute, see <ulink
+          url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
+
+          <para>Implies <literal>MemoryAccounting=true</literal>.</para>
+
+          <para>This setting is supported only if the unified control group hierarchy is used.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>MemoryHigh=<replaceable>bytes</replaceable></varname></term>
+
+        <listitem>
+          <para>Specify the high limit on memory usage of the executed processes in this unit. Memory usage may go
+          above the limit if unavoidable, but the processes are heavily slowed down and memory is taken away
+          aggressively in such cases. This is the main mechanism to control memory usage of a unit.</para>
+
+          <para>Takes a memory size in bytes. If the value is suffixed with K, M, G or T, the specified memory size is
+          parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
+          percentage value may be specified, which is taken relative to the installed physical memory on the
+          system. If assigned the
+          special value <literal>infinity</literal>, no memory limit is applied. This controls the
+          <literal>memory.high</literal> control group attribute. For details about this control group attribute, see
+          <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
+
+          <para>Implies <literal>MemoryAccounting=true</literal>.</para>
+
+          <para>This setting is supported only if the unified control group hierarchy is used.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>MemoryMax=<replaceable>bytes</replaceable></varname></term>
+
+        <listitem>
+          <para>Specify the absolute limit on memory usage of the executed processes in this unit. If memory usage
+          cannot be contained under the limit, out-of-memory killer is invoked inside the unit. It is recommended to
+          use <varname>MemoryHigh=</varname> as the main control mechanism and use <varname>MemoryMax=</varname> as the
+          last line of defense.</para>
+
+          <para>Takes a memory size in bytes. If the value is suffixed with K, M, G or T, the specified memory size is
+          parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
+          percentage value may be specified, which is taken relative to the installed physical memory on the system. If
+          assigned the special value <literal>infinity</literal>, no memory limit is applied. This controls the
+          <literal>memory.max</literal> control group attribute. For details about this control group attribute, see
+          <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
+
+          <para>Implies <literal>MemoryAccounting=true</literal>.</para>
+
+          <para>This setting is supported only if the unified control group hierarchy is used. Use
+          <varname>MemoryLimit=</varname> on systems using the legacy control group hierarchy.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><varname>MemoryLimit=<replaceable>bytes</replaceable></varname></term>
 
         <listitem>
-          <para>Specify the limit on maximum memory usage of the
-          executed processes. The limit specifies how much process and
-          kernel memory can be used by tasks in this unit. Takes a
-          memory size in bytes. If the value is suffixed with K, M, G
-          or T, the specified memory size is parsed as Kilobytes,
-          Megabytes, Gigabytes, or Terabytes (with the base 1024),
-          respectively. If assigned the special value
-          <literal>infinity</literal>, no memory limit is applied. This
-          controls the <literal>memory.limit_in_bytes</literal>
-          control group attribute. For details about this control
-          group attribute, see <ulink
+          <para>Specify the limit on maximum memory usage of the executed processes. The limit specifies how much
+          process and kernel memory can be used by tasks in this unit. Takes a memory size in bytes. If the value is
+          suffixed with K, M, G or T, the specified memory size is parsed as Kilobytes, Megabytes, Gigabytes, or
+          Terabytes (with the base 1024), respectively. Alternatively, a percentage value may be specified, which is
+          taken relative to the installed physical memory on the system. If assigned the special value
+          <literal>infinity</literal>, no memory limit is applied. This controls the
+          <literal>memory.limit_in_bytes</literal> control group attribute. For details about this control group
+          attribute, see <ulink
           url="https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt">memory.txt</ulink>.</para>
 
           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
+
+          <para>This setting is supported only if the legacy control group hierarchy is used. Use
+          <varname>MemoryMax=</varname> on systems using the unified control group hierarchy.</para>
         </listitem>
       </varlistentry>
 
@@ -256,15 +327,12 @@
         <term><varname>TasksMax=<replaceable>N</replaceable></varname></term>
 
         <listitem>
-          <para>Specify the maximum number of tasks that may be
-          created in the unit. This ensures that the number of tasks
-          accounted for the unit (see above) stays below a specific
-          limit. If assigned the special value
-          <literal>infinity</literal>, no tasks limit is applied. This
-          controls the <literal>pids.max</literal> control group
-          attribute. For details about this control group attribute,
-          see <ulink
-          url="https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt">pids.txt</ulink>.</para>
+          <para>Specify the maximum number of tasks that may be created in the unit. This ensures that the number of
+          tasks accounted for the unit (see above) stays below a specific limit. This either takes an absolute number
+          of tasks or a percentage value that is taken relative to the configured maximum number of tasks on the
+          system.  If assigned the special value <literal>infinity</literal>, no tasks limit is applied. This controls
+          the <literal>pids.max</literal> control group attribute. For details about this control group attribute, see
+          <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt">pids.txt</ulink>.</para>
 
           <para>Implies <literal>TasksAccounting=true</literal>. The
           system default for this setting may be controlled with
diff --git a/src/grp-system/systemd/systemd.service.xml b/src/grp-system/systemd/systemd.service.xml
index 6641dfed4f..875d368fcf 100644
--- a/src/grp-system/systemd/systemd.service.xml
+++ b/src/grp-system/systemd/systemd.service.xml
@@ -202,8 +202,9 @@
         notification message has been sent. If this option is used,
         <varname>NotifyAccess=</varname> (see below) should be set to
         open access to the notification socket provided by systemd. If
-        <varname>NotifyAccess=</varname> is not set, it will be
-        implicitly set to <option>main</option>. Note that currently
+        <varname>NotifyAccess=</varname> is missing or set to
+        <option>none</option>, it will be forcibly set to
+        <option>main</option>. Note that currently
         <varname>Type=</varname><option>notify</option> will not work
         if used in combination with
         <varname>PrivateNetwork=</varname><option>yes</option>.</para>
@@ -287,17 +288,14 @@
         <varname>ExecStart=</varname> is specified, then the service
         must have <varname>RemainAfterExit=yes</varname> set.</para>
 
-        <para>For each of the specified commands, the first argument
-        must be an absolute path to an executable. Optionally, if this
-        file name is prefixed with <literal>@</literal>, the second
-        token will be passed as <literal>argv[0]</literal> to the
-        executed process, followed by the further arguments specified.
-        If the absolute filename is prefixed with
-        <literal>-</literal>, an exit code of the command normally
-        considered a failure (i.e. non-zero exit status or abnormal
-        exit due to signal) is ignored and considered success. If both
-        <literal>-</literal> and <literal>@</literal> are used, they
-        can appear in either order.</para>
+        <para>For each of the specified commands, the first argument must be an absolute path to an
+        executable. Optionally, if this file name is prefixed with <literal>@</literal>, the second token will be
+        passed as <literal>argv[0]</literal> to the executed process, followed by the further arguments specified.  If
+        the absolute filename is prefixed with <literal>-</literal>, an exit code of the command normally considered a
+        failure (i.e. non-zero exit status or abnormal exit due to signal) is ignored and considered success.  If the
+        absolute path is prefixed with <literal>+</literal> then it is executed with full
+        privileges. <literal>-</literal>, <literal>@</literal>, and <literal>+</literal> may be used together and they
+        can appear in any order.</para>
 
         <para>If more than one command is specified, the commands are
         invoked sequentially in the order they appear in the unit
diff --git a/src/grp-system/systemd/systemd.special.xml b/src/grp-system/systemd/systemd.special.xml
index 26974ed73f..18ad8f92e5 100644
--- a/src/grp-system/systemd/systemd.special.xml
+++ b/src/grp-system/systemd/systemd.special.xml
@@ -127,9 +127,9 @@
         <listitem>
           <para>A special target unit covering basic boot-up.</para>
 
-          <para>systemd automatically adds dependencies of the types
-          <varname>Requires=</varname> and <varname>After=</varname>
-          for this target unit to all services (except for those with
+          <para>systemd automatically adds dependency of the type
+          <varname>After=</varname> for this target unit to all
+          services (except for those with
           <varname>DefaultDependencies=no</varname>).</para>
 
           <para>Usually, this should pull-in all local mount points plus
@@ -473,7 +473,7 @@
           <citerefentry><refentrytitle>systemd-fstab-generator</refentrytitle><manvolnum>3</manvolnum></citerefentry>
           and
           <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-          automatically setup the appropiate dependencies to make this happen.
+          automatically setup the appropriate dependencies to make this happen.
           </para>
         </listitem>
       </varlistentry>
@@ -497,8 +497,8 @@
           <para>These are targets that are called whenever the SysV
           compatibility code asks for runlevel 2, 3, 4, 5,
           respectively. It is a good idea to make this an alias for
-          (i.e. symlink to) <filename>multi-user.target</filename>
-          (for runlevel 2) or <filename>graphical.target</filename>
+          (i.e. symlink to) <filename>graphical.target</filename>
+          (for runlevel 5) or <filename>multi-user.target</filename>
           (the others).</para>
         </listitem>
       </varlistentry>
@@ -509,8 +509,9 @@
           system shutdown.</para>
 
           <para>Services that shall be terminated on system shutdown
-          shall add <varname>Conflicts=</varname> dependencies to this
-          unit for their service unit, which is implicitly done when
+          shall add <varname>Conflicts=</varname> and
+          <varname>Before=</varname> dependencies to this unit for
+          their service unit, which is implicitly done when
           <varname>DefaultDependencies=yes</varname> is set (the
           default).</para>
         </listitem>
@@ -579,6 +580,11 @@
       <varlistentry>
         <term><filename>sysinit.target</filename></term>
         <listitem>
+          <para>systemd automatically adds dependencies of the types
+          <varname>Requires=</varname> and <varname>After=</varname>
+          for this target unit to all services (except for those with
+          <varname>DefaultDependencies=no</varname>).</para>
+
           <para>This target pulls in the services required for system
           initialization. System services pulled in by this target should
           declare <varname>DefaultDependencies=no</varname> and specify
diff --git a/src/grp-system/systemd/systemd.target.xml b/src/grp-system/systemd/systemd.target.xml
index ab910d75dd..2e35e54fc4 100644
--- a/src/grp-system/systemd/systemd.target.xml
+++ b/src/grp-system/systemd/systemd.target.xml
@@ -82,11 +82,20 @@
   <refsect1>
     <title>Automatic Dependencies</title>
 
-    <para>Unless <varname>DefaultDependencies=</varname> in the <literal>[Unit]</literal> section is set to
-    <option>no</option>, target units will implicitly complement all configured dependencies of type
-    <varname>Wants=</varname>, <varname>Requires=</varname> with dependencies of type <varname>After=</varname>, unless
-    an ordering dependency of any kind between the target and the respective other unit is already in place. Note that
-    this behaviour is disabled if either unit has <varname>DefaultDependencies=no</varname>.</para>
+    <para>Unless <varname>DefaultDependencies=</varname> is set to
+    <option>no</option> in either of releated units or an explicit ordering
+    dependency is already defined, target units will implicitly complement all
+    configured dependencies of type <varname>Wants=</varname> or
+    <varname>Requires=</varname> with dependencies of type
+    <varname>After=</varname>. Note that <varname>Wants=</varname> or
+    <varname>Requires=</varname> must be defined in the target unit itself — if
+    you for example define <varname>Wants=</varname>some.target in
+    some.service, the implicit ordering will not be added.</para>
+
+    <para>All target units automatically gain <varname>Conflicts=</varname>
+    dependency against shutdown.target unless <varname>DefaultDependencies=</varname>
+    is set to <option>no</option>.</para>
+
   </refsect1>
 
   <refsect1>
diff --git a/src/grp-system/systemd/systemd.time.xml b/src/grp-system/systemd/systemd.time.xml
index ffcac82263..aae3accb6c 100644
--- a/src/grp-system/systemd/systemd.time.xml
+++ b/src/grp-system/systemd/systemd.time.xml
@@ -217,8 +217,8 @@
     should consist of one or more English language weekday names,
     either in the abbreviated (Wed) or non-abbreviated (Wednesday)
     form (case does not matter), separated by commas. Specifying two
-    weekdays separated by <literal>-</literal> refers to a range of
-    continuous weekdays. <literal>,</literal> and <literal>-</literal>
+    weekdays separated by <literal>..</literal> refers to a range of
+    continuous weekdays. <literal>,</literal> and <literal>..</literal>
     may be combined freely.</para>
 
     <para>In the date and time specifications, any component may be
@@ -226,8 +226,9 @@
     match. Alternatively, each component can be specified as a list of
     values separated by commas. Values may also be suffixed with
     <literal>/</literal> and a repetition value, which indicates that
-    the value and all values plus multiples of the repetition value
-    are matched.</para>
+    the value itself and the value plus all multiples of the repetition value
+    are matched.  Each component may also contain a range of values
+    separated by <literal>..</literal>.</para>
 
     <para>The seconds component may contain decimal fractions both in
     the value and the repetition. All fractions are rounded to 6
@@ -262,17 +263,18 @@
     <para>Examples for valid timestamps and their
     normalized form:</para>
 
-<programlisting>   Sat,Thu,Mon-Wed,Sat-Sun → Mon-Thu,Sat,Sun *-*-* 00:00:00
+<programlisting>   Sat,Thu,Mon..Wed,Sat..Sun → Mon..Thu,Sat,Sun *-*-* 00:00:00
      Mon,Sun 12-*-* 2,1:23 → Mon,Sun 2012-*-* 01,02:23:00
                    Wed *-1 → Wed *-*-01 00:00:00
-           Wed-Wed,Wed *-1 → Wed *-*-01 00:00:00
+           Wed..Wed,Wed *-1 → Wed *-*-01 00:00:00
                 Wed, 17:48 → Wed *-*-* 17:48:00
-Wed-Sat,Tue 12-10-15 1:2:3 → Tue-Sat 2012-10-15 01:02:03
+Wed..Sat,Tue 12-10-15 1:2:3 → Tue..Sat 2012-10-15 01:02:03
                *-*-7 0:0:0 → *-*-07 00:00:00
                      10-15 → *-10-15 00:00:00
        monday *-12-* 17:00 → Mon *-12-* 17:00:00
  Mon,Fri *-*-3,1,2 *:30:45 → Mon,Fri *-*-01,02,03 *:30:45
       12,14,13,12:20,10,30 → *-*-* 12,13,14:10,20,30:00
+           12..14:10,20,30 → *-*-* 12,13,14:10,20,30:00
  mon,fri *-1/2-1,3 *:30:45 → Mon,Fri *-01/2-01,03 *:30:45
             03-05 08:05:40 → *-03-05 08:05:40
                   08:05:40 → *-*-* 08:05:40
@@ -281,6 +283,7 @@ Wed-Sat,Tue 12-10-15 1:2:3 → Tue-Sat 2012-10-15 01:02:03
           Sat,Sun 08:05:40 → Sat,Sun *-*-* 08:05:40
           2003-03-05 05:40 → 2003-03-05 05:40:00
 05:40:23.4200004/3.1700005 → 05:40:23.420000/3.170001
+            2003-02..04-05 → 2003-02,03,04-05 00:00:00
       2003-03-05 05:40 UTC → 2003-03-05 05:40:00 UTC
                 2003-03-05 → 2003-03-05 00:00:00
                      03-05 → *-03-05 00:00:00
diff --git a/src/grp-system/systemd/systemd.timer.xml b/src/grp-system/systemd/systemd.timer.xml
index 0fa95e97a8..4fe140e4bc 100644
--- a/src/grp-system/systemd/systemd.timer.xml
+++ b/src/grp-system/systemd/systemd.timer.xml
@@ -76,7 +76,7 @@
 
     <para>Note that in case the unit to activate is already active at the time the timer elapses it is not restarted,
     but simply left running. There is no concept of spawning new service instances in this case. Due to this, services
-    with <varname>RemainAfterExit=</varname> set (which stay around continously even after the service's main process
+    with <varname>RemainAfterExit=</varname> set (which stay around continuously even after the service's main process
     exited) are usually not suitable for activation via repetitive timers, as they will only be activated once, and
     then stay around forever.</para>
   </refsect1>
diff --git a/src/grp-system/systemd/systemd.unit.xml b/src/grp-system/systemd/systemd.unit.xml
index 341789cd47..85a7b12d76 100644
--- a/src/grp-system/systemd/systemd.unit.xml
+++ b/src/grp-system/systemd/systemd.unit.xml
@@ -1234,7 +1234,7 @@
           <row>
       <entry><literal>%f</literal></entry>
       <entry>Unescaped filename</entry>
-      <entry>This is either the unescaped instance name (if applicable) with <filename>/</filename> prepended (if applicable), or the prefix name prepended with <filename>/</filename>.</entry>
+      <entry>This is either the unescaped instance name (if applicable) with <filename>/</filename> prepended (if applicable), or the unescaped prefix name prepended with <filename>/</filename>.</entry>
           </row>
           <row>
       <entry><literal>%c</literal></entry>
diff --git a/src/grp-system/systemd/systemd.xml b/src/grp-system/systemd/systemd.xml
index e05a9d6e29..4f0201fc76 100644
--- a/src/grp-system/systemd/systemd.xml
+++ b/src/grp-system/systemd/systemd.xml
@@ -1024,25 +1024,27 @@
 
       <varlistentry>
         <term><varname>emergency</varname></term>
+        <term><varname>rd.emergency</varname></term>
         <term><varname>-b</varname></term>
 
         <listitem><para>Boot into emergency mode. This is equivalent
-        to <varname>systemd.unit=emergency.target</varname> and
-        provided for compatibility reasons and to be easier to
-        type.</para></listitem>
+        to <varname>systemd.unit=emergency.target</varname> or
+        <varname>rd.systemd.unit=emergency.target</varname>, respectively, and
+        provided for compatibility reasons and to be easier to type.</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><varname>rescue</varname></term>
+        <term><varname>rd.rescue</varname></term>
         <term><varname>single</varname></term>
         <term><varname>s</varname></term>
         <term><varname>S</varname></term>
         <term><varname>1</varname></term>
 
         <listitem><para>Boot into rescue mode. This is equivalent to
-        <varname>systemd.unit=rescue.target</varname> and provided for
-        compatibility reasons and to be easier to
-        type.</para></listitem>
+        <varname>systemd.unit=rescue.target</varname> or
+        <varname>rd.systemd.unit=rescue.target</varname>, respectively, and
+        provided for compatibility reasons and to be easier to type.</para></listitem>
       </varlistentry>
 
       <varlistentry>
diff --git a/src/grp-timedate/systemd-timedated/Makefile b/src/grp-timedate/systemd-timedated/Makefile
index 798e3ba5a4..d06142536e 100644
--- a/src/grp-timedate/systemd-timedated/Makefile
+++ b/src/grp-timedate/systemd-timedated/Makefile
@@ -28,7 +28,7 @@ systemd_timedated_SOURCES = \
 	src/timedate/timedated.c
 
 systemd_timedated_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 rootlibexec_PROGRAMS += \
 	systemd-timedated
diff --git a/src/grp-timedate/systemd-timedated/systemd-timedated.service.in b/src/grp-timedate/systemd-timedated/systemd-timedated.service.in
index 0c9599db20..bc1795d747 100644
--- a/src/grp-timedate/systemd-timedated/systemd-timedated.service.in
+++ b/src/grp-timedate/systemd-timedated/systemd-timedated.service.in
@@ -18,3 +18,5 @@ WatchdogSec=3min
 PrivateTmp=yes
 ProtectSystem=yes
 ProtectHome=yes
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
diff --git a/src/grp-timedate/timedatectl/Makefile b/src/grp-timedate/timedatectl/Makefile
index 4394bf892b..b1093dad9b 100644
--- a/src/grp-timedate/timedatectl/Makefile
+++ b/src/grp-timedate/timedatectl/Makefile
@@ -28,7 +28,7 @@ timedatectl_SOURCES = \
 	src/timedate/timedatectl.c
 
 timedatectl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 bin_PROGRAMS += \
 	timedatectl
diff --git a/src/grp-timedate/timedatectl/timedatectl.c b/src/grp-timedate/timedatectl/timedatectl.c
index b85d2fdb80..14d66b557b 100644
--- a/src/grp-timedate/timedatectl/timedatectl.c
+++ b/src/grp-timedate/timedatectl/timedatectl.c
@@ -57,11 +57,11 @@ typedef struct StatusInfo {
         char *timezone;
 
         usec_t rtc_time;
-        bool rtc_local;
+        int rtc_local;
 
-        bool ntp_enabled;
-        bool ntp_capable;
-        bool ntp_synced;
+        int ntp_enabled;
+        int ntp_capable;
+        int ntp_synced;
 } StatusInfo;
 
 static void status_info_clear(StatusInfo *info) {
@@ -144,13 +144,13 @@ static void print_status_info(const StatusInfo *i) {
                yes_no(i->rtc_local));
 
         if (i->rtc_local)
-                fputs("\n" ANSI_HIGHLIGHT
-                      "Warning: The system is configured to read the RTC time in the local time zone.\n"
-                      "         This mode can not be fully supported. It will create various problems\n"
-                      "         with time zone changes and daylight saving time adjustments. The RTC\n"
-                      "         time is never updated, it relies on external facilities to maintain it.\n"
-                      "         If at all possible, use RTC in UTC by calling\n"
-                      "         'timedatectl set-local-rtc 0'." ANSI_NORMAL "\n", stdout);
+                printf("\n%s"
+                       "Warning: The system is configured to read the RTC time in the local time zone.\n"
+                       "         This mode can not be fully supported. It will create various problems\n"
+                       "         with time zone changes and daylight saving time adjustments. The RTC\n"
+                       "         time is never updated, it relies on external facilities to maintain it.\n"
+                       "         If at all possible, use RTC in UTC by calling\n"
+                       "         'timedatectl set-local-rtc 0'.%s\n", ansi_highlight(), ansi_normal());
 }
 
 static int show_status(sd_bus *bus, char **args, unsigned n) {
@@ -480,7 +480,7 @@ static int timedatectl_main(sd_bus *bus, int argc, char *argv[]) {
 }
 
 int main(int argc, char *argv[]) {
-        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
+        sd_bus *bus = NULL;
         int r;
 
         setlocale(LC_ALL, "");
@@ -500,6 +500,7 @@ int main(int argc, char *argv[]) {
         r = timedatectl_main(bus, argc, argv);
 
 finish:
+        sd_bus_flush_close_unref(bus);
         pager_close();
 
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
diff --git a/src/grp-udev/Makefile b/src/grp-udev/Makefile
index 6b287f458c..e826b46a5c 100644
--- a/src/grp-udev/Makefile
+++ b/src/grp-udev/Makefile
@@ -38,6 +38,7 @@ dist_udevrules_DATA += \
 	rules/60-serial.rules \
 	rules/64-btrfs.rules \
 	rules/70-mouse.rules \
+	rules/70-touchpad.rules \
 	rules/75-net-description.rules \
 	rules/78-sound-card.rules \
 	rules/80-net-setup-link.rules
diff --git a/src/grp-udev/hwdb/.gitignore b/src/grp-udev/hwdb/.gitignore
index 00b977a3b5..c4796815d2 100644
--- a/src/grp-udev/hwdb/.gitignore
+++ b/src/grp-udev/hwdb/.gitignore
@@ -1,5 +1,8 @@
-/pci.ids
-/usb.ids
+/20-acpi-vendor.hwdb.base
+/acpi_id_registry.html
 /ma-large.txt
 /ma-medium.txt
 /ma-small.txt
+/pci.ids
+/pnp_id_registry.html
+/usb.ids
diff --git a/src/grp-udev/hwdb/20-OUI.hwdb b/src/grp-udev/hwdb/20-OUI.hwdb
index d852e7b8b3..dd63627328 100644
--- a/src/grp-udev/hwdb/20-OUI.hwdb
+++ b/src/grp-udev/hwdb/20-OUI.hwdb
@@ -941,6 +941,63 @@ OUI:70B3D57B4*
 OUI:70B3D5B11*
  ID_OUI_FROM_DATABASE=CAB S.R.L.
 
+OUI:70B3D5513*
+ ID_OUI_FROM_DATABASE=MB connect line GmbH Fernwartungssysteme
+
+OUI:70B3D5F99*
+ ID_OUI_FROM_DATABASE=TEX COMPUTER SRL
+
+OUI:70B3D53A7*
+ ID_OUI_FROM_DATABASE=Varikorea
+
+OUI:70B3D5174*
+ ID_OUI_FROM_DATABASE=Carlson Wireless Technologies Inc.
+
+OUI:70B3D57D5*
+ ID_OUI_FROM_DATABASE=SICS Swedish ICT
+
+OUI:70B3D5448*
+ ID_OUI_FROM_DATABASE=B/E Aerospace, Inc.
+
+OUI:70B3D5A53*
+ ID_OUI_FROM_DATABASE=GS Industrie-Elektronik GmbH
+
+OUI:70B3D5BE3*
+ ID_OUI_FROM_DATABASE=Saratov Electrounit Production Plant named after Sergo Ordzhonikidze, OJSC
+
+OUI:70B3D5AAD*
+ ID_OUI_FROM_DATABASE=Bartec GmbH
+
+OUI:70B3D5E82*
+ ID_OUI_FROM_DATABASE=RF Track
+
+OUI:70B3D585D*
+ ID_OUI_FROM_DATABASE=ATHREYA INC
+
+OUI:70B3D5821*
+ ID_OUI_FROM_DATABASE=HL2 group
+
+OUI:70B3D5938*
+ ID_OUI_FROM_DATABASE=JETI Technische Instrumente GmbH
+
+OUI:70B3D5A21*
+ ID_OUI_FROM_DATABASE=PPI Inc.
+
+OUI:70B3D5E4F*
+ ID_OUI_FROM_DATABASE=RWS Automation GmbH
+
+OUI:70B3D55C4*
+ ID_OUI_FROM_DATABASE=TATTILE SRL
+
+OUI:70B3D567B*
+ ID_OUI_FROM_DATABASE=Stesalit Systems Ltd
+
+OUI:70B3D51C8*
+ ID_OUI_FROM_DATABASE=LDA audio video profesional S.L.
+
+OUI:70B3D5142*
+ ID_OUI_FROM_DATABASE=DAVE SRL
+
 OUI:70B3D5D60*
  ID_OUI_FROM_DATABASE=Flintab AB
 
@@ -1808,6 +1865,48 @@ OUI:70B3D509D*
 OUI:70B3D5FB0*
  ID_OUI_FROM_DATABASE=Rohde&Schwarz Topex SA
 
+OUI:70B3D5885*
+ ID_OUI_FROM_DATABASE=QuirkLogic
+
+OUI:70B3D5274*
+ ID_OUI_FROM_DATABASE=Stercom Power Solutions GmbH
+
+OUI:70B3D5615*
+ ID_OUI_FROM_DATABASE=JSC OTZVUK
+
+OUI:70B3D5889*
+ ID_OUI_FROM_DATABASE=Innovative Circuit Technology
+
+OUI:70B3D558D*
+ ID_OUI_FROM_DATABASE=DORLET SAU
+
+OUI:70B3D5FAA*
+ ID_OUI_FROM_DATABASE=LogiM GmbH Software und Entwicklung
+
+OUI:70B3D5854*
+ ID_OUI_FROM_DATABASE=Adimec Advanced Image Systems
+
+OUI:70B3D5FB3*
+ ID_OUI_FROM_DATABASE=3PS Inc
+
+OUI:70B3D5CAA*
+ ID_OUI_FROM_DATABASE=Bel Power Solutions GmbH
+
+OUI:70B3D5B9E*
+ ID_OUI_FROM_DATABASE=POLSYSTEM SI SP. Z O.O., S.K.A.
+
+OUI:70B3D54B0*
+ ID_OUI_FROM_DATABASE=Tecogen Inc.
+
+OUI:70B3D54A7*
+ ID_OUI_FROM_DATABASE=aelettronica group srl
+
+OUI:70B3D5238*
+ ID_OUI_FROM_DATABASE=Arete Associates
+
+OUI:70B3D59B6*
+ ID_OUI_FROM_DATABASE=Intercomp S.p.A.
+
 OUI:70B3D510C*
  ID_OUI_FROM_DATABASE=Vocality International Ltd
 
@@ -1820,6 +1919,18 @@ OUI:70B3D5307*
 OUI:70B3D59FA*
  ID_OUI_FROM_DATABASE=Ideas srl
 
+OUI:70B3D5649*
+ ID_OUI_FROM_DATABASE=swissled technologies AG
+
+OUI:70B3D5C0E*
+ ID_OUI_FROM_DATABASE=SYSDEV Srl
+
+OUI:70B3D54C7*
+ ID_OUI_FROM_DATABASE=SOLVERIS sp. z o.o.
+
+OUI:70B3D57A4*
+ ID_OUI_FROM_DATABASE=Potter Electric Signal Co. LLC
+
 OUI:70B3D5494*
  ID_OUI_FROM_DATABASE=Schildknecht AG
 
@@ -1895,9 +2006,6 @@ OUI:70B3D5383*
 OUI:70B3D59F6*
  ID_OUI_FROM_DATABASE=Edgeware AB
 
-OUI:70B3D5E0F*
- ID_OUI_FROM_DATABASE=Vtron Pty Ltd
-
 OUI:70B3D5504*
  ID_OUI_FROM_DATABASE=Xsight Systems Ltd.
 
@@ -2675,6 +2783,81 @@ OUI:70B3D53D5*
 OUI:70B3D5D11*
  ID_OUI_FROM_DATABASE=EREE Electronique
 
+OUI:70B3D51B5*
+ ID_OUI_FROM_DATABASE=StarBridge, Inc.
+
+OUI:70B3D55CD*
+ ID_OUI_FROM_DATABASE=MVT Video Technologies R + H Maedler GbR
+
+OUI:70B3D5AF7*
+ ID_OUI_FROM_DATABASE=DimoSystems BV
+
+OUI:70B3D59D2*
+ ID_OUI_FROM_DATABASE=ACS MOTION CONTROL
+
+OUI:70B3D5A5E*
+ ID_OUI_FROM_DATABASE=ConectaIP Tecnologia S.L.
+
+OUI:70B3D512C*
+ ID_OUI_FROM_DATABASE=CIELLE S.R.L.
+
+OUI:70B3D5486*
+ ID_OUI_FROM_DATABASE=ChongQing JianTao Technology Co., Ltd.
+
+OUI:70B3D512E*
+ ID_OUI_FROM_DATABASE=GreenFlux
+
+OUI:70B3D5B59*
+ ID_OUI_FROM_DATABASE=FutureTechnologyLaboratories INC.
+
+OUI:70B3D58B3*
+ ID_OUI_FROM_DATABASE=Firefly RFID Solutions
+
+OUI:70B3D5599*
+ ID_OUI_FROM_DATABASE=LECO Corporation
+
+OUI:70B3D5896*
+ ID_OUI_FROM_DATABASE=Shanghai Longpal Communication Equipment Co., Ltd.
+
+OUI:70B3D5692*
+ ID_OUI_FROM_DATABASE=HOSIN INDUSTRIAL LIMITED
+
+OUI:70B3D5AE7*
+ ID_OUI_FROM_DATABASE=E-T-A Elektrotechnische Apparate GmbH
+
+OUI:70B3D5400*
+ ID_OUI_FROM_DATABASE=Vtron Pty Ltd
+
+OUI:70B3D5E0F*
+ ID_OUI_FROM_DATABASE=Vtron Pty Ltd
+
+OUI:70B3D512F*
+ ID_OUI_FROM_DATABASE=DSP4YOU LTd
+
+OUI:70B3D59B1*
+ ID_OUI_FROM_DATABASE=Aplex Technology Inc.
+
+OUI:70B3D5CA4*
+ ID_OUI_FROM_DATABASE=Netemera Sp. z o.o.
+
+OUI:70B3D571B*
+ ID_OUI_FROM_DATABASE=elsys
+
+OUI:70B3D548F*
+ ID_OUI_FROM_DATABASE=Seiwa Giken
+
+OUI:70B3D5DDC*
+ ID_OUI_FROM_DATABASE=Syscom Instruments SA
+
+OUI:70B3D5C15*
+ ID_OUI_FROM_DATABASE=Sensobox GmbH
+
+OUI:70B3D5D2F*
+ ID_OUI_FROM_DATABASE=L.I.F.E. Corporation SA
+
+OUI:70B3D536A*
+ ID_OUI_FROM_DATABASE=Becton Dickinson
+
 OUI:70B3D566B*
  ID_OUI_FROM_DATABASE=Innitive B.V.
 
@@ -3044,9 +3227,6 @@ OUI:70B3D5610*
 OUI:70B3D5ECE*
  ID_OUI_FROM_DATABASE=COMM-connect A/S
 
-OUI:70B3D53EF*
- ID_OUI_FROM_DATABASE=Vtron Pty Ltd
-
 OUI:70B3D5EB2*
  ID_OUI_FROM_DATABASE=Shooter Detection Systems
 
@@ -3461,6 +3641,48 @@ OUI:70B3D59F3*
 OUI:70B3D5AAC*
  ID_OUI_FROM_DATABASE=SensoTec GmbH
 
+OUI:70B3D5F9A*
+ ID_OUI_FROM_DATABASE=Krabbenhøft og Ingolfsson
+
+OUI:70B3D5349*
+ ID_OUI_FROM_DATABASE=SLAT
+
+OUI:70B3D5D91*
+ ID_OUI_FROM_DATABASE=FoodALYT GmbH
+
+OUI:70B3D53AE*
+ ID_OUI_FROM_DATABASE=Exicom Technologies fze
+
+OUI:70B3D57DD*
+ ID_OUI_FROM_DATABASE=Excel Medical Electronics LLC
+
+OUI:70B3D5E71*
+ ID_OUI_FROM_DATABASE=SiS Technology
+
+OUI:70B3D5EA0*
+ ID_OUI_FROM_DATABASE=PARK24
+
+OUI:70B3D5D05*
+ ID_OUI_FROM_DATABASE=Colmek
+
+OUI:70B3D5BF5*
+ ID_OUI_FROM_DATABASE=Acacia Research
+
+OUI:70B3D5499*
+ ID_OUI_FROM_DATABASE=Pycom Ltd
+
+OUI:70B3D521E*
+ ID_OUI_FROM_DATABASE=Hildebrand Technology Limited
+
+OUI:70B3D5D67*
+ ID_OUI_FROM_DATABASE=ALPHA　Corporation
+
+OUI:70B3D5C4F*
+ ID_OUI_FROM_DATABASE=AE Van de Vliet BVBA
+
+OUI:70B3D5BD9*
+ ID_OUI_FROM_DATABASE=SolwayTech
+
 OUI:70B3D58DB*
  ID_OUI_FROM_DATABASE=Kratos Analytical Ltd
 
@@ -3485,6 +3707,60 @@ OUI:70B3D56C5*
 OUI:70B3D5FE9*
  ID_OUI_FROM_DATABASE=Camsat Przemysław Gralak
 
+OUI:70B3D54C5*
+ ID_OUI_FROM_DATABASE=Moving iMage Technologies LLC
+
+OUI:70B3D591A*
+ ID_OUI_FROM_DATABASE=Fujian Landfone Information Technology Co.,Ltd
+
+OUI:70B3D59EC*
+ ID_OUI_FROM_DATABASE=eSoftThings
+
+OUI:70B3D5761*
+ ID_OUI_FROM_DATABASE=Critical Link LLC
+
+OUI:70B3D5C22*
+ ID_OUI_FROM_DATABASE=Skyriver Communications Inc.
+
+OUI:70B3D53BB*
+ ID_OUI_FROM_DATABASE=A-M Systems
+
+OUI:70B3D5B44*
+ ID_OUI_FROM_DATABASE=ENTEC Electric & Electronic Co., LTD.
+
+OUI:70B3D5584*
+ ID_OUI_FROM_DATABASE=Sertone, a division of Opti-Knights Ltd
+
+OUI:70B3D53EF*
+ ID_OUI_FROM_DATABASE=Vtron Pty Ltd
+
+OUI:70B3D57C2*
+ ID_OUI_FROM_DATABASE=Morgan Schaffer Inc.
+
+OUI:70B3D5697*
+ ID_OUI_FROM_DATABASE=Alazar Technologies Inc.
+
+OUI:70B3D561A*
+ ID_OUI_FROM_DATABASE=Rocket Lab Ltd.
+
+OUI:70B3D5855*
+ ID_OUI_FROM_DATABASE=CRDE
+
+OUI:70B3D5F8D*
+ ID_OUI_FROM_DATABASE=Flextronics Canafa Design Services
+
+OUI:70B3D59AE*
+ ID_OUI_FROM_DATABASE=Volansys technologies pvt ltd
+
+OUI:70B3D542C*
+ ID_OUI_FROM_DATABASE=D.Marchiori Srl
+
+OUI:70B3D5CE5*
+ ID_OUI_FROM_DATABASE=GridBridge Inc
+
+OUI:70B3D51EF*
+ ID_OUI_FROM_DATABASE=ADTEK
+
 OUI:70B3D58AB*
  ID_OUI_FROM_DATABASE=EMAC, Inc.
 
@@ -4298,6 +4574,33 @@ OUI:70B3D5296*
 OUI:70B3D5167*
  ID_OUI_FROM_DATABASE=Eiden Co.,Ltd.
 
+OUI:70B3D5A4A*
+ ID_OUI_FROM_DATABASE=Beijing Arrow SEED Technology Co,.Ltd.
+
+OUI:70B3D585B*
+ ID_OUI_FROM_DATABASE=TSUBAKIMOTO CHAIN CO.
+
+OUI:70B3D56FF*
+ ID_OUI_FROM_DATABASE=AKEO PLUS
+
+OUI:70B3D589B*
+ ID_OUI_FROM_DATABASE=ControlWorks, Inc.
+
+OUI:70B3D568F*
+ ID_OUI_FROM_DATABASE=PEEK TRAFFIC
+
+OUI:70B3D55AB*
+ ID_OUI_FROM_DATABASE=Sea Air and Land Communications Ltd
+
+OUI:70B3D5CD2*
+ ID_OUI_FROM_DATABASE=HBH Microwave GmbH
+
+OUI:70B3D5B23*
+ ID_OUI_FROM_DATABASE=Supervision Test et Pilotage
+
+OUI:70B3D5178*
+ ID_OUI_FROM_DATABASE=Gamber Johnson-LLC
+
 OUI:70B3D57B6*
  ID_OUI_FROM_DATABASE=Amada Miyachi America Inc.
 
@@ -4328,6 +4631,24 @@ OUI:70B3D51DA*
 OUI:70B3D555B*
  ID_OUI_FROM_DATABASE=Procon Electronics Pty Ltd
 
+OUI:70B3D5461*
+ ID_OUI_FROM_DATABASE=TESEC Corporation
+
+OUI:70B3D57FB*
+ ID_OUI_FROM_DATABASE=db Broadcast Products Ltd
+
+OUI:70B3D5CED*
+ ID_OUI_FROM_DATABASE=Advanced Products Corporation Pte Ltd
+
+OUI:70B3D5DB0*
+ ID_OUI_FROM_DATABASE=Arnouse Digital Devices Corp
+
+OUI:70B3D5CCD*
+ ID_OUI_FROM_DATABASE=Suzhou PowerCore Technology Co.,Ltd.
+
+OUI:70B3D5163*
+ ID_OUI_FROM_DATABASE=BHARAT HEAVY ELECTRICALS LIMITED
+
 OUI:1C8776D*
  ID_OUI_FROM_DATABASE=Qivivo
 
@@ -4931,6 +5252,57 @@ OUI:58E8768*
 OUI:58E8766*
  ID_OUI_FROM_DATABASE=DivioTec Inc.
 
+OUI:84E0F4B*
+ ID_OUI_FROM_DATABASE=Orchard Electronics Co., Ltd.
+
+OUI:84E0F4C*
+ ID_OUI_FROM_DATABASE=AIMTRON CORPORATION
+
+OUI:84E0F45*
+ ID_OUI_FROM_DATABASE=Hangzhou Nationalchip Science & Technology Co.,Ltd.
+
+OUI:84E0F41*
+ ID_OUI_FROM_DATABASE=MedicusTek Inc.
+
+OUI:70F8E77*
+ ID_OUI_FROM_DATABASE=NST Technology Limited Co.,Ltd.
+
+OUI:F81D786*
+ ID_OUI_FROM_DATABASE=Zengge Co., Limited
+
+OUI:F81D784*
+ ID_OUI_FROM_DATABASE=Digital Imaging Technology
+
+OUI:F81D781*
+ ID_OUI_FROM_DATABASE=ADTECHNO Inc.
+
+OUI:383A211*
+ ID_OUI_FROM_DATABASE=HOBART GmbH
+
+OUI:383A212*
+ ID_OUI_FROM_DATABASE=Shenzhen HS Fiber Communication Equipment CO., LTD
+
+OUI:383A217*
+ ID_OUI_FROM_DATABASE=Chengdu Krosslan Technology Inc.
+
+OUI:AC64DDA*
+ ID_OUI_FROM_DATABASE=Bluewave Global Manufacturing Limited
+
+OUI:AC64DDB*
+ ID_OUI_FROM_DATABASE=Groupe Citypassenger Inc
+
+OUI:4CE173B*
+ ID_OUI_FROM_DATABASE=Shanghai Ehong Technology Co.,Ltd
+
+OUI:4CE1737*
+ ID_OUI_FROM_DATABASE=Ersúles Limited
+
+OUI:4CE1739*
+ ID_OUI_FROM_DATABASE=Shenzhen Evolution Dynamics Co., Ltd.
+
+OUI:1CC0E13*
+ ID_OUI_FROM_DATABASE=HANGZHOU SOFTEL OPTIC CO., LTD
+
 OUI:1C8776C*
  ID_OUI_FROM_DATABASE=Strone Technology
 
@@ -5516,6 +5888,60 @@ OUI:2836381*
 OUI:F0ACD7B*
  ID_OUI_FROM_DATABASE=Zhejiang Makepower Electronics,Inc.
 
+OUI:84E0F48*
+ ID_OUI_FROM_DATABASE=RAY Co.,LTD
+
+OUI:84E0F49*
+ ID_OUI_FROM_DATABASE=SHENZHEN HCN.ELECTRONICS CO.,LTD.
+
+OUI:84E0F4A*
+ ID_OUI_FROM_DATABASE=iSolution Technologies Co.,Ltd.
+
+OUI:70F8E74*
+ ID_OUI_FROM_DATABASE=CLIP Inc.
+
+OUI:70F8E70*
+ ID_OUI_FROM_DATABASE=SHENZHEN Xin JiuNing Electronics Co Ltd
+
+OUI:70F8E79*
+ ID_OUI_FROM_DATABASE=Kontech Electronics Co., Ltd
+
+OUI:F81D78C*
+ ID_OUI_FROM_DATABASE=SHENZHUOYUE TECHNOLOGY.,LTD
+
+OUI:70F8E71*
+ ID_OUI_FROM_DATABASE=System Level Solutions (India) Pvt.
+
+OUI:F81D78A*
+ ID_OUI_FROM_DATABASE=AVPro Global Holdings LLC
+
+OUI:383A21B*
+ ID_OUI_FROM_DATABASE=Pactron
+
+OUI:383A214*
+ ID_OUI_FROM_DATABASE=Dongguan Innovation Technology Co Ltd
+
+OUI:383A21A*
+ ID_OUI_FROM_DATABASE=Foresight Sports
+
+OUI:383A218*
+ ID_OUI_FROM_DATABASE=Alicat Scientific
+
+OUI:AC64DD1*
+ ID_OUI_FROM_DATABASE=JSC InfoTeCS
+
+OUI:383A21E*
+ ID_OUI_FROM_DATABASE=SDNware technology co.,LTD
+
+OUI:AC64DD4*
+ ID_OUI_FROM_DATABASE=8Cups
+
+OUI:AC64DDC*
+ ID_OUI_FROM_DATABASE=Beijing Hamigua Technology Co., Ltd.
+
+OUI:4CE1730*
+ ID_OUI_FROM_DATABASE=Beijing Sutongwang E-Business Co., Ltd
+
 OUI:F0ACD72*
  ID_OUI_FROM_DATABASE=QUANTUM POWER SYSTEMS
 
@@ -5540,6 +5966,27 @@ OUI:C0D3912*
 OUI:C0D391B*
  ID_OUI_FROM_DATABASE=Private
 
+OUI:84E0F40*
+ ID_OUI_FROM_DATABASE=ShenZhen Panrich Technology Limited
+
+OUI:AC64DD5*
+ ID_OUI_FROM_DATABASE=SHANGHAI ZTE TECHNOLOGIES CO.,LTD
+
+OUI:AC64DD8*
+ ID_OUI_FROM_DATABASE=PFDC ELANCYL
+
+OUI:AC64DDE*
+ ID_OUI_FROM_DATABASE=DIGIBIRD TECHNOLOGY CO., LTD.
+
+OUI:4CE1736*
+ ID_OUI_FROM_DATABASE=CHINA CNR CORPORATION LIMITED DALIAN ELECTRIC TRACTION R&D CENTER
+
+OUI:4CE173D*
+ ID_OUI_FROM_DATABASE=KTC(K-TEL)
+
+OUI:4CE173E*
+ ID_OUI_FROM_DATABASE=Plus One Japan Limited
+
 OUI:1C87765*
  ID_OUI_FROM_DATABASE=Zhuhai MYZR Technology Co.,Ltd
 
@@ -6206,6 +6653,69 @@ OUI:58E8764*
 OUI:C0D3911*
  ID_OUI_FROM_DATABASE=B9Creations
 
+OUI:C0D3910*
+ ID_OUI_FROM_DATABASE=Fuzhou Jinshi Technology Co.,Ltd.
+
+OUI:C0D391A*
+ ID_OUI_FROM_DATABASE=Alpha Audiotronics, Inc.
+
+OUI:84E0F47*
+ ID_OUI_FROM_DATABASE=Dantherm
+
+OUI:84E0F4E*
+ ID_OUI_FROM_DATABASE=Scale-Tec Ltd.
+
+OUI:70F8E72*
+ ID_OUI_FROM_DATABASE=VOXX International
+
+OUI:70F8E7A*
+ ID_OUI_FROM_DATABASE=TiVACI CORPORATION PTE LTD
+
+OUI:70F8E76*
+ ID_OUI_FROM_DATABASE=Flexim Security Oy
+
+OUI:F81D788*
+ ID_OUI_FROM_DATABASE=TELEOFIS
+
+OUI:F81D785*
+ ID_OUI_FROM_DATABASE=DACONS
+
+OUI:F81D78B*
+ ID_OUI_FROM_DATABASE=SigmaConnectivityAB
+
+OUI:F81D780*
+ ID_OUI_FROM_DATABASE=Dongguan Shun Hing Plastics Limited
+
+OUI:F81D78E*
+ ID_OUI_FROM_DATABASE=GUANGDONG ENOK COMMUNICATION CO., LTD.
+
+OUI:383A215*
+ ID_OUI_FROM_DATABASE=OOO NPP Uraltechnologiya
+
+OUI:383A21C*
+ ID_OUI_FROM_DATABASE=Mission Embedded GmbH
+
+OUI:383A219*
+ ID_OUI_FROM_DATABASE=Skylark Wireless LLC
+
+OUI:AC64DD2*
+ ID_OUI_FROM_DATABASE=Shenzhen PuHua Technology Co., Ltd
+
+OUI:AC64DDD*
+ ID_OUI_FROM_DATABASE=HMicro Inc
+
+OUI:AC64DD0*
+ ID_OUI_FROM_DATABASE=Jia-Teng
+
+OUI:4CE1731*
+ ID_OUI_FROM_DATABASE=Datastorm Technologies Inc.
+
+OUI:4CE1733*
+ ID_OUI_FROM_DATABASE=outpaceIO
+
+OUI:4CE173C*
+ ID_OUI_FROM_DATABASE=REMONDE NETWORK
+
 OUI:1C8776B*
  ID_OUI_FROM_DATABASE=Hekatron Vertriebs GmbH
 
@@ -6662,9 +7172,6 @@ OUI:7419F82*
 OUI:1C88793*
  ID_OUI_FROM_DATABASE=Shenzhen Xiaoxi Technology Co., Ltd.
 
-OUI:1C88798*
- ID_OUI_FROM_DATABASE=Toshiba Toko meter systems co., LTD.
-
 OUI:1C8879A*
  ID_OUI_FROM_DATABASE=ITW-FEG
 
@@ -6866,6 +7373,24 @@ OUI:2CD141F*
 OUI:2836388*
  ID_OUI_FROM_DATABASE=Havells India Limited
 
+OUI:84E0F44*
+ ID_OUI_FROM_DATABASE=PetroInTrade
+
+OUI:84E0F43*
+ ID_OUI_FROM_DATABASE=ASL Intercom B.V.
+
+OUI:1C88798*
+ ID_OUI_FROM_DATABASE=Toshiba Toko Meter Systems Co., LTD.
+
+OUI:383A210*
+ ID_OUI_FROM_DATABASE=R3C Information(Shenzhen) Co.，Ltd.
+
+OUI:4CE1734*
+ ID_OUI_FROM_DATABASE=Huizhou Dehong Technology Co., Ltd.
+
+OUI:4CE173A*
+ ID_OUI_FROM_DATABASE=jvi
+
 OUI:F0ACD70*
  ID_OUI_FROM_DATABASE=Guilin glsun Science and Tech Co.,LTD
 
@@ -6878,6 +7403,54 @@ OUI:58E8760*
 OUI:58E8761*
  ID_OUI_FROM_DATABASE=Beijing Perabytes IS Technology Co., Ltd
 
+OUI:C0D3914*
+ ID_OUI_FROM_DATABASE=Vernier Software & Technology
+
+OUI:C0D3919*
+ ID_OUI_FROM_DATABASE=xxter bv
+
+OUI:C0D391E*
+ ID_OUI_FROM_DATABASE=SAMSARA NETWORKS INC
+
+OUI:84E0F4D*
+ ID_OUI_FROM_DATABASE=Logos01 Srl
+
+OUI:70F8E7E*
+ ID_OUI_FROM_DATABASE=CUAV
+
+OUI:70F8E73*
+ ID_OUI_FROM_DATABASE=Dr. Simon Consulting GmbH
+
+OUI:70F8E7C*
+ ID_OUI_FROM_DATABASE=Fixstars Corporation
+
+OUI:F81D783*
+ ID_OUI_FROM_DATABASE=SHANGHAI SUN TELECOMMUNICATION CO., LTD.
+
+OUI:F81D78D*
+ ID_OUI_FROM_DATABASE=Tofino
+
+OUI:F81D787*
+ ID_OUI_FROM_DATABASE=WUHAN GUIDE INFRARED CO.,LTD
+
+OUI:F81D789*
+ ID_OUI_FROM_DATABASE=Ophrys Systèmes
+
+OUI:383A21D*
+ ID_OUI_FROM_DATABASE=Colooc AB
+
+OUI:383A213*
+ ID_OUI_FROM_DATABASE=Shanghai Greatwall Safety System Co.,Ltd
+
+OUI:AC64DD7*
+ ID_OUI_FROM_DATABASE=Wittmann Kunststoffgeräte GmbH
+
+OUI:AC64DD9*
+ ID_OUI_FROM_DATABASE=Micro Connect Pty Ltd
+
+OUI:AC64DD3*
+ ID_OUI_FROM_DATABASE=infypower Co., Ltd
+
 OUI:1C87740*
  ID_OUI_FROM_DATABASE=Philips Personal Health Solutions
 
@@ -7085,9 +7658,6 @@ OUI:0CEFAF7*
 OUI:A44F29E*
  ID_OUI_FROM_DATABASE=Neotech Systems Pvt. Ltd.
 
-OUI:0CEFAF0*
- ID_OUI_FROM_DATABASE=Assurelink
-
 OUI:2C265F9*
  ID_OUI_FROM_DATABASE=Brüel & Kjaer Vibro GmbH
 
@@ -7418,11 +7988,35 @@ OUI:D0D94FE*
 OUI:8C192D6*
  ID_OUI_FROM_DATABASE=smartHome Partner GmbH
 
+OUI:8C192DB*
+ ID_OUI_FROM_DATABASE=Abside Networks, Inc.
+
+OUI:70F8E7D*
+ ID_OUI_FROM_DATABASE=System-on-Chip engineering
+
+OUI:70F8E78*
+ ID_OUI_FROM_DATABASE=Eclipse Security
+
+OUI:70F8E75*
+ ID_OUI_FROM_DATABASE=Beijing Eehuu Technology Co.,Ltd.
+
+OUI:70F8E7B*
+ ID_OUI_FROM_DATABASE=Photonfocus AG
+
+OUI:F81D782*
+ ID_OUI_FROM_DATABASE=Xperio Labs Limited
+
+OUI:0CEFAF0*
+ ID_OUI_FROM_DATABASE=Kenmore
+
 OUI:78C2C06*
  ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
 
-OUI:8C192DB*
- ID_OUI_FROM_DATABASE=Abside Networks, Inc.
+OUI:4CE1732*
+ ID_OUI_FROM_DATABASE=Lenovo Data Center Group
+
+OUI:4CE1738*
+ ID_OUI_FROM_DATABASE=Nanjing Tongke Technology Development Co., LTD
 
 OUI:F0ACD7A*
  ID_OUI_FROM_DATABASE=Groupeer Technologies
@@ -7445,6 +8039,24 @@ OUI:C0D3917*
 OUI:C0D3918*
  ID_OUI_FROM_DATABASE=XENA SECURITY LIMITED
 
+OUI:C0D391C*
+ ID_OUI_FROM_DATABASE=Zhinengguo technology company limited
+
+OUI:84E0F42*
+ ID_OUI_FROM_DATABASE=Hangzhou Uni-Ubi Co.,Ltd.
+
+OUI:84E0F46*
+ ID_OUI_FROM_DATABASE=Liaoning IK'SONYA Science and Technology Co., Ltd.
+
+OUI:383A216*
+ ID_OUI_FROM_DATABASE=Shenzhen Smart-core Technology co., Ltd.
+
+OUI:4CE1735*
+ ID_OUI_FROM_DATABASE=NewVastek
+
+OUI:AC64DD6*
+ ID_OUI_FROM_DATABASE=Kpnetworks Ltd.
+
 OUI:E043DB*
  ID_OUI_FROM_DATABASE=Shenzhen ViewAt Technology Co.,Ltd.
 
@@ -7556,21 +8168,6 @@ OUI:58AC78*
 OUI:907F61*
  ID_OUI_FROM_DATABASE=Chicony Electronics Co., Ltd.
 
-OUI:001DCE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001DD4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001DCD*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:CCA462*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:903EAB*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:28BC18*
  ID_OUI_FROM_DATABASE=SourcingOverseas Co. Ltd
 
@@ -7598,45 +8195,6 @@ OUI:18AF61*
 OUI:BC83A7*
  ID_OUI_FROM_DATABASE=SHENZHEN CHUANGWEI-RGB ELECTRONICS CO.,LTD
 
-OUI:14CFE2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:900DCB*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:207355*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:C83FB4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E0B70A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:78719C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:D40598*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:946269*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:8C7F3B*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:D039B3*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0000C5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:3C36E4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00ACE0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:000347*
  ID_OUI_FROM_DATABASE=Intel Corporation
 
@@ -7709,15 +8267,6 @@ OUI:000802*
 OUI:90E7C4*
  ID_OUI_FROM_DATABASE=HTC Corporation
 
-OUI:00265E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:00234E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:00234D*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:74A78E*
  ID_OUI_FROM_DATABASE=zte corporation
 
@@ -7793,9 +8342,6 @@ OUI:84742A*
 OUI:681AB2*
  ID_OUI_FROM_DATABASE=zte corporation
 
-OUI:001C25*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E005C5*
  ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
 
@@ -7838,21 +8384,6 @@ OUI:CC4463*
 OUI:6C72E7*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
-OUI:0016CF*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:4437E6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:F4B7E2*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:083E8E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:485AB6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:CCA223*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -8015,18 +8546,6 @@ OUI:0090BF*
 OUI:005080*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:D0E54D*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:FC8E7E*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:B4F2E8*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:7085C6*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:00E018*
  ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
 
@@ -8159,9 +8678,6 @@ OUI:E4C722*
 OUI:C07BBC*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:005094*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:0090F2*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -8462,9 +8978,6 @@ OUI:70BF3E*
 OUI:D848EE*
  ID_OUI_FROM_DATABASE=Hangzhou Xueji Technology Co., Ltd.
 
-OUI:EC9BF3*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:88947E*
  ID_OUI_FROM_DATABASE=Fiberhome Telecommunication Technologies Co.,LTD
 
@@ -8474,9 +8987,6 @@ OUI:88C242*
 OUI:E8343E*
  ID_OUI_FROM_DATABASE=Beijing Infosec Technologies Co., LTD.
 
-OUI:A8474A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:C4ADF1*
  ID_OUI_FROM_DATABASE=GOPEACE Inc.
 
@@ -8558,9 +9068,6 @@ OUI:C025A2*
 OUI:7853F2*
  ID_OUI_FROM_DATABASE=ROXTON Ltd.
 
-OUI:384C90*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:ACBC32*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
@@ -8573,9 +9080,6 @@ OUI:AC8995*
 OUI:F898B9*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:D40AA9*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:1C497B*
  ID_OUI_FROM_DATABASE=Gemtek Technology Co., Ltd.
 
@@ -8609,9 +9113,6 @@ OUI:E4C2D1*
 OUI:DC3CF6*
  ID_OUI_FROM_DATABASE=Atomic Rules LLC
 
-OUI:441CA8*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:3C3178*
  ID_OUI_FROM_DATABASE=Qolsys Inc.
 
@@ -8624,9 +9125,6 @@ OUI:083A5C*
 OUI:4CAE31*
  ID_OUI_FROM_DATABASE=ShengHai Electronics (Shenzhen) Ltd
 
-OUI:C80E14*
- ID_OUI_FROM_DATABASE=AVM Audiovisuelles Marketing und Computersysteme GmbH
-
 OUI:F0D657*
  ID_OUI_FROM_DATABASE=ECHOSENS
 
@@ -8675,9 +9173,6 @@ OUI:24E5AA*
 OUI:88CBA5*
  ID_OUI_FROM_DATABASE=Suzhou Torchstar Intelligent Technology Co.,Ltd
 
-OUI:184F32*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:046169*
  ID_OUI_FROM_DATABASE=MEDIA GLOBAL LINKS CO., LTD.
 
@@ -8810,9 +9305,6 @@ OUI:38C70A*
 OUI:60E6BC*
  ID_OUI_FROM_DATABASE=Sino-Telecom Technology Co.,Ltd.
 
-OUI:F8042E*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:1CA532*
  ID_OUI_FROM_DATABASE=Shenzhen Gongjin Electronics Co.,Ltd
 
@@ -8825,24 +9317,15 @@ OUI:340A22*
 OUI:B008BF*
  ID_OUI_FROM_DATABASE=Vital Connect, Inc.
 
-OUI:7CF854*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:485415*
  ID_OUI_FROM_DATABASE=NET RULES TECNOLOGIA EIRELI
 
 OUI:70C76F*
  ID_OUI_FROM_DATABASE=INNO S
 
-OUI:C48E8F*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:704E66*
  ID_OUI_FROM_DATABASE=SHENZHEN FAST TECHNOLOGIES CO.,LTD
 
-OUI:1008B1*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:409B0D*
  ID_OUI_FROM_DATABASE=Shenzhen Yourf Kwan Industrial Co., Ltd
 
@@ -8924,9 +9407,6 @@ OUI:8C18D9*
 OUI:6099D1*
  ID_OUI_FROM_DATABASE=Vuzix / Lenovo
 
-OUI:38B1DB*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:34F6D2*
  ID_OUI_FROM_DATABASE=Panasonic Taiwan Co.,Ltd.
 
@@ -9263,9 +9743,6 @@ OUI:4486C1*
 OUI:C83168*
  ID_OUI_FROM_DATABASE=eZEX corporation
 
-OUI:843838*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:F84A73*
  ID_OUI_FROM_DATABASE=EUMTECH CO., LTD
 
@@ -9299,9 +9776,6 @@ OUI:64B370*
 OUI:D86595*
  ID_OUI_FROM_DATABASE=Toy's Myth Inc.
 
-OUI:C45006*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:D8DD5F*
  ID_OUI_FROM_DATABASE=BALMUDA Inc.
 
@@ -9311,12 +9785,6 @@ OUI:88D962*
 OUI:24C848*
  ID_OUI_FROM_DATABASE=mywerk system GmbH
 
-OUI:805719*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:B0DF3A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:2C18AE*
  ID_OUI_FROM_DATABASE=Trend Electronics Co., Ltd.
 
@@ -9347,12 +9815,6 @@ OUI:9CF8DB*
 OUI:644214*
  ID_OUI_FROM_DATABASE=Swisscom Energy Solutions AG
 
-OUI:00E3B2*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:30D6C9*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:8CCDA2*
  ID_OUI_FROM_DATABASE=ACTP, Inc.
 
@@ -9470,15 +9932,6 @@ OUI:404A18*
 OUI:C4C0AE*
  ID_OUI_FROM_DATABASE=MIDORI ELECTRONIC CO., LTD.
 
-OUI:08FD0E*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:78A873*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:54880E*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:90837A*
  ID_OUI_FROM_DATABASE=General Electric Water & Process Technologies
 
@@ -9542,9 +9995,6 @@ OUI:5056A8*
 OUI:D09D0A*
  ID_OUI_FROM_DATABASE=LINKCOM
 
-OUI:C81479*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:54FB58*
  ID_OUI_FROM_DATABASE=WISEWARE, Lda
 
@@ -9593,9 +10043,6 @@ OUI:CC4703*
 OUI:5C3327*
  ID_OUI_FROM_DATABASE=Spazio Italia srl
 
-OUI:BC8CCD*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co.,LTD.
-
 OUI:F85BC9*
  ID_OUI_FROM_DATABASE=M-Cube Spa
 
@@ -9614,15 +10061,9 @@ OUI:CC2A80*
 OUI:3859F8*
  ID_OUI_FROM_DATABASE=MindMade Sp. z o.o.
 
-OUI:F0728C*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:5C026A*
  ID_OUI_FROM_DATABASE=Applied Vision Corporation
 
-OUI:94350A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:7CBD06*
  ID_OUI_FROM_DATABASE=AE REFUsol
 
@@ -9710,9 +10151,6 @@ OUI:681D64*
 OUI:F4CD90*
  ID_OUI_FROM_DATABASE=Vispiron Rotec GmbH
 
-OUI:400E85*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co.,LTD.
-
 OUI:E438F2*
  ID_OUI_FROM_DATABASE=Advantage Controls
 
@@ -9755,9 +10193,6 @@ OUI:6C5779*
 OUI:40BD9E*
  ID_OUI_FROM_DATABASE=Physio-Control, Inc
 
-OUI:BC79AD*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:581CBD*
  ID_OUI_FROM_DATABASE=Affinegy
 
@@ -9827,12 +10262,6 @@ OUI:5061D6*
 OUI:68EC62*
  ID_OUI_FROM_DATABASE=YODO Technology Corp. Ltd.
 
-OUI:10D542*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:A0821F*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:F07F0C*
  ID_OUI_FROM_DATABASE=Leopold Kostal GmbH &Co. KG
 
@@ -9851,12 +10280,6 @@ OUI:74F102*
 OUI:080EA8*
  ID_OUI_FROM_DATABASE=Velex s.r.l.
 
-OUI:041BBA*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:5C3C27*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:0086A0*
  ID_OUI_FROM_DATABASE=Private
 
@@ -9992,9 +10415,6 @@ OUI:60B185*
 OUI:504F94*
  ID_OUI_FROM_DATABASE=Loxone Electronics GmbH
 
-OUI:88329B*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co.,LTD.
-
 OUI:8C078C*
  ID_OUI_FROM_DATABASE=FLOW DATA INC
 
@@ -10094,9 +10514,6 @@ OUI:C4E7BE*
 OUI:105F49*
  ID_OUI_FROM_DATABASE=Cisco SPVTG
 
-OUI:0418D6*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
 OUI:4495FA*
  ID_OUI_FROM_DATABASE=Qingdao Santong Digital Technology Co.Ltd
 
@@ -10139,9 +10556,6 @@ OUI:60BC4C*
 OUI:F41E26*
  ID_OUI_FROM_DATABASE=Simon-Kaloi Engineering
 
-OUI:840B2D*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS CO., LTD
-
 OUI:C44567*
  ID_OUI_FROM_DATABASE=SAMBON PRECISON and ELECTRONICS
 
@@ -10163,9 +10577,6 @@ OUI:28A192*
 OUI:A08C15*
  ID_OUI_FROM_DATABASE=Gerhard D. Wempe KG
 
-OUI:A02195*
- ID_OUI_FROM_DATABASE=Samsung Electronics Digital Imaging
-
 OUI:8CE081*
  ID_OUI_FROM_DATABASE=zte corporation
 
@@ -10250,9 +10661,6 @@ OUI:88615A*
 OUI:30215B*
  ID_OUI_FROM_DATABASE=Shenzhen Ostar Display Electronic Co.,Ltd
 
-OUI:08D42B*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:DC028E*
  ID_OUI_FROM_DATABASE=zte corporation
 
@@ -10334,9 +10742,6 @@ OUI:D43D7E*
 OUI:64517E*
  ID_OUI_FROM_DATABASE=LONG BEN (DONGGUAN) ELECTRONIC TECHNOLOGY CO.,LTD.
 
-OUI:18E2C2*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:0C57EB*
  ID_OUI_FROM_DATABASE=Mueller Systems
 
@@ -10373,9 +10778,6 @@ OUI:5C5015*
 OUI:0CD2B5*
  ID_OUI_FROM_DATABASE=Binatone Telecommunication Pvt. Ltd
 
-OUI:1C62B8*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:4846F1*
  ID_OUI_FROM_DATABASE=Uros Oy
 
@@ -10409,9 +10811,6 @@ OUI:40AC8D*
 OUI:54466B*
  ID_OUI_FROM_DATABASE=Shenzhen CZTIC Electronic Technology Co., Ltd
 
-OUI:08EDB9*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:1C3477*
  ID_OUI_FROM_DATABASE=Innovation Wireless
 
@@ -10676,12 +11075,6 @@ OUI:38A851*
 OUI:90185E*
  ID_OUI_FROM_DATABASE=Apex Tool Group GmbH & Co OHG
 
-OUI:7CE9D3*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:8CC8CD*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:649EF3*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -10742,9 +11135,6 @@ OUI:AC319D*
 OUI:08D09F*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:D0DFC7*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:B81413*
  ID_OUI_FROM_DATABASE=Keen High Holding(HK) Ltd.
 
@@ -10811,9 +11201,6 @@ OUI:34255D*
 OUI:1897FF*
  ID_OUI_FROM_DATABASE=TechFaith Wireless Technology Limited
 
-OUI:0CDFA4*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:8C8E76*
  ID_OUI_FROM_DATABASE=taskit GmbH
 
@@ -10901,9 +11288,6 @@ OUI:D0C282*
 OUI:449CB5*
  ID_OUI_FROM_DATABASE=Alcomp, Inc
 
-OUI:E4D53D*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:24E6BA*
  ID_OUI_FROM_DATABASE=JSC Zavod im. Kozitsky
 
@@ -10976,9 +11360,6 @@ OUI:84248D*
 OUI:24EC99*
  ID_OUI_FROM_DATABASE=ASKEY COMPUTER CORP
 
-OUI:9463D1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:B8621F*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -11024,9 +11405,6 @@ OUI:B83A7B*
 OUI:783F15*
  ID_OUI_FROM_DATABASE=EasySYNC Ltd.
 
-OUI:F4B549*
- ID_OUI_FROM_DATABASE=Yeastar Technology Co., Ltd.
-
 OUI:88B168*
  ID_OUI_FROM_DATABASE=Delta Control GmbH
 
@@ -11084,9 +11462,6 @@ OUI:24C86E*
 OUI:D4D898*
  ID_OUI_FROM_DATABASE=Korea CNO Tech Co., Ltd
 
-OUI:04180F*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:5070E5*
  ID_OUI_FROM_DATABASE=He Shan World Fair Electronics Technology Limited
 
@@ -11120,9 +11495,6 @@ OUI:D4C1FC*
 OUI:48DCFB*
  ID_OUI_FROM_DATABASE=Nokia Corporation
 
-OUI:CC051B*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:688470*
  ID_OUI_FROM_DATABASE=eSSys Co.,Ltd
 
@@ -11228,9 +11600,6 @@ OUI:DCCBA8*
 OUI:58EECE*
  ID_OUI_FROM_DATABASE=Icon Time Systems
 
-OUI:90004E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A41BC0*
  ID_OUI_FROM_DATABASE=Fastec Imaging Corporation
 
@@ -11264,15 +11633,9 @@ OUI:E44F29*
 OUI:6CAB4D*
  ID_OUI_FROM_DATABASE=Digital Payment Technologies
 
-OUI:60A10A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:60DA23*
  ID_OUI_FROM_DATABASE=Estech Co.,Ltd
 
-OUI:C0F8DA*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:28F358*
  ID_OUI_FROM_DATABASE=2C - Trifonov & Co
 
@@ -11303,12 +11666,6 @@ OUI:7C7D41*
 OUI:4C1480*
  ID_OUI_FROM_DATABASE=NOREGON SYSTEMS, INC
 
-OUI:8C71F8*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:A07591*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:60F673*
  ID_OUI_FROM_DATABASE=TERUMO CORPORATION
 
@@ -11429,9 +11786,6 @@ OUI:6015C7*
 OUI:188ED5*
  ID_OUI_FROM_DATABASE=TP Vision Belgium N.V. - innovation site Brugge
 
-OUI:E81132*
- ID_OUI_FROM_DATABASE=Samsung Electronics CO., LTD
-
 OUI:8CE7B3*
  ID_OUI_FROM_DATABASE=Sonardyne International Ltd
 
@@ -11462,9 +11816,6 @@ OUI:58BC27*
 OUI:34D2C4*
  ID_OUI_FROM_DATABASE=RENA GmbH Print Systeme
 
-OUI:4C0F6E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E0A670*
  ID_OUI_FROM_DATABASE=Nokia Corporation
 
@@ -11549,9 +11900,6 @@ OUI:D49E6D*
 OUI:94F720*
  ID_OUI_FROM_DATABASE=Tianjin Deviser Electronics Instrument Co., Ltd
 
-OUI:5C6D20*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:EC2368*
  ID_OUI_FROM_DATABASE=IntelliVoice Co.,Ltd.
 
@@ -11633,9 +11981,6 @@ OUI:C802A6*
 OUI:C84C75*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:68EBAE*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:284C53*
  ID_OUI_FROM_DATABASE=Intune Networks
 
@@ -11654,9 +11999,6 @@ OUI:5C35DA*
 OUI:005218*
  ID_OUI_FROM_DATABASE=Wuxi Keboda Electron Co.Ltd
 
-OUI:F07BCB*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:08F2F4*
  ID_OUI_FROM_DATABASE=Net One Partners Co.,Ltd.
 
@@ -11771,9 +12113,6 @@ OUI:60D30A*
 OUI:BC9DA5*
  ID_OUI_FROM_DATABASE=DASCOM Europe GmbH
 
-OUI:60D0A9*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:942E63*
  ID_OUI_FROM_DATABASE=Finsécur
 
@@ -11789,9 +12128,6 @@ OUI:406186*
 OUI:74E537*
  ID_OUI_FROM_DATABASE=RADSPIN
 
-OUI:C417FE*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:7C08D9*
  ID_OUI_FROM_DATABASE=Shanghai B-Star Technology Co
 
@@ -11834,9 +12170,6 @@ OUI:C45976*
 OUI:B0C8AD*
  ID_OUI_FROM_DATABASE=People Power Company
 
-OUI:A8F274*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:A870A5*
  ID_OUI_FROM_DATABASE=UniComm Inc.
 
@@ -12239,9 +12572,6 @@ OUI:00257F*
 OUI:002573*
  ID_OUI_FROM_DATABASE=ST Electronics (Info-Security) Pte Ltd
 
-OUI:002567*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:00256E*
  ID_OUI_FROM_DATABASE=Van Breda B.V.
 
@@ -12425,9 +12755,6 @@ OUI:0023AA*
 OUI:0023A9*
  ID_OUI_FROM_DATABASE=Beijing Detianquan Electromechanical Equipment Co., Ltd
 
-OUI:002341*
- ID_OUI_FROM_DATABASE=Siemens AB, Infrastructure & Cities, Building Technologies Division, IC BT SSP SP BA PR
-
 OUI:00233C*
  ID_OUI_FROM_DATABASE=Alflex
 
@@ -12860,9 +13187,6 @@ OUI:001EB3*
 OUI:001EB4*
  ID_OUI_FROM_DATABASE=UNIFAT TECHNOLOGY LTD.
 
-OUI:001EAE*
- ID_OUI_FROM_DATABASE=Continental Automotive Systems
-
 OUI:001EA8*
  ID_OUI_FROM_DATABASE=Datang Mobile Communications Equipment CO.,LTD
 
@@ -12890,15 +13214,9 @@ OUI:001FDC*
 OUI:001FD7*
  ID_OUI_FROM_DATABASE=TELERAD SA
 
-OUI:001FCC*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001FCB*
  ID_OUI_FROM_DATABASE=NIW Solutions
 
-OUI:001FCD*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:001F77*
  ID_OUI_FROM_DATABASE=HEOL DESIGN
 
@@ -13439,9 +13757,6 @@ OUI:001A99*
 OUI:001A9B*
  ID_OUI_FROM_DATABASE=ADEC & Parter AG
 
-OUI:001A8A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:001A94*
  ID_OUI_FROM_DATABASE=Votronic GmbH
 
@@ -14057,9 +14372,6 @@ OUI:0016EE*
 OUI:0016E7*
  ID_OUI_FROM_DATABASE=Dynamix Promotions Limited
 
-OUI:0016DB*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:0016E0*
  ID_OUI_FROM_DATABASE=3Com Ltd
 
@@ -14243,9 +14555,6 @@ OUI:0015AC*
 OUI:0015A7*
  ID_OUI_FROM_DATABASE=Robatech AG
 
-OUI:001599*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:001594*
  ID_OUI_FROM_DATABASE=BIXOLON CO.,LTD
 
@@ -14369,9 +14678,6 @@ OUI:00130E*
 OUI:0012FC*
  ID_OUI_FROM_DATABASE=PLANET System Co.,LTD
 
-OUI:0012FB*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:0012F6*
  ID_OUI_FROM_DATABASE=MDK CO.,LTD.
 
@@ -16223,9 +16529,6 @@ OUI:00D05F*
 OUI:000674*
  ID_OUI_FROM_DATABASE=Spectrum Control, Inc.
 
-OUI:000678*
- ID_OUI_FROM_DATABASE=Marantz Brand Company
-
 OUI:000661*
  ID_OUI_FROM_DATABASE=NIA Home Technologies Corp.
 
@@ -16739,9 +17042,6 @@ OUI:00019E*
 OUI:001095*
  ID_OUI_FROM_DATABASE=Thomson Inc.
 
-OUI:000278*
- ID_OUI_FROM_DATABASE=Samsung Electro-Mechanics Co., Ltd.
-
 OUI:00025A*
  ID_OUI_FROM_DATABASE=Catena Networks
 
@@ -16991,9 +17291,6 @@ OUI:000124*
 OUI:000101*
  ID_OUI_FROM_DATABASE=Private
 
-OUI:00010D*
- ID_OUI_FROM_DATABASE=CORECO, INC.
-
 OUI:000114*
  ID_OUI_FROM_DATABASE=KANDA TSUSHIN KOGYO CO., LTD.
 
@@ -19352,12 +19649,6 @@ OUI:ACE010*
 OUI:EC086B*
  ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
 
-OUI:00159A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00192C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:2421AB*
  ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
 
@@ -19397,18 +19688,6 @@ OUI:18CF5E*
 OUI:D0DF9A*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
-OUI:90B134*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:3C438E*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E86D52*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0015D0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:0013A9*
  ID_OUI_FROM_DATABASE=Sony Corporation
 
@@ -19421,57 +19700,6 @@ OUI:001E45*
 OUI:001813*
  ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
 
-OUI:00080E*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0050E3*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:94CCB9*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:40B7F3*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:20E564*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:F87B7A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0023A3*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:64ED57*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0023EE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002143*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:5856E8*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0025F1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0023AF*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001ADE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001E46*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0018C0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001A66*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:002163*
  ID_OUI_FROM_DATABASE=ASKEY COMPUTER CORP
 
@@ -19832,9 +20060,6 @@ OUI:DC2DCB*
 OUI:3810D5*
  ID_OUI_FROM_DATABASE=AVM Audiovisuelles Marketing und Computersysteme GmbH
 
-OUI:44AAF5*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:1C5F2B*
  ID_OUI_FROM_DATABASE=D-Link International
 
@@ -20000,9 +20225,6 @@ OUI:00144F*
 OUI:E80959*
  ID_OUI_FROM_DATABASE=Guoguang Electric Co.,Ltd
 
-OUI:541379*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:0090AE*
  ID_OUI_FROM_DATABASE=ITALTEL S.p.A/RF-UP-I
 
@@ -20201,18 +20423,6 @@ OUI:D84A87*
 OUI:BC307D*
  ID_OUI_FROM_DATABASE=Wistron Neweb Corporation
 
-OUI:643AB1*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
-OUI:D44165*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
-OUI:645D92*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
-OUI:8048A5*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:5410EC*
  ID_OUI_FROM_DATABASE=Microchip Technology Inc.
 
@@ -20303,12 +20513,6 @@ OUI:E02A82*
 OUI:001641*
  ID_OUI_FROM_DATABASE=Universal Global Scientific Industrial Co., Ltd.
 
-OUI:44D9E7*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
-OUI:F09FC2*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
 OUI:4C334E*
  ID_OUI_FROM_DATABASE=HIGHTECH
 
@@ -20438,42 +20642,12 @@ OUI:3092F6*
 OUI:7C2064*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent IPD
 
-OUI:48F8E1*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:00D0F6*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:E4A1E6*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
 
 OUI:000B34*
  ID_OUI_FROM_DATABASE=ShangHai Broadband Technologies CO.LTD
 
-OUI:B0754D*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:BC8D0E*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:E48184*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:94E98C*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:84262B*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:98B039*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:A47B2C*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:BC6B4D*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:38256B*
  ID_OUI_FROM_DATABASE=Microsoft Mobile Oy
 
@@ -20642,9 +20816,6 @@ OUI:E8EB11*
 OUI:D43639*
  ID_OUI_FROM_DATABASE=Texas Instruments
 
-OUI:A8A648*
- ID_OUI_FROM_DATABASE=Qingdao Hisense Communications Co.,Ltd.
-
 OUI:A043DB*
  ID_OUI_FROM_DATABASE=Sitael S.p.A.
 
@@ -20657,6 +20828,9 @@ OUI:84EF18*
 OUI:84C1C1*
  ID_OUI_FROM_DATABASE=Juniper Networks
 
+OUI:A8A648*
+ ID_OUI_FROM_DATABASE=Qingdao Hisense Communications Co.,Ltd.
+
 OUI:305890*
  ID_OUI_FROM_DATABASE=Frontier Silicon Ltd
 
@@ -20678,6 +20852,582 @@ OUI:98F058*
 OUI:24E43F*
  ID_OUI_FROM_DATABASE=Wenzhou Kunmei Communication Technology Co.,Ltd.
 
+OUI:A00460*
+ ID_OUI_FROM_DATABASE=NETGEAR
+
+OUI:946269*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D40598*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:78719C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E0B70A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:C83FB4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:207355*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:900DCB*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:14CFE2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015D0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E86D52*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:3C438E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:90B134*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:20E564*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:40B7F3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:94CCB9*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00ACE0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:3C36E4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0000C5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D039B3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:8C7F3B*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:903EAB*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:CCA462*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DCD*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DCE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0050E3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00080E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00159A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00192C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D40AA9*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:384C90*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:44AAF5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:7085C6*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D0E54D*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:B4F2E8*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:FC8E7E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:005094*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002143*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0023EE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:64ED57*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0023A3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:F87B7A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0025F1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001A66*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0018C0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001E46*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001ADE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0023AF*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:240AC4*
+ ID_OUI_FROM_DATABASE=Espressif Inc.
+
+OUI:5856E8*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E4C1F1*
+ ID_OUI_FROM_DATABASE=SHENZHEN SPOTMAU INFORMATION TECHNOLIGY CO., Ltd
+
+OUI:240DC2*
+ ID_OUI_FROM_DATABASE=TCT mobile ltd
+
+OUI:14DDE5*
+ ID_OUI_FROM_DATABASE=MPMKVVCL
+
+OUI:0016DB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5C3C27*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:10D542*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A0821F*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C45006*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:88329B*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:BC8CCD*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:400E85*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:EC9BF3*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:F8042E*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:843838*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:54880E*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:BC79AD*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:30D6C9*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:B0DF3A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:805719*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:78A873*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:041BBA*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:08FD0E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:08D42B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00E3B2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C81479*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F0728C*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:94350A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001FCD*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D0DFC7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:1C62B8*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:18E2C2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F04347*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:9CB2B2*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:84BE52*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:001A8A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002567*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A8F274*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:B07870*
+ ID_OUI_FROM_DATABASE=Wi-NEXT, Inc.
+
+OUI:001599*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0012FB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:7CF854*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:8CC8CD*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E81132*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A02195*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:840B2D*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:000278*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:F07BCB*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:4C0F6E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:5C6D20*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:90004E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C0F8DA*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:485AB6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:083E8E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:F4B7E2*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:4437E6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0016CF*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001C25*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C48E8F*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:184F32*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:441CA8*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:A8474A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:08EDB9*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:7CE9D3*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:E4D53D*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C417FE*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:38B1DB*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00234D*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00234E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00265E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:541379*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:1008B1*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:701DC4*
+ ID_OUI_FROM_DATABASE=NorthStar Battery Company, LLC
+
+OUI:801844*
+ ID_OUI_FROM_DATABASE=Dell Inc.
+
+OUI:C80E14*
+ ID_OUI_FROM_DATABASE=AVM Audiovisuelles Marketing und Computersysteme GmbH
+
+OUI:E0686D*
+ ID_OUI_FROM_DATABASE=Raybased AB
+
+OUI:A45385*
+ ID_OUI_FROM_DATABASE=Weifang GoerTek Electronics Co., Ltd.
+
+OUI:000678*
+ ID_OUI_FROM_DATABASE=D&M Holdings Inc.
+
+OUI:98B039*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:84262B*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:94E98C*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:E48184*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:BC8D0E*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:B0754D*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:BC6B4D*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:A47B2C*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:00D0F6*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:48F8E1*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:002341*
+ ID_OUI_FROM_DATABASE=Vanderbilt International (SWE) AB
+
+OUI:981333*
+ ID_OUI_FROM_DATABASE=zte corporation
+
+OUI:8C71F8*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:04180F*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:9463D1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0CDFA4*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:CC051B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:68EBAE*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:60D0A9*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:60A10A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A07591*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D814D6*
+ ID_OUI_FROM_DATABASE=SURE SYSTEM Co Ltd
+
+OUI:646184*
+ ID_OUI_FROM_DATABASE=VELUX
+
+OUI:001FCC*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:EC01E2*
+ ID_OUI_FROM_DATABASE=FOXCONN INTERCONNECT TECHNOLOGY
+
+OUI:00F22C*
+ ID_OUI_FROM_DATABASE=Shanghai B-star Technology Co.,Ltd.
+
+OUI:D03DC3*
+ ID_OUI_FROM_DATABASE=AQ Corporation
+
+OUI:FCCAC4*
+ ID_OUI_FROM_DATABASE=LifeHealth, LLC
+
+OUI:04BA36*
+ ID_OUI_FROM_DATABASE=Li Seng Technology Ltd
+
+OUI:DCF090*
+ ID_OUI_FROM_DATABASE=Private
+
+OUI:4409B8*
+ ID_OUI_FROM_DATABASE=Salcomp (Shenzhen) CO., LTD.
+
+OUI:78888A*
+ ID_OUI_FROM_DATABASE=CDR Sp. z o.o. Sp. k.
+
+OUI:F09838*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:18DED7*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:EC107B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A01081*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001EAE*
+ ID_OUI_FROM_DATABASE=Continental Automotive Systems Inc.
+
+OUI:9CF48E*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:FCD848*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:8048A5*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:645D92*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:D44165*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:643AB1*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:00010D*
+ ID_OUI_FROM_DATABASE=Teledyne DALSA Inc.
+
+OUI:F09FC2*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:0418D6*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:44D9E7*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:48DA96*
+ ID_OUI_FROM_DATABASE=Eddy Smart Home Solutions Inc.
+
+OUI:503AA0*
+ ID_OUI_FROM_DATABASE=SHENZHEN MERCURY COMMUNICATION TECHNOLOGIES CO.,LTD.
+
+OUI:C025E9*
+ ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
+
+OUI:50B363*
+ ID_OUI_FROM_DATABASE=Digitron da Amazonia S/A
+
+OUI:94B819*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:DC0B34*
+ ID_OUI_FROM_DATABASE=LG Electronics (Mobile Communications)
+
+OUI:A4D9A4*
+ ID_OUI_FROM_DATABASE=neXus ID Solutions AB
+
+OUI:484D7E*
+ ID_OUI_FROM_DATABASE=Dell Inc.
+
+OUI:8871E5*
+ ID_OUI_FROM_DATABASE=Amazon Technologies Inc.
+
+OUI:F4B549*
+ ID_OUI_FROM_DATABASE=Xiamen Yeastar Information Technology Co., Ltd.
+
+OUI:9C3DCF*
+ ID_OUI_FROM_DATABASE=NETGEAR
+
+OUI:28EED3*
+ ID_OUI_FROM_DATABASE=Shenzhen Super D Technology Co., Ltd
+
+OUI:18F292*
+ ID_OUI_FROM_DATABASE=Shannon Systems
+
+OUI:3C3F51*
+ ID_OUI_FROM_DATABASE=2CRSI
+
+OUI:F4F524*
+ ID_OUI_FROM_DATABASE=Motorola Mobility LLC, a Lenovo Company
+
+OUI:50584F*
+ ID_OUI_FROM_DATABASE=waytotec,Inc.
+
+OUI:00A2EE*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
 OUI:0C6F9C*
  ID_OUI_FROM_DATABASE=Shaw Communications Inc.
 
@@ -20801,33 +21551,12 @@ OUI:8896B6*
 OUI:188796*
  ID_OUI_FROM_DATABASE=HTC Corporation
 
-OUI:945330*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:00242C*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:00242B*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:D87988*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:AC2A0C*
  ID_OUI_FROM_DATABASE=CSR ZHUZHOU INSTITUTE CO.,LTD.
 
-OUI:601971*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:F4CA24*
  ID_OUI_FROM_DATABASE=FreeBit Co., Ltd.
 
-OUI:001DD1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001DD6*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:000A57*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
@@ -20918,30 +21647,6 @@ OUI:001279*
 OUI:001708*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
-OUI:306023*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:ACB313*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:14ABF0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0CF893*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:8461A0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E83381*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:44E137*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:1C1B68*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:2832C5*
  ID_OUI_FROM_DATABASE=HUMAX Co., Ltd.
 
@@ -21032,18 +21737,6 @@ OUI:101B54*
 OUI:7054F5*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:00197E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:78DD08*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:9CD21E*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:8096CA*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:D07AB5*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -21239,12 +21932,6 @@ OUI:74A2E6*
 OUI:204C9E*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:A055DE*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:0026D9*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:00112F*
  ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
 
@@ -21635,9 +22322,6 @@ OUI:98F428*
 OUI:7C5A67*
  ID_OUI_FROM_DATABASE=JNC Systems, Inc.
 
-OUI:5C4979*
- ID_OUI_FROM_DATABASE=AVM Audiovisuelles Marketing und Computersysteme GmbH
-
 OUI:C4BBEA*
  ID_OUI_FROM_DATABASE=Pakedge Device and Software Inc
 
@@ -21707,9 +22391,6 @@ OUI:385F66*
 OUI:544E90*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
-OUI:28C87A*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:58FC73*
  ID_OUI_FROM_DATABASE=Arria Live Media, Inc.
 
@@ -21749,12 +22430,6 @@ OUI:04C23E*
 OUI:2CFCE4*
  ID_OUI_FROM_DATABASE=CTEK Sweden AB
 
-OUI:A8A795*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:10868C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:C0B713*
  ID_OUI_FROM_DATABASE=Beijing Xiaoyuer Technology Co. Ltd.
 
@@ -21773,18 +22448,12 @@ OUI:ECA9FA*
 OUI:300C23*
  ID_OUI_FROM_DATABASE=zte corporation
 
-OUI:EC1F72*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:445F8C*
  ID_OUI_FROM_DATABASE=Intercel Group Limited
 
 OUI:A48D3B*
  ID_OUI_FROM_DATABASE=Vizio, Inc
 
-OUI:1005B1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:0C756C*
  ID_OUI_FROM_DATABASE=Anaren Microwave, Inc.
 
@@ -21845,9 +22514,6 @@ OUI:E02CB2*
 OUI:DC15DB*
  ID_OUI_FROM_DATABASE=Ge Ruili Intelligent Technology ( Beijing ) Co., Ltd.
 
-OUI:E8508B*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:30F335*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -21875,9 +22541,6 @@ OUI:5804CB*
 OUI:1CB72C*
  ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
 
-OUI:40B89A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:40B837*
  ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
 
@@ -21911,9 +22574,6 @@ OUI:00323A*
 OUI:64DB81*
  ID_OUI_FROM_DATABASE=Syszone Co., Ltd.
 
-OUI:FC6FB7*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:C4BAA3*
  ID_OUI_FROM_DATABASE=Beijing Winicssec Technologies Co., Ltd.
 
@@ -21974,9 +22634,6 @@ OUI:38D82F*
 OUI:C8D779*
  ID_OUI_FROM_DATABASE=Qingdao Haier Telecom Co.，Ltd
 
-OUI:A0C562*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:2CA2B4*
  ID_OUI_FROM_DATABASE=Fortify Technologies, LLC
 
@@ -22004,12 +22661,6 @@ OUI:DC0914*
 OUI:142971*
  ID_OUI_FROM_DATABASE=NEMOA ELECTRONICS (HK) CO. LTD
 
-OUI:C0BDD1*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
-OUI:346895*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:B47356*
  ID_OUI_FROM_DATABASE=Hangzhou Treebear Networking Co., Ltd.
 
@@ -22025,9 +22676,6 @@ OUI:28D98A*
 OUI:BC4DFB*
  ID_OUI_FROM_DATABASE=Hitron Technologies. Inc
 
-OUI:7429AF*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:40EACE*
  ID_OUI_FROM_DATABASE=FOUNDER BROADBAND NETWORK SERVICE CO.,LTD
 
@@ -22100,9 +22748,6 @@ OUI:64002D*
 OUI:101218*
  ID_OUI_FROM_DATABASE=Korins Inc.
 
-OUI:EC0EC4*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:B04515*
  ID_OUI_FROM_DATABASE=mira fitness,LLC.
 
@@ -22226,9 +22871,6 @@ OUI:2053CA*
 OUI:142BD6*
  ID_OUI_FROM_DATABASE=Guangdong Appscomm Co.,Ltd
 
-OUI:C8BA94*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:B025AA*
  ID_OUI_FROM_DATABASE=Private
 
@@ -22475,9 +23117,6 @@ OUI:64EB8C*
 OUI:48D0CF*
  ID_OUI_FROM_DATABASE=Universal Electronics, Inc.
 
-OUI:AC3613*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:DCC793*
  ID_OUI_FROM_DATABASE=Nokia Corporation
 
@@ -22520,27 +23159,18 @@ OUI:0CC47A*
 OUI:D0634D*
  ID_OUI_FROM_DATABASE=Meiko Maschinenbau GmbH &amp; Co. KG
 
-OUI:24DBED*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:88C626*
  ID_OUI_FROM_DATABASE=Logitech - Ultimate Ears
 
 OUI:889CA6*
  ID_OUI_FROM_DATABASE=BTB Korea INC
 
-OUI:F025B7*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:B0DA00*
  ID_OUI_FROM_DATABASE=CERA ELECTRONIQUE
 
 OUI:447098*
  ID_OUI_FROM_DATABASE=MING HONG TECHNOLOGY (SHEN ZHEN) LIMITED
 
-OUI:54E2E0*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:00EEBD*
  ID_OUI_FROM_DATABASE=HTC Corporation
 
@@ -22649,24 +23279,15 @@ OUI:88789C*
 OUI:18AA45*
  ID_OUI_FROM_DATABASE=Fon Technology
 
-OUI:0073E0*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:549359*
  ID_OUI_FROM_DATABASE=SHENZHEN TWOWING TECHNOLOGIES CO.,LTD.
 
-OUI:BC4486*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:284430*
  ID_OUI_FROM_DATABASE=GenesisTechnical Systems (UK) Ltd
 
 OUI:9843DA*
  ID_OUI_FROM_DATABASE=INTERTECH
 
-OUI:8056F2*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:285767*
  ID_OUI_FROM_DATABASE=Echostar Technologies Corp
 
@@ -22694,9 +23315,6 @@ OUI:A409CB*
 OUI:C445EC*
  ID_OUI_FROM_DATABASE=Shanghai Yali Electron Co.,LTD
 
-OUI:380B40*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:E8611F*
  ID_OUI_FROM_DATABASE=Dawning Information Industry Co.,Ltd
 
@@ -22733,12 +23351,6 @@ OUI:A47760*
 OUI:24A495*
  ID_OUI_FROM_DATABASE=Thales Canada Inc.
 
-OUI:70188B*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:3C77E6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:883612*
  ID_OUI_FROM_DATABASE=SRC Computers, LLC
 
@@ -22802,9 +23414,6 @@ OUI:A4C0C7*
 OUI:EC2257*
  ID_OUI_FROM_DATABASE=JiangSu NanJing University Electronic Information Technology Co.,Ltd
 
-OUI:0C84DC*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:341A4C*
  ID_OUI_FROM_DATABASE=SHENZHEN WEIBU ELECTRONICS CO.,LTD.
 
@@ -22871,9 +23480,6 @@ OUI:043D98*
 OUI:E8BB3D*
  ID_OUI_FROM_DATABASE=Sino Prime-Tech Limited
 
-OUI:E492FB*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:98CDB4*
  ID_OUI_FROM_DATABASE=Virident Systems, Inc.
 
@@ -22928,9 +23534,6 @@ OUI:CC04B4*
 OUI:284FCE*
  ID_OUI_FROM_DATABASE=Liaoning Wontel Science and Technology Development Co.,Ltd.
 
-OUI:1449E0*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co.,LTD.
-
 OUI:0CC81F*
  ID_OUI_FROM_DATABASE=Summer Infant, Inc.
 
@@ -22940,15 +23543,9 @@ OUI:D86960*
 OUI:442AFF*
  ID_OUI_FROM_DATABASE=E3 Technology, Inc.
 
-OUI:E440E2*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:0C9301*
  ID_OUI_FROM_DATABASE=PT. Prasimax Inovasi Teknologi
 
-OUI:1CAF05*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:60699B*
  ID_OUI_FROM_DATABASE=isepos GmbH
 
@@ -23216,9 +23813,6 @@ OUI:74372F*
 OUI:BC51FE*
  ID_OUI_FROM_DATABASE=Swann communications Pty Ltd
 
-OUI:789ED0*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:D40FB2*
  ID_OUI_FROM_DATABASE=Applied Micro Electronics AME bv
 
@@ -23261,9 +23855,6 @@ OUI:ACE87E*
 OUI:60CDC5*
  ID_OUI_FROM_DATABASE=Taiwan Carol Electronics., Ltd
 
-OUI:1489FD*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:60C5A8*
  ID_OUI_FROM_DATABASE=Beijing LT Honway Technology Co.,Ltd
 
@@ -23321,9 +23912,6 @@ OUI:F4472A*
 OUI:185253*
  ID_OUI_FROM_DATABASE=Pixord Corporation
 
-OUI:A41731*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:FCA9B0*
  ID_OUI_FROM_DATABASE=MIARTECH (SHANGHAI),INC.
 
@@ -23450,18 +24038,12 @@ OUI:74BFA1*
 OUI:F8AA8A*
  ID_OUI_FROM_DATABASE=Axview Technology (Shenzhen) Co.,Ltd
 
-OUI:60F494*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:5894CF*
  ID_OUI_FROM_DATABASE=Vertex Standard LMR, Inc.
 
 OUI:2C5AA3*
  ID_OUI_FROM_DATABASE=PROMATE ELECTRONIC CO.LTD
 
-OUI:9852B1*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:B4009C*
  ID_OUI_FROM_DATABASE=CableWorld Ltd.
 
@@ -23579,15 +24161,9 @@ OUI:7C02BC*
 OUI:1848D8*
  ID_OUI_FROM_DATABASE=Fastback Networks
 
-OUI:C819F7*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:702393*
  ID_OUI_FROM_DATABASE=fos4X GmbH
 
-OUI:C4731E*
- ID_OUI_FROM_DATABASE=Samsung Eletronics Co., Ltd
-
 OUI:D8AFF1*
  ID_OUI_FROM_DATABASE=Panasonic Appliances Company
 
@@ -23606,15 +24182,9 @@ OUI:241064*
 OUI:10D1DC*
  ID_OUI_FROM_DATABASE=INSTAR Deutschland GmbH
 
-OUI:844BF5*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:D8160A*
  ID_OUI_FROM_DATABASE=Nippon Electro-Sensory Devices
 
-OUI:58696C*
- ID_OUI_FROM_DATABASE=Fujian Ruijie Networks co, ltd
-
 OUI:F45433*
  ID_OUI_FROM_DATABASE=Rockwell Automation
 
@@ -23729,9 +24299,6 @@ OUI:940070*
 OUI:6C3A84*
  ID_OUI_FROM_DATABASE=Shenzhen Aero-Startech. Co.Ltd
 
-OUI:C0143D*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:442B03*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -23759,9 +24326,6 @@ OUI:18B591*
 OUI:A45630*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:CCFE3C*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:002AAF*
  ID_OUI_FROM_DATABASE=LARsys-Automation GmbH
 
@@ -23840,9 +24404,6 @@ OUI:CC187B*
 OUI:38B12D*
  ID_OUI_FROM_DATABASE=Sonotronic Nagel GmbH
 
-OUI:E006E6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:8020AF*
  ID_OUI_FROM_DATABASE=Trade FIDES, a.s.
 
@@ -23885,9 +24446,6 @@ OUI:E00B28*
 OUI:500B32*
  ID_OUI_FROM_DATABASE=Foxda Technology Industrial(ShenZhen)Co.,LTD
 
-OUI:E8039A*
- ID_OUI_FROM_DATABASE=Samsung Electronics CO., LTD
-
 OUI:302DE8*
  ID_OUI_FROM_DATABASE=JDA, LLC (JDA Systems)
 
@@ -23978,9 +24536,6 @@ OUI:4C2F9D*
 OUI:E467BA*
  ID_OUI_FROM_DATABASE=Danish Interpretation Systems A/S
 
-OUI:642737*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:BCFE8C*
  ID_OUI_FROM_DATABASE=Altronic, LLC
 
@@ -24068,9 +24623,6 @@ OUI:A85BF3*
 OUI:344F69*
  ID_OUI_FROM_DATABASE=EKINOPS SAS
 
-OUI:2C4401*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:C02973*
  ID_OUI_FROM_DATABASE=Audyssey Laboratories Inc.
 
@@ -24089,9 +24641,6 @@ OUI:88F488*
 OUI:0041B4*
  ID_OUI_FROM_DATABASE=Wuxi Zhongxing Optoelectronics Technology Co.,Ltd.
 
-OUI:0007AB*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:D453AF*
  ID_OUI_FROM_DATABASE=VIGO System S.A.
 
@@ -24101,12 +24650,6 @@ OUI:1CE192*
 OUI:20C8B3*
  ID_OUI_FROM_DATABASE=SHENZHEN BUL-TECH CO.,LTD.
 
-OUI:60D819*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:945103*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:58B0D4*
  ID_OUI_FROM_DATABASE=ZuniData Systems Inc.
 
@@ -24167,9 +24710,6 @@ OUI:3CD16E*
 OUI:00077D*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:D0176A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:1045BE*
  ID_OUI_FROM_DATABASE=Norphonic AS
 
@@ -24197,9 +24737,6 @@ OUI:8C5CA1*
 OUI:C8F981*
  ID_OUI_FROM_DATABASE=Seneca s.r.l.
 
-OUI:8C7712*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:703187*
  ID_OUI_FROM_DATABASE=ACX GmbH
 
@@ -24326,9 +24863,6 @@ OUI:50795B*
 OUI:E8C229*
  ID_OUI_FROM_DATABASE=H-Displays (MSC) Bhd
 
-OUI:3C6200*
- ID_OUI_FROM_DATABASE=Samsung electronics CO., LTD
-
 OUI:B0BDA1*
  ID_OUI_FROM_DATABASE=ZAKLAD ELEKTRONICZNY SIMS
 
@@ -24398,9 +24932,6 @@ OUI:806CBC*
 OUI:1C184A*
  ID_OUI_FROM_DATABASE=ShenZhen RicherLink Technologies Co.,LTD
 
-OUI:2013E0*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:04E662*
  ID_OUI_FROM_DATABASE=Acroname Inc.
 
@@ -24524,12 +25055,6 @@ OUI:18922C*
 OUI:F80F84*
  ID_OUI_FROM_DATABASE=Natural Security SAS
 
-OUI:FCA13E*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
-OUI:BC4760*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:EC9ECD*
  ID_OUI_FROM_DATABASE=Artesyn Embedded Technologies
 
@@ -24548,9 +25073,6 @@ OUI:A862A2*
 OUI:984E97*
  ID_OUI_FROM_DATABASE=Starlight Marketing (H. K.) Ltd.
 
-OUI:E4E0C5*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:7C6ADB*
  ID_OUI_FROM_DATABASE=SafeTone Technology Co.,Ltd
 
@@ -24596,9 +25118,6 @@ OUI:948D50*
 OUI:94E226*
  ID_OUI_FROM_DATABASE=D. ORtiz Consulting, LLC
 
-OUI:78D6F0*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics
-
 OUI:E8E732*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent
 
@@ -24752,9 +25271,6 @@ OUI:C8EE08*
 OUI:7472F2*
  ID_OUI_FROM_DATABASE=Chipsip Technology Co., Ltd.
 
-OUI:C0CB38*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:5CD998*
  ID_OUI_FROM_DATABASE=D-Link Corporation
 
@@ -24836,9 +25352,6 @@ OUI:100C24*
 OUI:58F6BF*
  ID_OUI_FROM_DATABASE=Kyoto University
 
-OUI:B407F9*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS
-
 OUI:7CED8D*
  ID_OUI_FROM_DATABASE=Microsoft
 
@@ -25253,9 +25766,6 @@ OUI:6465C0*
 OUI:F0DE71*
  ID_OUI_FROM_DATABASE=Shanghai EDO Technologies Co.,Ltd.
 
-OUI:A00798*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:28FBD3*
  ID_OUI_FROM_DATABASE=Ragentek Technology Group
 
@@ -25550,9 +26060,6 @@ OUI:002489*
 OUI:00248E*
  ID_OUI_FROM_DATABASE=Infoware ZRt.
 
-OUI:002490*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,LTD
-
 OUI:002482*
  ID_OUI_FROM_DATABASE=Ruckus Wireless
 
@@ -25592,9 +26099,6 @@ OUI:0023CB*
 OUI:0023D2*
  ID_OUI_FROM_DATABASE=Inhand Electronics, Inc.
 
-OUI:0023D7*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:0024B4*
  ID_OUI_FROM_DATABASE=ESCATRONIC GmbH
 
@@ -25706,9 +26210,6 @@ OUI:0024F7*
 OUI:0024F0*
  ID_OUI_FROM_DATABASE=Seanodes
 
-OUI:0024E9*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd., Storage System Division
-
 OUI:0024EB*
  ID_OUI_FROM_DATABASE=ClearPath Networks, Inc.
 
@@ -25832,9 +26333,6 @@ OUI:00231B*
 OUI:00239F*
  ID_OUI_FROM_DATABASE=Institut für Prüftechnik
 
-OUI:002399*
- ID_OUI_FROM_DATABASE=VD Division, Samsung Electronics Co.
-
 OUI:002393*
  ID_OUI_FROM_DATABASE=AJINEXTEK
 
@@ -26030,9 +26528,6 @@ OUI:0021E4*
 OUI:0021DF*
  ID_OUI_FROM_DATABASE=Martin Christ GmbH
 
-OUI:0021D2*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:0021D8*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -26285,9 +26780,6 @@ OUI:001E89*
 OUI:001E84*
  ID_OUI_FROM_DATABASE=Pika Technologies Inc.
 
-OUI:001E7D*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001E83*
  ID_OUI_FROM_DATABASE=LAN/MAN Standards Association (LMSC)
 
@@ -27224,9 +27716,6 @@ OUI:00165C*
 OUI:001655*
  ID_OUI_FROM_DATABASE=FUHO TECHNOLOGY Co., LTD
 
-OUI:001650*
- ID_OUI_FROM_DATABASE=Herley General Microwave Israel.
-
 OUI:0015E4*
  ID_OUI_FROM_DATABASE=Zimmer Elektromedizin
 
@@ -29675,9 +30164,6 @@ OUI:00043C*
 OUI:000441*
  ID_OUI_FROM_DATABASE=Half Dome Systems, Inc.
 
-OUI:000435*
- ID_OUI_FROM_DATABASE=Comptek International, Inc.
-
 OUI:00042F*
  ID_OUI_FROM_DATABASE=International Communications Products, Inc.
 
@@ -30332,9 +30818,6 @@ OUI:00D0AF*
 OUI:00D026*
  ID_OUI_FROM_DATABASE=HIRSCHMANN AUSTRIA GMBH
 
-OUI:00D037*
- ID_OUI_FROM_DATABASE=Pace France
-
 OUI:00D010*
  ID_OUI_FROM_DATABASE=CONVERGENT NETWORKS, INC.
 
@@ -31151,9 +31634,6 @@ OUI:0060B2*
 OUI:006004*
  ID_OUI_FROM_DATABASE=COMPUTADORES MODULARES SA
 
-OUI:0060D6*
- ID_OUI_FROM_DATABASE=NovAtel Wireless Technologies Ltd.
-
 OUI:006000*
  ID_OUI_FROM_DATABASE=XYCOM INC.
 
@@ -32561,21 +33041,6 @@ OUI:F0272D*
 OUI:00225F*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
-OUI:0018A4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001311*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0015A2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001596*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0000CA*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:983B16*
  ID_OUI_FROM_DATABASE=AMPAK Technology, Inc.
 
@@ -32609,84 +33074,9 @@ OUI:20689D*
 OUI:446D57*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
-OUI:000F9F*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0011AE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002040*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0015CE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001626*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00111A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00152F*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:000B06*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:44EE02*
  ID_OUI_FROM_DATABASE=MTI Ltd.
 
-OUI:001C11*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001CC1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001D6B*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001E5A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001DBE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001371*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:C8AA21*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:2C9E5F*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002495*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002642*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:A4ED4E*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0024A1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002375*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001ADB*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00149A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001A1B*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001F7E*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:0026B6*
  ID_OUI_FROM_DATABASE=ASKEY COMPUTER CORP
 
@@ -33209,12 +33599,6 @@ OUI:749781*
 OUI:B4B15A*
  ID_OUI_FROM_DATABASE=Siemens AG Energy Management Division
 
-OUI:A86BAD*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:D80F99*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A8D828*
  ID_OUI_FROM_DATABASE=Ascensia Diabetes Care
 
@@ -33293,9 +33677,6 @@ OUI:DCD916*
 OUI:002552*
  ID_OUI_FROM_DATABASE=VXi Corporation
 
-OUI:341FE4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:006CBC*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -33329,9 +33710,6 @@ OUI:B8E779*
 OUI:240A11*
  ID_OUI_FROM_DATABASE=TCT mobile ltd
 
-OUI:78B84B*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:C84544*
  ID_OUI_FROM_DATABASE=Asia Pacific CIS (Wuxi) Co, Ltd
 
@@ -33386,9 +33764,6 @@ OUI:48435A*
 OUI:9CE374*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:40F420*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:6C0EE6*
  ID_OUI_FROM_DATABASE=Chengdu Xiyida Electronic Technology Co,.Ltd
 
@@ -33590,18 +33965,12 @@ OUI:00E00F*
 OUI:3C404F*
  ID_OUI_FROM_DATABASE=GUANGDONG PISEN ELECTRONICS CO.,LTD
 
-OUI:1CEA1B*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:00233E*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent IPD
 
 OUI:6CBEE9*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent IPD
 
-OUI:4CC94F*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:0080F7*
  ID_OUI_FROM_DATABASE=Zenith Electronics Corporation
 
@@ -33635,12 +34004,6 @@ OUI:002713*
 OUI:002186*
  ID_OUI_FROM_DATABASE=Universal Global Scientific Industrial Co., Ltd.
 
-OUI:802AA8*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
-OUI:00156D*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
 OUI:8CFDF0*
  ID_OUI_FROM_DATABASE=Qualcomm Inc.
 
@@ -33659,9 +34022,6 @@ OUI:000C29*
 OUI:005056*
  ID_OUI_FROM_DATABASE=VMware, Inc.
 
-OUI:9C6121*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:001C4D*
  ID_OUI_FROM_DATABASE=Aplix IP Holdings Corporation
 
@@ -33689,18 +34049,273 @@ OUI:20F543*
 OUI:685388*
  ID_OUI_FROM_DATABASE=P&S Technology
 
-OUI:48F7F1*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:10E878*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:54A619*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
 
 OUI:1880F5*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
 
+OUI:24DBED*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:AC3613*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:1449E0*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:C0BDD1*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:E8508B*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:F025B7*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:C8BA94*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:EC1F72*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:9852B1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:1489FD*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:CCFE3C*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:789ED0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E440E2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:1CAF05*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E492FB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:247F20*
+ ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
+
+OUI:0073E0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:BC4486*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:380B40*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:8C0D76*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:005A13*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:002490*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0023D7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:FCA13E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A00798*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:945103*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C819F7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:2C4401*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:08C6B3*
+ ID_OUI_FROM_DATABASE=QTECH LLC
+
+OUI:64DAA0*
+ ID_OUI_FROM_DATABASE=Robert Bosch Smart Home GmbH
+
+OUI:14B837*
+ ID_OUI_FROM_DATABASE=Shenzhen YOUHUA Technology Co., Ltd
+
+OUI:8056F2*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:70188B*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:3C77E6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0C84DC*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:844BF5*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:E006E6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:60F494*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:A41731*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C0143D*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:642737*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:60D819*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:6474F6*
+ ID_OUI_FROM_DATABASE=Shooter Detection Systems
+
+OUI:604BAA*
+ ID_OUI_FROM_DATABASE=Private
+
+OUI:CC7314*
+ ID_OUI_FROM_DATABASE=HONG KONG WHEATEK TECHNOLOGY LIMITED
+
+OUI:C0CB38*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:98E7F4*
+ ID_OUI_FROM_DATABASE=Hewlett Packard
+
+OUI:D42C44*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:D842E2*
+ ID_OUI_FROM_DATABASE=Canary Connect, Inc.
+
+OUI:500959*
+ ID_OUI_FROM_DATABASE=Technicolor CH USA Inc.
+
+OUI:143365*
+ ID_OUI_FROM_DATABASE=TEM Mobile Limited
+
+OUI:205D47*
+ ID_OUI_FROM_DATABASE=vivo Mobile Communication Co., Ltd.
+
+OUI:C0F945*
+ ID_OUI_FROM_DATABASE=Toshiba Toko Meter Systems Co., LTD.
+
+OUI:ACAB2E*
+ ID_OUI_FROM_DATABASE=Beijing LasNubes Technology Co., Ltd.
+
+OUI:10E878*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:48F7F1*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:4CC94F*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:1CEA1B*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:B4F81E*
+ ID_OUI_FROM_DATABASE=Kinova
+
+OUI:A46011*
+ ID_OUI_FROM_DATABASE=VeriFone Inc.
+
+OUI:28CA09*
+ ID_OUI_FROM_DATABASE=ThyssenKrupp Elevators (Shanghai) Co.,Ltd
+
+OUI:E0B94D*
+ ID_OUI_FROM_DATABASE=SHENZHEN BILIAN ELECTRONIC CO.，LTD
+
+OUI:D8380D*
+ ID_OUI_FROM_DATABASE=SHENZHEN IP-COM Network Co.,Ltd
+
+OUI:A4C64F*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:C83DD4*
+ ID_OUI_FROM_DATABASE=CyberTAN Technology Inc.
+
+OUI:487B6B*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:3087D9*
+ ID_OUI_FROM_DATABASE=Ruckus Wireless
+
+OUI:A8E705*
+ ID_OUI_FROM_DATABASE=Fiberhome Telecommunication Technologies Co.,LTD
+
+OUI:9C62AB*
+ ID_OUI_FROM_DATABASE=Sumavision Technologies Co.,Ltd
+
+OUI:487A55*
+ ID_OUI_FROM_DATABASE=ALE International
+
+OUI:000435*
+ ID_OUI_FROM_DATABASE=InfiNet LLC
+
+OUI:BC39D9*
+ ID_OUI_FROM_DATABASE=Z-TEC
+
+OUI:88E87F*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:B853AC*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:B04BBF*
+ ID_OUI_FROM_DATABASE=PT HAN SUNG ELECTORONICS INDONESIA
+
+OUI:0060D6*
+ ID_OUI_FROM_DATABASE=NovAtel Inc.
+
+OUI:2C3361*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:78B84B*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:40F420*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:9C6121*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:8C8ABB*
+ ID_OUI_FROM_DATABASE=Beijing Orient View Technology Co., Ltd.
+
+OUI:88366C*
+ ID_OUI_FROM_DATABASE=EFM Networks
+
+OUI:F074E4*
+ ID_OUI_FROM_DATABASE=Thundercomm Technology Co., Ltd
+
+OUI:A0722C*
+ ID_OUI_FROM_DATABASE=HUMAX Co., Ltd.
+
+OUI:FCECDA*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:E07C13*
+ ID_OUI_FROM_DATABASE=zte corporation
+
+OUI:58696C*
+ ID_OUI_FROM_DATABASE=Ruijie Networks Co.,LTD.
+
 OUI:001972*
  ID_OUI_FROM_DATABASE=Plexus (Xiamen) Co.,ltd.
 
@@ -33866,9 +34481,6 @@ OUI:F45EAB*
 OUI:001783*
  ID_OUI_FROM_DATABASE=Texas Instruments
 
-OUI:400D10*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:A81B6A*
  ID_OUI_FROM_DATABASE=Texas Instruments
 
@@ -33902,15 +34514,333 @@ OUI:EC8CA2*
 OUI:C411E0*
  ID_OUI_FROM_DATABASE=Bull Group Co., Ltd
 
+OUI:90842B*
+ ID_OUI_FROM_DATABASE=LEGO System A/S
+
+OUI:84C7EA*
+ ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
+
+OUI:8C6102*
+ ID_OUI_FROM_DATABASE=Beijing Baofengmojing Technologies Co., Ltd
+
+OUI:1005B1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:10868C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:1C1B68*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:44E137*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E83381*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:8461A0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0CF893*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:14ABF0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:ACB313*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0026D9*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:28C87A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:54E2E0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:A055DE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:A0C562*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:FC6FB7*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001A1B*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00149A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001371*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DBE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001E5A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001D6B*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001CC1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001C11*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001F7E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002495*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:2C9E5F*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:C8AA21*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:341FE4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:400D10*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001596*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015A2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001311*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015CE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002040*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0011AE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:000F9F*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:306023*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD6*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:601971*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0000CA*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001ADB*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002375*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0024A1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:A4ED4E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002642*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:000B06*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00152F*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00111A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001626*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0018A4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00D037*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:FC9114*
+ ID_OUI_FROM_DATABASE=Technicolor CH USA Inc.
+
+OUI:1C25E1*
+ ID_OUI_FROM_DATABASE=China Mobile IOT Company Limited
+
+OUI:C0F636*
+ ID_OUI_FROM_DATABASE=Hangzhou Kuaiyue Technologies, Ltd.
+
+OUI:F0038C*
+ ID_OUI_FROM_DATABASE=AzureWave Technology Inc.
+
+OUI:B45D50*
+ ID_OUI_FROM_DATABASE=Aruba Networks
+
+OUI:742344*
+ ID_OUI_FROM_DATABASE=Xiaomi Communications Co Ltd
+
+OUI:001E7D*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:3C6200*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0024E9*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002399*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E4E0C5*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E8039A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C4731E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:78D6F0*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:B407F9*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:40B89A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:A8A795*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:8096CA*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:9CD21E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:D87988*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00242B*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00242C*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:945330*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:EC0EC4*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:7429AF*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:346895*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:A86BAD*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:D80F99*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:78DD08*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00197E*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:A0AB1B*
+ ID_OUI_FROM_DATABASE=D-Link International
+
+OUI:5C4979*
+ ID_OUI_FROM_DATABASE=AVM Audiovisuelles Marketing und Computersysteme GmbH
+
+OUI:086A0A*
+ ID_OUI_FROM_DATABASE=ASKEY COMPUTER CORP
+
+OUI:101250*
+ ID_OUI_FROM_DATABASE=Integrated Device Technology (Malaysia) Sdn. Bhd.
+
+OUI:8C7712*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:2013E0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0007AB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0021D2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:BC4760*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D0176A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F0D9B2*
+ ID_OUI_FROM_DATABASE=EXO S.A.
+
+OUI:2CBABA*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:24920E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:40D3AE*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:802AA8*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:00156D*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:787D48*
+ ID_OUI_FROM_DATABASE=ITEL MOBILE LIMITED
+
+OUI:D46E0E*
+ ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
+
+OUI:049790*
+ ID_OUI_FROM_DATABASE=Lartech telecom LLC
+
+OUI:8CEA1B*
+ ID_OUI_FROM_DATABASE=Edgecore Networks Corporation
+
+OUI:001650*
+ ID_OUI_FROM_DATABASE=Kratos EPD
+
+OUI:58E16C*
+ ID_OUI_FROM_DATABASE=Ying Hua Information Technology (Shanghai)Co., LTD
+
 OUI:5846E1*
  ID_OUI_FROM_DATABASE=Baxter International Inc
 
 OUI:00D0BD*
  ID_OUI_FROM_DATABASE=Lattice Semiconductor Corp. (LPA)
 
-OUI:001F3A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:F08261*
  ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
 
@@ -33995,9 +34925,6 @@ OUI:4CFB45*
 OUI:A4BA76*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:003676*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:78E3B5*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
@@ -34049,18 +34976,9 @@ OUI:F8DB7F*
 OUI:E899C4*
  ID_OUI_FROM_DATABASE=HTC Corporation
 
-OUI:28565A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:40490F*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:7CB15D*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:002269*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:18686A*
  ID_OUI_FROM_DATABASE=zte corporation
 
@@ -34142,15 +35060,6 @@ OUI:2C6E85*
 OUI:00D0B7*
  ID_OUI_FROM_DATABASE=Intel Corporation
 
-OUI:0015D1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:C005C2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:6455B1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:0002B3*
  ID_OUI_FROM_DATABASE=Intel Corporation
 
@@ -34187,24 +35096,6 @@ OUI:A0481C*
 OUI:A01D48*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
-OUI:001DD3*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E8892C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E83EFC*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:083E0C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:8C09F4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:3CDFA9*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:94B2CC*
  ID_OUI_FROM_DATABASE=PIONEER CORPORATION
 
@@ -34352,30 +35243,6 @@ OUI:C864C7*
 OUI:D0154A*
  ID_OUI_FROM_DATABASE=zte corporation
 
-OUI:001FE2*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:001DD9*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:0016CE*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:0014A4*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:D02788*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:300ED5*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:543530*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:90489A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:88E3AB*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -34889,9 +35756,6 @@ OUI:C02DEE*
 OUI:54A3FA*
  ID_OUI_FROM_DATABASE=BQT Solutions (Australia)Pty Ltd
 
-OUI:30F772*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:9023EC*
  ID_OUI_FROM_DATABASE=Availink, Inc.
 
@@ -34949,12 +35813,6 @@ OUI:DC2B2A*
 OUI:8C10D4*
  ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
 
-OUI:203D66*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:B83A9D*
- ID_OUI_FROM_DATABASE=FIVE INTERACTIVE, LLC
-
 OUI:089B4B*
  ID_OUI_FROM_DATABASE=iKuai Networks
 
@@ -34976,15 +35834,9 @@ OUI:A8741D*
 OUI:A4C138*
  ID_OUI_FROM_DATABASE=Telink Semiconductor (Taipei) Co. Ltd.
 
-OUI:48E244*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:D8EFCD*
  ID_OUI_FROM_DATABASE=Nokia
 
-OUI:D404CD*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:EC0133*
  ID_OUI_FROM_DATABASE=TRINUS SYSTEMS INC.
 
@@ -35141,9 +35993,6 @@ OUI:702A7D*
 OUI:B8B3DC*
  ID_OUI_FROM_DATABASE=DEREK (SHAOGUAN) LIMITED
 
-OUI:347A60*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:6C1E70*
  ID_OUI_FROM_DATABASE=Guangzhou YBDS IT Co.,Ltd
 
@@ -35174,9 +36023,6 @@ OUI:887384*
 OUI:584704*
  ID_OUI_FROM_DATABASE=Shenzhen Webridge Technology Co.,Ltd
 
-OUI:1C14B3*
- ID_OUI_FROM_DATABASE=Pinyon Technologies
-
 OUI:749CE3*
  ID_OUI_FROM_DATABASE=Art2Wave Canada Inc.
 
@@ -35252,9 +36098,6 @@ OUI:1436C6*
 OUI:04C09C*
  ID_OUI_FROM_DATABASE=Tellabs Inc.
 
-OUI:2C337A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:844464*
  ID_OUI_FROM_DATABASE=ServerU Inc
 
@@ -35282,9 +36125,6 @@ OUI:F8B2F3*
 OUI:1C7D22*
  ID_OUI_FROM_DATABASE=Fuji Xerox Co., Ltd.
 
-OUI:ACD1B8*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:7C11CD*
  ID_OUI_FROM_DATABASE=QianTang Technology
 
@@ -35330,9 +36170,6 @@ OUI:ECB907*
 OUI:5CF9F0*
  ID_OUI_FROM_DATABASE=Atomos Engineering P/L
 
-OUI:F409D8*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:FCDBB3*
  ID_OUI_FROM_DATABASE=Murata Manufacturing Co., Ltd.
 
@@ -35354,18 +36191,12 @@ OUI:B89BE4*
 OUI:C0EEFB*
  ID_OUI_FROM_DATABASE=OnePlus Tech (Shenzhen) Ltd
 
-OUI:E00DB9*
- ID_OUI_FROM_DATABASE=Private
-
 OUI:108A1B*
  ID_OUI_FROM_DATABASE=RAONIX Inc.
 
 OUI:8CF813*
  ID_OUI_FROM_DATABASE=ORANGE POLSKA
 
-OUI:B479A7*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:B8F317*
  ID_OUI_FROM_DATABASE=iSun Smasher Communications Private Limited
 
@@ -35384,9 +36215,6 @@ OUI:50F43C*
 OUI:B43934*
  ID_OUI_FROM_DATABASE=Pen Generations, Inc.
 
-OUI:C03896*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:DCC622*
  ID_OUI_FROM_DATABASE=BUHEUNG SYSTEM
 
@@ -35405,9 +36233,6 @@ OUI:2CA30E*
 OUI:4CF5A0*
  ID_OUI_FROM_DATABASE=Scalable Network Technologies Inc
 
-OUI:84E058*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:084656*
  ID_OUI_FROM_DATABASE=VEO-LABS
 
@@ -35633,9 +36458,6 @@ OUI:748F1B*
 OUI:F03A4B*
  ID_OUI_FROM_DATABASE=Bloombase, Inc.
 
-OUI:E4121D*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:D82A15*
  ID_OUI_FROM_DATABASE=Leitner SpA
 
@@ -35753,9 +36575,6 @@ OUI:083F3E*
 OUI:6C09D6*
  ID_OUI_FROM_DATABASE=Digiquest Electronics LTD
 
-OUI:684898*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:8C569D*
  ID_OUI_FROM_DATABASE=Imaging Solutions Group
 
@@ -35870,9 +36689,6 @@ OUI:5CFFFF*
 OUI:F0D3A7*
  ID_OUI_FROM_DATABASE=CobaltRay Co., Ltd
 
-OUI:20D390*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:847616*
  ID_OUI_FROM_DATABASE=Addat s.r.o.
 
@@ -35891,12 +36707,6 @@ OUI:38BF2F*
 OUI:182012*
  ID_OUI_FROM_DATABASE=Aztech Associates Inc.
 
-OUI:34BE00*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:343111*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:C0F991*
  ID_OUI_FROM_DATABASE=GME Standard Communications P/L
 
@@ -36011,9 +36821,6 @@ OUI:AC5036*
 OUI:FC019E*
  ID_OUI_FROM_DATABASE=VIEVU
 
-OUI:34AA8B*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:F45F69*
  ID_OUI_FROM_DATABASE=Matsufu Electronics distribution Company
 
@@ -36122,12 +36929,6 @@ OUI:6405BE*
 OUI:E03E4A*
  ID_OUI_FROM_DATABASE=Cavanagh Group International
 
-OUI:D890E8*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:24C696*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:6CB350*
  ID_OUI_FROM_DATABASE=Anhui comhigher tech co.,ltd
 
@@ -36173,9 +36974,6 @@ OUI:C06C6D*
 OUI:74CA25*
  ID_OUI_FROM_DATABASE=Calxeda, Inc.
 
-OUI:181EB0*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:CCBD35*
  ID_OUI_FROM_DATABASE=Steinel GmbH
 
@@ -36248,9 +37046,6 @@ OUI:380FE4*
 OUI:847A88*
  ID_OUI_FROM_DATABASE=HTC Corporation
 
-OUI:0808C2*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:5461EA*
  ID_OUI_FROM_DATABASE=Zaplox AB
 
@@ -36332,9 +37127,6 @@ OUI:5C20D0*
 OUI:E0C3F3*
  ID_OUI_FROM_DATABASE=zte corporation
 
-OUI:30CDA7*
- ID_OUI_FROM_DATABASE=Samsung Electronics ITS, Printer division
-
 OUI:104D77*
  ID_OUI_FROM_DATABASE=Innovative Computer Engineering
 
@@ -36368,9 +37160,6 @@ OUI:A8D236*
 OUI:6C8686*
  ID_OUI_FROM_DATABASE=Technonia
 
-OUI:78521A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:84E714*
  ID_OUI_FROM_DATABASE=Liang Herng Enterprise,Co.Ltd.
 
@@ -36380,12 +37169,6 @@ OUI:303D08*
 OUI:9C541C*
  ID_OUI_FROM_DATABASE=Shenzhen My-power Technology Co.,Ltd
 
-OUI:90187C*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
-OUI:FC1F19*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS CO., LTD.
-
 OUI:E496AE*
  ID_OUI_FROM_DATABASE=ALTOGRAPHICS Inc.
 
@@ -36416,9 +37199,6 @@ OUI:D40057*
 OUI:48B8DE*
  ID_OUI_FROM_DATABASE=HOMEWINS TECHNOLOGY CO.,LTD.
 
-OUI:20D5BF*
- ID_OUI_FROM_DATABASE=Samsung Eletronics Co., Ltd
-
 OUI:1065CF*
  ID_OUI_FROM_DATABASE=IQSIM
 
@@ -36476,9 +37256,6 @@ OUI:B85AF7*
 OUI:E0D9A2*
  ID_OUI_FROM_DATABASE=Hippih aps
 
-OUI:B0C4E7*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:F0F669*
  ID_OUI_FROM_DATABASE=Motion Analysis Corporation
 
@@ -36617,9 +37394,6 @@ OUI:50724D*
 OUI:B898B0*
  ID_OUI_FROM_DATABASE=Atlona Inc.
 
-OUI:1C66AA*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:2C625A*
  ID_OUI_FROM_DATABASE=Finest Security Systems Co., Ltd
 
@@ -36704,9 +37478,6 @@ OUI:D41E35*
 OUI:700BC0*
  ID_OUI_FROM_DATABASE=Dewav Technology Company
 
-OUI:58C38B*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:2CD444*
  ID_OUI_FROM_DATABASE=FUJITSU LIMITED
 
@@ -36740,18 +37511,12 @@ OUI:D8AF3B*
 OUI:78D34F*
  ID_OUI_FROM_DATABASE=Pace-O-Matic, Inc.
 
-OUI:D857EF*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:784405*
  ID_OUI_FROM_DATABASE=FUJITU(HONG KONG) ELECTRONIC Co.,LTD.
 
 OUI:C03F2A*
  ID_OUI_FROM_DATABASE=Biscotti, Inc.
 
-OUI:5001BB*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:44B382*
  ID_OUI_FROM_DATABASE=Kuang-chi Institute of Advanced Technology
 
@@ -36797,9 +37562,6 @@ OUI:A007B6*
 OUI:542A9C*
  ID_OUI_FROM_DATABASE=LSY Defense, LLC.
 
-OUI:D487D8*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:F89955*
  ID_OUI_FROM_DATABASE=Fortress Technology Inc
 
@@ -36839,9 +37601,6 @@ OUI:A4F7D0*
 OUI:D4EC0C*
  ID_OUI_FROM_DATABASE=Harley-Davidson Motor Company
 
-OUI:5C0A5B*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS CO., LTD.
-
 OUI:6CA96F*
  ID_OUI_FROM_DATABASE=TransPacket AS
 
@@ -36953,12 +37712,6 @@ OUI:8C604F*
 OUI:74FF7D*
  ID_OUI_FROM_DATABASE=Wren Sound Systems, LLC
 
-OUI:380A94*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:2CC260*
- ID_OUI_FROM_DATABASE=Ravello Systems
-
 OUI:30B216*
  ID_OUI_FROM_DATABASE=Hytec Geraetebau GmbH
 
@@ -37013,9 +37766,6 @@ OUI:A078BA*
 OUI:D4507A*
  ID_OUI_FROM_DATABASE=CEIVA Logic, Inc
 
-OUI:184617*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:9CC7D1*
  ID_OUI_FROM_DATABASE=SHARP Corporation
 
@@ -37163,9 +37913,6 @@ OUI:48C1AC*
 OUI:046D42*
  ID_OUI_FROM_DATABASE=Bryston Ltd.
 
-OUI:50CCF8*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics
-
 OUI:D0CF5E*
  ID_OUI_FROM_DATABASE=Energy Micro AS
 
@@ -37316,9 +38063,6 @@ OUI:DCF05D*
 OUI:D05A0F*
  ID_OUI_FROM_DATABASE=I-BT DIGITAL CO.,LTD
 
-OUI:9439E5*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:7CDD20*
  ID_OUI_FROM_DATABASE=IOXOS Technologies S.A.
 
@@ -37331,9 +38075,6 @@ OUI:9C7BD2*
 OUI:900D66*
  ID_OUI_FROM_DATABASE=Digimore Electronics Co., Ltd
 
-OUI:980C82*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics
-
 OUI:48C862*
  ID_OUI_FROM_DATABASE=Simo Wireless,Inc.
 
@@ -37502,9 +38243,6 @@ OUI:94E848*
 OUI:AC5E8C*
  ID_OUI_FROM_DATABASE=Utillink
 
-OUI:549B12*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:CC7EE7*
  ID_OUI_FROM_DATABASE=Panasonic AVC Networks Company
 
@@ -37538,21 +38276,12 @@ OUI:04C5A4*
 OUI:3CA72B*
  ID_OUI_FROM_DATABASE=MRV Communications (Networks) LTD
 
-OUI:EC55F9*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:F4D9FB*
- ID_OUI_FROM_DATABASE=Samsung Electronics CO., LTD
-
 OUI:584C19*
  ID_OUI_FROM_DATABASE=Chongqing Guohong Technology Development Company Limited
 
 OUI:D0A311*
  ID_OUI_FROM_DATABASE=Neuberger Gebäudeautomation GmbH
 
-OUI:3C5A37*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:10A13B*
  ID_OUI_FROM_DATABASE=FUJIKURA RUBBER LTD.
 
@@ -37748,9 +38477,6 @@ OUI:942053*
 OUI:D49C8E*
  ID_OUI_FROM_DATABASE=University of FUKUI
 
-OUI:3C8BFE*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:2CB0DF*
  ID_OUI_FROM_DATABASE=Soliton Technologies Pvt Ltd
 
@@ -37772,9 +38498,6 @@ OUI:6C9CE9*
 OUI:700258*
  ID_OUI_FROM_DATABASE=01DB-METRAVIB
 
-OUI:D4E8B2*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:20FDF1*
  ID_OUI_FROM_DATABASE=3COM EUROPE LTD
 
@@ -37850,9 +38573,6 @@ OUI:180C77*
 OUI:ACA016*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:78E400*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E4AD7D*
  ID_OUI_FROM_DATABASE=SCL Elements
 
@@ -37865,9 +38585,6 @@ OUI:7C051E*
 OUI:58570D*
  ID_OUI_FROM_DATABASE=Danfoss Solar Inverters
 
-OUI:E47CF9*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:0C826A*
  ID_OUI_FROM_DATABASE=Wuhan Huagong Genuine Optics Technology Co., Ltd
 
@@ -37925,9 +38642,6 @@ OUI:34E0D7*
 OUI:40520D*
  ID_OUI_FROM_DATABASE=Pico Technology
 
-OUI:8C7CB5*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:543131*
  ID_OUI_FROM_DATABASE=Raster Vision Ltd
 
@@ -38042,9 +38756,6 @@ OUI:F0264C*
 OUI:3C1CBE*
  ID_OUI_FROM_DATABASE=JADAK LLC
 
-OUI:506313*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A8995C*
  ID_OUI_FROM_DATABASE=aizo ag
 
@@ -38150,9 +38861,6 @@ OUI:C0BAE6*
 OUI:20BFDB*
  ID_OUI_FROM_DATABASE=DVL
 
-OUI:C87E75*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:889821*
  ID_OUI_FROM_DATABASE=TERAON
 
@@ -38306,9 +39014,6 @@ OUI:0026DD*
 OUI:0026DE*
  ID_OUI_FROM_DATABASE=FDI MATELEC
 
-OUI:7825AD*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRONICS CO., LTD.
-
 OUI:54B620*
  ID_OUI_FROM_DATABASE=SUHDOL E&C Co.Ltd.
 
@@ -38348,9 +39053,6 @@ OUI:002670*
 OUI:002663*
  ID_OUI_FROM_DATABASE=Shenzhen Huitaiwei Tech. Ltd, co.
 
-OUI:00265D*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:0025CD*
  ID_OUI_FROM_DATABASE=Skylane Optics
 
@@ -38615,9 +39317,6 @@ OUI:002485*
 OUI:002480*
  ID_OUI_FROM_DATABASE=Meteocontrol GmbH
 
-OUI:002454*
- ID_OUI_FROM_DATABASE=Samsung Electronics CO., LTD
-
 OUI:002448*
  ID_OUI_FROM_DATABASE=SpiderCloud Wireless, Inc
 
@@ -38807,12 +39506,6 @@ OUI:002353*
 OUI:00234C*
  ID_OUI_FROM_DATABASE=KTC AB
 
-OUI:00233A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:002339*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:002304*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -38951,9 +39644,6 @@ OUI:002120*
 OUI:002125*
  ID_OUI_FROM_DATABASE=KUK JE TONG SHIN Co.,LTD
 
-OUI:002119*
- ID_OUI_FROM_DATABASE=Samsung Electro-Mechanics
-
 OUI:002112*
  ID_OUI_FROM_DATABASE=WISCOM SYSTEM CO.,LTD
 
@@ -39287,9 +39977,6 @@ OUI:001EE9*
 OUI:001EEE*
  ID_OUI_FROM_DATABASE=ETL Systems Ltd
 
-OUI:001EE2*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001E7B*
  ID_OUI_FROM_DATABASE=R.I.CO. S.r.l.
 
@@ -39353,9 +40040,6 @@ OUI:001D1F*
 OUI:001D26*
  ID_OUI_FROM_DATABASE=Rockridgesound Technology Co.
 
-OUI:001D25*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001D1A*
  ID_OUI_FROM_DATABASE=OvisLink S.A.
 
@@ -39503,9 +40187,6 @@ OUI:001C59*
 OUI:001C4F*
  ID_OUI_FROM_DATABASE=MACAB AB
 
-OUI:001C43*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001C37*
  ID_OUI_FROM_DATABASE=Callpod, Inc.
 
@@ -40166,18 +40847,12 @@ OUI:001800*
 OUI:0017ED*
  ID_OUI_FROM_DATABASE=WooJooIT Ltd.
 
-OUI:0017D5*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:0017DA*
  ID_OUI_FROM_DATABASE=Spans Logic
 
 OUI:0017E1*
  ID_OUI_FROM_DATABASE=DACOS Technologies Co., Ltd.
 
-OUI:0017C9*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:0017D0*
  ID_OUI_FROM_DATABASE=Opticom Communications, LLC
 
@@ -40211,15 +40886,9 @@ OUI:001681*
 OUI:001674*
  ID_OUI_FROM_DATABASE=EuroCB (Phils.), Inc.
 
-OUI:00166B*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:001672*
  ID_OUI_FROM_DATABASE=Zenway enterprise ltd
 
-OUI:00166C*
- ID_OUI_FROM_DATABASE=Samsung Electonics Digital Video System Division
-
 OUI:001666*
  ID_OUI_FROM_DATABASE=Quantier Communication Inc.
 
@@ -40667,9 +41336,6 @@ OUI:001255*
 OUI:00124E*
  ID_OUI_FROM_DATABASE=XAC AUTOMATION CORP.
 
-OUI:001247*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:001248*
  ID_OUI_FROM_DATABASE=EMC Corporation (Kashya)
 
@@ -42035,9 +42701,6 @@ OUI:0009FC*
 OUI:000A03*
  ID_OUI_FROM_DATABASE=ENDESA SERVICIOS, S.L.
 
-OUI:0006F4*
- ID_OUI_FROM_DATABASE=Prime Electronics & Satellitics Inc.
-
 OUI:000705*
  ID_OUI_FROM_DATABASE=Endress & Hauser GmbH & Co
 
@@ -42422,9 +43085,6 @@ OUI:000603*
 OUI:A06A00*
  ID_OUI_FROM_DATABASE=Verilink Corporation
 
-OUI:0005EE*
- ID_OUI_FROM_DATABASE=Siemens AB, Infrastructure & Cities, Building Technologies Division, IC BT SSP SP BA PR
-
 OUI:0005F5*
  ID_OUI_FROM_DATABASE=Geospace Technologies
 
@@ -43037,9 +43697,6 @@ OUI:00B017*
 OUI:0030F0*
  ID_OUI_FROM_DATABASE=Uniform Industrial Corp.
 
-OUI:00B0CE*
- ID_OUI_FROM_DATABASE=TECHNOLOGY RESCUE
-
 OUI:00B080*
  ID_OUI_FROM_DATABASE=Mannesmann Ipulsys B.V.
 
@@ -45413,9 +46070,6 @@ OUI:3039F2*
 OUI:000827*
  ID_OUI_FROM_DATABASE=ADB Broadband Italia
 
-OUI:001CA8*
- ID_OUI_FROM_DATABASE=AirTies Wireless Netowrks
-
 OUI:9097D5*
  ID_OUI_FROM_DATABASE=Espressif Inc.
 
@@ -45449,18 +46103,6 @@ OUI:E8C74F*
 OUI:E8F724*
  ID_OUI_FROM_DATABASE=Hewlett Packard Enterprise
 
-OUI:1C1448*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:707E43*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001AAD*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:A47AA4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:701A04*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
@@ -45518,66 +46160,6 @@ OUI:0022F4*
 OUI:080046*
  ID_OUI_FROM_DATABASE=Sony Corporation
 
-OUI:0003E0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00128A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001225*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:3C754A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0024C1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002136*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0022B4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002395*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0023ED*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001B52*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00230B*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001E8D*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0023A2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001BDD*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001404*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:745612*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E46449*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002493*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:40FC89*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00195E*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:000D92*
  ID_OUI_FROM_DATABASE=ARIMA Communications Corp.
 
@@ -45818,12 +46400,6 @@ OUI:0C75BD*
 OUI:38F0C8*
  ID_OUI_FROM_DATABASE=Livestream
 
-OUI:74EAE8*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:A811FC*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:0C1167*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -45971,9 +46547,6 @@ OUI:9897D1*
 OUI:94C960*
  ID_OUI_FROM_DATABASE=Zhongshan B&T technology.co.,ltd
 
-OUI:E04FBD*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:001479*
  ID_OUI_FROM_DATABASE=NEC Magnus Communications,Ltd.
 
@@ -46301,15 +46874,9 @@ OUI:E0A3AC*
 OUI:E00EDA*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:044E5A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:6C2483*
  ID_OUI_FROM_DATABASE=Microsoft Mobile Oy
 
-OUI:94E8C5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:848319*
  ID_OUI_FROM_DATABASE=Hangzhou Zero Zero Technology Co., Ltd.
 
@@ -46451,9 +47018,6 @@ OUI:9CDD1F*
 OUI:00EBD5*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:F8A097*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:1C7B23*
  ID_OUI_FROM_DATABASE=Qingdao Hisense Communications Co.,Ltd.
 
@@ -46484,9 +47048,6 @@ OUI:40F413*
 OUI:2C094D*
  ID_OUI_FROM_DATABASE=Raptor Engineering, LLC
 
-OUI:ACE77B*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:B0E235*
  ID_OUI_FROM_DATABASE=Xiaomi Communications Co Ltd
 
@@ -46583,9 +47144,6 @@ OUI:00199D*
 OUI:6C0B84*
  ID_OUI_FROM_DATABASE=Universal Global Scientific Industrial Co., Ltd.
 
-OUI:24A43C*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
 OUI:E4509A*
  ID_OUI_FROM_DATABASE=HW Communications Ltd
 
@@ -46679,18 +47237,6 @@ OUI:00167A*
 OUI:28BE03*
  ID_OUI_FROM_DATABASE=TCT mobile ltd
 
-OUI:D4E33F*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:143E60*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:84DBFC*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:38521A*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:F4C613*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
 
@@ -46883,9 +47429,6 @@ OUI:D013FD*
 OUI:D8E72B*
  ID_OUI_FROM_DATABASE=NetScout Systems, Inc.
 
-OUI:BC644B*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:04FEA1*
  ID_OUI_FROM_DATABASE=Fihonest communication co.,Ltd
 
@@ -46898,6 +47441,552 @@ OUI:A8BD27*
 OUI:981E0F*
  ID_OUI_FROM_DATABASE=Jeelan (Shanghai Jeelan Technology Information Inc
 
+OUI:548CA0*
+ ID_OUI_FROM_DATABASE=Liteon Technology Corporation
+
+OUI:707E43*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:1C1448*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:A47AA4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001AAD*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E83EFC*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E8892C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:3CDFA9*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:8C09F4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:083E0C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D404CD*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:203D66*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:6455B1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:C005C2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001225*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00128A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0003E0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015D1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E46449*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:745612*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:74EAE8*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:A811FC*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:044E5A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:94E8C5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:F8A097*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:BC644B*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:347A60*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0023ED*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002395*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0022B4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002136*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0024C1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:3C754A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:40FC89*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002493*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00195E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001404*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001BDD*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0023A2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001E8D*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00230B*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001B52*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:84E058*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:003676*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001CA8*
+ ID_OUI_FROM_DATABASE=AirTies Wireless Networks
+
+OUI:001EE2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001C43*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001D25*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:3C5A37*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:549B12*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:3C8BFE*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00265D*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D4E8B2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0017D5*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001247*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:78521A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E4121D*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:684898*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F409D8*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:B479A7*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:18D276*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:1C66AA*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:58C38B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0808C2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:B0C4E7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D890E8*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:34AA8B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002339*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D487D8*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:184617*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5001BB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:380A94*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D857EF*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:24C696*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:181EB0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:20D390*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:343111*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:34BE00*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:50CCF8*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:980C82*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:002119*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:7825AD*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F4D9FB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0017C9*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00166B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00166C*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E47CF9*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002454*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5C0A5B*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:90187C*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:FC1F19*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:20D5BF*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:30CDA7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00749C*
+ ID_OUI_FROM_DATABASE=RUIJIE NETWORKS CO., LTD.
+
+OUI:300ED5*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:D02788*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0014A4*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0016CE*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001DD9*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001FE2*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:48E244*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:30F772*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:90489A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:543530*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C03896*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:2C337A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:ACD1B8*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:9439E5*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:506313*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:78E400*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:40490F*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:28565A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001F3A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:002269*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:5C8613*
+ ID_OUI_FROM_DATABASE=Beijing Zhoenet Technology Co., Ltd
+
+OUI:8C7CB5*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:EC55F9*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C8B21E*
+ ID_OUI_FROM_DATABASE=CHIPSEA TECHNOLOGIES (SHENZHEN) CORP.
+
+OUI:B072BF*
+ ID_OUI_FROM_DATABASE=Murata Manufacturing Co., Ltd.
+
+OUI:600B03*
+ ID_OUI_FROM_DATABASE=Hangzhou H3C Technologies Co., Limited
+
+OUI:503F98*
+ ID_OUI_FROM_DATABASE=CMITECH
+
+OUI:C09F05*
+ ID_OUI_FROM_DATABASE=GUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD
+
+OUI:AC63BE*
+ ID_OUI_FROM_DATABASE=Amazon Technologies Inc.
+
+OUI:38521A*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:A41437*
+ ID_OUI_FROM_DATABASE=Hangzhou Hikvision Digital Technology Co.,Ltd.
+
+OUI:884CCF*
+ ID_OUI_FROM_DATABASE=Pulzze Systems, Inc
+
+OUI:84DBFC*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:143E60*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:D4E33F*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:00233A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C87E75*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5454CF*
+ ID_OUI_FROM_DATABASE=PROBEDIGITAL CO.,LTD
+
+OUI:F0D5BF*
+ ID_OUI_FROM_DATABASE=Intel Corporate
+
+OUI:748A69*
+ ID_OUI_FROM_DATABASE=Korea Image Technology Co., Ltd
+
+OUI:1C9D3E*
+ ID_OUI_FROM_DATABASE=Integrated Device Technology (Malaysia) Sdn. Bhd.
+
+OUI:30B64F*
+ ID_OUI_FROM_DATABASE=Juniper Networks
+
+OUI:DC0D30*
+ ID_OUI_FROM_DATABASE=Shenzhen Feasycom Technology Co., Ltd.
+
+OUI:008731*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:B4EFFA*
+ ID_OUI_FROM_DATABASE=Lemobile Information Technology (Beijing) Co., Ltd.
+
+OUI:0005EE*
+ ID_OUI_FROM_DATABASE=Vanderbilt International (SWE) AB
+
+OUI:9495A0*
+ ID_OUI_FROM_DATABASE=Google, Inc.
+
+OUI:CCFD17*
+ ID_OUI_FROM_DATABASE=TCT mobile ltd
+
+OUI:4CF95D*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:8421F1*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:707990*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:38D547*
+ ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
+
+OUI:248894*
+ ID_OUI_FROM_DATABASE=shenzhen lensun Communication Technology LTD
+
+OUI:60A4D0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:3C8BCD*
+ ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
+
+OUI:E43ED7*
+ ID_OUI_FROM_DATABASE=Arcadyan Corporation
+
+OUI:38A4ED*
+ ID_OUI_FROM_DATABASE=Xiaomi Communications Co Ltd
+
+OUI:00B0CE*
+ ID_OUI_FROM_DATABASE=Viveris Technologies
+
+OUI:E00DB9*
+ ID_OUI_FROM_DATABASE=Cree, Inc.
+
+OUI:40FE0D*
+ ID_OUI_FROM_DATABASE=MAXIO
+
+OUI:609AC1*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:F07960*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:9C8BA0*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:9840BB*
+ ID_OUI_FROM_DATABASE=Dell Inc.
+
+OUI:CC2D83*
+ ID_OUI_FROM_DATABASE=GUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD
+
+OUI:4C3275*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:E04FBD*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:ACE77B*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:00B0E1*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:0006F4*
+ ID_OUI_FROM_DATABASE=Prime Electronics & Satellitics Inc.
+
+OUI:24A43C*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:28EE52*
+ ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
+
+OUI:D4E90B*
+ ID_OUI_FROM_DATABASE=CVT CO.,LTD
+
+OUI:788A20*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:905C44*
+ ID_OUI_FROM_DATABASE=Compal Broadband Networks, Inc.
+
+OUI:FC372B*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:0CD86C*
+ ID_OUI_FROM_DATABASE=SHENZHEN FAST TECHNOLOGIES CO.,LTD
+
+OUI:8C60E7*
+ ID_OUI_FROM_DATABASE=MPGIO CO.,LTD
+
+OUI:2C0E3D*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:24C44A*
+ ID_OUI_FROM_DATABASE=zte corporation
+
+OUI:B83A9D*
+ ID_OUI_FROM_DATABASE=Alarm.com
+
+OUI:00BBC1*
+ ID_OUI_FROM_DATABASE=CANON INC.
+
+OUI:2CC260*
+ ID_OUI_FROM_DATABASE=Oracle Corporation
+
+OUI:1C14B3*
+ ID_OUI_FROM_DATABASE=Airwire Technologies
+
+OUI:407183*
+ ID_OUI_FROM_DATABASE=Juniper Networks
+
+OUI:0059DC*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:14612F*
+ ID_OUI_FROM_DATABASE=Avaya Inc
+
 OUI:D86CE9*
  ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
 
@@ -47021,9 +48110,6 @@ OUI:D40B1A*
 OUI:A08D16*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:2C8158*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:601888*
  ID_OUI_FROM_DATABASE=zte corporation
 
@@ -47078,18 +48164,6 @@ OUI:1002B5*
 OUI:A468BC*
  ID_OUI_FROM_DATABASE=Private
 
-OUI:001DCF*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001DD5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001DD0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:5C571A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:441EA1*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
@@ -47105,9 +48179,6 @@ OUI:00237D*
 OUI:002655*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
-OUI:001438*
- ID_OUI_FROM_DATABASE=Hewlett Packard
-
 OUI:001560*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
@@ -47135,24 +48206,6 @@ OUI:38EAA7*
 OUI:E83935*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
-OUI:901ACA*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E8ED05*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:90C792*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:789684*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:CC65AD*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:986B3D*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:08EB74*
  ID_OUI_FROM_DATABASE=HUMAX Co., Ltd.
 
@@ -47288,18 +48341,6 @@ OUI:2002AF*
 OUI:0026E8*
  ID_OUI_FROM_DATABASE=Murata Manufacturing Co., Ltd.
 
-OUI:001C26*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:00197D*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:90FBA6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:142D27*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:ECCB30*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -47480,18 +48521,6 @@ OUI:005054*
 OUI:3C0E23*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:001CC3*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:14D4FE*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:70B14E*
- ID_OUI_FROM_DATABASE=Pace plc
-
-OUI:707630*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:90E6BA*
  ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
 
@@ -47906,9 +48935,6 @@ OUI:4473D6*
 OUI:E80734*
  ID_OUI_FROM_DATABASE=Champion Optical Network Engineering, LLC
 
-OUI:D02544*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co., LTD.
-
 OUI:6CEBB2*
  ID_OUI_FROM_DATABASE=Dongguan Sen DongLv Electronics Co.,Ltd
 
@@ -48020,9 +49046,6 @@ OUI:081FEB*
 OUI:785F4C*
  ID_OUI_FROM_DATABASE=Argox Information Co., Ltd.
 
-OUI:E866C4*
- ID_OUI_FROM_DATABASE=Datawise Systems
-
 OUI:5870C6*
  ID_OUI_FROM_DATABASE=Shanghai Xiaoyi Technology Co., Ltd.
 
@@ -48413,9 +49436,6 @@ OUI:80EACA*
 OUI:4CBC42*
  ID_OUI_FROM_DATABASE=Shenzhen Hangsheng Electronics Co.,Ltd.
 
-OUI:D82522*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:987E46*
  ID_OUI_FROM_DATABASE=Emizon Networks Limited
 
@@ -48449,9 +49469,6 @@ OUI:D8977C*
 OUI:80AD67*
  ID_OUI_FROM_DATABASE=Kasda Networks Inc
 
-OUI:9CAD97*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:30595B*
  ID_OUI_FROM_DATABASE=streamnow AG
 
@@ -48749,9 +49766,6 @@ OUI:10DDF4*
 OUI:080371*
  ID_OUI_FROM_DATABASE=KRG CORPORATE
 
-OUI:B43A28*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:ACC595*
  ID_OUI_FROM_DATABASE=Graphite Systems
 
@@ -48791,9 +49805,6 @@ OUI:F8572E*
 OUI:E0E631*
  ID_OUI_FROM_DATABASE=SNB TECHNOLOGIES LIMITED
 
-OUI:9401C2*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:20C60D*
  ID_OUI_FROM_DATABASE=Shanghai annijie Information technology Co.,LTD
 
@@ -48875,9 +49886,6 @@ OUI:044F8B*
 OUI:9CE7BD*
  ID_OUI_FROM_DATABASE=Winduskorea co., Ltd
 
-OUI:3842A6*
- ID_OUI_FROM_DATABASE=Ingenieurbuero Stahlkopf
-
 OUI:A0BF50*
  ID_OUI_FROM_DATABASE=S.C. ADD-PRODUCTION S.R.L.
 
@@ -48926,9 +49934,6 @@ OUI:7CBF88*
 OUI:90028A*
  ID_OUI_FROM_DATABASE=Shenzhen Shidean Legrand Electronic Products Co.,Ltd
 
-OUI:4C3C16*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:90356E*
  ID_OUI_FROM_DATABASE=Vodafone Omnitel N.V.
 
@@ -48995,9 +50000,6 @@ OUI:58E02C*
 OUI:E481B3*
  ID_OUI_FROM_DATABASE=Shenzhen ACT Industrial Co.,Ltd.
 
-OUI:BC8556*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E4F3E3*
  ID_OUI_FROM_DATABASE=Shanghai iComhome Co.,Ltd.
 
@@ -49040,18 +50042,12 @@ OUI:58F387*
 OUI:B0793C*
  ID_OUI_FROM_DATABASE=Revolv Inc
 
-OUI:D022BE*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co.,LTD.
-
 OUI:20CEC4*
  ID_OUI_FROM_DATABASE=Peraso Technologies
 
 OUI:04848A*
  ID_OUI_FROM_DATABASE=7INOVA TECHNOLOGY LIMITED
 
-OUI:94D771*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:20C6EB*
  ID_OUI_FROM_DATABASE=Panasonic Corporation AVC Networks Company
 
@@ -49076,9 +50072,6 @@ OUI:B847C6*
 OUI:4CDF3D*
  ID_OUI_FROM_DATABASE=TEAM ENGINEERS ADVANCE TECHNOLOGIES INDIA PVT LTD
 
-OUI:B85E7B*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:70F176*
  ID_OUI_FROM_DATABASE=Data Modul AG
 
@@ -49100,9 +50093,6 @@ OUI:C034B4*
 OUI:74ADB7*
  ID_OUI_FROM_DATABASE=China Mobile Group Device Co.,Ltd.
 
-OUI:C462EA*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:DC6F00*
  ID_OUI_FROM_DATABASE=Livescribe, Inc.
 
@@ -49160,9 +50150,6 @@ OUI:0C2D89*
 OUI:604A1C*
  ID_OUI_FROM_DATABASE=SUYIN Corporation
 
-OUI:3423BA*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics co.,LTD.
-
 OUI:A4D3B5*
  ID_OUI_FROM_DATABASE=GLITEL Stropkov, s.r.o.
 
@@ -49265,9 +50252,6 @@ OUI:E0C6B3*
 OUI:FCDB96*
  ID_OUI_FROM_DATABASE=ENERVALLEY CO., LTD
 
-OUI:F06BCA*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:FC8B97*
  ID_OUI_FROM_DATABASE=Shenzhen Gongjin Electronics Co.,Ltd
 
@@ -49295,9 +50279,6 @@ OUI:18E8DD*
 OUI:4CCC34*
  ID_OUI_FROM_DATABASE=Motorola Solutions Inc.
 
-OUI:F82FA8*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:F084C9*
  ID_OUI_FROM_DATABASE=zte corporation
 
@@ -49376,15 +50357,9 @@ OUI:6C9AC9*
 OUI:10F49A*
  ID_OUI_FROM_DATABASE=T3 Innovation
 
-OUI:1C5A3E*
- ID_OUI_FROM_DATABASE=Samsung Eletronics Co., Ltd (Visual Display Divison)
-
 OUI:5865E6*
  ID_OUI_FROM_DATABASE=INFOMARK CO., LTD.
 
-OUI:BC20A4*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:60BD91*
  ID_OUI_FROM_DATABASE=Move Innovation
 
@@ -49463,9 +50438,6 @@ OUI:683B1E*
 OUI:D4136F*
  ID_OUI_FROM_DATABASE=Asia Pacific Brands
 
-OUI:9C2A70*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A0A130*
  ID_OUI_FROM_DATABASE=DLI Taiwan Branch office
 
@@ -49484,9 +50456,6 @@ OUI:2C26C5*
 OUI:BC629F*
  ID_OUI_FROM_DATABASE=Telenet Systems P. Ltd.
 
-OUI:F47B5E*
- ID_OUI_FROM_DATABASE=Samsung Eletronics Co., Ltd
-
 OUI:B47F5E*
  ID_OUI_FROM_DATABASE=Foresight Manufacture (S) Pte Ltd
 
@@ -49508,9 +50477,6 @@ OUI:F0F644*
 OUI:30D357*
  ID_OUI_FROM_DATABASE=Logosol, Inc.
 
-OUI:14F42A*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:2C441B*
  ID_OUI_FROM_DATABASE=Spectrum Medical Limited
 
@@ -49853,9 +50819,6 @@ OUI:045A95*
 OUI:B40E96*
  ID_OUI_FROM_DATABASE=HERAN
 
-OUI:BC851F*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:0CAF5A*
  ID_OUI_FROM_DATABASE=GENUS POWER INFRASTRUCTURES LIMITED
 
@@ -49943,9 +50906,6 @@ OUI:B88F14*
 OUI:94FAE8*
  ID_OUI_FROM_DATABASE=Shenzhen Eycom Technology Co., Ltd
 
-OUI:4844F7*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:3CA315*
  ID_OUI_FROM_DATABASE=Bless Information & Communications Co., Ltd
 
@@ -49970,9 +50930,6 @@ OUI:A4B980*
 OUI:002D76*
  ID_OUI_FROM_DATABASE=TITECH GmbH
 
-OUI:DC7144*
- ID_OUI_FROM_DATABASE=Samsung Electro Mechanics
-
 OUI:78A183*
  ID_OUI_FROM_DATABASE=Advidia
 
@@ -50003,9 +50960,6 @@ OUI:842B50*
 OUI:0C5A19*
  ID_OUI_FROM_DATABASE=Axtion Sdn Bhd
 
-OUI:606BBD*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:A00CA1*
  ID_OUI_FROM_DATABASE=SKTB SKiT
 
@@ -50099,9 +51053,6 @@ OUI:3499D7*
 OUI:7C336E*
  ID_OUI_FROM_DATABASE=MEG Electronics Inc.
 
-OUI:D0C1B1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:D4D249*
  ID_OUI_FROM_DATABASE=Power Ethernet
 
@@ -50267,9 +51218,6 @@ OUI:8C94CF*
 OUI:149090*
  ID_OUI_FROM_DATABASE=KongTop industrial(shen zhen)CO.,LTD
 
-OUI:F008F1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:CCF8F0*
  ID_OUI_FROM_DATABASE=Xi'an HISU Multimedia Technology Co.,Ltd.
 
@@ -50513,9 +51461,6 @@ OUI:90B8D0*
 OUI:909060*
  ID_OUI_FROM_DATABASE=RSI VIDEO TECHNOLOGIES
 
-OUI:3859F9*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:281471*
  ID_OUI_FROM_DATABASE=Lantis co., LTD.
 
@@ -50603,9 +51548,6 @@ OUI:DC9B1E*
 OUI:5C7757*
  ID_OUI_FROM_DATABASE=Haivision Network Video
 
-OUI:3816D1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:E8B4AE*
  ID_OUI_FROM_DATABASE=Shenzhen C&D Electronics Co.,Ltd
 
@@ -50711,18 +51653,12 @@ OUI:B8BA68*
 OUI:BC38D2*
  ID_OUI_FROM_DATABASE=Pandachip Limited
 
-OUI:A00BBA*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS
-
 OUI:14EE9D*
  ID_OUI_FROM_DATABASE=AirNav Systems LLC
 
 OUI:48174C*
  ID_OUI_FROM_DATABASE=MicroPower technologies
 
-OUI:78471D*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:F81037*
  ID_OUI_FROM_DATABASE=Atopia Systems, LP
 
@@ -50750,15 +51686,9 @@ OUI:2C8065*
 OUI:F8F014*
  ID_OUI_FROM_DATABASE=RackWare Inc.
 
-OUI:889FFA*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E41C4B*
  ID_OUI_FROM_DATABASE=V2 TECHNOLOGY, INC.
 
-OUI:F0F002*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E0143E*
  ID_OUI_FROM_DATABASE=Modoosis Inc.
 
@@ -50831,9 +51761,6 @@ OUI:181456*
 OUI:E8995A*
  ID_OUI_FROM_DATABASE=PiiGAB, Processinformation i Goteborg AB
 
-OUI:18F46A*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:D4E32C*
  ID_OUI_FROM_DATABASE=S. Siedle & Sohne
 
@@ -50861,9 +51788,6 @@ OUI:D82986*
 OUI:C03B8F*
  ID_OUI_FROM_DATABASE=Minicom Digital Signage
 
-OUI:D48890*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:A4218A*
  ID_OUI_FROM_DATABASE=Nortel Networks
 
@@ -51014,9 +51938,6 @@ OUI:DCFAD5*
 OUI:D84606*
  ID_OUI_FROM_DATABASE=Silicon Valley Global Marketing
 
-OUI:5CAC4C*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:689234*
  ID_OUI_FROM_DATABASE=Ruckus Wireless
 
@@ -51209,9 +52130,6 @@ OUI:7884EE*
 OUI:2C3F3E*
  ID_OUI_FROM_DATABASE=Alge-Timing GmbH
 
-OUI:ECE09B*
- ID_OUI_FROM_DATABASE=Samsung electronics CO., LTD
-
 OUI:C0CFA3*
  ID_OUI_FROM_DATABASE=Creative Electronics & Software, Inc.
 
@@ -51224,9 +52142,6 @@ OUI:844823*
 OUI:D0F0DB*
  ID_OUI_FROM_DATABASE=Ericsson
 
-OUI:34C3AC*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:7C1476*
  ID_OUI_FROM_DATABASE=Damall Technologies SAS
 
@@ -51299,9 +52214,6 @@ OUI:8C8401*
 OUI:6C7039*
  ID_OUI_FROM_DATABASE=Novar GmbH
 
-OUI:C44619*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A4561B*
  ID_OUI_FROM_DATABASE=MCOT Corporation
 
@@ -51335,12 +52247,6 @@ OUI:E02636*
 OUI:4456B7*
  ID_OUI_FROM_DATABASE=Spawn Labs, Inc
 
-OUI:0C6076*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:0CEEE6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A09805*
  ID_OUI_FROM_DATABASE=OpenVox Communication Co Ltd
 
@@ -51377,12 +52283,6 @@ OUI:E80B13*
 OUI:44C9A2*
  ID_OUI_FROM_DATABASE=Greenwald Industries
 
-OUI:9CB206*
- ID_OUI_FROM_DATABASE=PROCENTEC
-
-OUI:44F459*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:646E6C*
  ID_OUI_FROM_DATABASE=Radio Datacom LLC
 
@@ -51599,9 +52499,6 @@ OUI:002666*
 OUI:002665*
  ID_OUI_FROM_DATABASE=ProtectedLogic Corporation
 
-OUI:00265F*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:002651*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
@@ -51677,9 +52574,6 @@ OUI:00257E*
 OUI:002572*
  ID_OUI_FROM_DATABASE=Nemo-Q International AB
 
-OUI:002566*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:00256B*
  ID_OUI_FROM_DATABASE=ATENIX E.E. s.r.l.
 
@@ -51809,9 +52703,6 @@ OUI:0023D0*
 OUI:0023CA*
  ID_OUI_FROM_DATABASE=Behind The Set, LLC
 
-OUI:0023D6*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,LTD
-
 OUI:0024B0*
  ID_OUI_FROM_DATABASE=ESAB AB
 
@@ -51833,9 +52724,6 @@ OUI:00248A*
 OUI:00248F*
  ID_OUI_FROM_DATABASE=DO-MONIX
 
-OUI:002491*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:002496*
  ID_OUI_FROM_DATABASE=Ginzinger electronic systems
 
@@ -52568,9 +53456,6 @@ OUI:001DFC*
 OUI:001DF5*
  ID_OUI_FROM_DATABASE=Sunshine Co,LTD
 
-OUI:001DF6*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001DF0*
  ID_OUI_FROM_DATABASE=Vidient Systems, Inc.
 
@@ -52919,9 +53804,6 @@ OUI:001BA4*
 OUI:001B9F*
  ID_OUI_FROM_DATABASE=Calyptech Pty Ltd
 
-OUI:001B98*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:001B9D*
  ID_OUI_FROM_DATABASE=Novus Security Sp. z o.o.
 
@@ -53126,9 +54008,6 @@ OUI:001A2D*
 OUI:001A32*
  ID_OUI_FROM_DATABASE=ACTIVA MULTIMEDIA
 
-OUI:001A39*
- ID_OUI_FROM_DATABASE=Merten GmbH&CoKG
-
 OUI:001A28*
  ID_OUI_FROM_DATABASE=ASWT Co., LTD. Taiwan Branch H.K.
 
@@ -53450,9 +54329,6 @@ OUI:001634*
 OUI:00162D*
  ID_OUI_FROM_DATABASE=STNet Co., Ltd.
 
-OUI:001628*
- ID_OUI_FROM_DATABASE=Ultra Electronics Manufacturing and Card Systems
-
 OUI:001621*
  ID_OUI_FROM_DATABASE=Colorado Vnet
 
@@ -53561,9 +54437,6 @@ OUI:0015FE*
 OUI:0015FD*
  ID_OUI_FROM_DATABASE=Complete Media Systems
 
-OUI:0015FF*
- ID_OUI_FROM_DATABASE=Novatel Wireless, Inc.
-
 OUI:0015F8*
  ID_OUI_FROM_DATABASE=Kingtronics Industrial Co. Ltd.
 
@@ -53612,9 +54485,6 @@ OUI:0015C2*
 OUI:0015BE*
  ID_OUI_FROM_DATABASE=Iqua Ltd.
 
-OUI:0015B9*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:0016EF*
  ID_OUI_FROM_DATABASE=Koko Fitness, Inc.
 
@@ -58010,9 +58880,6 @@ OUI:0000EE*
 OUI:000089*
  ID_OUI_FROM_DATABASE=CAYMAN SYSTEMS INC.
 
-OUI:0000F0*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRONICS CO., LTD.
-
 OUI:000021*
  ID_OUI_FROM_DATABASE=SUREMAN COMP. & COMMUN. CORP.
 
@@ -58748,36 +59615,6 @@ OUI:001FE4*
 OUI:002298*
  ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
 
-OUI:0019A6*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001700*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0015A8*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:000E5C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:000CE5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0004BD*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00E06F*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:386BBB*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0015CF*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0014E8*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:24FD52*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
@@ -58790,48 +59627,6 @@ OUI:9CB70D*
 OUI:1C659D*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
-OUI:F80BBE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:DC4517*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:74F612*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:74E7C6*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:B81619*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:B077AC*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:145BD1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:6CC1D2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0025F2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002374*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002641*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0026BA*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002180*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0019C0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:001B9E*
  ID_OUI_FROM_DATABASE=ASKEY COMPUTER CORP
 
@@ -59156,9 +59951,6 @@ OUI:9CAED3*
 OUI:F45C89*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
-OUI:A41588*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:8C3C4A*
  ID_OUI_FROM_DATABASE=NAKAYO TELECOMMUNICATIONS,INC
 
@@ -59462,9 +60254,6 @@ OUI:50DD4F*
 OUI:904D4A*
  ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
 
-OUI:38700C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:7C79E8*
  ID_OUI_FROM_DATABASE=PayRange Inc.
 
@@ -59555,9 +60344,6 @@ OUI:C83DFC*
 OUI:0016FB*
  ID_OUI_FROM_DATABASE=SHENZHEN MTC CO LTD
 
-OUI:08010F*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:381DD9*
  ID_OUI_FROM_DATABASE=FN-LINK TECHNOLOGY LIMITED
 
@@ -59585,9 +60371,6 @@ OUI:E0A8B8*
 OUI:B88198*
  ID_OUI_FROM_DATABASE=Intel Corporate
 
-OUI:CCA260*
- ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
-
 OUI:E4FB8F*
  ID_OUI_FROM_DATABASE=MOBIWIRE MOBILES (NINGBO) CO.,LTD
 
@@ -59636,9 +60419,6 @@ OUI:587E61*
 OUI:340AFF*
  ID_OUI_FROM_DATABASE=Qingdao Hisense Communications Co.,Ltd.
 
-OUI:FC51A4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:F85A00*
  ID_OUI_FROM_DATABASE=Sanford LP
 
@@ -59789,9 +60569,6 @@ OUI:0010C6*
 OUI:00247E*
  ID_OUI_FROM_DATABASE=Universal Global Scientific Industrial Co., Ltd.
 
-OUI:DC9FDB*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
 OUI:001639*
  ID_OUI_FROM_DATABASE=Ubiquam Co., Ltd.
 
@@ -59888,18 +60665,9 @@ OUI:94D723*
 OUI:A89DD2*
  ID_OUI_FROM_DATABASE=Shanghai DareGlobal Technologies Co.,Ltd
 
-OUI:903AA0*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:184A6F*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
 
-OUI:FC2FAA*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
-OUI:BC52B4*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:A0F3E4*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent IPD
 
@@ -59909,12 +60677,171 @@ OUI:002105*
 OUI:000772*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
 
+OUI:F06BCA*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:3423BA*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:D022BE*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:D02544*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS(THAILAND)
+
+OUI:BC20A4*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:14F42A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:BC851F*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:B85E7B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C462EA*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0023D6*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002491*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001B98*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:44F459*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:34C3AC*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:94D771*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:4C3C16*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:9401C2*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:B43A28*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:A8C83A*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:849FB5*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:D0C1B1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F008F1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:782079*
+ ID_OUI_FROM_DATABASE=ID Tech
+
+OUI:98234E*
+ ID_OUI_FROM_DATABASE=Micromedia AG
+
+OUI:E80036*
+ ID_OUI_FROM_DATABASE=Befs co,. ltd
+
+OUI:24590B*
+ ID_OUI_FROM_DATABASE=White Sky Inc. Limited
+
+OUI:10C60C*
+ ID_OUI_FROM_DATABASE=Domino UK Ltd
+
+OUI:3842A6*
+ ID_OUI_FROM_DATABASE=Ingenieurbuero Stahlkopf
+
+OUI:E866C4*
+ ID_OUI_FROM_DATABASE=Diamanti
+
+OUI:78471D*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:3816D1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:004A77*
+ ID_OUI_FROM_DATABASE=zte corporation
+
+OUI:D48890*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002566*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00265F*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001628*
+ ID_OUI_FROM_DATABASE=Magicard Ltd
+
+OUI:E4C801*
+ ID_OUI_FROM_DATABASE=BLU Products Inc
+
+OUI:00A6CA*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:9C7DA3*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:F02FA7*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:883FD3*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:A04E01*
+ ID_OUI_FROM_DATABASE=CENTRAL ENGINEERING co.,ltd.
+
+OUI:245CBF*
+ ID_OUI_FROM_DATABASE=NCSE
+
+OUI:84CD62*
+ ID_OUI_FROM_DATABASE=ShenZhen IDWELL Technology CO.,Ltd
+
+OUI:DC9FDB*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:B0958E*
+ ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
+
+OUI:001A39*
+ ID_OUI_FROM_DATABASE=Merten GmbH&CoKG
+
+OUI:007B18*
+ ID_OUI_FROM_DATABASE=SENTRY Co., LTD.
+
+OUI:144D67*
+ ID_OUI_FROM_DATABASE=Zioncom Electronics (Shenzhen) Ltd.
+
+OUI:34F39A*
+ ID_OUI_FROM_DATABASE=Intel Corporate
+
+OUI:20A8B9*
+ ID_OUI_FROM_DATABASE=Siemens
+
+OUI:C81B5C*
+ ID_OUI_FROM_DATABASE=BCTech
+
+OUI:3C2AF4*
+ ID_OUI_FROM_DATABASE=Brother Industries, LTD.
+
+OUI:20719E*
+ ID_OUI_FROM_DATABASE=SF Technology Co.,Ltd
+
 OUI:E0DDC0*
  ID_OUI_FROM_DATABASE=vivo Mobile Communication Co., Ltd.
 
-OUI:702526*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
-
 OUI:982F3C*
  ID_OUI_FROM_DATABASE=Sichuan Changhong Electric Ltd.
 
@@ -60077,12 +61004,6 @@ OUI:34B1F7*
 OUI:C4EDBA*
  ID_OUI_FROM_DATABASE=Texas Instruments
 
-OUI:641269*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:287AEE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:A40DBC*
  ID_OUI_FROM_DATABASE=Xiamen Intretech Inc.
 
@@ -60110,6 +61031,333 @@ OUI:345760*
 OUI:343DC4*
  ID_OUI_FROM_DATABASE=BUFFALO.INC
 
+OUI:6CEFC6*
+ ID_OUI_FROM_DATABASE=SHENZHEN TWOWING TECHNOLOGIES CO.,LTD.
+
+OUI:986B3D*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:CC65AD*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:789684*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:90C792*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015CF*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:386BBB*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00E06F*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0004BD*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:5C571A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DCF*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E8ED05*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:901ACA*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002A10*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:74E7C6*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:74F612*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:DC4517*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:F80BBE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:6CC1D2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:145BD1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:B077AC*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:B81619*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:A41588*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:38700C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:FC51A4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:287AEE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:641269*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001CC3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:14D4FE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:70B14E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D82522*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:707630*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:000CE5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:000E5C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015A8*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001700*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0019A6*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0014E8*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002180*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0026BA*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002641*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002374*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0025F2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0019C0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:886AB1*
+ ID_OUI_FROM_DATABASE=vivo Mobile Communication Co., Ltd.
+
+OUI:44D6E1*
+ ID_OUI_FROM_DATABASE=Snuza International Pty. Ltd.
+
+OUI:0015B9*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001DF6*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:ECE09B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:606BBD*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0000F0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:4844F7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:DC7144*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:A00BBA*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:1C5A3E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F47B5E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C44619*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:F0F002*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:889FFA*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:5CAC4C*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:18F46A*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:3859F9*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:BC8556*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:9C2A70*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:F82FA8*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0CEEE6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0C6076*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:90FBA6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00197D*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001C26*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:9CAD97*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:2C8158*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:142D27*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:843DC6*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:407C7D*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:BC52B4*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:FC2FAA*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:903AA0*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:702526*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:38F7B2*
+ ID_OUI_FROM_DATABASE=SEOJUN ELECTRIC
+
+OUI:7802B7*
+ ID_OUI_FROM_DATABASE=ShenZhen Ultra Easy Technology CO.,LTD
+
+OUI:88AD43*
+ ID_OUI_FROM_DATABASE=PEGATRON CORPORATION
+
+OUI:E4186B*
+ ID_OUI_FROM_DATABASE=ZyXEL Communications Corporation
+
+OUI:6C71BD*
+ ID_OUI_FROM_DATABASE=EZELINK TELECOM
+
+OUI:842519*
+ ID_OUI_FROM_DATABASE=Samsung Electronics
+
+OUI:88DEA9*
+ ID_OUI_FROM_DATABASE=Roku, Inc.
+
+OUI:FC83C6*
+ ID_OUI_FROM_DATABASE=N-Radio Technologies Co., Ltd.
+
+OUI:B4E782*
+ ID_OUI_FROM_DATABASE=Vivalnk
+
+OUI:008701*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:FC4203*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:1C232C*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:08010F*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:CCA260*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:0015FF*
+ ID_OUI_FROM_DATABASE=Novatel Wireless Solutions, Inc.
+
+OUI:203CAE*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:748D08*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:00D78F*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:A03BE3*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:18E29F*
+ ID_OUI_FROM_DATABASE=vivo Mobile Communication Co., Ltd.
+
+OUI:886B0F*
+ ID_OUI_FROM_DATABASE=Bluegiga Technologies OY
+
+OUI:001438*
+ ID_OUI_FROM_DATABASE=Hewlett Packard Enterprise
+
+OUI:98541B*
+ ID_OUI_FROM_DATABASE=Intel Corporate
+
+OUI:CC61E5*
+ ID_OUI_FROM_DATABASE=Motorola Mobility LLC, a Lenovo Company
+
+OUI:404E36*
+ ID_OUI_FROM_DATABASE=HTC Corporation
+
+OUI:9CB206*
+ ID_OUI_FROM_DATABASE=PROCENTEC
+
+OUI:1C40E8*
+ ID_OUI_FROM_DATABASE=SHENZHEN PROGRESS&WIN TECHNOLOGY CO.,LTD
+
+OUI:C8D3FF*
+ ID_OUI_FROM_DATABASE=Hewlett Packard
+
 OUI:2C3996*
  ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
 
@@ -60182,24 +61430,15 @@ OUI:3CDD89*
 OUI:2C56DC*
  ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
 
-OUI:001E4C*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:B8AF67*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
-OUI:9C3426*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:188B45*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
 OUI:B0C090*
  ID_OUI_FROM_DATABASE=Chicony Electronics Co., Ltd.
 
-OUI:001DD2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:1CA770*
  ID_OUI_FROM_DATABASE=SHENZHEN CHUANGWEI-RGB ELECTRONICS CO.,LTD
 
@@ -60317,30 +61556,6 @@ OUI:0060B0*
 OUI:24BE05*
  ID_OUI_FROM_DATABASE=Hewlett Packard
 
-OUI:94877C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:407009*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:F8EDA5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:5465DE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:6CCA08*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:5C8FE0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:BCCAB5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:000FCC*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:000423*
  ID_OUI_FROM_DATABASE=Intel Corporation
 
@@ -60383,21 +61598,12 @@ OUI:BCCFCC*
 OUI:B0F1A3*
  ID_OUI_FROM_DATABASE=Fengfan (BeiJing) Technology Co., Ltd.
 
-OUI:90CDB6*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:7C7D3D*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
 OUI:4482E5*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
-OUI:00265C*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:002556*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:542758*
  ID_OUI_FROM_DATABASE=Motorola (Wuhan) Mobility Technologies Communication Co., Ltd.
 
@@ -60431,21 +61637,12 @@ OUI:9060F1*
 OUI:EC26CA*
  ID_OUI_FROM_DATABASE=TP-LINK TECHNOLOGIES CO.,LTD.
 
-OUI:001FE1*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:002268*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:A09347*
  ID_OUI_FROM_DATABASE=GUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD
 
 OUI:2C088C*
  ID_OUI_FROM_DATABASE=HUMAX Co., Ltd.
 
-OUI:D42C0F*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:40F308*
  ID_OUI_FROM_DATABASE=Murata Manufacturing Co., Ltd.
 
@@ -60455,27 +61652,6 @@ OUI:5CDAD4*
 OUI:000E6D*
  ID_OUI_FROM_DATABASE=Murata Manufacturing Co., Ltd.
 
-OUI:904CE5*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:CCAF78*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:1C666D*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:785968*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:F80D43*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:F866D1*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
-OUI:0071CC*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:B05B67*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -60812,9 +61988,6 @@ OUI:000704*
 OUI:1C1D86*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:E0B7B1*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:001A92*
  ID_OUI_FROM_DATABASE=ASUSTek COMPUTER INC.
 
@@ -61118,9 +62291,6 @@ OUI:34C9F0*
 OUI:E034E4*
  ID_OUI_FROM_DATABASE=Feit Electric Company, Inc.
 
-OUI:681401*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:98E848*
  ID_OUI_FROM_DATABASE=Axiim
 
@@ -61238,9 +62408,6 @@ OUI:C8A2CE*
 OUI:A4DEC9*
  ID_OUI_FROM_DATABASE=QLove Mobile Intelligence Information Technology (W.H.) Co. Ltd.
 
-OUI:3C7A8A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:A4A6A9*
  ID_OUI_FROM_DATABASE=Private
 
@@ -61283,9 +62450,6 @@ OUI:041E7A*
 OUI:38B725*
  ID_OUI_FROM_DATABASE=Wistron Infocomm (Zhongshan) Corporation
 
-OUI:ACEC80*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:4CC681*
  ID_OUI_FROM_DATABASE=Shenzhen Aisat Electronic Co., Ltd.
 
@@ -61343,9 +62507,6 @@ OUI:F4672D*
 OUI:382B78*
  ID_OUI_FROM_DATABASE=ECO PLUGS ENTERPRISE CO., LTD
 
-OUI:606DC7*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:BCEB5F*
  ID_OUI_FROM_DATABASE=Fujian Beifeng Telecom Technology Co., Ltd.
 
@@ -61397,9 +62558,6 @@ OUI:D0C0BF*
 OUI:94F665*
  ID_OUI_FROM_DATABASE=Ruckus Wireless
 
-OUI:707781*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:E04B45*
  ID_OUI_FROM_DATABASE=Hi-P Electronics Pte Ltd
 
@@ -61511,9 +62669,6 @@ OUI:4CA515*
 OUI:9CE230*
  ID_OUI_FROM_DATABASE=JULONG CO,.LTD.
 
-OUI:80F503*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:34873D*
  ID_OUI_FROM_DATABASE=Quectel Wireless Solution Co.,Ltd.
 
@@ -61544,9 +62699,6 @@ OUI:F8C397*
 OUI:C4366C*
  ID_OUI_FROM_DATABASE=LG Innotek
 
-OUI:D85DE2*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:60D9A0*
  ID_OUI_FROM_DATABASE=Lenovo Mobile Communication Technology Ltd.
 
@@ -61856,9 +63008,6 @@ OUI:DC663A*
 OUI:B009D3*
  ID_OUI_FROM_DATABASE=Avizia
 
-OUI:B01041*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:3CAA3F*
  ID_OUI_FROM_DATABASE=iKey, Ltd.
 
@@ -61895,9 +63044,6 @@ OUI:D896E0*
 OUI:300D2A*
  ID_OUI_FROM_DATABASE=Zhejiang Wellcom Technology Co.,Ltd.
 
-OUI:8496D8*
- ID_OUI_FROM_DATABASE=Pace plc
-
 OUI:64EAC5*
  ID_OUI_FROM_DATABASE=SiboTech Automation Co., Ltd.
 
@@ -62126,15 +63272,6 @@ OUI:184462*
 OUI:9C443D*
  ID_OUI_FROM_DATABASE=CHENGDU XUGUANG TECHNOLOGY CO, LTD
 
-OUI:301966*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:CC07AB*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:E84E84*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:74A4B5*
  ID_OUI_FROM_DATABASE=Powerleader Science and Technology Co. Ltd.
 
@@ -62201,9 +63338,6 @@ OUI:103378*
 OUI:DC0575*
  ID_OUI_FROM_DATABASE=SIEMENS ENERGY AUTOMATION
 
-OUI:342387*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:5C1193*
  ID_OUI_FROM_DATABASE=Seal One AG
 
@@ -62282,9 +63416,6 @@ OUI:2C5FF3*
 OUI:E0AF4B*
  ID_OUI_FROM_DATABASE=Pluribus Networks, Inc.
 
-OUI:50FC9F*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:C85663*
  ID_OUI_FROM_DATABASE=Sunflex Europe GmbH
 
@@ -62390,15 +63521,6 @@ OUI:78DAB3*
 OUI:80BBEB*
  ID_OUI_FROM_DATABASE=Satmap Systems Ltd
 
-OUI:6CB7F4*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:C06599*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:182666*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:949FB4*
  ID_OUI_FROM_DATABASE=ChengDu JiaFaAnTai Technology Co.,Ltd
 
@@ -62429,9 +63551,6 @@ OUI:98F8C1*
 OUI:F47A4E*
  ID_OUI_FROM_DATABASE=Woojeon&Handan
 
-OUI:28BAB5*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:44700B*
  ID_OUI_FROM_DATABASE=IFFU
 
@@ -62444,9 +63563,6 @@ OUI:B8F828*
 OUI:58468F*
  ID_OUI_FROM_DATABASE=Koncar Electronics and Informatics
 
-OUI:103B59*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:746630*
  ID_OUI_FROM_DATABASE=T:mi Ytti
 
@@ -62501,12 +63617,6 @@ OUI:141330*
 OUI:0CF405*
  ID_OUI_FROM_DATABASE=Beijing Signalway Technologies Co.,Ltd
 
-OUI:BC72B1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:78F7BE*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:1C76CA*
  ID_OUI_FROM_DATABASE=Terasic Technologies Inc.
 
@@ -62591,9 +63701,6 @@ OUI:F0F260*
 OUI:1423D7*
  ID_OUI_FROM_DATABASE=EUTRONIX CO., LTD.
 
-OUI:1C3E84*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:3CFB96*
  ID_OUI_FROM_DATABASE=Emcraft Systems LLC
 
@@ -62615,12 +63722,6 @@ OUI:70E027*
 OUI:E880D8*
  ID_OUI_FROM_DATABASE=GNTEK Electronics Co.,Ltd.
 
-OUI:889B39*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:E432CB*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:188857*
  ID_OUI_FROM_DATABASE=Beijing Jinhong Xi-Dian Information Technology Corp.
 
@@ -62699,9 +63800,6 @@ OUI:187A93*
 OUI:94C962*
  ID_OUI_FROM_DATABASE=Teseq AG
 
-OUI:B8763F*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:384369*
  ID_OUI_FROM_DATABASE=Patrol Products Consortium LLC
 
@@ -62726,9 +63824,6 @@ OUI:98208E*
 OUI:704AE4*
  ID_OUI_FROM_DATABASE=Rinstrum Pty Ltd
 
-OUI:5CA39D*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS CO., LTD.
-
 OUI:68B8D9*
  ID_OUI_FROM_DATABASE=Act KDE, Inc.
 
@@ -62831,9 +63926,6 @@ OUI:74ECF1*
 OUI:6815D3*
  ID_OUI_FROM_DATABASE=Zaklady Elektroniki i Mechaniki Precyzyjnej R&G S.A.
 
-OUI:50B7C3*
- ID_OUI_FROM_DATABASE=Samsung Electronics CO., LTD
-
 OUI:601929*
  ID_OUI_FROM_DATABASE=VOLTRONIC POWER TECHNOLOGY(SHENZHEN) CORP.
 
@@ -62891,9 +63983,6 @@ OUI:E86D54*
 OUI:9857D3*
  ID_OUI_FROM_DATABASE=HON HAI-CCPBG  PRECISION IND.CO.,LTD.
 
-OUI:689423*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:9C8D1A*
  ID_OUI_FROM_DATABASE=INTEG process group inc
 
@@ -62912,9 +64001,6 @@ OUI:0CF361*
 OUI:34BDFA*
  ID_OUI_FROM_DATABASE=Cisco SPVTG
 
-OUI:70F927*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:8CEEC6*
  ID_OUI_FROM_DATABASE=Precepscion Pty. Ltd.
 
@@ -62948,9 +64034,6 @@ OUI:381C4A*
 OUI:C8DE51*
  ID_OUI_FROM_DATABASE=Integra Networks, Inc.
 
-OUI:5CE8EB*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:901EDD*
  ID_OUI_FROM_DATABASE=GREAT COMPUTER CORPORATION
 
@@ -63008,21 +64091,12 @@ OUI:604616*
 OUI:ECD925*
  ID_OUI_FROM_DATABASE=RAMI
 
-OUI:38AA3C*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO-MECHANICS
-
 OUI:049F06*
  ID_OUI_FROM_DATABASE=Smobile Co., Ltd.
 
 OUI:D806D1*
  ID_OUI_FROM_DATABASE=Honeywell Fire System (Shanghai) Co,. Ltd.
 
-OUI:687251*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
-OUI:B8D9CE*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:8C6AE4*
  ID_OUI_FROM_DATABASE=Viogem Limited
 
@@ -63050,9 +64124,6 @@ OUI:18D949*
 OUI:646223*
  ID_OUI_FROM_DATABASE=Cellient Co., Ltd.
 
-OUI:F0E77E*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:ACF0B2*
  ID_OUI_FROM_DATABASE=Becker Electronics Taiwan Ltd.
 
@@ -63113,9 +64184,6 @@ OUI:BC0200*
 OUI:1C973D*
  ID_OUI_FROM_DATABASE=PRICOM Design
 
-OUI:8018A7*
- ID_OUI_FROM_DATABASE=Samsung Eletronics Co., Ltd
-
 OUI:F00786*
  ID_OUI_FROM_DATABASE=Shandong Bittel Electronics Co., Ltd
 
@@ -63209,9 +64277,6 @@ OUI:A4934C*
 OUI:E85484*
  ID_OUI_FROM_DATABASE=NEO Information Systems Co., Ltd.
 
-OUI:206432*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO.,LTD.
-
 OUI:74AE76*
  ID_OUI_FROM_DATABASE=iNovo Broadband, Inc.
 
@@ -63251,9 +64316,6 @@ OUI:F0D14F*
 OUI:AC3D75*
  ID_OUI_FROM_DATABASE=HANGZHOU ZHIWAY TECHNOLOGIES CO.,LTD.
 
-OUI:C01885*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:141A51*
  ID_OUI_FROM_DATABASE=Treetech Sistemas Digitais
 
@@ -63428,9 +64490,6 @@ OUI:D8F0F2*
 OUI:B0CF4D*
  ID_OUI_FROM_DATABASE=MI-Zone Technology Ireland
 
-OUI:BCB1F3*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:143605*
  ID_OUI_FROM_DATABASE=Nokia Corporation
 
@@ -63464,9 +64523,6 @@ OUI:9CF67D*
 OUI:A0E201*
  ID_OUI_FROM_DATABASE=AVTrace Ltd.(China)
 
-OUI:38ECE4*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:04EE91*
  ID_OUI_FROM_DATABASE=x-fabric GmbH
 
@@ -63524,9 +64580,6 @@ OUI:70A66A*
 OUI:DC175A*
  ID_OUI_FROM_DATABASE=Hitachi High-Technologies Corporation
 
-OUI:9034FC*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:5C076F*
  ID_OUI_FROM_DATABASE=Thought Creator
 
@@ -63626,9 +64679,6 @@ OUI:C4EEAE*
 OUI:2437EF*
  ID_OUI_FROM_DATABASE=EMC Electronic Media Communication SA
 
-OUI:CCF9E8*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:D4F63F*
  ID_OUI_FROM_DATABASE=IEA S.R.L.
 
@@ -63791,9 +64841,6 @@ OUI:4C98EF*
 OUI:DCA6BD*
  ID_OUI_FROM_DATABASE=Beijing Lanbo Technology Co., Ltd.
 
-OUI:D0667B*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., LTD
-
 OUI:58E808*
  ID_OUI_FROM_DATABASE=AUTONICS CORPORATION
 
@@ -64109,9 +65156,6 @@ OUI:1C334D*
 OUI:609E64*
  ID_OUI_FROM_DATABASE=Vivonic GmbH
 
-OUI:906EBB*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:D44F80*
  ID_OUI_FROM_DATABASE=Kemper Digital GmbH
 
@@ -64307,12 +65351,6 @@ OUI:CC7A30*
 OUI:D8760A*
  ID_OUI_FROM_DATABASE=Escort, Inc.
 
-OUI:101DC0*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
-OUI:F49F54*
- ID_OUI_FROM_DATABASE=Samsung Electronics
-
 OUI:6063FD*
  ID_OUI_FROM_DATABASE=Transcend Communication Beijing Co.,Ltd.
 
@@ -64448,9 +65486,6 @@ OUI:C848F5*
 OUI:1C17D3*
  ID_OUI_FROM_DATABASE=Cisco Systems, Inc
 
-OUI:E8E5D6*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:ACBE75*
  ID_OUI_FROM_DATABASE=Ufine Technologies Co.,Ltd.
 
@@ -64508,9 +65543,6 @@ OUI:50F003*
 OUI:0C17F1*
  ID_OUI_FROM_DATABASE=TELECSYS
 
-OUI:5492BE*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:98BC99*
  ID_OUI_FROM_DATABASE=Edeltech Co.,Ltd.
 
@@ -64589,9 +65621,6 @@ OUI:8CD628*
 OUI:481BD2*
  ID_OUI_FROM_DATABASE=Intron Scientific co., ltd.
 
-OUI:444E1A*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:009363*
  ID_OUI_FROM_DATABASE=Uni-Link Technology Co., Ltd.
 
@@ -64964,9 +65993,6 @@ OUI:0026A6*
 OUI:00263C*
  ID_OUI_FROM_DATABASE=Bachmann Technology GmbH & Co. KG
 
-OUI:002637*
- ID_OUI_FROM_DATABASE=Samsung Electro-Mechanics
-
 OUI:002630*
  ID_OUI_FROM_DATABASE=ACOREL S.A.S
 
@@ -65360,9 +66386,6 @@ OUI:0023C6*
 OUI:0023C0*
  ID_OUI_FROM_DATABASE=Broadway Networks
 
-OUI:0023B9*
- ID_OUI_FROM_DATABASE=EADS Deutschland GmbH
-
 OUI:0023B3*
  ID_OUI_FROM_DATABASE=Lyyn AB
 
@@ -65438,9 +66461,6 @@ OUI:002242*
 OUI:00223B*
  ID_OUI_FROM_DATABASE=Communication Networks, LLC
 
-OUI:00214C*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRONICS CO., LTD.
-
 OUI:002146*
  ID_OUI_FROM_DATABASE=Sanmina-SCI
 
@@ -65594,9 +66614,6 @@ OUI:002101*
 OUI:002102*
  ID_OUI_FROM_DATABASE=UpdateLogic Inc.
 
-OUI:0021D1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:0021D0*
  ID_OUI_FROM_DATABASE=Global Display Solutions Spa
 
@@ -65744,9 +66761,6 @@ OUI:001EED*
 OUI:001EE7*
  ID_OUI_FROM_DATABASE=Epic Systems Inc
 
-OUI:001EE1*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
-
 OUI:001ED7*
  ID_OUI_FROM_DATABASE=H-Stream Wireless, Inc.
 
@@ -66665,9 +67679,6 @@ OUI:0018B1*
 OUI:0018B6*
  ID_OUI_FROM_DATABASE=S3C, Inc.
 
-OUI:0018AF*
- ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
-
 OUI:0018A3*
  ID_OUI_FROM_DATABASE=ZIPPY TECHNOLOGY CORP.
 
@@ -66749,9 +67760,6 @@ OUI:00163E*
 OUI:001637*
  ID_OUI_FROM_DATABASE=CITEL SpA
 
-OUI:001632*
- ID_OUI_FROM_DATABASE=SAMSUNG ELECTRONICS CO., LTD.
-
 OUI:00162B*
  ID_OUI_FROM_DATABASE=Togami Electric Mfg.co.,Ltd.
 
@@ -67334,9 +68342,6 @@ OUI:00138C*
 OUI:001391*
  ID_OUI_FROM_DATABASE=OUEN CO.,LTD.
 
-OUI:001377*
- ID_OUI_FROM_DATABASE=Samsung Electronics CO., LTD
-
 OUI:00137C*
  ID_OUI_FROM_DATABASE=Kaicom co., Ltd.
 
@@ -67910,9 +68915,6 @@ OUI:000DFD*
 OUI:000E02*
  ID_OUI_FROM_DATABASE=Advantech AMT Inc.
 
-OUI:000DF0*
- ID_OUI_FROM_DATABASE=QCOM TECHNOLOGY INC.
-
 OUI:000DEA*
  ID_OUI_FROM_DATABASE=Kingtel Telecommunication Corp.
 
@@ -69056,9 +70058,6 @@ OUI:0005C8*
 OUI:0005D4*
  ID_OUI_FROM_DATABASE=FutureSmart Networks, Inc.
 
-OUI:0005CD*
- ID_OUI_FROM_DATABASE=Denon, Ltd.
-
 OUI:0006EC*
  ID_OUI_FROM_DATABASE=Harris Corporation
 
@@ -71549,9 +72548,6 @@ OUI:0080BD*
 OUI:0080A8*
  ID_OUI_FROM_DATABASE=VITACOM CORPORATION
 
-OUI:0080FB*
- ID_OUI_FROM_DATABASE=BVM LIMITED
-
 OUI:008042*
  ID_OUI_FROM_DATABASE=Artesyn Embedded Technologies
 
@@ -72059,12 +73055,6 @@ OUI:DC0B1A*
 OUI:74888B*
  ID_OUI_FROM_DATABASE=ADB Broadband Italia
 
-OUI:8841FC*
- ID_OUI_FROM_DATABASE=AirTies Wireless Netowrks
-
-OUI:182861*
- ID_OUI_FROM_DATABASE=AirTies Wireless Netowrks
-
 OUI:84D6D0*
  ID_OUI_FROM_DATABASE=Amazon Technologies Inc.
 
@@ -72083,9 +73073,6 @@ OUI:00BB3A*
 OUI:000941*
  ID_OUI_FROM_DATABASE=Allied Telesis R&D Center K.K.
 
-OUI:984B4A*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:00014A*
  ID_OUI_FROM_DATABASE=Sony Corporation
 
@@ -72107,84 +73094,15 @@ OUI:8400D2*
 OUI:5CB524*
  ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
 
-OUI:0015A3*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0015A4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:94A1A2*
  ID_OUI_FROM_DATABASE=AMPAK Technology, Inc.
 
-OUI:00D088*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0017EE*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001180*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00909C*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:8096B1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:7CBFB1*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001A77*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:CC7D37*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0017E2*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001784*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0016B5*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001675*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:74DE2B*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
 OUI:68A3C4*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
-OUI:002210*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001FC4*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001C12*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:001CFB*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0012C9*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:E48399*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:00211E*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:0024A0*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
-OUI:002636*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:C8FF28*
  ID_OUI_FROM_DATABASE=Liteon Technology Corporation
 
@@ -72545,9 +73463,6 @@ OUI:10785B*
 OUI:20768F*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
-OUI:C0C522*
- ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
-
 OUI:9C5CF9*
  ID_OUI_FROM_DATABASE=Sony Mobile Communications AB
 
@@ -72773,9 +73688,6 @@ OUI:0020F2*
 OUI:00015D*
  ID_OUI_FROM_DATABASE=Oracle Corporation
 
-OUI:F8DA0C*
- ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
-
 OUI:943BB1*
  ID_OUI_FROM_DATABASE=Kaonmedia CO., LTD.
 
@@ -73181,9 +74093,6 @@ OUI:CC52AF*
 OUI:001A6B*
  ID_OUI_FROM_DATABASE=Universal Global Scientific Industrial Co., Ltd.
 
-OUI:002722*
- ID_OUI_FROM_DATABASE=Ubiquiti Networks
-
 OUI:00DD0A*
  ID_OUI_FROM_DATABASE=UNGERMANN-BASS INC.
 
@@ -73244,17 +74153,104 @@ OUI:00164D*
 OUI:FCFAF7*
  ID_OUI_FROM_DATABASE=Shanghai Baud Data Communication Co.,Ltd.
 
-OUI:0C54B9*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
+OUI:C8E776*
+ ID_OUI_FROM_DATABASE=PTCOM Technology
 
-OUI:C4084A*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
+OUI:5C497D*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0005CD*
+ ID_OUI_FROM_DATABASE=D&M Holdings Inc.
+
+OUI:E0286D*
+ ID_OUI_FROM_DATABASE=AVM Audiovisuelles Marketing und Computersysteme GmbH
+
+OUI:7487A9*
+ ID_OUI_FROM_DATABASE=OCT Technology Co., Ltd.
 
 OUI:34AA99*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:C4084A*
+ ID_OUI_FROM_DATABASE=Nokia
 
 OUI:8C90D3*
- ID_OUI_FROM_DATABASE=Alcatel-Lucent Canada
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:0C54B9*
+ ID_OUI_FROM_DATABASE=Nokia
+
+OUI:444E1A*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E8E5D6*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5492BE*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0021D1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:101DC0*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0023B9*
+ ID_OUI_FROM_DATABASE=Airbus Defence and Space Deutschland GmbH
+
+OUI:2047ED*
+ ID_OUI_FROM_DATABASE=BSkyB Ltd
+
+OUI:C8F946*
+ ID_OUI_FROM_DATABASE=LOCOSYS Technology Inc.
+
+OUI:D41D71*
+ ID_OUI_FROM_DATABASE=Palo Alto Networks
+
+OUI:5C2443*
+ ID_OUI_FROM_DATABASE=O-Sung Telecom Co., Ltd.
+
+OUI:1861C7*
+ ID_OUI_FROM_DATABASE=lemonbeat GmbH
+
+OUI:9CDC71*
+ ID_OUI_FROM_DATABASE=Hewlett Packard Enterprise
+
+OUI:C8028F*
+ ID_OUI_FROM_DATABASE=Nova Electronics (Shanghai) Co., Ltd.
+
+OUI:240D65*
+ ID_OUI_FROM_DATABASE=Shenzhen Vsun Communication Technology Co., Ltd.
+
+OUI:D8452B*
+ ID_OUI_FROM_DATABASE=Integrated Device Technology (Malaysia) Sdn. Bhd.
+
+OUI:2CDD95*
+ ID_OUI_FROM_DATABASE=Taicang T&W Electronics
+
+OUI:5C9960*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:CC088D*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:0080FB*
+ ID_OUI_FROM_DATABASE=BVM LIMITED
+
+OUI:107223*
+ ID_OUI_FROM_DATABASE=TELLESCOM INDUSTRIA E COMERCIO EM TELECOMUNICACAO
+
+OUI:AC84C9*
+ ID_OUI_FROM_DATABASE=Sagemcom Broadband SAS
+
+OUI:14EDBB*
+ ID_OUI_FROM_DATABASE=2Wire Inc
+
+OUI:44BA46*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:B4D135*
+ ID_OUI_FROM_DATABASE=Cloudistics
 
 OUI:A8AD3D*
  ID_OUI_FROM_DATABASE=Alcatel-Lucent Shanghai Bell Co., Ltd
@@ -73445,8 +74441,413 @@ OUI:58FB84*
 OUI:E0E7BB*
  ID_OUI_FROM_DATABASE=Nureva, Inc.
 
+OUI:BC8AA3*
+ ID_OUI_FROM_DATABASE=NHN Entertainment
+
+OUI:70A84C*
+ ID_OUI_FROM_DATABASE=MONAD., Inc.
+
+OUI:407009*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:94877C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001DD2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:9C3426*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:3C7A8A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:000FCC*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:BCCAB5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:5C8FE0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:6CCA08*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:5465DE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:F8EDA5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00A289*
+ ID_OUI_FROM_DATABASE=Cisco Systems, Inc
+
+OUI:ACEC80*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015A4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0015A3*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:7CBFB1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:8096B1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00909C*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001180*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0017EE*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00D088*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001675*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0016B5*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001784*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0017E2*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:CC7D37*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001A77*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:984B4A*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:80F503*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:8496D8*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:D42C0F*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E0B7B1*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002210*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:00211E*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:E48399*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:002636*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0024A0*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:0012C9*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001CFB*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001C12*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:001FC4*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
+OUI:C0C522*
+ ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
+
 OUI:5CB066*
  ID_OUI_FROM_DATABASE=ARRIS Group, Inc.
 
-OUI:BC8AA3*
- ID_OUI_FROM_DATABASE=NHN Entertainment
+OUI:486DBB*
+ ID_OUI_FROM_DATABASE=Vestel Elektronik San ve Tic. A.Ş.
+
+OUI:6C1E90*
+ ID_OUI_FROM_DATABASE=Hansol Technics Co., Ltd.
+
+OUI:E09DFA*
+ ID_OUI_FROM_DATABASE=Wanan Hongsheng Electronic Co.Ltd
+
+OUI:34E71C*
+ ID_OUI_FROM_DATABASE=Shenzhen YOUHUA Technology Co., Ltd
+
+OUI:182861*
+ ID_OUI_FROM_DATABASE=AirTies Wireless Networks
+
+OUI:8841FC*
+ ID_OUI_FROM_DATABASE=AirTies Wireless Networks
+
+OUI:BCB1F3*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:38ECE4*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:CCF9E8*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F0E77E*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5CE8EB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:B8D9CE*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:6CB7F4*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:182666*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:C06599*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:CC07AB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E84E84*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:50FC9F*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:E432CB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:889B39*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:BC72B1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:78F7BE*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:70F927*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:301966*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:28BAB5*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:103B59*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:7C11CB*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:A4CAA0*
+ ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
+
+OUI:001EE1*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:F49F54*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:0018AF*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:00214C*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001632*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:D0667B*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:001377*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:50B7C3*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:5CA39D*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:38AA3C*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:206432*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:8018A7*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
+
+OUI:002637*
+ ID_OUI_FROM_DATABASE=SAMSUNG ELECTRO MECHANICS CO., LTD.
+
+OUI:B88EDF*
+ ID_OUI_FROM_DATABASE=Zencheer Communication Technology Co., Ltd.
+
+OUI:707781*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:606DC7*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:681401*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:0071CC*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:F866D1*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:F80D43*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:785968*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:002556*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:00265C*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:90CDB6*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001E4C*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:F8DA0C*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:342387*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:9034FC*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:906EBB*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:1C666D*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:CCAF78*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:904CE5*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:002268*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:001FE1*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:689423*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:B8763F*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:1C3E84*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:C01885*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:B01041*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:D85DE2*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Ind. Co.,Ltd.
+
+OUI:949AA9*
+ ID_OUI_FROM_DATABASE=Microsoft Corporation
+
+OUI:F8633F*
+ ID_OUI_FROM_DATABASE=Intel Corporate
+
+OUI:088620*
+ ID_OUI_FROM_DATABASE=TECNO MOBILE LIMITED
+
+OUI:A42983*
+ ID_OUI_FROM_DATABASE=Boeing Defence Australia
+
+OUI:702E22*
+ ID_OUI_FROM_DATABASE=zte corporation
+
+OUI:B0C128*
+ ID_OUI_FROM_DATABASE=Adler ELREHA GmbH
+
+OUI:5CA933*
+ ID_OUI_FROM_DATABASE=Luma Home
+
+OUI:60EFC6*
+ ID_OUI_FROM_DATABASE=Shenzhen Chima Technologies Co Limited
+
+OUI:502B73*
+ ID_OUI_FROM_DATABASE=Tenda Technology Co.,Ltd.Dongguan branch
+
+OUI:20DBAB*
+ ID_OUI_FROM_DATABASE=Samsung Electronics Co., Ltd.
+
+OUI:000DF0*
+ ID_OUI_FROM_DATABASE=QCOM TECHNOLOGY INC.
+
+OUI:5CF7E6*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:A0D795*
+ ID_OUI_FROM_DATABASE=Apple, Inc.
+
+OUI:002722*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:687251*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:B4FBE4*
+ ID_OUI_FROM_DATABASE=Ubiquiti Networks Inc.
+
+OUI:188B15*
+ ID_OUI_FROM_DATABASE=ShenZhen ZhongRuiJing Technology co.,LTD
+
+OUI:CCB0DA*
+ ID_OUI_FROM_DATABASE=Liteon Technology Corporation
+
+OUI:E02CF3*
+ ID_OUI_FROM_DATABASE=MRS Electronic GmbH
+
+OUI:F41F88*
+ ID_OUI_FROM_DATABASE=zte corporation
+
+OUI:D816C1*
+ ID_OUI_FROM_DATABASE=DEWAV (HK) ELECTRONICS LIMITED
+
+OUI:7CCC1F*
+ ID_OUI_FROM_DATABASE=SICHUAN TIANYI COMHEART TELECOMCO.,LTD
+
+OUI:C0854C*
+ ID_OUI_FROM_DATABASE=Ragentek Technology Group
+
+OUI:00FD45*
+ ID_OUI_FROM_DATABASE=Hewlett Packard Enterprise
diff --git a/src/grp-udev/hwdb/20-acpi-vendor.hwdb b/src/grp-udev/hwdb/20-acpi-vendor.hwdb
index 9b3b0094d5..3731b33656 100644
--- a/src/grp-udev/hwdb/20-acpi-vendor.hwdb
+++ b/src/grp-udev/hwdb/20-acpi-vendor.hwdb
@@ -1,15 +1,233 @@
 # This file is part of systemd.
 #
 # Data imported from:
-#  http://download.microsoft.com/download/7/E/7/7E7662CF-CBEA-470B-A97E-CE7CE0D98DC2/ISA_PNPID_List.xlsx
-# Non-unique, duplicate assignements manually removed.
+#     http://www.uefi.org/uefi-pnp-export
+#     http://www.uefi.org/uefi-acpi-export
+#
+# With various additions from other sources
+
+acpi:3NOD*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen three Connaught Information Technology Co., Ltd. (3nod Group)
+
+acpi:AAVA*:
+ ID_VENDOR_FROM_DATABASE=Aava Mobile Oy
+
+acpi:AMDI*:
+ ID_VENDOR_FROM_DATABASE=AMD
+
+acpi:APMC*:
+ ID_VENDOR_FROM_DATABASE=Applied Micro Circuits Corporation
+
+acpi:APTA*:
+ ID_VENDOR_FROM_DATABASE=Aptina Imaging Corporation
+
+acpi:ARMH*:
+ ID_VENDOR_FROM_DATABASE=ARM Ltd.
+
+acpi:ARML*:
+ ID_VENDOR_FROM_DATABASE=ARM Ltd.
+
+acpi:ASUS*:
+ ID_VENDOR_FROM_DATABASE=ASUS
+
+acpi:ATML*:
+ ID_VENDOR_FROM_DATABASE=Atmel
+
+acpi:AUTH*:
+ ID_VENDOR_FROM_DATABASE=AuthenTec
+
+acpi:BOSC*:
+ ID_VENDOR_FROM_DATABASE=Robert Bosch GmbH
+
+acpi:BRCM*:
+ ID_VENDOR_FROM_DATABASE=Broadcom Corporation
+
+acpi:CORE*:
+ ID_VENDOR_FROM_DATABASE=CoreOS, Inc
+
+acpi:CPLM*:
+ ID_VENDOR_FROM_DATABASE=Capella Microsystems Inc.
+
+acpi:DELL*:
+ ID_VENDOR_FROM_DATABASE=Dell, Inc.
+
+acpi:DLGS*:
+ ID_VENDOR_FROM_DATABASE=Dialog Semiconductor PLC
+
+acpi:DLLK*:
+ ID_VENDOR_FROM_DATABASE=Dell, Inc.
+
+acpi:DSUO*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen DSO Microelectronics Co.,Ltd.
+
+acpi:ELAN*:
+ ID_VENDOR_FROM_DATABASE=ELAN MICROELECTRONICS CORPORATION
+
+acpi:ESSX*:
+ ID_VENDOR_FROM_DATABASE=Everest Semiconductor Co., Ltd.
+
+acpi:FRSC*:
+ ID_VENDOR_FROM_DATABASE=Freescale, Inc
+
+acpi:FTSC*:
+ ID_VENDOR_FROM_DATABASE=FocalTech Systems Co., Ltd.
+
+acpi:GOOG*:
+ ID_VENDOR_FROM_DATABASE=Google, Inc.
+
+acpi:HIMX*:
+ ID_VENDOR_FROM_DATABASE=Himax Technologies, Inc.
+
+acpi:HISI*:
+ ID_VENDOR_FROM_DATABASE=HiSilicon Technologies Co., Ltd.
+
+acpi:HPIC*:
+ ID_VENDOR_FROM_DATABASE=HP Inc.
+
+acpi:HPQC*:
+ ID_VENDOR_FROM_DATABASE=Hewlett-Packard Company
+
+acpi:HTLM*:
+ ID_VENDOR_FROM_DATABASE=HTBLuVA Mödling
+
+acpi:HWPE*:
+ ID_VENDOR_FROM_DATABASE=Hewlett Packard Enterprise
+
+acpi:IBMX*:
+ ID_VENDOR_FROM_DATABASE=IBM
+
+acpi:IDEA*:
+ ID_VENDOR_FROM_DATABASE=Lenovo Beijing Co. Ltd.
+
+acpi:IMPJ*:
+ ID_VENDOR_FROM_DATABASE=Impinj
+
+acpi:INTC*:
+ ID_VENDOR_FROM_DATABASE=Intel Corporation
+
+acpi:INTL*:
+ ID_VENDOR_FROM_DATABASE=Intel Corporation
+
+acpi:INVN*:
+ ID_VENDOR_FROM_DATABASE=Invensense, Inc
+
+acpi:IP3T*:
+ ID_VENDOR_FROM_DATABASE=IP3 Technology Ltd.
+
+acpi:IPHI*:
+ ID_VENDOR_FROM_DATABASE=Inphi Corporation
+
+acpi:KIOX*:
+ ID_VENDOR_FROM_DATABASE=Kionix, Inc.
+
+acpi:LNRO*:
+ ID_VENDOR_FROM_DATABASE=Linaro, Ltd.
+
+acpi:LNUX*:
+ ID_VENDOR_FROM_DATABASE=The Linux Foundation
+
+acpi:MIPI*:
+ ID_VENDOR_FROM_DATABASE=MIPI Alliance
+
+acpi:MSAY*:
+ ID_VENDOR_FROM_DATABASE=Microsoft Corporation
+
+acpi:MSFT*:
+ ID_VENDOR_FROM_DATABASE=Microsoft Corporation
+
+acpi:MSHW*:
+ ID_VENDOR_FROM_DATABASE=Microsoft Corporation
+
+acpi:MXIM*:
+ ID_VENDOR_FROM_DATABASE=Maxim Integrated
+
+acpi:NVDA*:
+ ID_VENDOR_FROM_DATABASE=Nvidia
+
+acpi:NVTN*:
+ ID_VENDOR_FROM_DATABASE=Nuvoton Technology Corporation
+
+acpi:OBDA*:
+ ID_VENDOR_FROM_DATABASE=REALTEK Semiconductor Corp.
+
+acpi:OMPS*:
+ ID_VENDOR_FROM_DATABASE=OmniPreSense
+
+acpi:OVTI*:
+ ID_VENDOR_FROM_DATABASE=OmniVision Technologies, Inc.
+
+acpi:PEGA*:
+ ID_VENDOR_FROM_DATABASE=Pegatron Corporation
+
+acpi:QCOM*:
+ ID_VENDOR_FROM_DATABASE=Qualcomm Inc
+
+acpi:QEMU*:
+ ID_VENDOR_FROM_DATABASE=Red Hat, Inc.
+
+acpi:RAYD*:
+ ID_VENDOR_FROM_DATABASE=Raydium Semiconductor Corporation
+
+acpi:RKCP*:
+ ID_VENDOR_FROM_DATABASE=Fuzhou Rockchip Electronics Co., Ltd.
+
+acpi:RZSN*:
+ ID_VENDOR_FROM_DATABASE=Rozsnyó, s.r.o.
+
+acpi:SHRP*:
+ ID_VENDOR_FROM_DATABASE=Sharp Corporation
+
+acpi:SONY*:
+ ID_VENDOR_FROM_DATABASE=Sony Corporation
+
+acpi:ST86*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen South-Top Computer Co., Ltd.
+
+acpi:SWEM*:
+ ID_VENDOR_FROM_DATABASE=Sierra Wireless
+
+acpi:SYNA*:
+ ID_VENDOR_FROM_DATABASE=Synaptics Inc
+
+acpi:TCAG*:
+ ID_VENDOR_FROM_DATABASE=Teracue AG
+
+acpi:TOSB*:
+ ID_VENDOR_FROM_DATABASE=Toshiba Corporation
+
+acpi:TXNW*:
+ ID_VENDOR_FROM_DATABASE=Texas Instruments
+
+acpi:UBLX*:
+ ID_VENDOR_FROM_DATABASE=u-blox AG
+
+acpi:VAIO*:
+ ID_VENDOR_FROM_DATABASE=VAIO Corporation
+
+acpi:VFSI*:
+ ID_VENDOR_FROM_DATABASE=Validity Sensors, Inc
+
+acpi:WCOM*:
+ ID_VENDOR_FROM_DATABASE=Wacom
+
+acpi:WSDR*:
+ ID_VENDOR_FROM_DATABASE=Winsider Seminars & Solutions Inc.
+
+acpi:XMCC*:
+ ID_VENDOR_FROM_DATABASE=Xiaomi Inc.
 
 acpi:AAA*:
  ID_VENDOR_FROM_DATABASE=Avolites Ltd
 
+acpi:AAC*:
+ ID_VENDOR_FROM_DATABASE=AcerView
+
 acpi:AAE*:
  ID_VENDOR_FROM_DATABASE=Anatek Electronics Inc.
 
+acpi:AAM*:
+ ID_VENDOR_FROM_DATABASE=Aava Mobile Oy
+
 acpi:AAT*:
  ID_VENDOR_FROM_DATABASE=Ann Arbor Technologies
 
@@ -17,7 +235,7 @@ acpi:ABA*:
  ID_VENDOR_FROM_DATABASE=ABBAHOME INC.
 
 acpi:ABC*:
- ID_VENDOR_FROM_DATABASE=AboCom System Inc
+ ID_VENDOR_FROM_DATABASE=AboCom System Inc.
 
 acpi:ABD*:
  ID_VENDOR_FROM_DATABASE=Allen Bradley Company
@@ -28,6 +246,12 @@ acpi:ABE*:
 acpi:ABO*:
  ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
 
+acpi:ABP*:
+ ID_VENDOR_FROM_DATABASE=Advansys
+
+acpi:ABS*:
+ ID_VENDOR_FROM_DATABASE=Abaco Systems, Inc.
+
 acpi:ABT*:
  ID_VENDOR_FROM_DATABASE=Anchor Bay Technologies, Inc.
 
@@ -50,7 +274,7 @@ acpi:ACE*:
  ID_VENDOR_FROM_DATABASE=Actek Engineering Pty Ltd
 
 acpi:ACG*:
- ID_VENDOR_FROM_DATABASE=A&R Cambridge Ltd
+ ID_VENDOR_FROM_DATABASE=A&R Cambridge Ltd.
 
 acpi:ACH*:
  ID_VENDOR_FROM_DATABASE=Archtek Telecom Corporation
@@ -131,7 +355,7 @@ acpi:ADS*:
  ID_VENDOR_FROM_DATABASE=Analog Devices Inc
 
 acpi:ADT*:
- ID_VENDOR_FROM_DATABASE=Aved Display Technologies
+ ID_VENDOR_FROM_DATABASE=Adtek
 
 acpi:ADV*:
  ID_VENDOR_FROM_DATABASE=Advanced Micro Devices Inc
@@ -139,6 +363,9 @@ acpi:ADV*:
 acpi:ADX*:
  ID_VENDOR_FROM_DATABASE=Adax Inc
 
+acpi:ADZ*:
+ ID_VENDOR_FROM_DATABASE=ADDER TECHNOLOGY LTD
+
 acpi:AEC*:
  ID_VENDOR_FROM_DATABASE=Antex Electronics Corporation
 
@@ -178,12 +405,18 @@ acpi:AGL*:
 acpi:AGM*:
  ID_VENDOR_FROM_DATABASE=Advan Int'l Corporation
 
+acpi:AGO*:
+ ID_VENDOR_FROM_DATABASE=AlgolTek, Inc.
+
 acpi:AGT*:
  ID_VENDOR_FROM_DATABASE=Agilent Technologies
 
 acpi:AHC*:
  ID_VENDOR_FROM_DATABASE=Advantech Co., Ltd.
 
+acpi:AHS*:
+ ID_VENDOR_FROM_DATABASE=Beijing AnHeng SecoTech Information Technology Co., Ltd.
+
 acpi:AIC*:
  ID_VENDOR_FROM_DATABASE=Arnos Insturments & Computer Systems
 
@@ -193,6 +426,9 @@ acpi:AIE*:
 acpi:AII*:
  ID_VENDOR_FROM_DATABASE=Amptron International Inc.
 
+acpi:AIK*:
+ ID_VENDOR_FROM_DATABASE=Dongguan Alllike Electronics Co., Ltd.
+
 acpi:AIL*:
  ID_VENDOR_FROM_DATABASE=Altos India Ltd
 
@@ -244,6 +480,9 @@ acpi:ALC*:
 acpi:ALD*:
  ID_VENDOR_FROM_DATABASE=In4S Inc
 
+acpi:ALE*:
+ ID_VENDOR_FROM_DATABASE=Alenco BV
+
 acpi:ALG*:
  ID_VENDOR_FROM_DATABASE=Realtek Semiconductor Corp.
 
@@ -316,12 +555,18 @@ acpi:AMO*:
 acpi:AMP*:
  ID_VENDOR_FROM_DATABASE=AMP Inc
 
-acpi:AMS *:
+acpi:AMR*:
+ ID_VENDOR_FROM_DATABASE=AmTRAN Technology Co., Ltd.
+
+acpi:AMS*:
  ID_VENDOR_FROM_DATABASE=ARMSTEL, Inc.
 
 acpi:AMT*:
  ID_VENDOR_FROM_DATABASE=AMT International Industry
 
+acpi:AMW*:
+ ID_VENDOR_FROM_DATABASE=AMW
+
 acpi:AMX*:
  ID_VENDOR_FROM_DATABASE=AMX LLC
 
@@ -358,12 +603,21 @@ acpi:ANS*:
 acpi:ANT*:
  ID_VENDOR_FROM_DATABASE=Ace CAD Enterprise Company Ltd
 
+acpi:ANV*:
+ ID_VENDOR_FROM_DATABASE=Beijing ANTVR Technology Co., Ltd.
+
+acpi:ANW*:
+ ID_VENDOR_FROM_DATABASE=Analog Way SAS
+
 acpi:ANX*:
  ID_VENDOR_FROM_DATABASE=Acer Netxus Inc
 
 acpi:AOA*:
  ID_VENDOR_FROM_DATABASE=AOpen Inc.
 
+acpi:AOC*:
+ ID_VENDOR_FROM_DATABASE=AOC
+
 acpi:AOE*:
  ID_VENDOR_FROM_DATABASE=Advanced Optics Electronics, Inc.
 
@@ -373,12 +627,18 @@ acpi:AOL*:
 acpi:AOT*:
  ID_VENDOR_FROM_DATABASE=Alcatel
 
+acpi:APA*:
+ ID_VENDOR_FROM_DATABASE=Adaptec
+
 acpi:APC*:
  ID_VENDOR_FROM_DATABASE=American Power Conversion
 
 acpi:APD*:
  ID_VENDOR_FROM_DATABASE=AppliAdata
 
+acpi:APE*:
+ ID_VENDOR_FROM_DATABASE=Alpine Electronics, Inc.
+
 acpi:APG*:
  ID_VENDOR_FROM_DATABASE=Horner Electric Inc
 
@@ -415,6 +675,9 @@ acpi:APX*:
 acpi:ARC*:
  ID_VENDOR_FROM_DATABASE=Alta Research Corporation
 
+acpi:ARD*:
+ ID_VENDOR_FROM_DATABASE=AREC Inc.
+
 acpi:ARE*:
  ID_VENDOR_FROM_DATABASE=ICET S.p.A.
 
@@ -436,6 +699,9 @@ acpi:ARM*:
 acpi:ARO*:
  ID_VENDOR_FROM_DATABASE=Poso International B.V.
 
+acpi:ARR*:
+ ID_VENDOR_FROM_DATABASE=ARRIS Group, Inc.
+
 acpi:ARS*:
  ID_VENDOR_FROM_DATABASE=Arescom Inc
 
@@ -451,6 +717,9 @@ acpi:ASD*:
 acpi:ASE*:
  ID_VENDOR_FROM_DATABASE=AseV Display Labs
 
+acpi:ASH*:
+ ID_VENDOR_FROM_DATABASE=Ashton Bentley Concepts
+
 acpi:ASI*:
  ID_VENDOR_FROM_DATABASE=Ahead Systems
 
@@ -499,6 +768,9 @@ acpi:ATH*:
 acpi:ATI*:
  ID_VENDOR_FROM_DATABASE=Allied Telesis KK
 
+acpi:ATJ*:
+ ID_VENDOR_FROM_DATABASE=ArchiTek Corporation
+
 acpi:ATK*:
  ID_VENDOR_FROM_DATABASE=Allied Telesyn Int'l
 
@@ -526,15 +798,27 @@ acpi:ATV*:
 acpi:ATX*:
  ID_VENDOR_FROM_DATABASE=Athenix Corporation
 
+acpi:AUG*:
+ ID_VENDOR_FROM_DATABASE=August Home, Inc.
+
 acpi:AUI*:
  ID_VENDOR_FROM_DATABASE=Alps Electric Inc
 
+acpi:AUO*:
+ ID_VENDOR_FROM_DATABASE=AU Optronics
+
 acpi:AUR*:
  ID_VENDOR_FROM_DATABASE=Aureal Semiconductor
 
+acpi:AUS*:
+ ID_VENDOR_FROM_DATABASE=ASUSTek COMPUTER INC
+
 acpi:AUT*:
  ID_VENDOR_FROM_DATABASE=Autotime Corporation
 
+acpi:AUV*:
+ ID_VENDOR_FROM_DATABASE=Auvidea GmbH
+
 acpi:AVA*:
  ID_VENDOR_FROM_DATABASE=Avaya Communication
 
@@ -547,16 +831,22 @@ acpi:AVD*:
 acpi:AVE*:
  ID_VENDOR_FROM_DATABASE=Add Value Enterpises (Asia) Pte Ltd
 
+acpi:AVG*:
+ ID_VENDOR_FROM_DATABASE=Avegant Corporation
+
 acpi:AVI*:
  ID_VENDOR_FROM_DATABASE=Nippon Avionics Co.,Ltd
 
+acpi:AVJ*:
+ ID_VENDOR_FROM_DATABASE=Atelier Vision Corporation
+
 acpi:AVL*:
  ID_VENDOR_FROM_DATABASE=Avalue Technology Inc.
 
 acpi:AVM*:
  ID_VENDOR_FROM_DATABASE=AVM GmbH
 
-acpi:AVN *:
+acpi:AVN*:
  ID_VENDOR_FROM_DATABASE=Advance Computer Corporation
 
 acpi:AVO*:
@@ -571,6 +861,9 @@ acpi:AVT*:
 acpi:AVV*:
  ID_VENDOR_FROM_DATABASE=SBS Technologies (Canada), Inc. (was Avvida Systems, Inc.)
 
+acpi:AVX*:
+ ID_VENDOR_FROM_DATABASE=A/Vaux Electronics
+
 acpi:AWC*:
  ID_VENDOR_FROM_DATABASE=Access Works Comm Inc
 
@@ -587,7 +880,7 @@ acpi:AXC*:
  ID_VENDOR_FROM_DATABASE=AXIOMTEK CO., LTD.
 
 acpi:AXE*:
- ID_VENDOR_FROM_DATABASE=D-Link Systems Inc (used as 2nd pnpid)
+ ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
 
 acpi:AXI*:
  ID_VENDOR_FROM_DATABASE=American Magnetics
@@ -616,6 +909,9 @@ acpi:AYD*:
 acpi:AYR*:
  ID_VENDOR_FROM_DATABASE=Airlib, Inc
 
+acpi:AZH*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen three Connaught Information Technology Co., Ltd. (3nod Group)
+
 acpi:AZM*:
  ID_VENDOR_FROM_DATABASE=AZ Middelheim - Radiotherapy
 
@@ -643,6 +939,9 @@ acpi:BCC*:
 acpi:BCD*:
  ID_VENDOR_FROM_DATABASE=Barco GmbH
 
+acpi:BCI*:
+ ID_VENDOR_FROM_DATABASE=Broadata Communications Inc.
+
 acpi:BCM*:
  ID_VENDOR_FROM_DATABASE=Broadcom
 
@@ -662,7 +961,7 @@ acpi:BDS*:
  ID_VENDOR_FROM_DATABASE=Barco Display Systems
 
 acpi:BEC*:
- ID_VENDOR_FROM_DATABASE=Elektro Beckhoff GmbH
+ ID_VENDOR_FROM_DATABASE=Beckhoff Automation
 
 acpi:BEI*:
  ID_VENDOR_FROM_DATABASE=Beckworth Enterprises Inc
@@ -688,6 +987,9 @@ acpi:BGT*:
 acpi:BHZ*:
  ID_VENDOR_FROM_DATABASE=BitHeadz, Inc.
 
+acpi:BIA*:
+ ID_VENDOR_FROM_DATABASE=Biamp Systems Corporation
+
 acpi:BIC*:
  ID_VENDOR_FROM_DATABASE=Big Island Communications
 
@@ -712,12 +1014,18 @@ acpi:BLN*:
 acpi:BLP*:
  ID_VENDOR_FROM_DATABASE=Bloomberg L.P.
 
+acpi:BMD*:
+ ID_VENDOR_FROM_DATABASE=Blackmagic Design
+
 acpi:BMI*:
  ID_VENDOR_FROM_DATABASE=Benson Medical Instruments Company
 
 acpi:BML*:
  ID_VENDOR_FROM_DATABASE=BIOMED Lab
 
+acpi:BMM*:
+ ID_VENDOR_FROM_DATABASE=BMM
+
 acpi:BMS*:
  ID_VENDOR_FROM_DATABASE=BIOMEDISYS
 
@@ -730,6 +1038,9 @@ acpi:BNK*:
 acpi:BNO*:
  ID_VENDOR_FROM_DATABASE=Bang & Olufsen
 
+acpi:BNQ*:
+ ID_VENDOR_FROM_DATABASE=BenQ Corporation
+
 acpi:BNS*:
  ID_VENDOR_FROM_DATABASE=Boulder Nonlinear Systems
 
@@ -748,6 +1059,9 @@ acpi:BOS*:
 acpi:BPD*:
  ID_VENDOR_FROM_DATABASE=Micro Solutions, Inc.
 
+acpi:BPS*:
+ ID_VENDOR_FROM_DATABASE=Barco, N.V.
+
 acpi:BPU*:
  ID_VENDOR_FROM_DATABASE=Best Power
 
@@ -772,6 +1086,9 @@ acpi:BRO*:
 acpi:BSE*:
  ID_VENDOR_FROM_DATABASE=Bose Corporation
 
+acpi:BSG*:
+ ID_VENDOR_FROM_DATABASE=Robert Bosch GmbH
+
 acpi:BSL*:
  ID_VENDOR_FROM_DATABASE=Biomedical Systems Laboratory
 
@@ -1114,6 +1431,9 @@ acpi:COB*:
 acpi:COD*:
  ID_VENDOR_FROM_DATABASE=CODAN Pty. Ltd.
 
+acpi:COG*:
+ ID_VENDOR_FROM_DATABASE=Cogent
+
 acpi:COI*:
  ID_VENDOR_FROM_DATABASE=Codec Inc.
 
@@ -1159,6 +1479,9 @@ acpi:CPL*:
 acpi:CPM*:
  ID_VENDOR_FROM_DATABASE=Capella Microsystems Inc.
 
+acpi:CPP*:
+ ID_VENDOR_FROM_DATABASE=Compound Photonics
+
 acpi:CPQ*:
  ID_VENDOR_FROM_DATABASE=Compaq Computer Company
 
@@ -1168,6 +1491,9 @@ acpi:CPT*:
 acpi:CPX*:
  ID_VENDOR_FROM_DATABASE=Powermatic Data Systems
 
+acpi:CRA*:
+ ID_VENDOR_FROM_DATABASE=CRALTECH ELECTRONICA, S.L.
+
 acpi:CRC*:
  ID_VENDOR_FROM_DATABASE=CONRAC GmbH
 
@@ -1177,11 +1503,14 @@ acpi:CRD*:
 acpi:CRE*:
  ID_VENDOR_FROM_DATABASE=Creative Labs Inc
 
+acpi:CRH*:
+ ID_VENDOR_FROM_DATABASE=Contemporary Research Corp.
+
 acpi:CRI*:
  ID_VENDOR_FROM_DATABASE=Crio Inc.
 
 acpi:CRL*:
- ID_VENDOR_FROM_DATABASE=Creative Logic  
+ ID_VENDOR_FROM_DATABASE=Creative Logic
 
 acpi:CRN*:
  ID_VENDOR_FROM_DATABASE=Cornerstone Imaging
@@ -1216,6 +1545,9 @@ acpi:CSE*:
 acpi:CSI*:
  ID_VENDOR_FROM_DATABASE=Cabletron System Inc
 
+acpi:CSL*:
+ ID_VENDOR_FROM_DATABASE=Cloudium Systems Ltd.
+
 acpi:CSM*:
  ID_VENDOR_FROM_DATABASE=Cosmic Engineering Inc.
 
@@ -1249,6 +1581,9 @@ acpi:CTN*:
 acpi:CTP*:
  ID_VENDOR_FROM_DATABASE=Computer Technology Corporation
 
+acpi:CTR*:
+ ID_VENDOR_FROM_DATABASE=Control4 Corporation
+
 acpi:CTS*:
  ID_VENDOR_FROM_DATABASE=Comtec Systems Co., Ltd.
 
@@ -1264,9 +1599,18 @@ acpi:CUK*:
 acpi:CVA*:
  ID_VENDOR_FROM_DATABASE=Covia Inc.
 
+acpi:CVI*:
+ ID_VENDOR_FROM_DATABASE=Colorado Video, Inc.
+
+acpi:CVP*:
+ ID_VENDOR_FROM_DATABASE=Chromatec Video Products Ltd
+
 acpi:CVS*:
  ID_VENDOR_FROM_DATABASE=Clarity Visual Systems
 
+acpi:CWC*:
+ ID_VENDOR_FROM_DATABASE=Curtiss-Wright Controls, Inc.
+
 acpi:CWR*:
  ID_VENDOR_FROM_DATABASE=Connectware Inc
 
@@ -1285,6 +1629,9 @@ acpi:CYD*:
 acpi:CYL*:
  ID_VENDOR_FROM_DATABASE=Cyberlabs
 
+acpi:CYP*:
+ ID_VENDOR_FROM_DATABASE=CYPRESS SEMICONDUCTOR CORPORATION
+
 acpi:CYT*:
  ID_VENDOR_FROM_DATABASE=Cytechinfo Inc
 
@@ -1297,6 +1644,9 @@ acpi:CYW*:
 acpi:CYX*:
  ID_VENDOR_FROM_DATABASE=Cyrix Corporation
 
+acpi:CZC*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen ChuangZhiCheng Technology Co., Ltd.
+
 acpi:CZE*:
  ID_VENDOR_FROM_DATABASE=Carl Zeiss AG
 
@@ -1400,7 +1750,7 @@ acpi:DDI*:
  ID_VENDOR_FROM_DATABASE=Data Display AG
 
 acpi:DDS*:
- ID_VENDOR_FROM_DATABASE=Barco, n.v.
+ ID_VENDOR_FROM_DATABASE=Barco, N.V.
 
 acpi:DDT*:
  ID_VENDOR_FROM_DATABASE=Datadesk Technologies Inc
@@ -1451,7 +1801,10 @@ acpi:DGS*:
  ID_VENDOR_FROM_DATABASE=Diagsoft Inc
 
 acpi:DGT*:
- ID_VENDOR_FROM_DATABASE=The Dearborn Group
+ ID_VENDOR_FROM_DATABASE=Dearborn Group Technology
+
+acpi:DHD*:
+ ID_VENDOR_FROM_DATABASE=Dension Audio Systems
 
 acpi:DHP*:
  ID_VENDOR_FROM_DATABASE=DH Print
@@ -1519,6 +1872,9 @@ acpi:DMC*:
 acpi:DMM*:
  ID_VENDOR_FROM_DATABASE=Dimond Multimedia Systems Inc
 
+acpi:DMO*:
+ ID_VENDOR_FROM_DATABASE=Data Modul AG
+
 acpi:DMP*:
  ID_VENDOR_FROM_DATABASE=D&M Holdings Inc, Professional Business Company
 
@@ -1564,6 +1920,9 @@ acpi:DPA*:
 acpi:DPC*:
  ID_VENDOR_FROM_DATABASE=Delta Electronics Inc
 
+acpi:DPH*:
+ ID_VENDOR_FROM_DATABASE=Delphi Automotive LLP
+
 acpi:DPI*:
  ID_VENDOR_FROM_DATABASE=DocuPoint
 
@@ -1600,6 +1959,9 @@ acpi:DRI*:
 acpi:DRS*:
  ID_VENDOR_FROM_DATABASE=DRS Defense Solutions, LLC
 
+acpi:DSA*:
+ ID_VENDOR_FROM_DATABASE=Display Solution AG
+
 acpi:DSD*:
  ID_VENDOR_FROM_DATABASE=DS Multimedia Pte Ltd
 
@@ -1631,7 +1993,7 @@ acpi:DTL*:
  ID_VENDOR_FROM_DATABASE=e-Net Inc
 
 acpi:DTN*:
- ID_VENDOR_FROM_DATABASE=Datang  Telephone Co
+ ID_VENDOR_FROM_DATABASE=Datang Telephone Co
 
 acpi:DTO*:
  ID_VENDOR_FROM_DATABASE=Deutsche Thomson OHG
@@ -1690,12 +2052,18 @@ acpi:DYN*:
 acpi:DYX*:
  ID_VENDOR_FROM_DATABASE=Dynax Electronics (HK) Ltd
 
+acpi:EAG*:
+ ID_VENDOR_FROM_DATABASE=ELTEC Elektronik AG
+
 acpi:EAS*:
  ID_VENDOR_FROM_DATABASE=Evans and Sutherland Computer
 
 acpi:EBH*:
  ID_VENDOR_FROM_DATABASE=Data Price Informatica
 
+acpi:EBS*:
+ ID_VENDOR_FROM_DATABASE=EBS Euchner Büro- und Schulsysteme GmbH
+
 acpi:EBT*:
  ID_VENDOR_FROM_DATABASE=HUALONG TECHNOLOGY CO., LTD
 
@@ -1705,6 +2073,9 @@ acpi:ECA*:
 acpi:ECC*:
  ID_VENDOR_FROM_DATABASE=ESSential Comm. Corporation
 
+acpi:ECH*:
+ ID_VENDOR_FROM_DATABASE=EchoStar Corporation
+
 acpi:ECI*:
  ID_VENDOR_FROM_DATABASE=Enciris Technologies
 
@@ -1780,6 +2151,9 @@ acpi:EHN*:
 acpi:EIC*:
  ID_VENDOR_FROM_DATABASE=Eicon Technology Corporation
 
+acpi:EIZ*:
+ ID_VENDOR_FROM_DATABASE=Eizo
+
 acpi:EKA*:
  ID_VENDOR_FROM_DATABASE=MagTek Inc.
 
@@ -1819,6 +2193,9 @@ acpi:ELS*:
 acpi:ELT*:
  ID_VENDOR_FROM_DATABASE=Element Labs, Inc.
 
+acpi:ELU*:
+ ID_VENDOR_FROM_DATABASE=Express Industrial, Ltd.
+
 acpi:ELX*:
  ID_VENDOR_FROM_DATABASE=Elonex PLC
 
@@ -1828,6 +2205,9 @@ acpi:EMB*:
 acpi:EMC*:
  ID_VENDOR_FROM_DATABASE=eMicro Corporation
 
+acpi:EMD*:
+ ID_VENDOR_FROM_DATABASE=Embrionix Design Inc.
+
 acpi:EME*:
  ID_VENDOR_FROM_DATABASE=EMiNE TECHNOLOGY COMPANY, LTD.
 
@@ -1864,11 +2244,14 @@ acpi:ENS*:
 acpi:ENT*:
  ID_VENDOR_FROM_DATABASE=Enterprise Comm. & Computing Inc
 
+acpi:EON*:
+ ID_VENDOR_FROM_DATABASE=Eon Instrumentation, Inc.
+
 acpi:EPC*:
  ID_VENDOR_FROM_DATABASE=Empac
 
-acpi:EPH *:
- ID_VENDOR_FROM_DATABASE=Epiphan Systems Inc. 
+acpi:EPH*:
+ ID_VENDOR_FROM_DATABASE=Epiphan Systems Inc.
 
 acpi:EPI*:
  ID_VENDOR_FROM_DATABASE=Envision Peripherals, Inc
@@ -1897,12 +2280,18 @@ acpi:ERN*:
 acpi:ERP*:
  ID_VENDOR_FROM_DATABASE=Euraplan GmbH
 
+acpi:ERS*:
+ ID_VENDOR_FROM_DATABASE=Eizo Rugged Solutions
+
 acpi:ERT*:
  ID_VENDOR_FROM_DATABASE=Escort Insturments Corporation
 
 acpi:ESA*:
  ID_VENDOR_FROM_DATABASE=Elbit Systems of America
 
+acpi:ESB*:
+ ID_VENDOR_FROM_DATABASE=Esterline Belgium BVBA
+
 acpi:ESC*:
  ID_VENDOR_FROM_DATABASE=Eden Sistemas de Computacao S/A
 
@@ -1984,6 +2373,9 @@ acpi:EXN*:
 acpi:EXP*:
  ID_VENDOR_FROM_DATABASE=Data Export Corporation
 
+acpi:EXR*:
+ ID_VENDOR_FROM_DATABASE=Explorer Inc.
+
 acpi:EXT*:
  ID_VENDOR_FROM_DATABASE=Exatech Computadores & Servicos Ltda
 
@@ -1996,12 +2388,18 @@ acpi:EXY*:
 acpi:EYE*:
  ID_VENDOR_FROM_DATABASE=eyevis GmbH
 
+acpi:EYF*:
+ ID_VENDOR_FROM_DATABASE=eyefactive Gmbh
+
 acpi:EZE*:
  ID_VENDOR_FROM_DATABASE=EzE Technologies
 
 acpi:EZP*:
  ID_VENDOR_FROM_DATABASE=Storm Technology
 
+acpi:FAN*:
+ ID_VENDOR_FROM_DATABASE=Fantalooks Co., Ltd.
+
 acpi:FAR*:
  ID_VENDOR_FROM_DATABASE=Farallon Computing
 
@@ -2014,12 +2412,21 @@ acpi:FCB*:
 acpi:FCG*:
  ID_VENDOR_FROM_DATABASE=First International Computer Ltd
 
+acpi:FCM*:
+ ID_VENDOR_FROM_DATABASE=Funai
+
 acpi:FCS*:
  ID_VENDOR_FROM_DATABASE=Focus Enhancements, Inc.
 
 acpi:FDC*:
  ID_VENDOR_FROM_DATABASE=Future Domain
 
+acpi:FDD*:
+ ID_VENDOR_FROM_DATABASE=Forth Dimension Displays Ltd
+
+acpi:FDI*:
+ ID_VENDOR_FROM_DATABASE=Future Designs, Inc.
+
 acpi:FDT*:
  ID_VENDOR_FROM_DATABASE=Fujitsu Display Technologies Corp.
 
@@ -2093,7 +2500,7 @@ acpi:FMC*:
  ID_VENDOR_FROM_DATABASE=Ford Microelectronics Inc
 
 acpi:FMI*:
- ID_VENDOR_FROM_DATABASE=Fujitsu Microelect Inc
+ ID_VENDOR_FROM_DATABASE=Fellowes, Inc.
 
 acpi:FML*:
  ID_VENDOR_FROM_DATABASE=Fujitsu Microelect Ltd
@@ -2110,12 +2517,21 @@ acpi:FNI*:
 acpi:FOA*:
  ID_VENDOR_FROM_DATABASE=FOR-A Company Limited
 
+acpi:FOK*:
+ ID_VENDOR_FROM_DATABASE=Fokus Technologies GmbH
+
 acpi:FOS*:
  ID_VENDOR_FROM_DATABASE=Foss Tecator
 
+acpi:FOV*:
+ ID_VENDOR_FROM_DATABASE=FOVE INC
+
 acpi:FOX*:
  ID_VENDOR_FROM_DATABASE=HON HAI PRECISON IND.CO.,LTD.
 
+acpi:FPC*:
+ ID_VENDOR_FROM_DATABASE=Fingerprint Cards AB
+
 acpi:FPE*:
  ID_VENDOR_FROM_DATABASE=Fujitsu Peripherals Ltd
 
@@ -2137,6 +2553,9 @@ acpi:FRE*:
 acpi:FRI*:
  ID_VENDOR_FROM_DATABASE=Fibernet Research Inc
 
+acpi:FRO*:
+ ID_VENDOR_FROM_DATABASE=FARO Technologies
+
 acpi:FRS*:
  ID_VENDOR_FROM_DATABASE=South Mountain Technologies, LTD
 
@@ -2170,6 +2589,9 @@ acpi:FTN*:
 acpi:FTR*:
  ID_VENDOR_FROM_DATABASE=Mediasonic
 
+acpi:FTS*:
+ ID_VENDOR_FROM_DATABASE=FocalTech Systems Co., Ltd.
+
 acpi:FTW*:
  ID_VENDOR_FROM_DATABASE=MindTribe Product Engineering, Inc.
 
@@ -2203,6 +2625,9 @@ acpi:FZC*:
 acpi:FZI*:
  ID_VENDOR_FROM_DATABASE=FZI Forschungszentrum Informatik
 
+acpi:GAC*:
+ ID_VENDOR_FROM_DATABASE=GreenArrays, Inc.
+
 acpi:GAG*:
  ID_VENDOR_FROM_DATABASE=Gage Applied Sciences Inc
 
@@ -2233,11 +2658,17 @@ acpi:GDS*:
 acpi:GDT*:
  ID_VENDOR_FROM_DATABASE=Vortex Computersysteme GmbH
 
+acpi:GEC*:
+ ID_VENDOR_FROM_DATABASE=Gechic Corporation
+
+acpi:GED*:
+ ID_VENDOR_FROM_DATABASE=General Dynamics C4 Systems
+
 acpi:GEF*:
  ID_VENDOR_FROM_DATABASE=GE Fanuc Embedded Systems
 
 acpi:GEH*:
- ID_VENDOR_FROM_DATABASE=GE Intelligent Platforms - Huntsville
+ ID_VENDOR_FROM_DATABASE=Abaco Systems, Inc.
 
 acpi:GEM*:
  ID_VENDOR_FROM_DATABASE=Gem Plus
@@ -2317,6 +2748,12 @@ acpi:GNN*:
 acpi:GNZ*:
  ID_VENDOR_FROM_DATABASE=Gunze Ltd
 
+acpi:GOE*:
+ ID_VENDOR_FROM_DATABASE=GOEPEL electronic GmbH
+
+acpi:GPR*:
+ ID_VENDOR_FROM_DATABASE=GoPro, Inc.
+
 acpi:GRA*:
  ID_VENDOR_FROM_DATABASE=Graphica Computer
 
@@ -2344,6 +2781,9 @@ acpi:GSC*:
 acpi:GSM*:
  ID_VENDOR_FROM_DATABASE=Goldstar Company Ltd
 
+acpi:GSN*:
+ ID_VENDOR_FROM_DATABASE=Grandstream Networks, Inc.
+
 acpi:GST*:
  ID_VENDOR_FROM_DATABASE=Graphic SystemTechnology
 
@@ -2383,6 +2823,9 @@ acpi:GVL*:
 acpi:GWI*:
  ID_VENDOR_FROM_DATABASE=GW Instruments
 
+acpi:GWK*:
+ ID_VENDOR_FROM_DATABASE=Gateworks Corporation
+
 acpi:GWY*:
  ID_VENDOR_FROM_DATABASE=Gateway 2000
 
@@ -2437,6 +2880,9 @@ acpi:HDV*:
 acpi:HEC*:
  ID_VENDOR_FROM_DATABASE=Hisense Electric Co., Ltd.
 
+acpi:HEI*:
+ ID_VENDOR_FROM_DATABASE=Hyundai
+
 acpi:HEL*:
  ID_VENDOR_FROM_DATABASE=Hitachi Micro Systems Europe Ltd
 
@@ -2458,6 +2904,9 @@ acpi:HIB*:
 acpi:HIC*:
  ID_VENDOR_FROM_DATABASE=Hitachi Information Technology Co., Ltd.
 
+acpi:HII*:
+ ID_VENDOR_FROM_DATABASE=Harman International Industries, Inc
+
 acpi:HIK*:
  ID_VENDOR_FROM_DATABASE=Hikom Co., Ltd.
 
@@ -2467,6 +2916,9 @@ acpi:HIL*:
 acpi:HIQ*:
  ID_VENDOR_FROM_DATABASE=Kaohsiung Opto Electronics Americas, Inc.
 
+acpi:HIS*:
+ ID_VENDOR_FROM_DATABASE=Hope Industrial Systems, Inc.
+
 acpi:HIT*:
  ID_VENDOR_FROM_DATABASE=Hitachi America Ltd
 
@@ -2476,9 +2928,15 @@ acpi:HJI*:
 acpi:HKA*:
  ID_VENDOR_FROM_DATABASE=HONKO MFG. CO., LTD.
 
+acpi:HKC*:
+ ID_VENDOR_FROM_DATABASE=HKC OVERSEAS LIMITED
+
 acpi:HKG*:
  ID_VENDOR_FROM_DATABASE=Josef Heim KG
 
+acpi:HLG*:
+ ID_VENDOR_FROM_DATABASE=China Hualu Group Co., Ltd.
+
 acpi:HMC*:
  ID_VENDOR_FROM_DATABASE=Hualon Microelectric Corporation
 
@@ -2507,19 +2965,25 @@ acpi:HPA*:
  ID_VENDOR_FROM_DATABASE=Zytor Communications
 
 acpi:HPC*:
- ID_VENDOR_FROM_DATABASE=Hewlett Packard Co.
+ ID_VENDOR_FROM_DATABASE=Hewlett-Packard Co.
 
 acpi:HPD*:
  ID_VENDOR_FROM_DATABASE=Hewlett Packard
 
+acpi:HPE*:
+ ID_VENDOR_FROM_DATABASE=Hewlett Packard Enterprise
+
 acpi:HPI*:
  ID_VENDOR_FROM_DATABASE=Headplay, Inc.
 
 acpi:HPK*:
  ID_VENDOR_FROM_DATABASE=HAMAMATSU PHOTONICS K.K.
 
+acpi:HPN*:
+ ID_VENDOR_FROM_DATABASE=HP Inc.
+
 acpi:HPQ*:
- ID_VENDOR_FROM_DATABASE=HP
+ ID_VENDOR_FROM_DATABASE=Hewlett-Packard Co.
 
 acpi:HPR*:
  ID_VENDOR_FROM_DATABASE=H.P.R. Electronics GmbH
@@ -2548,12 +3012,18 @@ acpi:HSC*:
 acpi:HSD*:
  ID_VENDOR_FROM_DATABASE=HannStar Display Corp
 
+acpi:HSL*:
+ ID_VENDOR_FROM_DATABASE=Hansol
+
 acpi:HSM*:
  ID_VENDOR_FROM_DATABASE=AT&T Microelectronics
 
 acpi:HSP*:
  ID_VENDOR_FROM_DATABASE=HannStar Display Corp
 
+acpi:HST*:
+ ID_VENDOR_FROM_DATABASE=Horsent Technology Co., Ltd.
+
 acpi:HTC*:
  ID_VENDOR_FROM_DATABASE=Hitachi Ltd
 
@@ -2563,15 +3033,27 @@ acpi:HTI*:
 acpi:HTK*:
  ID_VENDOR_FROM_DATABASE=Holtek Microelectronics Inc
 
+acpi:HTL*:
+ ID_VENDOR_FROM_DATABASE=HTBLuVA Mödling
+
+acpi:HTR*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen ZhuoYi HengTong Computer Technology Limited
+
 acpi:HTX*:
  ID_VENDOR_FROM_DATABASE=Hitex Systementwicklung GmbH
 
 acpi:HUB*:
  ID_VENDOR_FROM_DATABASE=GAI-Tronics, A Hubbell Company
 
+acpi:HUK*:
+ ID_VENDOR_FROM_DATABASE=Hoffmann + Krippner GmbH
+
 acpi:HUM*:
  ID_VENDOR_FROM_DATABASE=IMP Electronics Ltd.
 
+acpi:HVR*:
+ ID_VENDOR_FROM_DATABASE=HTC Corportation
+
 acpi:HWA*:
  ID_VENDOR_FROM_DATABASE=Harris Canada Inc
 
@@ -2608,6 +3090,9 @@ acpi:HYT*:
 acpi:HYV*:
  ID_VENDOR_FROM_DATABASE=Hynix Semiconductor
 
+acpi:IAD*:
+ ID_VENDOR_FROM_DATABASE=IAdea Corporation
+
 acpi:IAF*:
  ID_VENDOR_FROM_DATABASE=Institut f r angewandte Funksystemtechnik GmbH
 
@@ -2624,7 +3109,7 @@ acpi:IBI*:
  ID_VENDOR_FROM_DATABASE=INBINE.CO.LTD
 
 acpi:IBM*:
- ID_VENDOR_FROM_DATABASE=IBM
+ ID_VENDOR_FROM_DATABASE=IBM Brasil
 
 acpi:IBP*:
  ID_VENDOR_FROM_DATABASE=IBP Instruments GmbH
@@ -2647,6 +3132,9 @@ acpi:ICE*:
 acpi:ICI*:
  ID_VENDOR_FROM_DATABASE=Infotek Communication Inc
 
+acpi:ICL*:
+ ID_VENDOR_FROM_DATABASE=Fujitsu ICL
+
 acpi:ICM*:
  ID_VENDOR_FROM_DATABASE=Intracom SA
 
@@ -2656,6 +3144,9 @@ acpi:ICN*:
 acpi:ICO*:
  ID_VENDOR_FROM_DATABASE=Intel Corp
 
+acpi:ICP*:
+ ID_VENDOR_FROM_DATABASE=ICP Electronics, Inc./iEi Technology Corp.
+
 acpi:ICS*:
  ID_VENDOR_FROM_DATABASE=Integrated Circuit Systems
 
@@ -2731,6 +3222,15 @@ acpi:III*:
 acpi:IIN*:
  ID_VENDOR_FROM_DATABASE=IINFRA Co., Ltd
 
+acpi:IIT*:
+ ID_VENDOR_FROM_DATABASE=Informatik Information Technologies
+
+acpi:IKE*:
+ ID_VENDOR_FROM_DATABASE=Ikegami Tsushinki Co. Ltd.
+
+acpi:IKN*:
+ ID_VENDOR_FROM_DATABASE=IKON
+
 acpi:IKS*:
  ID_VENDOR_FROM_DATABASE=Ikos Systems Inc
 
@@ -2768,11 +3268,17 @@ acpi:IMN*:
  ID_VENDOR_FROM_DATABASE=Impossible Production
 
 acpi:IMP*:
- ID_VENDOR_FROM_DATABASE=Impression Products Incorporated
+ ID_VENDOR_FROM_DATABASE=Impinj
 
 acpi:IMT*:
  ID_VENDOR_FROM_DATABASE=Inmax Technology Corporation
 
+acpi:IMS*:
+ ID_VENDOR_FROM_DATABASE=Integrated Micro Solution Inc.
+
+acpi:INA*:
+ ID_VENDOR_FROM_DATABASE=Inventec Corporation
+
 acpi:INC*:
  ID_VENDOR_FROM_DATABASE=Home Row Inc
 
@@ -2815,12 +3321,12 @@ acpi:INS*:
 acpi:INT*:
  ID_VENDOR_FROM_DATABASE=Interphase Corporation
 
-acpi:inu*:
- ID_VENDOR_FROM_DATABASE=Inovatec S.p.A.
-
 acpi:INV*:
  ID_VENDOR_FROM_DATABASE=Inviso, Inc.
 
+acpi:INX*:
+ ID_VENDOR_FROM_DATABASE=Communications Supply Corporation (A division of WESCO)
+
 acpi:INZ*:
  ID_VENDOR_FROM_DATABASE=Best Buy
 
@@ -2860,6 +3366,9 @@ acpi:IPN*:
 acpi:IPP*:
  ID_VENDOR_FROM_DATABASE=IP Power Technologies GmbH
 
+acpi:IPQ*:
+ ID_VENDOR_FROM_DATABASE=IP3 Technology Ltd.
+
 acpi:IPR*:
  ID_VENDOR_FROM_DATABASE=Ithaca Peripherals
 
@@ -2879,7 +3388,7 @@ acpi:IQT*:
  ID_VENDOR_FROM_DATABASE=IMAGEQUEST Co., Ltd
 
 acpi:IRD*:
- ID_VENDOR_FROM_DATABASE=IRdata
+ ID_VENDOR_FROM_DATABASE=Irdata
 
 acpi:ISA*:
  ID_VENDOR_FROM_DATABASE=Symbol Technologies
@@ -2926,6 +3435,9 @@ acpi:ITD*:
 acpi:ITE*:
  ID_VENDOR_FROM_DATABASE=Integrated Tech Express Inc
 
+acpi:ITI*:
+ ID_VENDOR_FROM_DATABASE=VanErum Group
+
 acpi:ITK*:
  ID_VENDOR_FROM_DATABASE=ITK Telekommunikation AG
 
@@ -2974,6 +3486,9 @@ acpi:IWX*:
 acpi:IXD*:
  ID_VENDOR_FROM_DATABASE=Intertex Data AB
 
+acpi:IXN*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen Inet Mobile Internet Technology Co., LTD
+
 acpi:JAC*:
  ID_VENDOR_FROM_DATABASE=Astec Inc
 
@@ -2992,6 +3507,9 @@ acpi:JAZ*:
 acpi:JCE*:
  ID_VENDOR_FROM_DATABASE=Jace Tech Inc
 
+acpi:JDI*:
+ ID_VENDOR_FROM_DATABASE=Japan Display Inc.
+
 acpi:JDL*:
  ID_VENDOR_FROM_DATABASE=Japan Digital Laboratory Co.,Ltd.
 
@@ -3100,6 +3618,9 @@ acpi:KEM*:
 acpi:KES*:
  ID_VENDOR_FROM_DATABASE=Kesa Corporation
 
+acpi:KEU*:
+ ID_VENDOR_FROM_DATABASE=Kontron Europe GmbH
+
 acpi:KEY*:
  ID_VENDOR_FROM_DATABASE=Key Tech Inc
 
@@ -3112,9 +3633,15 @@ acpi:KFE*:
 acpi:KFX*:
  ID_VENDOR_FROM_DATABASE=Kofax Image Products
 
+acpi:KGI*:
+ ID_VENDOR_FROM_DATABASE=Klipsch Group, Inc
+
 acpi:KGL*:
  ID_VENDOR_FROM_DATABASE=KEISOKU GIKEN Co.,Ltd.
 
+acpi:KIO*:
+ ID_VENDOR_FROM_DATABASE=Kionix, Inc.
+
 acpi:KIS*:
  ID_VENDOR_FROM_DATABASE=KiSS Technology A/S
 
@@ -3127,6 +3654,9 @@ acpi:KME*:
 acpi:KML*:
  ID_VENDOR_FROM_DATABASE=Kensington Microware Ltd
 
+acpi:KMR*:
+ ID_VENDOR_FROM_DATABASE=Kramer Electronics Ltd. International
+
 acpi:KNC*:
  ID_VENDOR_FROM_DATABASE=Konica corporation
 
@@ -3166,6 +3696,9 @@ acpi:KRY*:
 acpi:KSC*:
  ID_VENDOR_FROM_DATABASE=Kinetic Systems Corporation
 
+acpi:KSG*:
+ ID_VENDOR_FROM_DATABASE=KUPA China Shenzhen Micro Technology Co., Ltd. Gold Institute
+
 acpi:KSL*:
  ID_VENDOR_FROM_DATABASE=Karn Solutions Ltd.
 
@@ -3214,6 +3747,9 @@ acpi:KYE*:
 acpi:KYK*:
  ID_VENDOR_FROM_DATABASE=Samsung Electronics America Inc
 
+acpi:KYN*:
+ ID_VENDOR_FROM_DATABASE=KEYENCE CORPORATION
+
 acpi:KZI*:
  ID_VENDOR_FROM_DATABASE=K-Zone International co. Ltd.
 
@@ -3235,6 +3771,9 @@ acpi:LAG*:
 acpi:LAN*:
  ID_VENDOR_FROM_DATABASE=Sodeman Lancom Inc
 
+acpi:LAP*:
+ ID_VENDOR_FROM_DATABASE=BenQ
+
 acpi:LAS*:
  ID_VENDOR_FROM_DATABASE=LASAT Comm. A/S
 
@@ -3268,6 +3807,9 @@ acpi:LCS*:
 acpi:LCT*:
  ID_VENDOR_FROM_DATABASE=Labcal Technologies
 
+acpi:LDN*:
+ ID_VENDOR_FROM_DATABASE=Laserdyne Technologies
+
 acpi:LDT*:
  ID_VENDOR_FROM_DATABASE=LogiDataTech Electronic GmbH
 
@@ -3277,6 +3819,9 @@ acpi:LEC*:
 acpi:LED*:
  ID_VENDOR_FROM_DATABASE=Long Engineering Design Inc
 
+acpi:LED*:
+ ID_VENDOR_FROM_DATABASE=LeafNet
+
 acpi:LEG*:
  ID_VENDOR_FROM_DATABASE=Legerity, Inc
 
@@ -3292,6 +3837,9 @@ acpi:LEX*:
 acpi:LGC*:
  ID_VENDOR_FROM_DATABASE=Logic Ltd
 
+acpi:LGD*:
+ ID_VENDOR_FROM_DATABASE=LG Display
+
 acpi:LGI*:
  ID_VENDOR_FROM_DATABASE=Logitech Inc
 
@@ -3343,6 +3891,9 @@ acpi:LMT*:
 acpi:LND*:
  ID_VENDOR_FROM_DATABASE=Land Computer Company Ltd
 
+acpi:LNE*:
+ ID_VENDOR_FROM_DATABASE=Linksys
+
 acpi:LNK*:
  ID_VENDOR_FROM_DATABASE=Link Tech Inc
 
@@ -3355,6 +3906,9 @@ acpi:LNT*:
 acpi:LNV*:
  ID_VENDOR_FROM_DATABASE=Lenovo
 
+acpi:LNX*:
+ ID_VENDOR_FROM_DATABASE=The Linux Foundation
+
 acpi:LOC*:
  ID_VENDOR_FROM_DATABASE=Locamation B.V.
 
@@ -3373,6 +3927,9 @@ acpi:LPE*:
 acpi:LPI*:
  ID_VENDOR_FROM_DATABASE=Design Technology
 
+acpi:LPL*:
+ ID_VENDOR_FROM_DATABASE=LG Philips
+
 acpi:LSC*:
  ID_VENDOR_FROM_DATABASE=LifeSize Communications
 
@@ -3538,6 +4095,12 @@ acpi:MCS*:
 acpi:MCT*:
  ID_VENDOR_FROM_DATABASE=Microtec
 
+acpi:MCX*:
+ ID_VENDOR_FROM_DATABASE=Millson Custom Solutions Inc.
+
+acpi:MCY*:
+ ID_VENDOR_FROM_DATABASE=Microdyne
+
 acpi:MDA*:
  ID_VENDOR_FROM_DATABASE=Media4 Inc
 
@@ -3547,6 +4110,9 @@ acpi:MDC*:
 acpi:MDD*:
  ID_VENDOR_FROM_DATABASE=MODIS
 
+acpi:MDF*:
+ ID_VENDOR_FROM_DATABASE=MILDEF AB
+
 acpi:MDG*:
  ID_VENDOR_FROM_DATABASE=Madge Networks
 
@@ -3587,7 +4153,7 @@ acpi:MEE*:
  ID_VENDOR_FROM_DATABASE=Mitsubishi Electric Engineering Co., Ltd.
 
 acpi:MEG*:
- ID_VENDOR_FROM_DATABASE=Abeam Tech Ltd
+ ID_VENDOR_FROM_DATABASE=Abeam Tech Ltd.
 
 acpi:MEI*:
  ID_VENDOR_FROM_DATABASE=Panasonic Industry Company
@@ -3595,18 +4161,27 @@ acpi:MEI*:
 acpi:MEJ*:
  ID_VENDOR_FROM_DATABASE=Mac-Eight Co., LTD.
 
+acpi:MEK*:
+ ID_VENDOR_FROM_DATABASE=Mediaedge Corporation
+
 acpi:MEL*:
  ID_VENDOR_FROM_DATABASE=Mitsubishi Electric Corporation
 
 acpi:MEN*:
  ID_VENDOR_FROM_DATABASE=MEN Mikroelectronik Nueruberg GmbH
 
+acpi:MEP*:
+ ID_VENDOR_FROM_DATABASE=Meld Technology
+
 acpi:MEQ*:
  ID_VENDOR_FROM_DATABASE=Matelect Ltd.
 
 acpi:MET*:
  ID_VENDOR_FROM_DATABASE=Metheus Corporation
 
+acpi:MEU*:
+ ID_VENDOR_FROM_DATABASE=MPL AG, Elektronik-Unternehmen
+
 acpi:MEX*:
  ID_VENDOR_FROM_DATABASE=MSC Vertriebs GmbH
 
@@ -3664,6 +4239,9 @@ acpi:MIS*:
 acpi:MIT*:
  ID_VENDOR_FROM_DATABASE=MCM Industrial Technology GmbH
 
+acpi:MIV*:
+ ID_VENDOR_FROM_DATABASE=MicroImage Video Systems
+
 acpi:MJI*:
  ID_VENDOR_FROM_DATABASE=MARANTZ JAPAN, INC.
 
@@ -3673,6 +4251,9 @@ acpi:MJS*:
 acpi:MKC*:
  ID_VENDOR_FROM_DATABASE=Media Tek Inc.
 
+acpi:MKS*:
+ ID_VENDOR_FROM_DATABASE=MK Seiko Co., Ltd.
+
 acpi:MKT*:
  ID_VENDOR_FROM_DATABASE=MICROTEK Inc.
 
@@ -3688,15 +4269,24 @@ acpi:MLG*:
 acpi:MLI*:
  ID_VENDOR_FROM_DATABASE=McIntosh Laboratory Inc.
 
+acpi:MLL*:
+ ID_VENDOR_FROM_DATABASE=Millogic Ltd.
+
 acpi:MLM*:
  ID_VENDOR_FROM_DATABASE=Millennium Engineering Inc
 
 acpi:MLN*:
  ID_VENDOR_FROM_DATABASE=Mark Levinson
 
+acpi:MLP*:
+ ID_VENDOR_FROM_DATABASE=Magic Leap
+
 acpi:MLS*:
  ID_VENDOR_FROM_DATABASE=Milestone EPE
 
+acpi:MLT*:
+ ID_VENDOR_FROM_DATABASE=Wanlida Group Co., Ltd.
+
 acpi:MLX*:
  ID_VENDOR_FROM_DATABASE=Mylex Corporation
 
@@ -3724,6 +4314,9 @@ acpi:MMS*:
 acpi:MNC*:
  ID_VENDOR_FROM_DATABASE=Mini Micro Methods Ltd
 
+acpi:MNI*:
+ ID_VENDOR_FROM_DATABASE=Marseille, Inc.
+
 acpi:MNL*:
  ID_VENDOR_FROM_DATABASE=Monorail Inc
 
@@ -3736,6 +4329,9 @@ acpi:MOD*:
 acpi:MOM*:
  ID_VENDOR_FROM_DATABASE=Momentum Data Systems
 
+acpi:MON*:
+ ID_VENDOR_FROM_DATABASE=Daewoo
+
 acpi:MOS*:
  ID_VENDOR_FROM_DATABASE=Moses Corporation
 
@@ -3820,6 +4416,9 @@ acpi:MSM*:
 acpi:MSP*:
  ID_VENDOR_FROM_DATABASE=Mistral Solutions [P] Ltd.
 
+acpi:MSR*:
+ ID_VENDOR_FROM_DATABASE=MASPRO DENKOH Corp.
+
 acpi:MST*:
  ID_VENDOR_FROM_DATABASE=MS Telematica
 
@@ -3835,6 +4434,9 @@ acpi:MSX*:
 acpi:MSY*:
  ID_VENDOR_FROM_DATABASE=MicroTouch Systems Inc
 
+acpi:MTA*:
+ ID_VENDOR_FROM_DATABASE=Meta Watch Ltd
+
 acpi:MTB*:
  ID_VENDOR_FROM_DATABASE=Media Technologies Ltd.
 
@@ -3853,6 +4455,9 @@ acpi:MTH*:
 acpi:MTI*:
  ID_VENDOR_FROM_DATABASE=MaxCom Technical Inc
 
+acpi:MTJ*:
+ ID_VENDOR_FROM_DATABASE=MicroTechnica Co.,Ltd.
+
 acpi:MTK*:
  ID_VENDOR_FROM_DATABASE=Microtek International Inc.
 
@@ -3881,7 +4486,7 @@ acpi:MUD*:
  ID_VENDOR_FROM_DATABASE=Multi-Dimension Institute
 
 acpi:MUK*:
- ID_VENDOR_FROM_DATABASE=mainpine limited
+ ID_VENDOR_FROM_DATABASE=Mainpine Limited
 
 acpi:MVD*:
  ID_VENDOR_FROM_DATABASE=Microvitec PLC
@@ -3892,6 +4497,9 @@ acpi:MVI*:
 acpi:MVM*:
  ID_VENDOR_FROM_DATABASE=SOBO VISION
 
+acpi:MVN*:
+ ID_VENDOR_FROM_DATABASE=Meta Company
+
 acpi:MVS*:
  ID_VENDOR_FROM_DATABASE=Microvision
 
@@ -3946,6 +4554,9 @@ acpi:NAK*:
 acpi:NAL*:
  ID_VENDOR_FROM_DATABASE=Network Alchemy
 
+acpi:NAN*:
+ ID_VENDOR_FROM_DATABASE=Nanao
+
 acpi:NAT*:
  ID_VENDOR_FROM_DATABASE=NaturalPoint Inc.
 
@@ -3979,6 +4590,9 @@ acpi:NCI*:
 acpi:NCL*:
  ID_VENDOR_FROM_DATABASE=NetComm Ltd
 
+acpi:NCP*:
+ ID_VENDOR_FROM_DATABASE=Najing CEC Panda FPD Technology CO. ltd
+
 acpi:NCR*:
  ID_VENDOR_FROM_DATABASE=NCR Electronics
 
@@ -3991,6 +4605,9 @@ acpi:NCT*:
 acpi:NDC*:
  ID_VENDOR_FROM_DATABASE=National DataComm Corporaiton
 
+acpi:NDF*:
+ ID_VENDOR_FROM_DATABASE=NDF Special Light Products B.V.
+
 acpi:NDI*:
  ID_VENDOR_FROM_DATABASE=National Display Systems
 
@@ -4009,6 +4626,9 @@ acpi:NEC*:
 acpi:NEO*:
  ID_VENDOR_FROM_DATABASE=NEO TELECOM CO.,LTD.
 
+acpi:NES*:
+ ID_VENDOR_FROM_DATABASE=INNES
+
 acpi:NET*:
  ID_VENDOR_FROM_DATABASE=Mettler Toledo
 
@@ -4048,6 +4668,9 @@ acpi:NIX*:
 acpi:NLC*:
  ID_VENDOR_FROM_DATABASE=Next Level Communications
 
+acpi:NME*:
+ ID_VENDOR_FROM_DATABASE=Navico, Inc.
+
 acpi:NMP*:
  ID_VENDOR_FROM_DATABASE=Nokia Mobile Phones
 
@@ -4063,6 +4686,9 @@ acpi:NMX*:
 acpi:NNC*:
  ID_VENDOR_FROM_DATABASE=NNC
 
+acpi:NOD*:
+ ID_VENDOR_FROM_DATABASE=3NOD Digital Technology Co. Ltd.
+
 acpi:NOE*:
  ID_VENDOR_FROM_DATABASE=NordicEye AB
 
@@ -4078,6 +4704,9 @@ acpi:NOR*:
 acpi:NOT*:
  ID_VENDOR_FROM_DATABASE=Not Limited Inc
 
+acpi:NPA*:
+ ID_VENDOR_FROM_DATABASE=Arvanics
+
 acpi:NPI*:
  ID_VENDOR_FROM_DATABASE=Network Peripherals Inc
 
@@ -4090,6 +4719,9 @@ acpi:NRT*:
 acpi:NRV*:
  ID_VENDOR_FROM_DATABASE=Taugagreining hf
 
+acpi:NSA*:
+ ID_VENDOR_FROM_DATABASE=NeuroSky, Inc.
+
 acpi:NSC*:
  ID_VENDOR_FROM_DATABASE=National Semiconductor Corporation
 
@@ -4178,7 +4810,7 @@ acpi:NXS*:
  ID_VENDOR_FROM_DATABASE=Technology Nexus Secure Open Systems AB
 
 acpi:NYC*:
- ID_VENDOR_FROM_DATABASE=nakayo telecommunications,inc.
+ ID_VENDOR_FROM_DATABASE=Nakayo Relecommunications, Inc.
 
 acpi:OAK*:
  ID_VENDOR_FROM_DATABASE=Oak Tech Inc
@@ -4210,6 +4842,9 @@ acpi:OEC*:
 acpi:OEI*:
  ID_VENDOR_FROM_DATABASE=Optum Engineering Inc.
 
+acpi:OHW*:
+ ID_VENDOR_FROM_DATABASE=M-Labs Limited
+
 acpi:OIC*:
  ID_VENDOR_FROM_DATABASE=Option Industrial Computers
 
@@ -4300,6 +4935,12 @@ acpi:ORN*:
 acpi:OSA*:
  ID_VENDOR_FROM_DATABASE=OSAKA Micro Computer, Inc.
 
+acpi:OSD*:
+ ID_VENDOR_FROM_DATABASE=Optical Systems Design Pty Ltd
+
+acpi:OSI*:
+ ID_VENDOR_FROM_DATABASE=Open Stack, Inc.
+
 acpi:OSP*:
  ID_VENDOR_FROM_DATABASE=OPTI-UPS Corporation
 
@@ -4312,8 +4953,11 @@ acpi:OTB*:
 acpi:OTI*:
  ID_VENDOR_FROM_DATABASE=Orchid Technology
 
+acpi:OTK*:
+ ID_VENDOR_FROM_DATABASE=OmniTek
+
 acpi:OTM*:
- ID_VENDOR_FROM_DATABASE=Optoma Corporation          
+ ID_VENDOR_FROM_DATABASE=Optoma Corporation
 
 acpi:OTT*:
  ID_VENDOR_FROM_DATABASE=OPTO22, Inc.
@@ -4321,6 +4965,9 @@ acpi:OTT*:
 acpi:OUK*:
  ID_VENDOR_FROM_DATABASE=OUK Company Ltd
 
+acpi:OVR*:
+ ID_VENDOR_FROM_DATABASE=Oculus VR, Inc.
+
 acpi:OWL*:
  ID_VENDOR_FROM_DATABASE=Mediacom Technologies Pte Ltd
 
@@ -4408,6 +5055,9 @@ acpi:PCW*:
 acpi:PCX*:
  ID_VENDOR_FROM_DATABASE=PC Xperten
 
+acpi:PDC*:
+ ID_VENDOR_FROM_DATABASE=Polaroid
+
 acpi:PDM*:
  ID_VENDOR_FROM_DATABASE=Psion Dacom Plc.
 
@@ -4429,6 +5079,9 @@ acpi:PDV*:
 acpi:PEC*:
  ID_VENDOR_FROM_DATABASE=POTRANS Electrical Corp.
 
+acpi:PEG*:
+ ID_VENDOR_FROM_DATABASE=Pegatron Corporation
+
 acpi:PEI*:
  ID_VENDOR_FROM_DATABASE=PEI Electronics Inc
 
@@ -4480,6 +5133,9 @@ acpi:PHS*:
 acpi:PHY*:
  ID_VENDOR_FROM_DATABASE=Phylon Communications
 
+acpi:PIC*:
+ ID_VENDOR_FROM_DATABASE=Picturall Ltd.
+
 acpi:PIE*:
  ID_VENDOR_FROM_DATABASE=Pacific Image Electronics Company Ltd
 
@@ -4502,7 +5158,7 @@ acpi:PJT*:
  ID_VENDOR_FROM_DATABASE=Pan Jit International Inc.
 
 acpi:PKA*:
- ID_VENDOR_FROM_DATABASE=Acco UK ltd.
+ ID_VENDOR_FROM_DATABASE=Acco UK Ltd.
 
 acpi:PLC*:
  ID_VENDOR_FROM_DATABASE=Pro-Log Corporation
@@ -4564,6 +5220,9 @@ acpi:PON*:
 acpi:POR*:
  ID_VENDOR_FROM_DATABASE=Portalis LC
 
+acpi:POT*:
+ ID_VENDOR_FROM_DATABASE=Parrot
+
 acpi:PPC*:
  ID_VENDOR_FROM_DATABASE=Phoenixtec Power Company Ltd
 
@@ -4612,6 +5271,9 @@ acpi:PRM*:
 acpi:PRO*:
  ID_VENDOR_FROM_DATABASE=Proteon
 
+acpi:PRP*:
+ ID_VENDOR_FROM_DATABASE=UEFI Forum
+
 acpi:PRS*:
  ID_VENDOR_FROM_DATABASE=Leutron Vision
 
@@ -4645,6 +5307,9 @@ acpi:PSM*:
 acpi:PST*:
  ID_VENDOR_FROM_DATABASE=Global Data SA
 
+acpi:PSY*:
+ ID_VENDOR_FROM_DATABASE=Prodea Systems Inc.
+
 acpi:PTA*:
  ID_VENDOR_FROM_DATABASE=PAR Tech Inc.
 
@@ -4666,6 +5331,9 @@ acpi:PTL*:
 acpi:PTS*:
  ID_VENDOR_FROM_DATABASE=Plain Tree Systems Inc
 
+acpi:PUL*:
+ ID_VENDOR_FROM_DATABASE=Pulse-Eight Ltd
+
 acpi:PVG*:
  ID_VENDOR_FROM_DATABASE=Proview Global Co., Ltd
 
@@ -4840,9 +5508,21 @@ acpi:RES*:
 acpi:RET*:
  ID_VENDOR_FROM_DATABASE=Resonance Technology, Inc.
 
+acpi:REV*:
+ ID_VENDOR_FROM_DATABASE=Revolution Display, Inc.
+
 acpi:REX*:
  ID_VENDOR_FROM_DATABASE=RATOC Systems, Inc.
 
+acpi:RFI*:
+ ID_VENDOR_FROM_DATABASE=RAFI GmbH & Co. KG
+
+acpi:RFX*:
+ ID_VENDOR_FROM_DATABASE=Redfox Technologies Inc.
+
+acpi:RGB*:
+ ID_VENDOR_FROM_DATABASE=RGB Spectrum
+
 acpi:RGL*:
  ID_VENDOR_FROM_DATABASE=Robertson Geologging Ltd
 
@@ -4891,6 +5571,9 @@ acpi:RMC*:
 acpi:RMP*:
  ID_VENDOR_FROM_DATABASE=Research Machines
 
+acpi:RMS*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen Ramos Digital Technology Co., Ltd
+
 acpi:RMT*:
  ID_VENDOR_FROM_DATABASE=Roper Mobile
 
@@ -4936,6 +5619,9 @@ acpi:RSN*:
 acpi:RSQ*:
  ID_VENDOR_FROM_DATABASE=R Squared
 
+acpi:RSR*:
+ ID_VENDOR_FROM_DATABASE=Zhong Shan City Richsound Electronic Industrial Ltd.
+
 acpi:RSS*:
  ID_VENDOR_FROM_DATABASE=Rockwell Semiconductor Systems
 
@@ -4978,6 +5664,9 @@ acpi:RWC*:
 acpi:RXT*:
  ID_VENDOR_FROM_DATABASE=Tectona SoftSolutions (P) Ltd.,
 
+acpi:RZS*:
+ ID_VENDOR_FROM_DATABASE=Rozsnyó, s.r.o.
+
 acpi:SAA*:
  ID_VENDOR_FROM_DATABASE=Sanritz Automation Co.,Ltd.
 
@@ -5020,6 +5709,9 @@ acpi:SBS*:
 acpi:SBT*:
  ID_VENDOR_FROM_DATABASE=Senseboard Technologies AB
 
+acpi:SCB*:
+ ID_VENDOR_FROM_DATABASE=SeeCubic B.V.
+
 acpi:SCC*:
  ID_VENDOR_FROM_DATABASE=SORD Computer Corporation
 
@@ -5059,6 +5751,9 @@ acpi:SCS*:
 acpi:SCT*:
  ID_VENDOR_FROM_DATABASE=Smart Card Technology
 
+acpi:SCX*:
+ ID_VENDOR_FROM_DATABASE=Socionext Inc.
+
 acpi:SDA*:
  ID_VENDOR_FROM_DATABASE=SAT (Societe Anonyme)
 
@@ -5239,6 +5934,9 @@ acpi:SJE*:
 acpi:SKD*:
  ID_VENDOR_FROM_DATABASE=Schneider & Koch
 
+acpi:SKM*:
+ ID_VENDOR_FROM_DATABASE=Guangzhou Teclast Information Technology Limited
+
 acpi:SKT*:
  ID_VENDOR_FROM_DATABASE=Samsung Electro-Mechanics Company Ltd
 
@@ -5329,6 +6027,9 @@ acpi:SNI*:
 acpi:SNK*:
  ID_VENDOR_FROM_DATABASE=S&K Electronics
 
+acpi:SNN*:
+ ID_VENDOR_FROM_DATABASE=SUNNY ELEKTRONIK
+
 acpi:SNO*:
  ID_VENDOR_FROM_DATABASE=SINOSUN TECHNOLOGY CO., LTD
 
@@ -5350,6 +6051,9 @@ acpi:SNX*:
 acpi:SNY*:
  ID_VENDOR_FROM_DATABASE=Sony
 
+acpi:SOC*:
+ ID_VENDOR_FROM_DATABASE=Santec Corporation
+
 acpi:SOI*:
  ID_VENDOR_FROM_DATABASE=Silicon Optix Corporation
 
@@ -5419,6 +6123,9 @@ acpi:SRF*:
 acpi:SRG*:
  ID_VENDOR_FROM_DATABASE=Intuitive Surgical, Inc.
 
+acpi:SRS*:
+ ID_VENDOR_FROM_DATABASE=SR-Systems e.K.
+
 acpi:SRT*:
  ID_VENDOR_FROM_DATABASE=SeeReal Technologies GmbH
 
@@ -5437,6 +6144,9 @@ acpi:SSI*:
 acpi:SSJ*:
  ID_VENDOR_FROM_DATABASE=Sankyo Seiki Mfg.co., Ltd
 
+acpi:SSL*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen South-Top Computer Co., Ltd.
+
 acpi:SSP*:
  ID_VENDOR_FROM_DATABASE=Spectrum Signal Proecessing Inc
 
@@ -5491,6 +6201,9 @@ acpi:STO*:
 acpi:STP*:
  ID_VENDOR_FROM_DATABASE=StreamPlay Ltd
 
+acpi:STQ*:
+ ID_VENDOR_FROM_DATABASE=Synthetel Corporation
+
 acpi:STR*:
  ID_VENDOR_FROM_DATABASE=Starlight Networks Inc
 
@@ -5536,9 +6249,15 @@ acpi:SVC*:
 acpi:SVD*:
  ID_VENDOR_FROM_DATABASE=SVD Computer
 
+acpi:SVE*:
+ ID_VENDOR_FROM_DATABASE=SVEC
+
 acpi:SVI*:
  ID_VENDOR_FROM_DATABASE=Sun Microsystems
 
+acpi:SVR*:
+ ID_VENDOR_FROM_DATABASE=Sensics, Inc.
+
 acpi:SVS*:
  ID_VENDOR_FROM_DATABASE=SVSI
 
@@ -5554,6 +6273,9 @@ acpi:SWI*:
 acpi:SWL*:
  ID_VENDOR_FROM_DATABASE=Sharedware Ltd
 
+acpi:SWO*:
+ ID_VENDOR_FROM_DATABASE=Guangzhou Shirui Electronics Co., Ltd.
+
 acpi:SWS*:
  ID_VENDOR_FROM_DATABASE=Static
 
@@ -5566,6 +6288,9 @@ acpi:SXB*:
 acpi:SXD*:
  ID_VENDOR_FROM_DATABASE=Silex technology, Inc.
 
+acpi:SXG*:
+ ID_VENDOR_FROM_DATABASE=SELEX GALILEO
+
 acpi:SXL*:
  ID_VENDOR_FROM_DATABASE=SolutionInside
 
@@ -5605,6 +6330,12 @@ acpi:SYV*:
 acpi:SYX*:
  ID_VENDOR_FROM_DATABASE=Prime Systems, Inc.
 
+acpi:SZM*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen MTC Co., Ltd
+
+acpi:SZV*:
+ ID_VENDOR_FROM_DATABASE=OvisLink
+
 acpi:TAA*:
  ID_VENDOR_FROM_DATABASE=Tandberg
 
@@ -5626,6 +6357,9 @@ acpi:TAS*:
 acpi:TAT*:
  ID_VENDOR_FROM_DATABASE=Teleliaison Inc
 
+acpi:TAV*:
+ ID_VENDOR_FROM_DATABASE=Thales Avionics
+
 acpi:TAX*:
  ID_VENDOR_FROM_DATABASE=Taxan (Europe) Ltd
 
@@ -5722,6 +6456,15 @@ acpi:TEL*:
 acpi:TER*:
  ID_VENDOR_FROM_DATABASE=TerraTec Electronic GmbH
 
+acpi:TET*:
+ ID_VENDOR_FROM_DATABASE=TETRADYNE CO., LTD.
+
+acpi:TEX*:
+ ID_VENDOR_FROM_DATABASE=Texas Instruments
+
+acpi:TEZ*:
+ ID_VENDOR_FROM_DATABASE=Tech Source Inc.
+
 acpi:TGC*:
  ID_VENDOR_FROM_DATABASE=Toshiba Global Commerce Solutions, Inc.
 
@@ -5743,6 +6486,9 @@ acpi:THN*:
 acpi:TIC*:
  ID_VENDOR_FROM_DATABASE=Trigem KinfoComm
 
+acpi:TIL*:
+ ID_VENDOR_FROM_DATABASE=Technical Illusions Inc.
+
 acpi:TIP*:
  ID_VENDOR_FROM_DATABASE=TIPTEL AG
 
@@ -5755,6 +6501,9 @@ acpi:TIX*:
 acpi:TKC*:
  ID_VENDOR_FROM_DATABASE=Taiko Electric Works.LTD
 
+acpi:TKG*:
+ ID_VENDOR_FROM_DATABASE=Tek Gear
+
 acpi:TKN*:
  ID_VENDOR_FROM_DATABASE=Teknor Microsystem Inc
 
@@ -5770,12 +6519,21 @@ acpi:TLA*:
 acpi:TLD*:
  ID_VENDOR_FROM_DATABASE=Telindus
 
+acpi:TLE*:
+ ID_VENDOR_FROM_DATABASE=Zhejiang Tianle Digital Electric Co., Ltd.
+
+acpi:TLF*:
+ ID_VENDOR_FROM_DATABASE=Teleforce.,co,ltd
+
 acpi:TLI*:
  ID_VENDOR_FROM_DATABASE=TOSHIBA TELI CORPORATION
 
 acpi:TLK*:
  ID_VENDOR_FROM_DATABASE=Telelink AG
 
+acpi:TLL*:
+ ID_VENDOR_FROM_DATABASE=Thinklogical
+
 acpi:TLS*:
  ID_VENDOR_FROM_DATABASE=Teleste Educational OY
 
@@ -5827,6 +6585,12 @@ acpi:TOE*:
 acpi:TOG*:
  ID_VENDOR_FROM_DATABASE=The OPEN Group
 
+acpi:TOL*:
+ ID_VENDOR_FROM_DATABASE=TCL Corporation
+
+acpi:TOM*:
+ ID_VENDOR_FROM_DATABASE=Ceton Corporation
+
 acpi:TON*:
  ID_VENDOR_FROM_DATABASE=TONNA
 
@@ -5842,6 +6606,9 @@ acpi:TOU*:
 acpi:TPC*:
  ID_VENDOR_FROM_DATABASE=Touch Panel Systems Corporation
 
+acpi:TPD*:
+ ID_VENDOR_FROM_DATABASE=Times (Shanghai) Computer Co., Ltd.
+
 acpi:TPE*:
  ID_VENDOR_FROM_DATABASE=Technology Power Enterprises Inc
 
@@ -5869,6 +6636,9 @@ acpi:TPZ*:
 acpi:TRA*:
  ID_VENDOR_FROM_DATABASE=TriTech Microelectronics International
 
+acpi:TRB*:
+ ID_VENDOR_FROM_DATABASE=Triumph Board a.s.
+
 acpi:TRC*:
  ID_VENDOR_FROM_DATABASE=Trioc AB
 
@@ -5923,6 +6693,9 @@ acpi:TSF*:
 acpi:TSG*:
  ID_VENDOR_FROM_DATABASE=The Software Group Ltd
 
+acpi:TSH*:
+ ID_VENDOR_FROM_DATABASE=ELAN MICROELECTRONICS CORPORATION
+
 acpi:TSI*:
  ID_VENDOR_FROM_DATABASE=TeleVideo Systems
 
@@ -5960,11 +6733,17 @@ acpi:TTK*:
  ID_VENDOR_FROM_DATABASE=Totoku Electric Company Ltd
 
 acpi:TTL*:
- ID_VENDOR_FROM_DATABASE=2-Tel B.V.
+ ID_VENDOR_FROM_DATABASE=2-Tel B.V
+
+acpi:TTP*:
+ ID_VENDOR_FROM_DATABASE=Toshiba Corporation
 
 acpi:TTS*:
  ID_VENDOR_FROM_DATABASE=TechnoTrend Systemtechnik GmbH
 
+acpi:TTX*:
+ ID_VENDOR_FROM_DATABASE=Taitex Corporation
+
 acpi:TTY*:
  ID_VENDOR_FROM_DATABASE=TRIDELITY Display Solutions GmbH
 
@@ -6034,6 +6813,9 @@ acpi:UBI*:
 acpi:UBL*:
  ID_VENDOR_FROM_DATABASE=Ubinetics Ltd.
 
+acpi:UBU*:
+ ID_VENDOR_FROM_DATABASE=Canonical Ltd.
+
 acpi:UDN*:
  ID_VENDOR_FROM_DATABASE=Uniden Corporation
 
@@ -6085,9 +6867,18 @@ acpi:UNB*:
 acpi:UNC*:
  ID_VENDOR_FROM_DATABASE=Unisys Corporation
 
-acpi:UNI*:
+acpi:UND*
  ID_VENDOR_FROM_DATABASE=Unisys Corporation
 
+acpi:UNE*
+ ID_VENDOR_FROM_DATABASE=Unisys Corporation
+
+acpi:UNF*
+ ID_VENDOR_FROM_DATABASE=Unisys Corporation
+
+acpi:UNI*:
+ ID_VENDOR_FROM_DATABASE=Uniform Industry Corp.
+
 acpi:UNM*:
  ID_VENDOR_FROM_DATABASE=Unisys Corporation
 
@@ -6118,9 +6909,15 @@ acpi:URD*:
 acpi:USA*:
  ID_VENDOR_FROM_DATABASE=Utimaco Safeware AG
 
+acpi:USC*:
+ ID_VENDOR_FROM_DATABASE=UltraStor
+
 acpi:USD*:
  ID_VENDOR_FROM_DATABASE=U.S. Digital Corporation
 
+acpi:USE*:
+ ID_VENDOR_FROM_DATABASE=U. S. Electronics Inc.
+
 acpi:USI*:
  ID_VENDOR_FROM_DATABASE=Universal Scientific Industrial Co., Ltd.
 
@@ -6133,6 +6930,12 @@ acpi:UTD*:
 acpi:UWC*:
  ID_VENDOR_FROM_DATABASE=Uniwill Computer Corp.
 
+acpi:VAD*:
+ ID_VENDOR_FROM_DATABASE=Vaddio, LLC
+
+acpi:VAI*:
+ ID_VENDOR_FROM_DATABASE=VAIO Corporation
+
 acpi:VAL*:
  ID_VENDOR_FROM_DATABASE=Valence Computing Corporation
 
@@ -6208,6 +7011,9 @@ acpi:VID*:
 acpi:VIK*:
  ID_VENDOR_FROM_DATABASE=Viking Connectors
 
+acpi:VIM*:
+ ID_VENDOR_FROM_DATABASE=Via Mons Ltd.
+
 acpi:VIN*:
  ID_VENDOR_FROM_DATABASE=Vine Micros Ltd
 
@@ -6226,9 +7032,18 @@ acpi:VIZ*:
 acpi:VLB*:
  ID_VENDOR_FROM_DATABASE=ValleyBoard Ltda.
 
+acpi:VLC*:
+ ID_VENDOR_FROM_DATABASE=VersaLogic Corporation
+
+acpi:VLK*:
+ ID_VENDOR_FROM_DATABASE=Vislink International Ltd
+
 acpi:VLT*:
  ID_VENDOR_FROM_DATABASE=VideoLan Technologies
 
+acpi:VLV*:
+ ID_VENDOR_FROM_DATABASE=Valve Corporation
+
 acpi:VMI*:
  ID_VENDOR_FROM_DATABASE=Vermont Microsystems
 
@@ -6250,12 +7065,18 @@ acpi:VPI*:
 acpi:VPR*:
  ID_VENDOR_FROM_DATABASE=Best Buy
 
+acpi:VPX*:
+ ID_VENDOR_FROM_DATABASE=VPixx Technologies Inc.
+
 acpi:VQ@*:
  ID_VENDOR_FROM_DATABASE=Vision Quest
 
 acpi:VRC*:
  ID_VENDOR_FROM_DATABASE=Virtual Resources Corporation
 
+acpi:VRM*:
+ ID_VENDOR_FROM_DATABASE=VRmagic Holding AG
+
 acpi:VSC*:
  ID_VENDOR_FROM_DATABASE=ViewSonic Corporation
 
@@ -6274,6 +7095,9 @@ acpi:VSP*:
 acpi:VSR*:
  ID_VENDOR_FROM_DATABASE=V-Star Electronics Inc.
 
+acpi:VTB*:
+ ID_VENDOR_FROM_DATABASE=Videotechnik Breithaupt
+
 acpi:VTC*:
  ID_VENDOR_FROM_DATABASE=VTel Corporation
 
@@ -6343,7 +7167,7 @@ acpi:WEB*:
 acpi:WEC*:
  ID_VENDOR_FROM_DATABASE=Winbond Electronics Corporation
 
-acpi:WEL *:
+acpi:WEL*:
  ID_VENDOR_FROM_DATABASE=W-DEV
 
 acpi:WEY*:
@@ -6421,6 +7245,12 @@ acpi:WTS*:
 acpi:WVM*:
  ID_VENDOR_FROM_DATABASE=Wave Systems Corporation
 
+acpi:WVV*:
+ ID_VENDOR_FROM_DATABASE=WolfVision GmbH
+
+acpi:WWP*:
+ ID_VENDOR_FROM_DATABASE=Wipotec Wiege- und Positioniersysteme GmbH
+
 acpi:WWV*:
  ID_VENDOR_FROM_DATABASE=World Wide Video, Inc.
 
@@ -6428,7 +7258,7 @@ acpi:WXT*:
  ID_VENDOR_FROM_DATABASE=Woxter Technology Co. Ltd
 
 acpi:WYS*:
- ID_VENDOR_FROM_DATABASE=Myse Technology
+ ID_VENDOR_FROM_DATABASE=Wyse Technology
 
 acpi:WYT*:
  ID_VENDOR_FROM_DATABASE=Wooyoung Image & Information Co.,Ltd.
@@ -6502,6 +7332,9 @@ acpi:XTN*:
 acpi:XYC*:
  ID_VENDOR_FROM_DATABASE=Xycotec Computer GmbH
 
+acpi:XYE*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen Zhuona Technology Co., Ltd.
+
 acpi:YED*:
  ID_VENDOR_FROM_DATABASE=Y-E Data Inc
 
@@ -6529,18 +7362,30 @@ acpi:ZAZ*:
 acpi:ZBR*:
  ID_VENDOR_FROM_DATABASE=Zebra Technologies International, LLC
 
+acpi:ZBX*:
+ ID_VENDOR_FROM_DATABASE=Zebax Technologies
+
+acpi:ZCM*:
+ ID_VENDOR_FROM_DATABASE=Zenith
+
 acpi:ZCT*:
  ID_VENDOR_FROM_DATABASE=ZeitControl cardsystems GmbH
 
 acpi:ZDS*:
  ID_VENDOR_FROM_DATABASE=Zenith Data Systems
 
+acpi:ZEN*:
+ ID_VENDOR_FROM_DATABASE=ZENIC Inc.
+
 acpi:ZGT*:
  ID_VENDOR_FROM_DATABASE=Zenith Data Systems
 
 acpi:ZIC*:
  ID_VENDOR_FROM_DATABASE=Nationz Technologies Inc.
 
+acpi:ZMC*:
+ ID_VENDOR_FROM_DATABASE=HangZhou ZMCHIVIN
+
 acpi:ZMT*:
  ID_VENDOR_FROM_DATABASE=Zalman Tech Co., Ltd.
 
@@ -6577,6 +7422,9 @@ acpi:ZTM*:
 acpi:ZTT*:
  ID_VENDOR_FROM_DATABASE=Z3 Technology
 
+acpi:ZWE*:
+ ID_VENDOR_FROM_DATABASE=Shenzhen Zowee Technology Co., LTD
+
 acpi:ZYD*:
  ID_VENDOR_FROM_DATABASE=Zydacron Inc
 
@@ -6591,3 +7439,6 @@ acpi:ZYX*:
 
 acpi:ZZZ*:
  ID_VENDOR_FROM_DATABASE=Boca Research Inc
+
+acpi:inu*:
+ ID_VENDOR_FROM_DATABASE=Inovatec S.p.A.
diff --git a/src/grp-udev/hwdb/20-acpi-vendor.hwdb.patch b/src/grp-udev/hwdb/20-acpi-vendor.hwdb.patch
new file mode 100644
index 0000000000..734dc59422
--- /dev/null
+++ b/src/grp-udev/hwdb/20-acpi-vendor.hwdb.patch
@@ -0,0 +1,492 @@
+--- 20-acpi-vendor.hwdb.base	2016-06-10 12:40:38.143970821 +0200
++++ 20-acpi-vendor.hwdb	2016-06-10 12:43:40.557054147 +0200
+@@ -3,6 +3,8 @@
+ # Data imported from:
+ #     http://www.uefi.org/uefi-pnp-export
+ #     http://www.uefi.org/uefi-acpi-export
++#
++# With various additions from other sources
+
+ acpi:3NOD*:
+  ID_VENDOR_FROM_DATABASE=Shenzhen three Connaught Information Technology Co., Ltd. (3nod Group)
+@@ -10,9 +12,6 @@
+ acpi:AAVA*:
+  ID_VENDOR_FROM_DATABASE=Aava Mobile Oy
+
+-acpi:ACPI*:
+- ID_VENDOR_FROM_DATABASE=Intel Corporation
+-
+ acpi:AMDI*:
+  ID_VENDOR_FROM_DATABASE=AMD
+
+@@ -217,6 +216,9 @@
+ acpi:AAA*:
+  ID_VENDOR_FROM_DATABASE=Avolites Ltd
+
++acpi:AAC*:
++ ID_VENDOR_FROM_DATABASE=AcerView
++
+ acpi:AAE*:
+  ID_VENDOR_FROM_DATABASE=Anatek Electronics Inc.
+
+@@ -241,6 +243,9 @@
+ acpi:ABO*:
+  ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
+
++acpi:ABP*:
++ ID_VENDOR_FROM_DATABASE=Advansys
++
+ acpi:ABS*:
+  ID_VENDOR_FROM_DATABASE=Abaco Systems, Inc.
+
+@@ -286,7 +291,7 @@
+ acpi:ACO*:
+  ID_VENDOR_FROM_DATABASE=Allion Computer Inc.
+
+-acpi:ACP*:
++acpi:ACP[0-9A-F]*:
+  ID_VENDOR_FROM_DATABASE=Aspen Tech Inc
+
+ acpi:ACR*:
+@@ -556,6 +561,9 @@
+ acpi:AMT*:
+  ID_VENDOR_FROM_DATABASE=AMT International Industry
+
++acpi:AMW*:
++ ID_VENDOR_FROM_DATABASE=AMW
++
+ acpi:AMX*:
+  ID_VENDOR_FROM_DATABASE=AMX LLC
+
+@@ -604,6 +612,9 @@
+ acpi:AOA*:
+  ID_VENDOR_FROM_DATABASE=AOpen Inc.
+
++acpi:AOC*:
++ ID_VENDOR_FROM_DATABASE=AOC
++
+ acpi:AOE*:
+  ID_VENDOR_FROM_DATABASE=Advanced Optics Electronics, Inc.
+
+@@ -613,6 +624,9 @@
+ acpi:AOT*:
+  ID_VENDOR_FROM_DATABASE=Alcatel
+
++acpi:APA*:
++ ID_VENDOR_FROM_DATABASE=Adaptec
++
+ acpi:APC*:
+  ID_VENDOR_FROM_DATABASE=American Power Conversion
+
+@@ -788,7 +802,7 @@
+  ID_VENDOR_FROM_DATABASE=Alps Electric Inc
+
+ acpi:AUO*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - AUO
++ ID_VENDOR_FROM_DATABASE=AU Optronics
+
+ acpi:AUR*:
+  ID_VENDOR_FROM_DATABASE=Aureal Semiconductor
+@@ -862,6 +876,9 @@
+ acpi:AXC*:
+  ID_VENDOR_FROM_DATABASE=AXIOMTEK CO., LTD.
+
++acpi:AXE*:
++ ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
++
+ acpi:AXI*:
+  ID_VENDOR_FROM_DATABASE=American Magnetics
+
+@@ -1003,6 +1020,9 @@
+ acpi:BML*:
+  ID_VENDOR_FROM_DATABASE=BIOMED Lab
+
++acpi:BMM*:
++ ID_VENDOR_FROM_DATABASE=BMM
++
+ acpi:BMS*:
+  ID_VENDOR_FROM_DATABASE=BIOMEDISYS
+
+@@ -1015,6 +1035,9 @@
+ acpi:BNO*:
+  ID_VENDOR_FROM_DATABASE=Bang & Olufsen
+
++acpi:BNQ*:
++ ID_VENDOR_FROM_DATABASE=BenQ Corporation
++
+ acpi:BNS*:
+  ID_VENDOR_FROM_DATABASE=Boulder Nonlinear Systems
+
+@@ -1255,6 +1278,9 @@
+ acpi:CHA*:
+  ID_VENDOR_FROM_DATABASE=Chase Research PLC
+
++acpi:CHC*:
++ ID_VENDOR_FROM_DATABASE=Chic Technology Corp.
++
+ acpi:CHD*:
+  ID_VENDOR_FROM_DATABASE=ChangHong Electric Co.,Ltd
+
+@@ -1402,6 +1428,9 @@
+ acpi:COD*:
+  ID_VENDOR_FROM_DATABASE=CODAN Pty. Ltd.
+
++acpi:COG*:
++ ID_VENDOR_FROM_DATABASE=Cogent
++
+ acpi:COI*:
+  ID_VENDOR_FROM_DATABASE=Codec Inc.
+
+@@ -1805,7 +1834,7 @@
+  ID_VENDOR_FROM_DATABASE=Dragon Information Technology
+
+ acpi:DJE*:
+- ID_VENDOR_FROM_DATABASE=Capstone Visua lProduct Development
++ ID_VENDOR_FROM_DATABASE=Capstone Visual Product Development
+
+ acpi:DJP*:
+  ID_VENDOR_FROM_DATABASE=Maygay Machines, Ltd
+@@ -2119,6 +2148,9 @@
+ acpi:EIC*:
+  ID_VENDOR_FROM_DATABASE=Eicon Technology Corporation
+
++acpi:EIZ*:
++ ID_VENDOR_FROM_DATABASE=Eizo
++
+ acpi:EKA*:
+  ID_VENDOR_FROM_DATABASE=MagTek Inc.
+
+@@ -2377,6 +2409,9 @@
+ acpi:FCG*:
+  ID_VENDOR_FROM_DATABASE=First International Computer Ltd
+
++acpi:FCM*:
++ ID_VENDOR_FROM_DATABASE=Funai
++
+ acpi:FCS*:
+  ID_VENDOR_FROM_DATABASE=Focus Enhancements, Inc.
+
+@@ -2839,6 +2874,9 @@
+ acpi:HEC*:
+  ID_VENDOR_FROM_DATABASE=Hisense Electric Co., Ltd.
+
++acpi:HEI*:
++ ID_VENDOR_FROM_DATABASE=Hyundai
++
+ acpi:HEL*:
+  ID_VENDOR_FROM_DATABASE=Hitachi Micro Systems Europe Ltd
+
+@@ -2968,6 +3006,9 @@
+ acpi:HSD*:
+  ID_VENDOR_FROM_DATABASE=HannStar Display Corp
+
++acpi:HSL*:
++ ID_VENDOR_FROM_DATABASE=Hansol
++
+ acpi:HSM*:
+  ID_VENDOR_FROM_DATABASE=AT&T Microelectronics
+
+@@ -3082,6 +3123,9 @@
+ acpi:ICI*:
+  ID_VENDOR_FROM_DATABASE=Infotek Communication Inc
+
++acpi:ICL*:
++ ID_VENDOR_FROM_DATABASE=Fujitsu ICL
++
+ acpi:ICM*:
+  ID_VENDOR_FROM_DATABASE=Intracom SA
+
+@@ -3175,6 +3219,9 @@
+ acpi:IKE*:
+  ID_VENDOR_FROM_DATABASE=Ikegami Tsushinki Co. Ltd.
+
++acpi:IKN*:
++ ID_VENDOR_FROM_DATABASE=IKON
++
+ acpi:IKS*:
+  ID_VENDOR_FROM_DATABASE=Ikos Systems Inc
+
+@@ -3217,6 +3264,9 @@
+ acpi:IMT*:
+  ID_VENDOR_FROM_DATABASE=Inmax Technology Corporation
+
++acpi:IMS*:
++ ID_VENDOR_FROM_DATABASE=Integrated Micro Solution Inc.
++
+ acpi:INA*:
+  ID_VENDOR_FROM_DATABASE=Inventec Corporation
+
+@@ -3712,6 +3762,9 @@
+ acpi:LAN*:
+  ID_VENDOR_FROM_DATABASE=Sodeman Lancom Inc
+
++acpi:LAP*:
++ ID_VENDOR_FROM_DATABASE=BenQ
++
+ acpi:LAS*:
+  ID_VENDOR_FROM_DATABASE=LASAT Comm. A/S
+
+@@ -3757,6 +3810,9 @@
+ acpi:LED*:
+  ID_VENDOR_FROM_DATABASE=Long Engineering Design Inc
+
++acpi:LED*:
++ ID_VENDOR_FROM_DATABASE=LeafNet
++
+ acpi:LEG*:
+  ID_VENDOR_FROM_DATABASE=Legerity, Inc
+
+@@ -3772,6 +3828,9 @@
+ acpi:LGC*:
+  ID_VENDOR_FROM_DATABASE=Logic Ltd
+
++acpi:LGD*:
++ ID_VENDOR_FROM_DATABASE=LG Display
++
+ acpi:LGI*:
+  ID_VENDOR_FROM_DATABASE=Logitech Inc
+
+@@ -3823,6 +3882,9 @@
+ acpi:LND*:
+  ID_VENDOR_FROM_DATABASE=Land Computer Company Ltd
+
++acpi:LNE*:
++ ID_VENDOR_FROM_DATABASE=Linksys
++
+ acpi:LNK*:
+  ID_VENDOR_FROM_DATABASE=Link Tech Inc
+
+@@ -3857,7 +3919,7 @@
+  ID_VENDOR_FROM_DATABASE=Design Technology
+
+ acpi:LPL*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - LPL
++ ID_VENDOR_FROM_DATABASE=LG Philips
+
+ acpi:LSC*:
+  ID_VENDOR_FROM_DATABASE=LifeSize Communications
+@@ -4027,6 +4089,9 @@
+ acpi:MCX*:
+  ID_VENDOR_FROM_DATABASE=Millson Custom Solutions Inc.
+
++acpi:MCY*:
++ ID_VENDOR_FROM_DATABASE=Microdyne
++
+ acpi:MDA*:
+  ID_VENDOR_FROM_DATABASE=Media4 Inc
+
+@@ -4252,6 +4317,9 @@
+ acpi:MOM*:
+  ID_VENDOR_FROM_DATABASE=Momentum Data Systems
+
++acpi:MON*:
++ ID_VENDOR_FROM_DATABASE=Daewoo
++
+ acpi:MOS*:
+  ID_VENDOR_FROM_DATABASE=Moses Corporation
+
+@@ -4474,6 +4542,9 @@
+ acpi:NAL*:
+  ID_VENDOR_FROM_DATABASE=Network Alchemy
+
++acpi:NAN*:
++ ID_VENDOR_FROM_DATABASE=Nanao
++
+ acpi:NAT*:
+  ID_VENDOR_FROM_DATABASE=NaturalPoint Inc.
+
+@@ -4969,6 +5040,9 @@
+ acpi:PCX*:
+  ID_VENDOR_FROM_DATABASE=PC Xperten
+
++acpi:PDC*:
++ ID_VENDOR_FROM_DATABASE=Polaroid
++
+ acpi:PDM*:
+  ID_VENDOR_FROM_DATABASE=Psion Dacom Plc.
+
+@@ -5032,9 +5106,6 @@
+ acpi:PHE*:
+  ID_VENDOR_FROM_DATABASE=Philips Medical Systems Boeblingen GmbH
+
+-acpi:PHI*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - PHI
+-
+ acpi:PHL*:
+  ID_VENDOR_FROM_DATABASE=Philips Consumer Electronics Company
+
+@@ -5116,9 +5187,6 @@
+ acpi:PNL*:
+  ID_VENDOR_FROM_DATABASE=Panelview, Inc.
+
+-acpi:PNP*:
+- ID_VENDOR_FROM_DATABASE=Microsoft
+-
+ acpi:PNR*:
+  ID_VENDOR_FROM_DATABASE=Planar Systems, Inc.
+
+@@ -5248,15 +5316,9 @@
+ acpi:PTS*:
+  ID_VENDOR_FROM_DATABASE=Plain Tree Systems Inc
+
+-acpi:PTW*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - PTW
+-
+ acpi:PUL*:
+  ID_VENDOR_FROM_DATABASE=Pulse-Eight Ltd
+
+-acpi:PVC*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - PVC
+-
+ acpi:PVG*:
+  ID_VENDOR_FROM_DATABASE=Proview Global Co., Ltd
+
+@@ -5560,9 +5622,6 @@
+ acpi:RTI*:
+  ID_VENDOR_FROM_DATABASE=Rancho Tech Inc
+
+-acpi:RTK*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - RTK
+-
+ acpi:RTL*:
+  ID_VENDOR_FROM_DATABASE=Realtek Semiconductor Company Ltd
+
+@@ -5725,9 +5784,6 @@
+ acpi:SEE*:
+  ID_VENDOR_FROM_DATABASE=SeeColor Corporation
+
+-acpi:SEG*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - SEG
+-
+ acpi:SEI*:
+  ID_VENDOR_FROM_DATABASE=Seitz & Associates Inc
+
+@@ -6178,6 +6234,9 @@
+ acpi:SVD*:
+  ID_VENDOR_FROM_DATABASE=SVD Computer
+
++acpi:SVE*:
++ ID_VENDOR_FROM_DATABASE=SVEC
++
+ acpi:SVI*:
+  ID_VENDOR_FROM_DATABASE=Sun Microsystems
+
+@@ -6259,6 +6318,9 @@
+ acpi:SZM*:
+  ID_VENDOR_FROM_DATABASE=Shenzhen MTC Co., Ltd
+
++acpi:SZV*:
++ ID_VENDOR_FROM_DATABASE=OvisLink
++
+ acpi:TAA*:
+  ID_VENDOR_FROM_DATABASE=Tandberg
+
+@@ -6343,6 +6405,9 @@
+ acpi:TDD*:
+  ID_VENDOR_FROM_DATABASE=Tandberg Data Display AS
+
++acpi:TDK*:
++ ID_VENDOR_FROM_DATABASE=TDK USA Corporation
++
+ acpi:TDM*:
+  ID_VENDOR_FROM_DATABASE=Tandem Computer Europe Inc
+
+@@ -6379,6 +6444,9 @@
+ acpi:TET*:
+  ID_VENDOR_FROM_DATABASE=TETRADYNE CO., LTD.
+
++acpi:TEX*:
++ ID_VENDOR_FROM_DATABASE=Texas Instruments
++
+ acpi:TEZ*:
+  ID_VENDOR_FROM_DATABASE=Tech Source Inc.
+
+@@ -6490,9 +6558,6 @@
+ acpi:TNC*:
+  ID_VENDOR_FROM_DATABASE=TNC Industrial Company Ltd
+
+-acpi:TNJ*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - TNJ
+-
+ acpi:TNM*:
+  ID_VENDOR_FROM_DATABASE=TECNIMAGEN SA
+
+@@ -6787,14 +6852,14 @@
+ acpi:UNC*:
+  ID_VENDOR_FROM_DATABASE=Unisys Corporation
+
+-acpi:UND*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - UND
++acpi:UND*
++ ID_VENDOR_FROM_DATABASE=Unisys Corporation
+
+-acpi:UNE*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - UNE
++acpi:UNE*
++ ID_VENDOR_FROM_DATABASE=Unisys Corporation
+
+-acpi:UNF*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - UNF
++acpi:UNF*
++ ID_VENDOR_FROM_DATABASE=Unisys Corporation
+
+ acpi:UNI*:
+  ID_VENDOR_FROM_DATABASE=Uniform Industry Corp.
+@@ -6829,6 +6894,9 @@
+ acpi:USA*:
+  ID_VENDOR_FROM_DATABASE=Utimaco Safeware AG
+
++acpi:USC*:
++ ID_VENDOR_FROM_DATABASE=UltraStor
++
+ acpi:USD*:
+  ID_VENDOR_FROM_DATABASE=U.S. Digital Corporation
+
+@@ -7057,9 +7125,6 @@
+ acpi:WAL*:
+  ID_VENDOR_FROM_DATABASE=Wave Access
+
+-acpi:WAN*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - WAN
+-
+ acpi:WAV*:
+  ID_VENDOR_FROM_DATABASE=Wavephore
+
+@@ -7178,7 +7243,7 @@
+  ID_VENDOR_FROM_DATABASE=Woxter Technology Co. Ltd
+
+ acpi:WYS*:
+- ID_VENDOR_FROM_DATABASE=Myse Technology
++ ID_VENDOR_FROM_DATABASE=Wyse Technology
+
+ acpi:WYT*:
+  ID_VENDOR_FROM_DATABASE=Wooyoung Image & Information Co.,Ltd.
+@@ -7192,9 +7257,6 @@
+ acpi:XDM*:
+  ID_VENDOR_FROM_DATABASE=XDM Ltd.
+
+-acpi:XER*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - XER
+-
+ acpi:XFG*:
+  ID_VENDOR_FROM_DATABASE=Jan Strapko - FOTO
+
+@@ -7222,9 +7284,6 @@
+ acpi:XNT*:
+  ID_VENDOR_FROM_DATABASE=XN Technologies, Inc.
+
+-acpi:XOC*:
+- ID_VENDOR_FROM_DATABASE=DO NOT USE - XOC
+-
+ acpi:XQU*:
+  ID_VENDOR_FROM_DATABASE=SHANGHAI SVA-DAV ELECTRONICS CO., LTD
+
+@@ -7291,6 +7350,9 @@
+ acpi:ZBX*:
+  ID_VENDOR_FROM_DATABASE=Zebax Technologies
+
++acpi:ZCM*:
++ ID_VENDOR_FROM_DATABASE=Zenith
++
+ acpi:ZCT*:
+  ID_VENDOR_FROM_DATABASE=ZeitControl cardsystems GmbH
diff --git a/src/grp-udev/hwdb/20-bluetooth-vendor-product.hwdb b/src/grp-udev/hwdb/20-bluetooth-vendor-product.hwdb
index 60b62b0b38..5089ab4e04 100644
--- a/src/grp-udev/hwdb/20-bluetooth-vendor-product.hwdb
+++ b/src/grp-udev/hwdb/20-bluetooth-vendor-product.hwdb
@@ -151,7 +151,7 @@ bluetooth:v0030*
  ID_VENDOR_FROM_DATABASE=ST Microelectronics
 
 bluetooth:v0031*
- ID_VENDOR_FROM_DATABASE=Synopsis
+ ID_VENDOR_FROM_DATABASE=Synopsys, Inc.
 
 bluetooth:v0032*
  ID_VENDOR_FROM_DATABASE=Red-M (Communications) Ltd
@@ -868,7 +868,7 @@ bluetooth:v011E*
  ID_VENDOR_FROM_DATABASE=Skoda Auto a.s.
 
 bluetooth:v011F*
- ID_VENDOR_FROM_DATABASE=Volkswagon AG
+ ID_VENDOR_FROM_DATABASE=Volkswagen AG
 
 bluetooth:v0120*
  ID_VENDOR_FROM_DATABASE=Porsche AG
@@ -2648,3 +2648,183 @@ bluetooth:v036F*
 
 bluetooth:v0370*
  ID_VENDOR_FROM_DATABASE=Wazombi Labs OÜ
+
+bluetooth:v0371*
+ ID_VENDOR_FROM_DATABASE=ORBCOMM
+
+bluetooth:v0372*
+ ID_VENDOR_FROM_DATABASE=Nixie Labs, Inc.
+
+bluetooth:v0373*
+ ID_VENDOR_FROM_DATABASE=AppNearMe Ltd
+
+bluetooth:v0374*
+ ID_VENDOR_FROM_DATABASE=Holman Industries
+
+bluetooth:v0375*
+ ID_VENDOR_FROM_DATABASE=Expain AS
+
+bluetooth:v0376*
+ ID_VENDOR_FROM_DATABASE=Electronic Temperature Instruments Ltd
+
+bluetooth:v0377*
+ ID_VENDOR_FROM_DATABASE=Plejd AB
+
+bluetooth:v0378*
+ ID_VENDOR_FROM_DATABASE=Propeller Health
+
+bluetooth:v0379*
+ ID_VENDOR_FROM_DATABASE=Shenzhen iMCO Electronic Technology Co.,Ltd
+
+bluetooth:v037A*
+ ID_VENDOR_FROM_DATABASE=Algoria
+
+bluetooth:v037B*
+ ID_VENDOR_FROM_DATABASE=Apption Labs Inc.
+
+bluetooth:v037C*
+ ID_VENDOR_FROM_DATABASE=Cronologics Corporation
+
+bluetooth:v037D*
+ ID_VENDOR_FROM_DATABASE=MICRODIA Ltd.
+
+bluetooth:v037E*
+ ID_VENDOR_FROM_DATABASE=lulabytes S.L.
+
+bluetooth:v037F*
+ ID_VENDOR_FROM_DATABASE=Nestec S.A.
+
+bluetooth:v0380*
+ ID_VENDOR_FROM_DATABASE=LLC "MEGA-F service"
+
+bluetooth:v0381*
+ ID_VENDOR_FROM_DATABASE=Sharp Corporation
+
+bluetooth:v0382*
+ ID_VENDOR_FROM_DATABASE=Precision Outcomes Ltd
+
+bluetooth:v0383*
+ ID_VENDOR_FROM_DATABASE=Kronos Incorporated
+
+bluetooth:v0384*
+ ID_VENDOR_FROM_DATABASE=OCOSMOS Co., Ltd.
+
+bluetooth:v0385*
+ ID_VENDOR_FROM_DATABASE=Embedded Electronic Solutions Ltd. dba e2Solutions
+
+bluetooth:v0386*
+ ID_VENDOR_FROM_DATABASE=Aterica Inc.
+
+bluetooth:v0387*
+ ID_VENDOR_FROM_DATABASE=BluStor PMC, Inc.
+
+bluetooth:v0388*
+ ID_VENDOR_FROM_DATABASE=Kapsch TrafficCom AB
+
+bluetooth:v0389*
+ ID_VENDOR_FROM_DATABASE=ActiveBlu Corporation
+
+bluetooth:v038A*
+ ID_VENDOR_FROM_DATABASE=Kohler Mira Limited
+
+bluetooth:v038B*
+ ID_VENDOR_FROM_DATABASE=Noke
+
+bluetooth:v038C*
+ ID_VENDOR_FROM_DATABASE=Appion Inc.
+
+bluetooth:v038D*
+ ID_VENDOR_FROM_DATABASE=Resmed Ltd
+
+bluetooth:v038E*
+ ID_VENDOR_FROM_DATABASE=Crownstone B.V.
+
+bluetooth:v038F*
+ ID_VENDOR_FROM_DATABASE=Xiaomi Inc.
+
+bluetooth:v0390*
+ ID_VENDOR_FROM_DATABASE=INFOTECH s.r.o.
+
+bluetooth:v0391*
+ ID_VENDOR_FROM_DATABASE=Thingsquare AB
+
+bluetooth:v0392*
+ ID_VENDOR_FROM_DATABASE=T&D
+
+bluetooth:v0393*
+ ID_VENDOR_FROM_DATABASE=LAVAZZA S.p.A.
+
+bluetooth:v0394*
+ ID_VENDOR_FROM_DATABASE=Netclearance Systems, Inc.
+
+bluetooth:v0395*
+ ID_VENDOR_FROM_DATABASE=SDATAWAY
+
+bluetooth:v0396*
+ ID_VENDOR_FROM_DATABASE=BLOKS GmbH
+
+bluetooth:v0397*
+ ID_VENDOR_FROM_DATABASE=LEGO System A/S
+
+bluetooth:v0398*
+ ID_VENDOR_FROM_DATABASE=Thetatronics Ltd
+
+bluetooth:v0399*
+ ID_VENDOR_FROM_DATABASE=Nikon Corporation
+
+bluetooth:v039A*
+ ID_VENDOR_FROM_DATABASE=NeST
+
+bluetooth:v039B*
+ ID_VENDOR_FROM_DATABASE=South Silicon Valley Microelectronics
+
+bluetooth:v039C*
+ ID_VENDOR_FROM_DATABASE=ALE International
+
+bluetooth:v039D*
+ ID_VENDOR_FROM_DATABASE=CareView Communications, Inc.
+
+bluetooth:v039E*
+ ID_VENDOR_FROM_DATABASE=SchoolBoard Limited
+
+bluetooth:v039F*
+ ID_VENDOR_FROM_DATABASE=Molex Corporation
+
+bluetooth:v03A0*
+ ID_VENDOR_FROM_DATABASE=IVT Wireless Limited
+
+bluetooth:v03A1*
+ ID_VENDOR_FROM_DATABASE=Alpine Labs LLC
+
+bluetooth:v03A2*
+ ID_VENDOR_FROM_DATABASE=Candura Instruments
+
+bluetooth:v03A3*
+ ID_VENDOR_FROM_DATABASE=SmartMovt Technology Co., Ltd
+
+bluetooth:v03A4*
+ ID_VENDOR_FROM_DATABASE=Token Zero Ltd
+
+bluetooth:v03A5*
+ ID_VENDOR_FROM_DATABASE=ACE CAD Enterprise Co., Ltd. (ACECAD)
+
+bluetooth:v03A6*
+ ID_VENDOR_FROM_DATABASE=Medela, Inc
+
+bluetooth:v03A7*
+ ID_VENDOR_FROM_DATABASE=AeroScout
+
+bluetooth:v03A8*
+ ID_VENDOR_FROM_DATABASE=Esrille Inc.
+
+bluetooth:v03A9*
+ ID_VENDOR_FROM_DATABASE=THINKERLY SRL
+
+bluetooth:v03AA*
+ ID_VENDOR_FROM_DATABASE=Exon Sp. z o.o.
+
+bluetooth:v03AB*
+ ID_VENDOR_FROM_DATABASE=Meizu Technology Co., Ltd.
+
+bluetooth:v03AC*
+ ID_VENDOR_FROM_DATABASE=Smablo LTD
diff --git a/src/grp-udev/hwdb/20-pci-vendor-model.hwdb b/src/grp-udev/hwdb/20-pci-vendor-model.hwdb
index f068e53fbc..0c829c8aec 100644
--- a/src/grp-udev/hwdb/20-pci-vendor-model.hwdb
+++ b/src/grp-udev/hwdb/20-pci-vendor-model.hwdb
@@ -4071,55 +4071,55 @@ pci:v00001002d00005A12sv000015D9sd0000A811*
  ID_MODEL_FROM_DATABASE=RD890 Northbridge only dual slot (2x8) PCI-e GFX Hydra part (H8DGU)
 
 pci:v00001002d00005A13*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (external gfx0 port A)
+ ID_MODEL_FROM_DATABASE=RD890S/SR5650 Host Bridge
 
 pci:v00001002d00005A14*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (external gfx0 port B)
+ ID_MODEL_FROM_DATABASE=RD9x0/RX980 Host Bridge
 
 pci:v00001002d00005A15*
  ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port A)
 
 pci:v00001002d00005A16*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port B)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GFX port 0)
 
 pci:v00001002d00005A17*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port C)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0 PCI to PCI bridge (PCI Express GFX port 1)
 
 pci:v00001002d00005A18*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port D)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 0)
 
 pci:v00001002d00005A18sv000015D9sd0000A811*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port D) (H8DGU)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 0) (H8DGU)
 
 pci:v00001002d00005A19*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port E)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 1)
 
 pci:v00001002d00005A1A*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port F)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 2)
 
 pci:v00001002d00005A1B*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port G)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 3)
 
 pci:v00001002d00005A1C*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (PCI express gpp port H)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 4)
 
 pci:v00001002d00005A1D*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (external gfx1 port A)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP Port 5)
 
 pci:v00001002d00005A1E*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (external gfx1 port B)
+ ID_MODEL_FROM_DATABASE=RD890/RD9x0/RX980 PCI to PCI bridge (PCI Express GPP2 Port 0)
 
 pci:v00001002d00005A1F*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (NB-SB link)
+ ID_MODEL_FROM_DATABASE=RD890/RD990 PCI to PCI bridge (PCI Express GFX2 port 0)
 
 pci:v00001002d00005A1Fsv000015D9sd0000A811*
- ID_MODEL_FROM_DATABASE=RD890 PCI to PCI bridge (NB-SB link) (H8DGU)
+ ID_MODEL_FROM_DATABASE=RD890/RD990 PCI to PCI bridge (PCI Express GFX2 port 0) (H8DGU)
 
 pci:v00001002d00005A20*
- ID_MODEL_FROM_DATABASE=RD890S PCI Express bridge for GPP2 port 1
+ ID_MODEL_FROM_DATABASE=RD890/RD990 PCI to PCI bridge (PCI Express GFX2 port 1)
 
 pci:v00001002d00005A23*
- ID_MODEL_FROM_DATABASE=RD990 I/O Memory Management Unit (IOMMU)
+ ID_MODEL_FROM_DATABASE=RD890S/RD990 I/O Memory Management Unit (IOMMU)
 
 pci:v00001002d00005A31*
  ID_MODEL_FROM_DATABASE=RC410 Host Bridge
@@ -4481,6 +4481,9 @@ pci:v00001002d00006649sv00001002sd00000B0C*
 pci:v00001002d00006649sv0000103Csd00000B0C*
  ID_MODEL_FROM_DATABASE=Bonaire [FirePro W5100] (Bonaire [FirePro W4300])
 
+pci:v00001002d00006649sv0000103Csd0000230C*
+ ID_MODEL_FROM_DATABASE=Bonaire [FirePro W5100] (FirePro W5100)
+
 pci:v00001002d00006650*
  ID_MODEL_FROM_DATABASE=Bonaire
 
@@ -6179,6 +6182,9 @@ pci:v00001002d0000679Bsv0000148Csd00008990*
 pci:v00001002d0000679E*
  ID_MODEL_FROM_DATABASE=Tahiti LE [Radeon HD 7870 XT]
 
+pci:v00001002d0000679Esv00001787sd00002328*
+ ID_MODEL_FROM_DATABASE=Tahiti LE [Radeon HD 7870 XT] (Radeon HD 7870 Black Edition 2 GB GDDR5 [2GBD5-2DHV3E])
+
 pci:v00001002d0000679F*
  ID_MODEL_FROM_DATABASE=Tahiti
 
@@ -6329,6 +6335,9 @@ pci:v00001002d000067B1sv00001043sd000004DD*
 pci:v00001002d000067B1sv0000148Csd00002358*
  ID_MODEL_FROM_DATABASE=Hawaii PRO [Radeon R9 290/390] (Radeon R9 390)
 
+pci:v00001002d000067B1sv0000174Bsd0000E324*
+ ID_MODEL_FROM_DATABASE=Hawaii PRO [Radeon R9 290/390] (Sapphire Nitro R9 390)
+
 pci:v00001002d000067B9*
  ID_MODEL_FROM_DATABASE=Vesuvius [Radeon R9 295X2]
 
@@ -6339,7 +6348,7 @@ pci:v00001002d000067C0*
  ID_MODEL_FROM_DATABASE=Ellesmere [Polaris10]
 
 pci:v00001002d000067DF*
- ID_MODEL_FROM_DATABASE=Ellesmere [Polaris10]
+ ID_MODEL_FROM_DATABASE=Ellesmere [Radeon RX 480]
 
 pci:v00001002d000067E0*
  ID_MODEL_FROM_DATABASE=Baffin [Polaris11]
@@ -11090,6 +11099,9 @@ pci:v00001014d000004DAsv00001014sd000004FB*
 pci:v00001014d000004DAsv00001014sd000004FC*
  ID_MODEL_FROM_DATABASE=PCI-E IPR SAS+ Adapter (ASIC) (PCIe3 x8 12Gb Quad SAS RAID+ Adapter(580A))
 
+pci:v00001014d000004ED*
+ ID_MODEL_FROM_DATABASE=Internal Shared Memory (ISM) virtual PCI device
+
 pci:v00001014d00003022*
  ID_MODEL_FROM_DATABASE=QLA3022 Network Adapter
 
@@ -17630,12 +17642,30 @@ pci:v00001077d00002261sv00001077sd0000029B*
 pci:v00001077d00002261sv00001077sd0000029C*
  ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (QLE2692 Dual Port 16Gb Fibre Channel to PCIe Adapter)
 
+pci:v00001077d00002261sv00001077sd000002A7*
+ ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (QLE2690 Single Port 16Gb FC to PCIe Gen3 x8 Adapter)
+
+pci:v00001077d00002261sv00001077sd000002A8*
+ ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (QLE2692 Dual Port 16Gb FC to PCIe Gen3 x8 Adapter)
+
+pci:v00001077d00002261sv00001077sd000002AB*
+ ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (QLE2740 Single Port 32Gb FC to PCIe Gen3 x8 Adapter)
+
+pci:v00001077d00002261sv00001077sd000002AC*
+ ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (QLE2742 Dual Port 32Gb FC to PCIe Gen3 x8 Adapter)
+
 pci:v00001077d00002261sv00001590sd000000F9*
  ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (HPE StoreFabric SN1100Q 16Gb Single Port Fibre Channel Host Bus Adapter)
 
 pci:v00001077d00002261sv00001590sd000000FA*
  ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (HPE StoreFabric SN1100Q 16Gb Dual Port Fibre Channel Host Bus Adapter)
 
+pci:v00001077d00002261sv00001590sd00000203*
+ ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (HPE StoreFabric SN1600Q 32Gb Single Port Fibre Channel Host Bus Adapter)
+
+pci:v00001077d00002261sv00001590sd00000204*
+ ID_MODEL_FROM_DATABASE=ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter (HPE StoreFabric SN1600Q 32Gb Dual Port Fibre Channel Host Bus Adapter)
+
 pci:v00001077d00002300*
  ID_MODEL_FROM_DATABASE=QLA2300 64-bit Fibre Channel Adapter
 
@@ -29636,6 +29666,9 @@ pci:v000010DEd000010C5*
 pci:v000010DEd000010D8*
  ID_MODEL_FROM_DATABASE=GT218 [NVS 300]
 
+pci:v000010DEd000010F0*
+ ID_MODEL_FROM_DATABASE=GP104 High Definition Audio Controller
+
 pci:v000010DEd00001140*
  ID_MODEL_FROM_DATABASE=GF117M [GeForce 610M/710M/810M/820M / GT 620M/625M/630M/720M]
 
@@ -31209,7 +31242,13 @@ pci:v000010DEd000013BC*
  ID_MODEL_FROM_DATABASE=GM107GL [Quadro K1200]
 
 pci:v000010DEd000013BD*
- ID_MODEL_FROM_DATABASE=GM107GL [GRID M40]
+ ID_MODEL_FROM_DATABASE=GM107GL [Tesla M10]
+
+pci:v000010DEd000013BDsv000010DEsd0000110A*
+ ID_MODEL_FROM_DATABASE=GM107GL [Tesla M10] (GRID M40)
+
+pci:v000010DEd000013BDsv000010DEsd00001160*
+ ID_MODEL_FROM_DATABASE=GM107GL [Tesla M10] (Tesla M10)
 
 pci:v000010DEd000013C0*
  ID_MODEL_FROM_DATABASE=GM204 [GeForce GTX 980]
@@ -31283,6 +31322,18 @@ pci:v000010DEd00001430*
 pci:v000010DEd00001431*
  ID_MODEL_FROM_DATABASE=GM206GL [Tesla M4]
 
+pci:v000010DEd000015F0*
+ ID_MODEL_FROM_DATABASE=GP100GL
+
+pci:v000010DEd000015F1*
+ ID_MODEL_FROM_DATABASE=GP100GL
+
+pci:v000010DEd000015F8*
+ ID_MODEL_FROM_DATABASE=GP100GL
+
+pci:v000010DEd000015F9*
+ ID_MODEL_FROM_DATABASE=GP100GL
+
 pci:v000010DEd00001617*
  ID_MODEL_FROM_DATABASE=GM204M [GeForce GTX 980M]
 
@@ -31298,6 +31349,15 @@ pci:v000010DEd0000161A*
 pci:v000010DEd00001667*
  ID_MODEL_FROM_DATABASE=GM204M [GeForce GTX 965M]
 
+pci:v000010DEd00001725*
+ ID_MODEL_FROM_DATABASE=GP100
+
+pci:v000010DEd0000172E*
+ ID_MODEL_FROM_DATABASE=GP100
+
+pci:v000010DEd0000172F*
+ ID_MODEL_FROM_DATABASE=GP100
+
 pci:v000010DEd000017C2*
  ID_MODEL_FROM_DATABASE=GM200 [GeForce GTX TITAN X]
 
@@ -31313,9 +31373,87 @@ pci:v000010DEd000017F1*
 pci:v000010DEd000017FD*
  ID_MODEL_FROM_DATABASE=GM200GL [Tesla M40]
 
+pci:v000010DEd00001B00*
+ ID_MODEL_FROM_DATABASE=GP102
+
+pci:v000010DEd00001B01*
+ ID_MODEL_FROM_DATABASE=GP102
+
+pci:v000010DEd00001B70*
+ ID_MODEL_FROM_DATABASE=GP102GL
+
+pci:v000010DEd00001B78*
+ ID_MODEL_FROM_DATABASE=GP102GL
+
 pci:v000010DEd00001B80*
  ID_MODEL_FROM_DATABASE=GP104 [GeForce GTX 1080]
 
+pci:v000010DEd00001B81*
+ ID_MODEL_FROM_DATABASE=GP104 [GeForce GTX 1070]
+
+pci:v000010DEd00001B82*
+ ID_MODEL_FROM_DATABASE=GP104
+
+pci:v000010DEd00001B83*
+ ID_MODEL_FROM_DATABASE=GP104
+
+pci:v000010DEd00001BA1*
+ ID_MODEL_FROM_DATABASE=GP104M [GeForce GTX 1070]
+
+pci:v000010DEd00001BB0*
+ ID_MODEL_FROM_DATABASE=GP104GL
+
+pci:v000010DEd00001BB1*
+ ID_MODEL_FROM_DATABASE=GP104GL
+
+pci:v000010DEd00001BB4*
+ ID_MODEL_FROM_DATABASE=GP104GL
+
+pci:v000010DEd00001BE0*
+ ID_MODEL_FROM_DATABASE=GP104M [GeForce GTX 1080]
+
+pci:v000010DEd00001BE1*
+ ID_MODEL_FROM_DATABASE=GP104M [GeForce GTX 1070]
+
+pci:v000010DEd00001C00*
+ ID_MODEL_FROM_DATABASE=GP106
+
+pci:v000010DEd00001C01*
+ ID_MODEL_FROM_DATABASE=GP106
+
+pci:v000010DEd00001C02*
+ ID_MODEL_FROM_DATABASE=GP106
+
+pci:v000010DEd00001C03*
+ ID_MODEL_FROM_DATABASE=GP106 [GeForce GTX 1060]
+
+pci:v000010DEd00001C30*
+ ID_MODEL_FROM_DATABASE=GP106GL
+
+pci:v000010DEd00001C70*
+ ID_MODEL_FROM_DATABASE=GP106GL
+
+pci:v000010DEd00001C80*
+ ID_MODEL_FROM_DATABASE=GP107
+
+pci:v000010DEd00001C81*
+ ID_MODEL_FROM_DATABASE=GP107
+
+pci:v000010DEd00001C82*
+ ID_MODEL_FROM_DATABASE=GP107
+
+pci:v000010DEd00001CA7*
+ ID_MODEL_FROM_DATABASE=GP107GL
+
+pci:v000010DEd00001CA8*
+ ID_MODEL_FROM_DATABASE=GP107GL
+
+pci:v000010DEd00001CAA*
+ ID_MODEL_FROM_DATABASE=GP107GL
+
+pci:v000010DEd00001D01*
+ ID_MODEL_FROM_DATABASE=GP108
+
 pci:v000010DF*
  ID_VENDOR_FROM_DATABASE=Emulex Corporation
 
@@ -32063,6 +32201,9 @@ pci:v000010ECd00008168sv00001028sd000004B2*
 pci:v000010ECd00008168sv00001028sd000004DA*
  ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (Vostro 3750)
 
+pci:v000010ECd00008168sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (Latitude 3570)
+
 pci:v000010ECd00008168sv0000103Csd00001611*
  ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (Pavilion DM1Z-3000)
 
@@ -32097,7 +32238,7 @@ pci:v000010ECd00008168sv000010ECsd00008168*
  ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (RTL8111/8168 PCI Express Gigabit Ethernet controller)
 
 pci:v000010ECd00008168sv00001458sd0000E000*
- ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (Motherboard)
+ ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (Onboard Ethernet)
 
 pci:v000010ECd00008168sv00001462sd0000238C*
  ID_MODEL_FROM_DATABASE=RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (Onboard RTL8111b on MSI P965 Platinum Mainboard)
@@ -32198,6 +32339,9 @@ pci:v000010ECd00008178*
 pci:v000010ECd00008179*
  ID_MODEL_FROM_DATABASE=RTL8188EE Wireless Network Adapter
 
+pci:v000010ECd00008179sv0000103Csd0000197D*
+ ID_MODEL_FROM_DATABASE=RTL8188EE Wireless Network Adapter (RTL8188EE mini-PCIe card)
+
 pci:v000010ECd00008180*
  ID_MODEL_FROM_DATABASE=RTL8180L 802.11b MAC
 
@@ -32436,175 +32580,340 @@ pci:v00001102*
  ID_VENDOR_FROM_DATABASE=Creative Labs
 
 pci:v00001102d00000002*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series]
 
 pci:v00001102d00000002sv0000100Asd00001102*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SB Live! 5.1 Digital OEM SB0220 EMU10K1-JFF)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB Live! 5.1 Digital OEM SB0220 EMU10K1-JFF)
 
 pci:v00001102d00000002sv00001102sd00000020*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4850 SBLive! Value)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4670/4850 SBLive! Value)
 
 pci:v00001102d00000002sv00001102sd00000021*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4620 SBLive!)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4620 SBLive!)
 
 pci:v00001102d00000002sv00001102sd0000002F*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SBLive! mainboard implementation)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (M002/M003 Integrated SBLive!)
 
 pci:v00001102d00000002sv00001102sd0000100A*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SB Live! 5.1 Digital OEM [SB0220])
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0220/0229 SBLive! 5.1 Digital OEM)
 
 pci:v00001102d00000002sv00001102sd00004001*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (E-mu APS)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (E-mu APS)
 
 pci:v00001102d00000002sv00001102sd00008022*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4780 SBLive! Value)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4780 SBLive! Value)
 
 pci:v00001102d00000002sv00001102sd00008023*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4790 SoundBlaster PCI512)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4790 SoundBlaster PCI512)
 
 pci:v00001102d00000002sv00001102sd00008024*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4760 SBLive!)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4760 SBLive!)
 
 pci:v00001102d00000002sv00001102sd00008025*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SBLive! Mainboard Implementation)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT1140/SB0040 Integrated SBLive!)
 
 pci:v00001102d00000002sv00001102sd00008026*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4830 SBLive! Value)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4830 SBLive! Value)
 
 pci:v00001102d00000002sv00001102sd00008027*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4832 SBLive! Value)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4832 SBLive! Value)
 
 pci:v00001102d00000002sv00001102sd00008028*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4760 SBLive! OEM version)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4870 SBLive! Value)
+
+pci:v00001102d00000002sv00001102sd00008029*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4872 SBLive! Value)
+
+pci:v00001102d00000002sv00001102sd0000802A*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4890 SoundBlaster PCI256)
+
+pci:v00001102d00000002sv00001102sd0000802B*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4891 SoundBlaster PCI256)
 
 pci:v00001102d00000002sv00001102sd00008031*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4831 SBLive! Value)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4831 SBLive! Value)
+
+pci:v00001102d00000002sv00001102sd00008032*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4871 SBLive! Value)
+
+pci:v00001102d00000002sv00001102sd00008033*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4893 SoundBlaster PCI256)
+
+pci:v00001102d00000002sv00001102sd00008035*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT0060 SBLive!)
 
 pci:v00001102d00000002sv00001102sd00008040*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4760 SBLive!)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4760 SBLive!)
+
+pci:v00001102d00000002sv00001102sd00008050*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4750 SoundBlaster PCI512)
 
 pci:v00001102d00000002sv00001102sd00008051*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (CT4850 SBLive! Value)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT4850 SBLive! Value)
 
 pci:v00001102d00000002sv00001102sd00008061*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SBLive! Player 5.1)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB060 SBLive! Player 5.1)
+
+pci:v00001102d00000002sv00001102sd00008062*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0100 SBLive! 5.1)
+
+pci:v00001102d00000002sv00001102sd00008063*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (DXW Integrated SBLive! 5.1)
 
 pci:v00001102d00000002sv00001102sd00008064*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SBLive! 5.1 Model SB0100)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0100/SB0102 SBLive! 5.1)
 
 pci:v00001102d00000002sv00001102sd00008065*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SBLive! 5.1 Digital Model SB0220)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0220/0222 SBLive! 5.1 Digital)
 
 pci:v00001102d00000002sv00001102sd00008066*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (Live! 5.1 Digital [SB0228])
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0228 SBLive! 5.1 Digital)
 
 pci:v00001102d00000002sv00001102sd00008067*
- ID_MODEL_FROM_DATABASE=SB Live! EMU10k1 (SBLive! 5.1 eMicro 28028)
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0220 SBLive! 5.1)
+
+pci:v00001102d00000002sv00001102sd00008068*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (CT0061 SBLive!)
+
+pci:v00001102d00000002sv00001102sd00008069*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0101 SBLive! 5.1 Value)
+
+pci:v00001102d00000002sv00001102sd0000806A*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0103 SBLive! 5.1)
+
+pci:v00001102d00000002sv00001102sd0000806B*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0105 SBLive! 5.1)
+
+pci:v00001102d00000002sv00001102sd0000806C*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0221 SBLive! 5.1)
+
+pci:v00001102d00000002sv00001102sd00008071*
+ ID_MODEL_FROM_DATABASE=EMU10k1 [Sound Blaster Live! Series] (SB0150 SoundBlaster PCI512)
+
+pci:v00001102d00000003*
+ ID_MODEL_FROM_DATABASE=SB AWE64(D)
 
 pci:v00001102d00000004*
- ID_MODEL_FROM_DATABASE=SB Audigy
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series]
+
+pci:v00001102d00000004sv00001102sd00000040*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0090 Audigy Player)
+
+pci:v00001102d00000004sv00001102sd00000041*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (CT4820 SBLive!2)
+
+pci:v00001102d00000004sv00001102sd00000042*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (CT0070 Audigy)
+
+pci:v00001102d00000004sv00001102sd00000043*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (CT0072 Audigy)
 
 pci:v00001102d00000004sv00001102sd00000051*
- ID_MODEL_FROM_DATABASE=SB Audigy (SB0090 Audigy Player)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0090 Audigy Player/Platinum (EX))
+
+pci:v00001102d00000004sv00001102sd00000052*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0162 Audigy ES)
 
 pci:v00001102d00000004sv00001102sd00000053*
- ID_MODEL_FROM_DATABASE=SB Audigy (SB0090 Audigy Player/OEM)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (CT0090/SB0092 Audigy Player/OEM)
+
+pci:v00001102d00000004sv00001102sd00000054*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0161 Audigy ES)
+
+pci:v00001102d00000004sv00001102sd00000055*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0192 Audigy)
+
+pci:v00001102d00000004sv00001102sd00000056*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0191 Audigy)
+
+pci:v00001102d00000004sv00001102sd00000057*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0091 Audigy)
 
 pci:v00001102d00000004sv00001102sd00000058*
- ID_MODEL_FROM_DATABASE=SB Audigy (SB0090 Audigy Player/OEM)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0095 Audigy Player/OEM)
+
+pci:v00001102d00000004sv00001102sd00000059*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0230 Audigy)
+
+pci:v00001102d00000004sv00001102sd0000005A*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0231 Audigy)
+
+pci:v00001102d00000004sv00001102sd0000005B*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0232 Audigy)
+
+pci:v00001102d00000004sv00001102sd0000005C*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0238 Audigy)
 
 pci:v00001102d00000004sv00001102sd00001002*
- ID_MODEL_FROM_DATABASE=SB Audigy (2 Platinum)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0240 Audigy 2 Platinum 6.1)
 
 pci:v00001102d00000004sv00001102sd00001003*
- ID_MODEL_FROM_DATABASE=SB Audigy (SB0350 Audigy 2)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0350 Audigy 2 / SB0243 Audigy 2 OEM)
+
+pci:v00001102d00000004sv00001102sd00001004*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0242 Audigy 2)
+
+pci:v00001102d00000004sv00001102sd00001005*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0280 Audigy 2 Platinum Ex)
+
+pci:v00001102d00000004sv00001102sd00001006*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0245 Audigy 2 OEM)
 
 pci:v00001102d00000004sv00001102sd00001007*
- ID_MODEL_FROM_DATABASE=SB Audigy (SB0240 Audigy 2 Platinum 6.1)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0240/SB0244 Audigy 2 Platinum)
+
+pci:v00001102d00000004sv00001102sd00001008*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0320 Audigy 2)
 
 pci:v00001102d00000004sv00001102sd00001009*
- ID_MODEL_FROM_DATABASE=SB Audigy (2 OEM HP)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0249 Audigy 2 OEM)
+
+pci:v00001102d00000004sv00001102sd0000100A*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0246 Audigy 2)
 
 pci:v00001102d00000004sv00001102sd00002001*
- ID_MODEL_FROM_DATABASE=SB Audigy (2 ZS Platinum Pro)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0360 Audigy 2 ZS Platinum Pro)
 
 pci:v00001102d00000004sv00001102sd00002002*
- ID_MODEL_FROM_DATABASE=SB Audigy (2 ZS (SB0350))
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0350 Audigy 2 ZS)
+
+pci:v00001102d00000004sv00001102sd00002003*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0352 Audigy 2 ZS)
+
+pci:v00001102d00000004sv00001102sd00002004*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0355 Audigy 2 ZS)
+
+pci:v00001102d00000004sv00001102sd00002005*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0359 Audigy 2 ZS)
+
+pci:v00001102d00000004sv00001102sd00002006*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB035x Audigy 2 OEM)
+
+pci:v00001102d00000004sv00001102sd00002007*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (SB0380 Audigy 4 Pro)
 
 pci:v00001102d00000004sv00001102sd00004001*
- ID_MODEL_FROM_DATABASE=SB Audigy (E-MU 1010)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (E-MU 1010 [MAEM8810])
 
 pci:v00001102d00000004sv00001102sd00004002*
- ID_MODEL_FROM_DATABASE=SB Audigy (E-MU 0404)
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (E-MU 0404)
+
+pci:v00001102d00000004sv00001102sd00004003*
+ ID_MODEL_FROM_DATABASE=EMU10k2/CA0100/CA0102/CA10200 [Sound Blaster Audigy Series] (E-MU 1010)
 
 pci:v00001102d00000005*
- ID_MODEL_FROM_DATABASE=SB X-Fi
+ ID_MODEL_FROM_DATABASE=EMU20k1 [Sound Blaster X-Fi Series]
 
 pci:v00001102d00000005sv00001102sd00000021*
- ID_MODEL_FROM_DATABASE=SB X-Fi (X-Fi Platinum)
+ ID_MODEL_FROM_DATABASE=EMU20k1 [Sound Blaster X-Fi Series] (X-Fi Platinum)
 
 pci:v00001102d00000005sv00001102sd0000002C*
- ID_MODEL_FROM_DATABASE=SB X-Fi (X-Fi XtremeGamer FATAL1TY PRO)
+ ID_MODEL_FROM_DATABASE=EMU20k1 [Sound Blaster X-Fi Series] (X-Fi XtremeGamer FATAL1TY PRO)
 
 pci:v00001102d00000005sv00001102sd00001003*
- ID_MODEL_FROM_DATABASE=SB X-Fi (X-Fi XtremeMusic)
+ ID_MODEL_FROM_DATABASE=EMU20k1 [Sound Blaster X-Fi Series] (X-Fi XtremeMusic)
 
 pci:v00001102d00000006*
- ID_MODEL_FROM_DATABASE=[SB Live! Value] EMU10k1X
+ ID_MODEL_FROM_DATABASE=EMU10k1X [SB Live! Value/OEM Series]
 
 pci:v00001102d00000007*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series]
 
 pci:v00001102d00000007sv00001102sd00000007*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (SBLive! 24bit)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (SBLive! 24bit)
 
 pci:v00001102d00000007sv00001102sd00001001*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (SB0310 Audigy LS)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (SB0310 Audigy LS)
 
 pci:v00001102d00000007sv00001102sd00001002*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (SB0312 Audigy LS)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (SB0312 Audigy LS)
 
 pci:v00001102d00000007sv00001102sd00001006*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (SB0410 SBLive! 24-bit)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (SB0410 SBLive! 24-bit)
 
 pci:v00001102d00000007sv00001102sd0000100A*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (SB0570 [SB Audigy SE])
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (SB0570 [SB Audigy SE])
 
 pci:v00001102d00000007sv00001102sd00001012*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (SB0790 X-Fi XA)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (SB0790 X-Fi XA)
 
 pci:v00001102d00000007sv00001102sd00001013*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (Soundblaster X-Fi Xtreme Audio)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (Soundblaster X-Fi Xtreme Audio)
 
 pci:v00001102d00000007sv00001462sd00001009*
- ID_MODEL_FROM_DATABASE=CA0106 Soundblaster (K8N Diamond)
+ ID_MODEL_FROM_DATABASE=CA0106/CA0111 [SB Live!/Audigy/X-Fi Series] (K8N Diamond)
 
 pci:v00001102d00000008*
- ID_MODEL_FROM_DATABASE=SB0400 Audigy2 Value
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series]
 
 pci:v00001102d00000008sv00001102sd00000008*
- ID_MODEL_FROM_DATABASE=SB0400 Audigy2 Value (EMU0404 Digital Audio System)
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (EMU0404 Digital Audio System)
+
+pci:v00001102d00000008sv00001102sd00001001*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SB0400 Audigy 2 Value)
+
+pci:v00001102d00000008sv00001102sd00001021*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SB0610 Audigy 4 Value)
+
+pci:v00001102d00000008sv00001102sd00001022*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SBxxx Audigy 2/4 Value)
+
+pci:v00001102d00000008sv00001102sd00001023*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SB0612 Audigy 2 LS)
+
+pci:v00001102d00000008sv00001102sd00001024*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SB1550 Audigy 5/Rx)
+
+pci:v00001102d00000008sv00001102sd00001101*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SBxxxx Audigy 2 SA)
+
+pci:v00001102d00000008sv00001102sd00002001*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SB0530 Audigy 2 ZS Notebook)
+
+pci:v00001102d00000008sv00001102sd00002021*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (SBxxxx Audigy 4 Notebook)
+
+pci:v00001102d00000008sv00001102sd00004002*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (E-MU 0404)
+
+pci:v00001102d00000008sv00001102sd00004003*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (E-MU 1010)
 
 pci:v00001102d00000008sv00001102sd00004004*
- ID_MODEL_FROM_DATABASE=SB0400 Audigy2 Value (EMU1010 Digital Audio System [MAEM8960])
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (EMU1010 Digital Audio System [MAEM8960])
+
+pci:v00001102d00000008sv00001102sd00004005*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (E-MU 0404 [MAEM8984])
+
+pci:v00001102d00000008sv00001102sd00004007*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (E-MU 1010 [MAEM8982])
+
+pci:v00001102d00000008sv00001102sd00004201*
+ ID_MODEL_FROM_DATABASE=CA0108/CA10300 [Sound Blaster Audigy Series] (E-MU 0202 [MAEM8950])
 
 pci:v00001102d00000009*
- ID_MODEL_FROM_DATABASE=[SB X-Fi Xtreme Audio] CA0110-IBG
+ ID_MODEL_FROM_DATABASE=CA0110 [Sound Blaster X-Fi Xtreme Audio]
 
 pci:v00001102d00000009sv00001102sd00000010*
- ID_MODEL_FROM_DATABASE=[SB X-Fi Xtreme Audio] CA0110-IBG
+ ID_MODEL_FROM_DATABASE=CA0110 [Sound Blaster X-Fi Xtreme Audio] (MB0820 Integrated)
 
 pci:v00001102d00000009sv00001102sd00000018*
- ID_MODEL_FROM_DATABASE=[SB X-Fi Xtreme Audio] CA0110-IBG (SB1040)
+ ID_MODEL_FROM_DATABASE=CA0110 [Sound Blaster X-Fi Xtreme Audio] (SB1040 PCI Express)
 
 pci:v00001102d0000000B*
- ID_MODEL_FROM_DATABASE=EMU20k2 [X-Fi Titanium Series]
+ ID_MODEL_FROM_DATABASE=EMU20k2 [Sound Blaster X-Fi Titanium Series]
 
 pci:v00001102d0000000Bsv00001102sd00000041*
- ID_MODEL_FROM_DATABASE=EMU20k2 [X-Fi Titanium Series] (SB0880 [SoundBlaster X-Fi Titanium PCI-e])
+ ID_MODEL_FROM_DATABASE=EMU20k2 [Sound Blaster X-Fi Titanium Series] (SB0880 [SoundBlaster X-Fi Titanium PCI-e])
+
+pci:v00001102d0000000Bsv00001102sd00000062*
+ ID_MODEL_FROM_DATABASE=EMU20k2 [Sound Blaster X-Fi Titanium Series] (SB1270 [SoundBlaster X-Fi Titanium HD])
 
 pci:v00001102d00000012*
- ID_MODEL_FROM_DATABASE=SB Recon3D
+ ID_MODEL_FROM_DATABASE=Sound Core3D [Sound Blaster Recon3D / Z-Series]
+
+pci:v00001102d00000012sv00001102sd00000010*
+ ID_MODEL_FROM_DATABASE=Sound Core3D [Sound Blaster Recon3D / Z-Series] (SB1570 SB Audigy Fx)
 
 pci:v00001102d00004001*
  ID_MODEL_FROM_DATABASE=SB Audigy FireWire Port
@@ -38037,7 +38346,7 @@ pci:v00001180d00000592sv0000103Csd000030CC*
  ID_MODEL_FROM_DATABASE=R5C592 Memory Stick Bus Host Adapter (Pavilion dv6700)
 
 pci:v00001180d00000592sv0000103Csd000030CF*
- ID_MODEL_FROM_DATABASE=R5C592 Memory Stick Bus Host Adapter (Pavilion dv9500/9600/9700 series)
+ ID_MODEL_FROM_DATABASE=R5C592 Memory Stick Bus Host Adapter (Pavilion dv95xx/96xx/97xx/98xx series)
 
 pci:v00001180d00000592sv00001043sd00001237*
  ID_MODEL_FROM_DATABASE=R5C592 Memory Stick Bus Host Adapter (A6J-Q008)
@@ -40340,6 +40649,9 @@ pci:v00001203*
 pci:v00001204*
  ID_VENDOR_FROM_DATABASE=Lattice Semiconductor Corporation
 
+pci:v00001204d00001965*
+ ID_MODEL_FROM_DATABASE=SB6501 802.11ad Wireless Network Adapter
+
 pci:v00001205*
  ID_VENDOR_FROM_DATABASE=Array Corporation
 
@@ -40610,6 +40922,9 @@ pci:v00001217d00008331*
 pci:v00001217d00008520*
  ID_MODEL_FROM_DATABASE=SD/MMC Card Reader Controller
 
+pci:v00001217d00008621*
+ ID_MODEL_FROM_DATABASE=SD/MMC Card Reader Controller
+
 pci:v00001218*
  ID_VENDOR_FROM_DATABASE=Hybricon Corp.
 
@@ -41261,6 +41576,9 @@ pci:v0000125Dd00001969sv00001014sd00000166*
 pci:v0000125Dd00001969sv0000125Dsd00008888*
  ID_MODEL_FROM_DATABASE=ES1938/ES1946/ES1969 Solo-1 Audiodrive (Solo-1 Audio Adapter)
 
+pci:v0000125Dd00001969sv0000125Dsd00008898*
+ ID_MODEL_FROM_DATABASE=ES1938/ES1946/ES1969 Solo-1 Audiodrive (ES1938S TTSOLO1-SL [TerraTec 128i PCI])
+
 pci:v0000125Dd00001969sv0000153Bsd0000111B*
  ID_MODEL_FROM_DATABASE=ES1938/ES1946/ES1969 Solo-1 Audiodrive (Terratec 128i PCI)
 
@@ -41622,172 +41940,172 @@ pci:v00001274d00001171*
  ID_MODEL_FROM_DATABASE=ES1373 / Creative Labs CT5803 [AudioPCI]
 
 pci:v00001274d00001371*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518
 
 pci:v00001274d00001371sv00000E11sd00000024*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (AudioPCI on Motherboard Compaq Deskpro)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (AudioPCI on Motherboard Compaq Deskpro)
 
 pci:v00001274d00001371sv00000E11sd0000B1A7*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI)
 
 pci:v00001274d00001371sv00001033sd000080AC*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI)
 
 pci:v00001274d00001371sv00001042sd00001854*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (Tazer)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (Tazer)
 
 pci:v00001274d00001371sv0000107Bsd00008054*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (Tabor2)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (Tabor2)
 
 pci:v00001274d00001371sv00001274sd00001371*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (AudioPCI 64V/128 / Creative CT4810/CT5803/CT5806 [Sound Blaster PCI])
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (Audio PCI 64V/128/5200 / Creative CT4810/CT5803/CT5806 [Sound Blaster PCI])
 
 pci:v00001274d00001371sv00001274sd00008001*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (CT4751 board)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (CT4751 board)
 
 pci:v00001274d00001371sv00001462sd00006470*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6147 1.1A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6147 1.1A)
 
 pci:v00001274d00001371sv00001462sd00006560*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6156 1.10)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6156 1.10)
 
 pci:v00001274d00001371sv00001462sd00006630*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6163BX 1.0A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6163BX 1.0A)
 
 pci:v00001274d00001371sv00001462sd00006631*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6163VIA 1.0A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6163VIA 1.0A)
 
 pci:v00001274d00001371sv00001462sd00006632*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6163BX 2.0A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6163BX 2.0A)
 
 pci:v00001274d00001371sv00001462sd00006633*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6163VIA 2.0A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6163VIA 2.0A)
 
 pci:v00001274d00001371sv00001462sd00006820*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6182 1.00)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6182 1.00)
 
 pci:v00001274d00001371sv00001462sd00006822*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6182 1.00A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6182 1.00A)
 
 pci:v00001274d00001371sv00001462sd00006830*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6183 1.00)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6183 1.00)
 
 pci:v00001274d00001371sv00001462sd00006880*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6188 1.00)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6188 1.00)
 
 pci:v00001274d00001371sv00001462sd00006900*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6190 1.00)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6190 1.00)
 
 pci:v00001274d00001371sv00001462sd00006910*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6191)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6191)
 
 pci:v00001274d00001371sv00001462sd00006930*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6193)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6193)
 
 pci:v00001274d00001371sv00001462sd00006990*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6199BX 2.0A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6199BX 2.0A)
 
 pci:v00001274d00001371sv00001462sd00006991*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MS-6199VIA 2.0A)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MS-6199VIA 2.0A)
 
 pci:v00001274d00001371sv000014A4sd00002077*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard KR639)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard KR639)
 
 pci:v00001274d00001371sv000014A4sd00002105*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MR800)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MR800)
 
 pci:v00001274d00001371sv000014A4sd00002107*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard MR801)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard MR801)
 
 pci:v00001274d00001371sv000014A4sd00002172*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard DR739)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard DR739)
 
 pci:v00001274d00001371sv00001509sd00009902*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard KW11)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard KW11)
 
 pci:v00001274d00001371sv00001509sd00009903*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard KW31)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard KW31)
 
 pci:v00001274d00001371sv00001509sd00009904*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard KA11)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard KA11)
 
 pci:v00001274d00001371sv00001509sd00009905*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard KC13)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard KC13)
 
 pci:v00001274d00001371sv0000152Dsd00008801*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard CP810E)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard CP810E)
 
 pci:v00001274d00001371sv0000152Dsd00008802*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard CP810)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard CP810)
 
 pci:v00001274d00001371sv0000152Dsd00008803*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard P3810E)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard P3810E)
 
 pci:v00001274d00001371sv0000152Dsd00008804*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard P3810-S)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard P3810-S)
 
 pci:v00001274d00001371sv0000152Dsd00008805*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard P3820-S)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard P3820-S)
 
 pci:v00001274d00001371sv0000270Fsd00002001*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard 6CTR)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard 6CTR)
 
 pci:v00001274d00001371sv0000270Fsd00002200*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard 6WTX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard 6WTX)
 
 pci:v00001274d00001371sv0000270Fsd00003000*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard 6WSV)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard 6WSV)
 
 pci:v00001274d00001371sv0000270Fsd00003100*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard 6WIV2)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard 6WIV2)
 
 pci:v00001274d00001371sv0000270Fsd00003102*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard 6WIV)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard 6WIV)
 
 pci:v00001274d00001371sv0000270Fsd00007060*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard 6ASA2)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard 6ASA2)
 
 pci:v00001274d00001371sv00008086sd00004249*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard BI440ZX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard BI440ZX)
 
 pci:v00001274d00001371sv00008086sd0000424C*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard BL440ZX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard BL440ZX)
 
 pci:v00001274d00001371sv00008086sd0000425A*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard BZ440ZX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard BZ440ZX)
 
 pci:v00001274d00001371sv00008086sd00004341*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard Cayman)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard Cayman)
 
 pci:v00001274d00001371sv00008086sd00004343*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard Cape Cod)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard Cape Cod)
 
 pci:v00001274d00001371sv00008086sd00004541*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (D815EEA Motherboard)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (D815EEA Motherboard)
 
 pci:v00001274d00001371sv00008086sd00004649*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard Fire Island)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard Fire Island)
 
 pci:v00001274d00001371sv00008086sd0000464A*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard FJ440ZX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard FJ440ZX)
 
 pci:v00001274d00001371sv00008086sd00004D4F*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard Montreal)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard Montreal)
 
 pci:v00001274d00001371sv00008086sd00004F43*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard OC440LX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard OC440LX)
 
 pci:v00001274d00001371sv00008086sd00005243*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard RC440BX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard RC440BX)
 
 pci:v00001274d00001371sv00008086sd00005352*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard SunRiver)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard SunRiver)
 
 pci:v00001274d00001371sv00008086sd00005643*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard Vancouver)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard Vancouver)
 
 pci:v00001274d00001371sv00008086sd00005753*
- ID_MODEL_FROM_DATABASE=ES1371 / Creative Labs CT2518/ES1373 (ES1371, ES1373 AudioPCI On Motherboard WS440BX)
+ ID_MODEL_FROM_DATABASE=ES1371/ES1373 / Creative Labs CT2518 (ES1371, ES1373 AudioPCI On Motherboard WS440BX)
 
 pci:v00001274d00005000*
  ID_MODEL_FROM_DATABASE=ES1370 [AudioPCI]
@@ -42486,7 +42804,7 @@ pci:v000012AA*
  ID_VENDOR_FROM_DATABASE=SDL Communications, Inc.
 
 pci:v000012AB*
- ID_VENDOR_FROM_DATABASE=Yuan Yuan Enterprise Co., Ltd.
+ ID_VENDOR_FROM_DATABASE=YUAN High-Tech Development Co., Ltd.
 
 pci:v000012ABd00000000*
  ID_MODEL_FROM_DATABASE=MPG160/Kuroutoshikou ITVC15-STVLP
@@ -46751,6 +47069,9 @@ pci:v00001425d00005016*
 pci:v00001425d00005017*
  ID_MODEL_FROM_DATABASE=T520-OCP-SO Unified Wire Ethernet Controller
 
+pci:v00001425d00005018*
+ ID_MODEL_FROM_DATABASE=T540-BT Unified Wire Ethernet Controller
+
 pci:v00001425d00005080*
  ID_MODEL_FROM_DATABASE=T540-5080 Unified Wire Ethernet Controller
 
@@ -46889,6 +47210,9 @@ pci:v00001425d00005416*
 pci:v00001425d00005417*
  ID_MODEL_FROM_DATABASE=T520-OCP-SO Unified Wire Ethernet Controller
 
+pci:v00001425d00005418*
+ ID_MODEL_FROM_DATABASE=T540-BT Unified Wire Ethernet Controller
+
 pci:v00001425d00005480*
  ID_MODEL_FROM_DATABASE=T540-5080 Unified Wire Ethernet Controller
 
@@ -47027,6 +47351,9 @@ pci:v00001425d00005516*
 pci:v00001425d00005517*
  ID_MODEL_FROM_DATABASE=T520-OCP-SO Unified Wire Storage Controller
 
+pci:v00001425d00005518*
+ ID_MODEL_FROM_DATABASE=T540-BT Unified Wire Storage Controller
+
 pci:v00001425d00005580*
  ID_MODEL_FROM_DATABASE=T540-5080 Unified Wire Storage Controller
 
@@ -47165,6 +47492,9 @@ pci:v00001425d00005616*
 pci:v00001425d00005617*
  ID_MODEL_FROM_DATABASE=T520-OCP-SO Unified Wire Storage Controller
 
+pci:v00001425d00005618*
+ ID_MODEL_FROM_DATABASE=T540-BT Unified Wire Storage Controller
+
 pci:v00001425d00005680*
  ID_MODEL_FROM_DATABASE=T540-5080 Unified Wire Storage Controller
 
@@ -47420,6 +47750,9 @@ pci:v00001425d00005816*
 pci:v00001425d00005817*
  ID_MODEL_FROM_DATABASE=T520-OCP-SO Unified Wire Ethernet Controller [VF]
 
+pci:v00001425d00005818*
+ ID_MODEL_FROM_DATABASE=T540-BT Unified Wire Ethernet Controller [VF]
+
 pci:v00001425d00005880*
  ID_MODEL_FROM_DATABASE=T540-5080 Unified Wire Ethernet Controller [VF]
 
@@ -49622,6 +49955,12 @@ pci:v000014E4d000016CA*
 pci:v000014E4d000016CB*
  ID_MODEL_FROM_DATABASE=BCM57304 NetXtreme-C Ethernet Virtual Function
 
+pci:v000014E4d000016CE*
+ ID_MODEL_FROM_DATABASE=BCM57311 NetXtreme-C Single-port 10Gb RDMA Ethernet
+
+pci:v000014E4d000016CF*
+ ID_MODEL_FROM_DATABASE=BCM57312 NetXtreme-C Dual-port 10Gb/25Gb RDMA Ethernet
+
 pci:v000014E4d000016D0*
  ID_MODEL_FROM_DATABASE=BCM57402 NetXtreme-E Dual-port 10Gb Ethernet
 
@@ -49634,9 +49973,39 @@ pci:v000014E4d000016D2*
 pci:v000014E4d000016D3*
  ID_MODEL_FROM_DATABASE=BCM57404 NetXtreme-E Ethernet Virtual Function
 
+pci:v000014E4d000016D4*
+ ID_MODEL_FROM_DATABASE=BCM57404 NetXtreme-E Ethernet Partition
+
+pci:v000014E4d000016D6*
+ ID_MODEL_FROM_DATABASE=BCM57412 NetXtreme-E Dual-port 10Gb RDMA Ethernet
+
+pci:v000014E4d000016D7*
+ ID_MODEL_FROM_DATABASE=BCM57414 NetXtreme-E Dual-port 10Gb/25Gb RDMA Ethernet
+
+pci:v000014E4d000016D8*
+ ID_MODEL_FROM_DATABASE=BCM57416 NetXtreme-E Dual-port 10GBase-T RDMA Ethernet
+
+pci:v000014E4d000016D9*
+ ID_MODEL_FROM_DATABASE=BCM57417 NetXtreme-E Dual-port 10GBase-T RDMA Ethernet
+
+pci:v000014E4d000016DC*
+ ID_MODEL_FROM_DATABASE=BCM57414 NetXtreme-E Ethernet Virtual Function
+
 pci:v000014E4d000016DD*
  ID_MODEL_FROM_DATABASE=NetLink BCM5781 Gigabit Ethernet PCI Express
 
+pci:v000014E4d000016DE*
+ ID_MODEL_FROM_DATABASE=BCM57414 NetXtreme-E Ethernet Partition
+
+pci:v000014E4d000016DF*
+ ID_MODEL_FROM_DATABASE=BCM57314 NetXtreme-C Dual-port 10Gb/25Gb/40Gb/50Gb RDMA Ethernet
+
+pci:v000014E4d000016E1*
+ ID_MODEL_FROM_DATABASE=BCM57314 NetXtreme-C Ethernet Virtual Function
+
+pci:v000014E4d000016E2*
+ ID_MODEL_FROM_DATABASE=BCM57417 NetXtreme-E Dual-port 10Gb/25Gb RDMA Ethernet
+
 pci:v000014E4d000016F3*
  ID_MODEL_FROM_DATABASE=NetXtreme BCM5727 Gigabit Ethernet PCIe
 
@@ -51275,6 +51644,9 @@ pci:v000014F1d00008852sv00000070sd0000F038*
 pci:v000014F1d00008852sv0000107Dsd00006F22*
  ID_MODEL_FROM_DATABASE=CX23885 PCI Video and Audio Decoder (WinFast PxTV1200)
 
+pci:v000014F1d00008852sv000012ABsd0000D585*
+ ID_MODEL_FROM_DATABASE=CX23885 PCI Video and Audio Decoder (PE988J Hybrid ATSC/QAM PCI-E AVS Video Capture (SoftEncoder))
+
 pci:v000014F1d00008852sv000013C2sd00003013*
  ID_MODEL_FROM_DATABASE=CX23885 PCI Video and Audio Decoder (TT-budget CT2-4500 CI)
 
@@ -52643,6 +53015,12 @@ pci:v000015B3d0000CAF1*
 pci:v000015B3d0000CB84*
  ID_MODEL_FROM_DATABASE=MT52100
 
+pci:v000015B3d0000CF08*
+ ID_MODEL_FROM_DATABASE=MT53236
+
+pci:v000015B3d0000D2F0*
+ ID_MODEL_FROM_DATABASE=Switch-IB 3 HDR (200Gbps) switch
+
 pci:v000015B4*
  ID_VENDOR_FROM_DATABASE=CCI/TRIAD
 
@@ -54174,11 +54552,17 @@ pci:v0000168Cd00000032sv00001A3Bsd00001186*
  ID_MODEL_FROM_DATABASE=AR9485 Wireless Network Adapter (AW-NE186H)
 
 pci:v0000168Cd00000033*
- ID_MODEL_FROM_DATABASE=AR9580 Wireless Network Adapter
+ ID_MODEL_FROM_DATABASE=AR958x 802.11abgn Wireless Network Adapter
+
+pci:v0000168Cd00000033sv0000168Csd0000A120*
+ ID_MODEL_FROM_DATABASE=AR958x 802.11abgn Wireless Network Adapter (AR9582 802.11a/n WLAN Mini-PCIe Adapter)
 
 pci:v0000168Cd00000034*
  ID_MODEL_FROM_DATABASE=AR9462 Wireless Network Adapter
 
+pci:v0000168Cd00000034sv00001028sd00000300*
+ ID_MODEL_FROM_DATABASE=AR9462 Wireless Network Adapter (Wireless 1802 802.11abgn Adapter)
+
 pci:v0000168Cd00000034sv00001A56sd00002003*
  ID_MODEL_FROM_DATABASE=AR9462 Wireless Network Adapter (Killer Wireless-N 1202 Half-size Mini PCIe Card)
 
@@ -54551,6 +54935,21 @@ pci:v000016D5d00007006*
 pci:v000016D5d00007007*
  ID_MODEL_FROM_DATABASE=XMC-7A200CC: User-Configurable Conduction-Cooled Artix-7 FPGA, with 200k logic cells
 
+pci:v000016D5d00007011*
+ ID_MODEL_FROM_DATABASE=AP440-1: 32-Channel Isolated Digital Input Module
+
+pci:v000016D5d00007012*
+ ID_MODEL_FROM_DATABASE=AP440-2: 32-Channel Isolated Digital Input Module
+
+pci:v000016D5d00007013*
+ ID_MODEL_FROM_DATABASE=AP440-3: 32-Channel Isolated Digital Input Module
+
+pci:v000016D5d00007014*
+ ID_MODEL_FROM_DATABASE=AP445: 32-Channel Isolated Digital Output Module
+
+pci:v000016D5d00007018*
+ ID_MODEL_FROM_DATABASE=AP408: 32-Channel Digital I/O Module
+
 pci:v000016DA*
  ID_VENDOR_FROM_DATABASE=Advantech Co., Ltd.
 
@@ -54836,6 +55235,9 @@ pci:v0000177Dd00009703*
 pci:v0000177Dd00009712*
  ID_MODEL_FROM_DATABASE=CN23XX [LiquidIO II] SRIOV Virtual Function
 
+pci:v0000177Dd00009712sv0000177Dsd00000003*
+ ID_MODEL_FROM_DATABASE=CN23XX [LiquidIO II] SRIOV Virtual Function (CN2350 [LiquidIO II] 2-port 10GbE SRIOV Virtual Function)
+
 pci:v0000177Dd00009713*
  ID_MODEL_FROM_DATABASE=CN23XX [LiquidIO II] NVMe SRIOV Virtual Function
 
@@ -54843,7 +55245,7 @@ pci:v0000177Dd00009800*
  ID_MODEL_FROM_DATABASE=Octeon Fusion CNF75XX Processor
 
 pci:v0000177Dd0000A001*
- ID_MODEL_FROM_DATABASE=THUNDERX MRML Bridge
+ ID_MODEL_FROM_DATABASE=ThunderX MRML(Master RML Bridge to RSL devices)
 
 pci:v0000177Dd0000A002*
  ID_MODEL_FROM_DATABASE=THUNDERX PCC Bridge
@@ -54957,7 +55359,7 @@ pci:v0000177Dd0000A029*
  ID_MODEL_FROM_DATABASE=THUNDERX NCSI (Network Controller Sideband Interface)
 
 pci:v0000177Dd0000A02A*
- ID_MODEL_FROM_DATABASE=THUNDERX SGP
+ ID_MODEL_FROM_DATABASE=ThunderX SGPIO (Serial GPIO controller for SATA disk lights)
 
 pci:v0000177Dd0000A02B*
  ID_MODEL_FROM_DATABASE=THUNDERX SMI / MDIO Controller
@@ -54969,7 +55371,7 @@ pci:v0000177Dd0000A02D*
  ID_MODEL_FROM_DATABASE=THUNDERX PCIERC (PCIe Root Complex)
 
 pci:v0000177Dd0000A02E*
- ID_MODEL_FROM_DATABASE=THUNDERX L2C-TAD
+ ID_MODEL_FROM_DATABASE=ThunderX L2C-TAD (Level 2 cache tag and data)
 
 pci:v0000177Dd0000A02F*
  ID_MODEL_FROM_DATABASE=THUNDERX L2C-CBC
@@ -54983,6 +55385,33 @@ pci:v0000177Dd0000A031*
 pci:v0000177Dd0000A032*
  ID_MODEL_FROM_DATABASE=THUNDERX FUSF (Fuse Controller)
 
+pci:v0000177Dd0000A033*
+ ID_MODEL_FROM_DATABASE=THUNDERX Random Number Generator virtual function
+
+pci:v0000177Dd0000A034*
+ ID_MODEL_FROM_DATABASE=THUNDERX Network Interface Controller virtual function
+
+pci:v0000177Dd0000A035*
+ ID_MODEL_FROM_DATABASE=THUNDERX Parallel Bus
+
+pci:v0000177Dd0000A036*
+ ID_MODEL_FROM_DATABASE=ThunderX RAD (RAID acceleration engine) virtual function
+
+pci:v0000177Dd0000A037*
+ ID_MODEL_FROM_DATABASE=THUNDERX ZIP virtual function
+
+pci:v0000177Dd0000A040*
+ ID_MODEL_FROM_DATABASE=THUNDERX CPT Cryptographic Accelerator
+
+pci:v0000177Dd0000A100*
+ ID_MODEL_FROM_DATABASE=THUNDERX CN88XX 48 core SoC
+
+pci:v0000177Dd0000A200*
+ ID_MODEL_FROM_DATABASE=OCTEON TX CN81XX/CN80XX
+
+pci:v0000177Dd0000A300*
+ ID_MODEL_FROM_DATABASE=OCTEON TX CN83XX
+
 pci:v00001787*
  ID_VENDOR_FROM_DATABASE=Hightech Information System Ltd.
 
@@ -55136,6 +55565,9 @@ pci:v000017A0d00008084*
 pci:v000017AA*
  ID_VENDOR_FROM_DATABASE=Lenovo
 
+pci:v000017AAd0000402B*
+ ID_MODEL_FROM_DATABASE=Intel 82599ES 10Gb 2-port Server Adapter X520-2
+
 pci:v000017AB*
  ID_VENDOR_FROM_DATABASE=Phillips Components
 
@@ -55409,6 +55841,120 @@ pci:v000017DBd00000101*
 pci:v000017DE*
  ID_VENDOR_FROM_DATABASE=KWorld Computer Co. Ltd.
 
+pci:v000017DF*
+ ID_VENDOR_FROM_DATABASE=Dini Group
+
+pci:v000017DFd00001864*
+ ID_MODEL_FROM_DATABASE=Virtex4 PCI Board w/ QL5064 Bridge [DN7000K10PCI/DN8000K10PCI/DN8000K10PSX/NOTUS]
+
+pci:v000017DFd00001865*
+ ID_MODEL_FROM_DATABASE=Virtex4 ASIC Emulator [DN8000K10PCIe]
+
+pci:v000017DFd00001866*
+ ID_MODEL_FROM_DATABASE=Virtex4 ASIC Emulator Cable Connection [DN8000K10PCI]
+
+pci:v000017DFd00001867*
+ ID_MODEL_FROM_DATABASE=Virtex4 ASIC Emulator Cable Connection [DN8000K10PCIe]
+
+pci:v000017DFd00001868*
+ ID_MODEL_FROM_DATABASE=Virtex4 ASIC Emulator [DN8000K10PCIe-8]
+
+pci:v000017DFd00001900*
+ ID_MODEL_FROM_DATABASE=Virtex5 PCIe ASIC Emulator [DN9000K10PCIe8T/DN9002K10PCIe8T/DN9200K10PCIe8T/DN7006K10PCIe8T/DN7406K10PCIe8T]
+
+pci:v000017DFd00001901*
+ ID_MODEL_FROM_DATABASE=Virtex5 PCIe ASIC Emulator Large BARs [DN9000K10PCIe8T/DN9002K10PCIe8T/DN9200K10PCIe8T/DN7006K10PCIe8T/DN7406K10PCIe8T]
+
+pci:v000017DFd00001902*
+ ID_MODEL_FROM_DATABASE=Virtex5 PCIe ASIC Emulator Low Power [Interceptor]
+
+pci:v000017DFd00001903*
+ ID_MODEL_FROM_DATABASE=Spartan6 PCIe FPGA Accelerator Board [DNBFCS12PCIe]
+
+pci:v000017DFd00001904*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe ASIC Emulation Board [DNDUALV6_PCIe4]
+
+pci:v000017DFd00001905*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe ASIC Emulation Board [DNV6F6PCIe]
+
+pci:v000017DFd00001906*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe ASIC Emulation Board [DN2076K10]
+
+pci:v000017DFd00001907*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe ASIC Emulation Board [DNV6F2PCIe]
+
+pci:v000017DFd00001908*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe ASIC Emulation Board Large BARs[DNV6F2PCIe]
+
+pci:v000017DFd00001909*
+ ID_MODEL_FROM_DATABASE=Kintex7 PCIe FPGA Accelerator Board [DNK7F5PCIe]
+
+pci:v000017DFd0000190A*
+ ID_MODEL_FROM_DATABASE=Virtex7 PCIe ASIC Emulation Board [DNV7F1A]
+
+pci:v000017DFd0000190B*
+ ID_MODEL_FROM_DATABASE=Stratix5 PCIe ASIC Emulation Board [DNS5GXF2]
+
+pci:v000017DFd0000190C*
+ ID_MODEL_FROM_DATABASE=Virtex7 PCIe ASIC Emulation Board [DNV7F2A]
+
+pci:v000017DFd0000190D*
+ ID_MODEL_FROM_DATABASE=Virtex7 PCIe ASIC Emulation Board [DNV7F4A]
+
+pci:v000017DFd0000190E*
+ ID_MODEL_FROM_DATABASE=Virtex7 PCIe ASIC Emulation Board [DNV7F2B]
+
+pci:v000017DFd0000190F*
+ ID_MODEL_FROM_DATABASE=KintexUS PCIe MainRef Design [DNPCIE_40G_KU_LL]
+
+pci:v000017DFd00001910*
+ ID_MODEL_FROM_DATABASE=VirtexUS ASIC Emulation Board [DNVUF4A]
+
+pci:v000017DFd00001911*
+ ID_MODEL_FROM_DATABASE=VirtexUS PCIe ASIC Emulation Board [DNVU_F2PCIe]
+
+pci:v000017DFd00001912*
+ ID_MODEL_FROM_DATABASE=KintexUS PCIe MainRef Design [DNPCIe_40G_KU_LL_QSFP]
+
+pci:v000017DFd00001913*
+ ID_MODEL_FROM_DATABASE=VirtexUS ASIC Emulation Board [DNVUF1A]
+
+pci:v000017DFd00001914*
+ ID_MODEL_FROM_DATABASE=VirtexUS ASIC Emulation Board [DNVUF2A]
+
+pci:v000017DFd00001915*
+ ID_MODEL_FROM_DATABASE=Arria10 PCIe MainRef Design [DNPCIe_80G_A10_LL]
+
+pci:v000017DFd00001916*
+ ID_MODEL_FROM_DATABASE=VirtexUS PCIe Accelerator Board [DNVUF2_HPC_PCIe]
+
+pci:v000017DFd00001A00*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe DMA Netlist Design
+
+pci:v000017DFd00001A01*
+ ID_MODEL_FROM_DATABASE=Virtex6 PCIe Darklite Design [DNPCIe_HXT_10G_LL]
+
+pci:v000017DFd00001A02*
+ ID_MODEL_FROM_DATABASE=Virtex7 PCIe DMA Netlist Design
+
+pci:v000017DFd00001A03*
+ ID_MODEL_FROM_DATABASE=Kintex7 PCIe Darklite Design [DNPCIe_K7_10G_LL]
+
+pci:v000017DFd00001A05*
+ ID_MODEL_FROM_DATABASE=Stratix5 PCIe Darklite Design [DNS5GX_F2]
+
+pci:v000017DFd00001A06*
+ ID_MODEL_FROM_DATABASE=VirtexUS PCIe DMA Netlist Design
+
+pci:v000017DFd00001A07*
+ ID_MODEL_FROM_DATABASE=KintexUS PCIe Darklite Design [DNPCIe_40G_KU_LL]
+
+pci:v000017DFd00001A08*
+ ID_MODEL_FROM_DATABASE=KintexUS PCIe Darklite Design [DNPCIe_40G_KU_LL_QSFP]
+
+pci:v000017DFd00001A09*
+ ID_MODEL_FROM_DATABASE=Arria10 PCIe Darklite Design [DNPCIe_80G_A10_LL]
+
 pci:v000017E4*
  ID_VENDOR_FROM_DATABASE=Sectra AB
 
@@ -56738,6 +57284,9 @@ pci:v00001924d00000903sv00001924sd0000800D*
 pci:v00001924d00000903sv00001924sd00008010*
  ID_MODEL_FROM_DATABASE=SFC9120 (SFA7942Q-R1 QSFP+ AOE Adapter)
 
+pci:v00001924d00000903sv00001924sd00008015*
+ ID_MODEL_FROM_DATABASE=SFC9120 (SFA7942Q-A5-0-R1 QSFP+ AOE Adapter)
+
 pci:v00001924d00000923*
  ID_MODEL_FROM_DATABASE=SFC9140
 
@@ -56753,12 +57302,30 @@ pci:v00001924d00000923sv00001924sd0000800F*
 pci:v00001924d00000A03*
  ID_MODEL_FROM_DATABASE=SFC9220
 
+pci:v00001924d00000A03sv00001924sd00008011*
+ ID_MODEL_FROM_DATABASE=SFC9220 (SFN 8022-R1 Solarflare Flareon 8000 Series 10G Adapter)
+
 pci:v00001924d00000A03sv00001924sd00008012*
  ID_MODEL_FROM_DATABASE=SFC9220 (SFN8522-R1 Flareon Ultra 8000 Series 10G Adapter)
 
+pci:v00001924d00000A03sv00001924sd00008013*
+ ID_MODEL_FROM_DATABASE=SFC9220 (SFN8042-R1 Solarflare Flareon 8000 Series 10/40G Adapter)
+
 pci:v00001924d00000A03sv00001924sd00008014*
  ID_MODEL_FROM_DATABASE=SFC9220 (SFN8542-R1 Flareon Ultra 8000 Series 10/40G Adapter)
 
+pci:v00001924d00000A03sv00001924sd00008016*
+ ID_MODEL_FROM_DATABASE=SFC9220 (SFN8022-R2 Flareon 8000 Series 10G Adapter)
+
+pci:v00001924d00000A03sv00001924sd00008017*
+ ID_MODEL_FROM_DATABASE=SFC9220 (SFN8522-R2 Flareon Ultra 8000 Series 10G Adapter)
+
+pci:v00001924d00000A03sv00001924sd00008018*
+ ID_MODEL_FROM_DATABASE=SFC9220 (SFN8042-R2 Flareon 8000 Series 10/40G Adapter)
+
+pci:v00001924d00000A03sv00001924sd00008019*
+ ID_MODEL_FROM_DATABASE=SFC9220 (SFN8542-R2 Flareon Ultra 8000 Series 10/40G Adapter)
+
 pci:v00001924d00001803*
  ID_MODEL_FROM_DATABASE=SFC9020 Virtual Function [Solarstorm]
 
@@ -58244,6 +58811,15 @@ pci:v00001B36d00000005*
 pci:v00001B36d00000005sv00001AF4sd00001100*
  ID_MODEL_FROM_DATABASE=QEMU PCI Test Device (QEMU Virtual Machine)
 
+pci:v00001B36d00000006*
+ ID_MODEL_FROM_DATABASE=PCI Rocker Ethernet switch device
+
+pci:v00001B36d00000007*
+ ID_MODEL_FROM_DATABASE=PCI SD Card Host Controller Interface
+
+pci:v00001B36d0000000A*
+ ID_MODEL_FROM_DATABASE=PCI-PCI bridge (multiseat)
+
 pci:v00001B36d00000100*
  ID_MODEL_FROM_DATABASE=QXL paravirtual graphic card
 
@@ -58385,6 +58961,9 @@ pci:v00001B4Bd00009220*
 pci:v00001B4Bd00009230*
  ID_MODEL_FROM_DATABASE=88SE9230 PCIe SATA 6Gb/s Controller
 
+pci:v00001B4Bd00009230sv00001D49sd00000300*
+ ID_MODEL_FROM_DATABASE=88SE9230 PCIe SATA 6Gb/s Controller (ThinkSystem M.2 with Mirroring Enablement Kit)
+
 pci:v00001B4Bd00009235*
  ID_MODEL_FROM_DATABASE=88SE9235 PCIe 2.0 x2 4-port SATA 6 Gb/s Controller
 
@@ -58403,6 +58982,9 @@ pci:v00001B55*
 pci:v00001B55d000018F6*
  ID_MODEL_FROM_DATABASE=Dual DVB Universal CI card
 
+pci:v00001B55d000018F7*
+ ID_MODEL_FROM_DATABASE=Dual DVB Universal CI card rev 1.4
+
 pci:v00001B55d00002A2C*
  ID_MODEL_FROM_DATABASE=Dual DVB-S2-CI card
 
@@ -58532,6 +59114,18 @@ pci:v00001BB1d0000005Dsv00001BB1sd00006522*
 pci:v00001BB1d0000005Dsv00001BB1sd00006523*
  ID_MODEL_FROM_DATABASE=Nytro PCIe Flash Storage (Nytro XP6500-8A4096)
 
+pci:v00001BB1d00000100*
+ ID_MODEL_FROM_DATABASE=Nytro Flash Storage
+
+pci:v00001BB1d00000100sv00001BB1sd00000101*
+ ID_MODEL_FROM_DATABASE=Nytro Flash Storage (Nytro XF1440)
+
+pci:v00001BB1d00000100sv00001BB1sd00000121*
+ ID_MODEL_FROM_DATABASE=Nytro Flash Storage (Nytro XM1440)
+
+pci:v00001BB1d00000100sv00001BB1sd000001A1*
+ ID_MODEL_FROM_DATABASE=Nytro Flash Storage (Nytro XP7102)
+
 pci:v00001BB3*
  ID_VENDOR_FROM_DATABASE=Bluecherry
 
@@ -58739,12 +59333,24 @@ pci:v00001C8Ad00000001*
 pci:v00001CB1*
  ID_VENDOR_FROM_DATABASE=Collion UG & Co.KG
 
+pci:v00001CB8*
+ ID_VENDOR_FROM_DATABASE=Dawning Information Industry Co., Ltd.
+
 pci:v00001CC5*
  ID_VENDOR_FROM_DATABASE=Embedded Intelligence, Inc.
 
 pci:v00001CC5d00000100*
  ID_MODEL_FROM_DATABASE=CAN-PCIe-02
 
+pci:v00001CC7*
+ ID_VENDOR_FROM_DATABASE=Radian Memory Systems Inc.
+
+pci:v00001CC7d00000200*
+ ID_MODEL_FROM_DATABASE=RMS-200
+
+pci:v00001CC7d00000250*
+ ID_MODEL_FROM_DATABASE=RMS-250
+
 pci:v00001CD2*
  ID_VENDOR_FROM_DATABASE=SesKion GmbH
 
@@ -58760,6 +59366,9 @@ pci:v00001CD2d00000303*
 pci:v00001CD2d00000304*
  ID_MODEL_FROM_DATABASE=Simulyzer-RT CompactPCI Serial PWR-ANA-1 card
 
+pci:v00001CD2d00000305*
+ ID_MODEL_FROM_DATABASE=Simulyzer-RT CompactPCI Serial CAN-1 card
+
 pci:v00001CDD*
  ID_VENDOR_FROM_DATABASE=secunet Security Networks AG
 
@@ -58805,6 +59414,12 @@ pci:v00001D26*
 pci:v00001D26d00000040*
  ID_MODEL_FROM_DATABASE=Turbocard2 Accelerator
 
+pci:v00001D26d00000080*
+ ID_MODEL_FROM_DATABASE=Open Network Interface Card 80G
+
+pci:v00001D26d000000C0*
+ ID_MODEL_FROM_DATABASE=Turbocard3 Accelerator
+
 pci:v00001D26d0000E004*
  ID_MODEL_FROM_DATABASE=AB01/EMB01 Development Board
 
@@ -58874,6 +59489,12 @@ pci:v00001D6Cd0000100B*
 pci:v00001D6Cd0000100C*
  ID_MODEL_FROM_DATABASE=K35-4SFP
 
+pci:v00001D6Cd0000100D*
+ ID_MODEL_FROM_DATABASE=AR-ARKA-FX0 [Arkville 32B DPDK Data Mover]
+
+pci:v00001D6Cd0000100E*
+ ID_MODEL_FROM_DATABASE=AR-ARKA-FX1 [Arkville 64B DPDK Data Mover]
+
 pci:v00001D6Cd00004200*
  ID_MODEL_FROM_DATABASE=A5PL-E1-10GETI [10 GbE Ethernet Traffic Instrument]
 
@@ -59174,6 +59795,9 @@ pci:v00003388d00000022*
 pci:v00003388d00000026*
  ID_MODEL_FROM_DATABASE=HB2 PCI-PCI Bridge
 
+pci:v00003388d00001014*
+ ID_MODEL_FROM_DATABASE=AudioTrak Maya
+
 pci:v00003388d00001018*
  ID_MODEL_FROM_DATABASE=Audiotrak INCA88
 
@@ -59783,6 +60407,9 @@ pci:v00004624d0000DE01*
 pci:v00004624d0000DE02*
  ID_MODEL_FROM_DATABASE=DL200ME Middle resolution delay line PCI based card
 
+pci:v00004651*
+ ID_VENDOR_FROM_DATABASE=TXIC
+
 pci:v00004680*
  ID_VENDOR_FROM_DATABASE=Umax Computer Corp
 
@@ -60827,6 +61454,9 @@ pci:v00005646*
 pci:v00005654*
  ID_VENDOR_FROM_DATABASE=VoiceTronix Pty Ltd
 
+pci:v00005678*
+ ID_VENDOR_FROM_DATABASE=Dawicontrol Computersysteme GmbH
+
 pci:v00005700*
  ID_VENDOR_FROM_DATABASE=Netpower
 
@@ -64568,6 +65198,9 @@ pci:v00008086d000010FBsv000017AAsd00001071*
 pci:v00008086d000010FBsv000017AAsd00004007*
  ID_MODEL_FROM_DATABASE=82599ES 10-Gigabit SFI/SFP+ Network Connection
 
+pci:v00008086d000010FBsv000017AAsd0000402B*
+ ID_MODEL_FROM_DATABASE=82599ES 10-Gigabit SFI/SFP+ Network Connection (82599ES 10Gb 2-port Server Adapter X520-DA2)
+
 pci:v00008086d000010FBsv00008086sd00000002*
  ID_MODEL_FROM_DATABASE=82599ES 10-Gigabit SFI/SFP+ Network Connection (Ethernet Server Adapter X520-DA2)
 
@@ -65741,6 +66374,9 @@ pci:v00008086d00001563sv00008086sd0000001A*
 pci:v00008086d00001563sv00008086sd00000022*
  ID_MODEL_FROM_DATABASE=Ethernet Controller 10G X550T (Ethernet Converged Network Adapter X550-T2)
 
+pci:v00008086d00001565*
+ ID_MODEL_FROM_DATABASE=X550 Virtual Function
+
 pci:v00008086d00001566*
  ID_MODEL_FROM_DATABASE=DSL4410 Thunderbolt NHI [Redwood Ridge 2C 2013]
 
@@ -65840,9 +66476,15 @@ pci:v00008086d00001572sv00008086sd00000009*
 pci:v00008086d00001572sv00008086sd0000000A*
  ID_MODEL_FROM_DATABASE=Ethernet Controller X710 for 10GbE SFP+
 
+pci:v00008086d00001572sv00008086sd0000000B*
+ ID_MODEL_FROM_DATABASE=Ethernet Controller X710 for 10GbE SFP+ (Ethernet Server Adapter X710-DA2 for OCP)
+
 pci:v00008086d00001572sv00008086sd0000000D*
  ID_MODEL_FROM_DATABASE=Ethernet Controller X710 for 10GbE SFP+
 
+pci:v00008086d00001572sv00008086sd00000010*
+ ID_MODEL_FROM_DATABASE=Ethernet Controller X710 for 10GbE SFP+ (Ethernet Converged Network Adapter X710)
+
 pci:v00008086d00001572sv00008086sd00004005*
  ID_MODEL_FROM_DATABASE=Ethernet Controller X710 for 10GbE SFP+ (Ethernet Controller XL710 for 10 Gigabit SFP+)
 
@@ -65850,10 +66492,10 @@ pci:v00008086d00001572sv00008086sd00004006*
  ID_MODEL_FROM_DATABASE=Ethernet Controller X710 for 10GbE SFP+
 
 pci:v00008086d00001575*
- ID_MODEL_FROM_DATABASE=DSL5110 Thunderbolt NHI [Falcon Ridge LP 2014]
+ ID_MODEL_FROM_DATABASE=DSL6340 Thunderbolt 3 NHI [Alpine Ridge 2C 2015]
 
 pci:v00008086d00001576*
- ID_MODEL_FROM_DATABASE=DSL5110 Thunderbolt Bridge [Falcon Ridge LP 2014]
+ ID_MODEL_FROM_DATABASE=DSL6340 Thunderbolt 3 Bridge [Alpine Ridge 2C 2015]
 
 pci:v00008086d00001577*
  ID_MODEL_FROM_DATABASE=DSL6540 Thunderbolt 3 NHI [Alpine Ridge 4C 2015]
@@ -65868,10 +66510,10 @@ pci:v00008086d0000157C*
  ID_MODEL_FROM_DATABASE=I210 Gigabit Backplane Connection
 
 pci:v00008086d0000157D*
- ID_MODEL_FROM_DATABASE=DSL6340 Thunderbolt 3 NHI [Alpine Ridge 2C 2015]
+ ID_MODEL_FROM_DATABASE=DSL5110 Thunderbolt 2 NHI (Low Power) [Win Ridge 2C 2014]
 
 pci:v00008086d0000157E*
- ID_MODEL_FROM_DATABASE=DSL6340 Thunderbolt 3 Bridge [Alpine Ridge 2C 2015]
+ ID_MODEL_FROM_DATABASE=DSL5110 Thunderbolt 2 Bridge (Low Power) [Win Ridge 2C 2014]
 
 pci:v00008086d00001580*
  ID_MODEL_FROM_DATABASE=Ethernet Controller XL710 for 40GbE backplane
@@ -66002,6 +66644,9 @@ pci:v00008086d00001589sv00008086sd00000001*
 pci:v00008086d00001589sv00008086sd00000002*
  ID_MODEL_FROM_DATABASE=Ethernet Controller X710/X557-AT 10GBASE-T (Ethernet Converged Network Adapter X710-T4)
 
+pci:v00008086d00001589sv00008086sd00001003*
+ ID_MODEL_FROM_DATABASE=Ethernet Controller X710/X557-AT 10GBASE-T (Ethernet Converged Network Adapter X710-T)
+
 pci:v00008086d000015A0*
  ID_MODEL_FROM_DATABASE=Ethernet Connection (2) I218-LM
 
@@ -66041,6 +66686,9 @@ pci:v00008086d000015AD*
 pci:v00008086d000015AE*
  ID_MODEL_FROM_DATABASE=Ethernet Connection X552 1000BASE-T
 
+pci:v00008086d000015B5*
+ ID_MODEL_FROM_DATABASE=DSL6340 USB 3.1 Controller [Alpine Ridge]
+
 pci:v00008086d000015B6*
  ID_MODEL_FROM_DATABASE=DSL6540 USB 3.1 Controller [Alpine Ridge]
 
@@ -66053,6 +66701,12 @@ pci:v00008086d000015B8*
 pci:v00008086d000015B9*
  ID_MODEL_FROM_DATABASE=Ethernet Connection (3) I219-LM
 
+pci:v00008086d000015BF*
+ ID_MODEL_FROM_DATABASE=JHL6240 Thunderbolt 3 NHI (Low Power) [Alpine Ridge LP 2016]
+
+pci:v00008086d000015C0*
+ ID_MODEL_FROM_DATABASE=JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016]
+
 pci:v00008086d000015D0*
  ID_MODEL_FROM_DATABASE=Ethernet SDI Adapter FM10420-100GbE-QDA2
 
@@ -66068,9 +66722,18 @@ pci:v00008086d000015D1sv00008086sd00000021*
 pci:v00008086d000015D1sv00008086sd000000A2*
  ID_MODEL_FROM_DATABASE=Ethernet Controller 10G X550T (Ethernet Converged Network Adapter X550-T1)
 
+pci:v00008086d000015D2*
+ ID_MODEL_FROM_DATABASE=JHL6540 Thunderbolt 3 NHI (C step) [Alpine Ridge 4C 2016]
+
+pci:v00008086d000015D3*
+ ID_MODEL_FROM_DATABASE=JHL6540 Thunderbolt 3 Bridge (C step) [Alpine Ridge 4C 2016]
+
 pci:v00008086d000015D5*
  ID_MODEL_FROM_DATABASE=Ethernet SDI Adapter FM10420-25GbE-DA2
 
+pci:v00008086d000015D5sv00008086sd00000001*
+ ID_MODEL_FROM_DATABASE=Ethernet SDI Adapter FM10420-25GbE-DA2 (Intel(R) Ethernet SDI Adapter FM10420-25GbE-DA2)
+
 pci:v00008086d000015D6*
  ID_MODEL_FROM_DATABASE=Ethernet Connection (5) I219-V
 
@@ -66080,6 +66743,12 @@ pci:v00008086d000015D7*
 pci:v00008086d000015D8*
  ID_MODEL_FROM_DATABASE=Ethernet Connection (4) I219-V
 
+pci:v00008086d000015D9*
+ ID_MODEL_FROM_DATABASE=JHL6340 Thunderbolt 3 NHI (C step) [Alpine Ridge 2C 2016]
+
+pci:v00008086d000015DA*
+ ID_MODEL_FROM_DATABASE=JHL6340 Thunderbolt 3 Bridge (C step) [Alpine Ridge 2C 2016]
+
 pci:v00008086d000015E3*
  ID_MODEL_FROM_DATABASE=Ethernet Connection (5) I219-LM
 
@@ -66212,6 +66881,9 @@ pci:v00008086d00001903*
 pci:v00008086d00001904*
  ID_MODEL_FROM_DATABASE=Skylake Host Bridge/DRAM Registers
 
+pci:v00008086d00001904sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Skylake Host Bridge/DRAM Registers (Latitude 3570)
+
 pci:v00008086d00001905*
  ID_MODEL_FROM_DATABASE=Skylake PCIe Controller (x8)
 
@@ -66242,6 +66914,9 @@ pci:v00008086d00001912*
 pci:v00008086d00001916*
  ID_MODEL_FROM_DATABASE=HD Graphics 520
 
+pci:v00008086d00001916sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=HD Graphics 520 (Latitude 3570)
+
 pci:v00008086d00001918*
  ID_MODEL_FROM_DATABASE=Skylake Host Bridge/DRAM Registers
 
@@ -67656,97 +68331,97 @@ pci:v00008086d0000225E*
  ID_MODEL_FROM_DATABASE=Xeon Phi coprocessor 31S1
 
 pci:v00008086d00002280*
- ID_MODEL_FROM_DATABASE=Braswell SoC Transaction Router
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SoC Transaction Register
 
 pci:v00008086d00002284*
- ID_MODEL_FROM_DATABASE=Braswell HD Audio Controller
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series High Definition Audio Controller
 
 pci:v00008086d00002286*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O DMA
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO1 DMA Controller
 
 pci:v00008086d0000228A*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O HSUART Port 1
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO1 HSUART Controller #1
 
 pci:v00008086d0000228C*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O HSUART Port 2
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO1 HSUART Controller #2
 
 pci:v00008086d00002292*
- ID_MODEL_FROM_DATABASE=Braswell Platform Controller Unit SMBus
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx SMBus Controller
 
 pci:v00008086d00002294*
- ID_MODEL_FROM_DATABASE=Braswell Storage Cluster Control MMC Port
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series MMC Controller
 
 pci:v00008086d00002295*
- ID_MODEL_FROM_DATABASE=Braswell Storage Cluster Control SDIO Port
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SDIO Controller
 
 pci:v00008086d00002296*
- ID_MODEL_FROM_DATABASE=Braswell Storage Cluster Control SD Port
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SD Controller
 
 pci:v00008086d00002298*
- ID_MODEL_FROM_DATABASE=Braswell Trusted Execution Engine Interface
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series Trusted Execution Engine
 
 pci:v00008086d0000229C*
- ID_MODEL_FROM_DATABASE=Braswell Platform Controller Unit LPC
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCU
 
 pci:v00008086d000022A3*
- ID_MODEL_FROM_DATABASE=Braswell SATA Controller
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SATA Controller
 
 pci:v00008086d000022A4*
- ID_MODEL_FROM_DATABASE=Braswell SATA AHCI Controller
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SATA AHCI Controller
 
 pci:v00008086d000022A8*
- ID_MODEL_FROM_DATABASE=Braswell Low Power Engine Audio
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series Low Power Engine Audio
 
 pci:v00008086d000022B0*
- ID_MODEL_FROM_DATABASE=Braswell PCI Configuration Registers
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Configuration Registers
 
 pci:v00008086d000022B1*
- ID_MODEL_FROM_DATABASE=Braswell Integrated Graphics Controller
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Integrated Graphics Controller
 
 pci:v00008086d000022B5*
- ID_MODEL_FROM_DATABASE=Braswell USB xHCI Host Controller
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series USB xHCI Controller
 
 pci:v00008086d000022B8*
- ID_MODEL_FROM_DATABASE=Braswell ISP Camera
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series Imaging Unit
 
 pci:v00008086d000022C0*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O DMA
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 DMA Controller
 
 pci:v00008086d000022C1*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 1
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #1
 
 pci:v00008086d000022C2*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 2
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #2
 
 pci:v00008086d000022C3*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 3
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #3
 
 pci:v00008086d000022C4*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 4
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #4
 
 pci:v00008086d000022C5*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 5
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #5
 
 pci:v00008086d000022C6*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 6
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #6
 
 pci:v00008086d000022C7*
- ID_MODEL_FROM_DATABASE=Braswell Serial I/O I2C Port 7
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #7
 
 pci:v00008086d000022C8*
- ID_MODEL_FROM_DATABASE=Braswell PCIe Port 1
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #1
 
 pci:v00008086d000022CA*
- ID_MODEL_FROM_DATABASE=Braswell PCIe Port 2
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #2
 
 pci:v00008086d000022CC*
- ID_MODEL_FROM_DATABASE=Braswell PCIe Port 3
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #3
 
 pci:v00008086d000022CE*
- ID_MODEL_FROM_DATABASE=Braswell PCIe Port 4
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #4
 
 pci:v00008086d000022DC*
- ID_MODEL_FROM_DATABASE=Braswell P-Unit Power Management
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series Power Management Controller
 
 pci:v00008086d00002310*
  ID_MODEL_FROM_DATABASE=DH89xxCC LPC Controller
@@ -69758,6 +70433,12 @@ pci:v00008086d000024F0sv000010A9sd00008031*
 pci:v00008086d000024F0sv000015D9sd00000934*
  ID_MODEL_FROM_DATABASE=Omni-Path HFI Silicon 100 Series [discrete] (Omni-Path HFI Adapter 100 Series, 1 Port, PCIe x16, SIOM Module)
 
+pci:v00008086d000024F0sv00001CB8sd00000001*
+ ID_MODEL_FROM_DATABASE=Omni-Path HFI Silicon 100 Series [discrete] (Omni-Path HFI Adapter 100 Series, 1 Port, PCIe x16, TC4600 QSFP28)
+
+pci:v00008086d000024F0sv00001CB8sd00000002*
+ ID_MODEL_FROM_DATABASE=Omni-Path HFI Silicon 100 Series [discrete] (Omni-Path HFI Adapter 100 Series, 1 Port, PCIe x16, TC6600 Fixed Port)
+
 pci:v00008086d000024F0sv00008086sd00002628*
  ID_MODEL_FROM_DATABASE=Omni-Path HFI Silicon 100 Series [discrete] (Omni-Path HFI Adapter 100 Series, 1 Port, PCIe x16)
 
@@ -76064,6 +76745,12 @@ pci:v00008086d000037CD*
 pci:v00008086d000037CE*
  ID_MODEL_FROM_DATABASE=Ethernet Connection X722 for 10GbE backplane
 
+pci:v00008086d000037CEsv00001590sd00000200*
+ ID_MODEL_FROM_DATABASE=Ethernet Connection X722 for 10GbE backplane (Ethernet 10Gb 2-port 568i Adapter)
+
+pci:v00008086d000037CEsv00008086sd00000215*
+ ID_MODEL_FROM_DATABASE=Ethernet Connection X722 for 10GbE backplane (Ethernet 10Gb 2-port 568i Adapter)
+
 pci:v00008086d000037CF*
  ID_MODEL_FROM_DATABASE=Ethernet Connection X722 for 10GbE QSFP+
 
@@ -76082,6 +76769,9 @@ pci:v00008086d000037D3*
 pci:v00008086d000037D4*
  ID_MODEL_FROM_DATABASE=Ethernet Connection X722 for 10GbE QSFP+
 
+pci:v00008086d000037D9*
+ ID_MODEL_FROM_DATABASE=X722 Hyper-V Virtual Function
+
 pci:v00008086d00003A00*
  ID_MODEL_FROM_DATABASE=82801JD/DO (ICH10 Family) 4-port SATA IDE Controller
 
@@ -77681,8 +78371,110 @@ pci:v00008086d00005845*
 pci:v00008086d00005845sv00001AF4sd00001100*
  ID_MODEL_FROM_DATABASE=QEMU NVM Express Controller (QEMU Virtual Machine)
 
+pci:v00008086d00005A84*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Integrated Graphics Controller
+
+pci:v00008086d00005A88*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Imaging Unit
+
+pci:v00008086d00005A98*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Audio Cluster
+
+pci:v00008086d00005A9A*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Trusted Execution Engine
+
+pci:v00008086d00005AA2*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Integrated Sensor Hub
+
+pci:v00008086d00005AA8*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series USB xHCI
+
+pci:v00008086d00005AAC*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #1
+
+pci:v00008086d00005AAE*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #2
+
+pci:v00008086d00005AB0*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #3
+
+pci:v00008086d00005AB2*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #4
+
+pci:v00008086d00005AB4*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #5
+
+pci:v00008086d00005AB6*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #6
+
+pci:v00008086d00005AB8*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #7
+
+pci:v00008086d00005ABA*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series I2C Controller #8
+
+pci:v00008086d00005ABC*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series HSUART Controller #1
+
+pci:v00008086d00005ABE*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series HSUART Controller #2
+
+pci:v00008086d00005AC0*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series HSUART Controller #3
+
+pci:v00008086d00005AC2*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SPI Controller #1
+
+pci:v00008086d00005AC4*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SPI Controller #2
+
+pci:v00008086d00005AC6*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SPI Controller #3
+
+pci:v00008086d00005AC8*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PWM Pin Controller
+
+pci:v00008086d00005ACA*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SDXC/MMC Host Controller
+
+pci:v00008086d00005ACC*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series eMMC Controller
+
+pci:v00008086d00005AD0*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SDIO Controller
+
 pci:v00008086d00005AD4*
- ID_MODEL_FROM_DATABASE=Broxton SMBus Controller
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SMBus Controller
+
+pci:v00008086d00005AD6*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PCI Express Port B #1
+
+pci:v00008086d00005AD7*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PCI Express Port B #2
+
+pci:v00008086d00005AD8*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PCI Express Port A #1
+
+pci:v00008086d00005AD9*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PCI Express Port A #2
+
+pci:v00008086d00005ADA*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PCI Express Port A #3
+
+pci:v00008086d00005ADB*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series PCI Express Port A #4
+
+pci:v00008086d00005AE3*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series SATA AHCI Controller
+
+pci:v00008086d00005AE8*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Low Pin Count Interface
+
+pci:v00008086d00005AEE*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series HSUART Controller #4
+
+pci:v00008086d00005AF0*
+ ID_MODEL_FROM_DATABASE=Atom/Celeron/Pentium Processor N4200/N3350/E3900 Series Host Bridge
 
 pci:v00008086d000065C0*
  ID_MODEL_FROM_DATABASE=5100 Chipset Memory Controller Hub
@@ -79601,6 +80393,9 @@ pci:v00008086d00009CE6*
 pci:v00008086d00009D03*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP SATA Controller [AHCI mode]
 
+pci:v00008086d00009D03sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP SATA Controller [AHCI mode] (Latitude 3570)
+
 pci:v00008086d00009D14*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP PCI Express Root Port #5
 
@@ -79610,9 +80405,15 @@ pci:v00008086d00009D15*
 pci:v00008086d00009D21*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP PMC
 
+pci:v00008086d00009D21sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP PMC (Latitude 3570)
+
 pci:v00008086d00009D23*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP SMBus
 
+pci:v00008086d00009D23sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP SMBus (Latitude 3570)
+
 pci:v00008086d00009D27*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP Serial IO UART Controller #0
 
@@ -79631,18 +80432,33 @@ pci:v00008086d00009D2D*
 pci:v00008086d00009D2F*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP USB 3.0 xHCI Controller
 
+pci:v00008086d00009D2Fsv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP USB 3.0 xHCI Controller (Latitude 3570)
+
 pci:v00008086d00009D31*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP Thermal subsystem
 
+pci:v00008086d00009D31sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP Thermal subsystem (Latitude 3570)
+
 pci:v00008086d00009D3A*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP CSME HECI #1
 
+pci:v00008086d00009D3Asv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP CSME HECI #1 (Latitude 3570)
+
 pci:v00008086d00009D48*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP LPC Controller
 
+pci:v00008086d00009D48sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP LPC Controller (Latitude 3570)
+
 pci:v00008086d00009D60*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP Serial IO I2C Controller #0
 
+pci:v00008086d00009D60sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP Serial IO I2C Controller #0 (Latitude 3570)
+
 pci:v00008086d00009D60sv00008086sd00009D60*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP Serial IO I2C Controller #0 (100 Series PCH/Sunrise Point PCH I2C0 [Skylake/Kaby Lake LPSS I2C])
 
@@ -79667,6 +80483,9 @@ pci:v00008086d00009D66*
 pci:v00008086d00009D70*
  ID_MODEL_FROM_DATABASE=Sunrise Point-LP HD Audio
 
+pci:v00008086d00009D70sv00001028sd000006F3*
+ ID_MODEL_FROM_DATABASE=Sunrise Point-LP HD Audio (Latitude 3570)
+
 pci:v00008086d0000A000*
  ID_MODEL_FROM_DATABASE=Atom Processor D4xx/D5xx/N4xx/N5xx DMI Bridge
 
diff --git a/src/grp-udev/hwdb/20-usb-vendor-model.hwdb b/src/grp-udev/hwdb/20-usb-vendor-model.hwdb
index cef2ade2e9..fec0fb4daa 100644
--- a/src/grp-udev/hwdb/20-usb-vendor-model.hwdb
+++ b/src/grp-udev/hwdb/20-usb-vendor-model.hwdb
@@ -275,9 +275,15 @@ usb:v03EBp210D*
 usb:v03EBp2110*
  ID_MODEL_FROM_DATABASE=AVR JTAGICE3 Debugger and Programmer
 
+usb:v03EBp2111*
+ ID_MODEL_FROM_DATABASE=Xplained Pro board debugger and programmer
+
 usb:v03EBp2122*
  ID_MODEL_FROM_DATABASE=XMEGA-A1 Explained evaluation kit
 
+usb:v03EBp2140*
+ ID_MODEL_FROM_DATABASE=AVR JTAGICE3 (v3.x) Debugger and Programmer
+
 usb:v03EBp2141*
  ID_MODEL_FROM_DATABASE=ICE debugger
 
@@ -293,12 +299,36 @@ usb:v03EBp2FE6*
 usb:v03EBp2FEA*
  ID_MODEL_FROM_DATABASE=Cactus RF60 (DFU)
 
+usb:v03EBp2FEE*
+ ID_MODEL_FROM_DATABASE=atmega8u2 DFU bootloader
+
+usb:v03EBp2FEF*
+ ID_MODEL_FROM_DATABASE=atmega16u2 DFU bootloader
+
 usb:v03EBp2FF0*
  ID_MODEL_FROM_DATABASE=atmega32u2 DFU bootloader
 
+usb:v03EBp2FF1*
+ ID_MODEL_FROM_DATABASE=at32uc3a3 DFU bootloader
+
+usb:v03EBp2FF3*
+ ID_MODEL_FROM_DATABASE=atmega16u4 DFU bootloader
+
 usb:v03EBp2FF4*
  ID_MODEL_FROM_DATABASE=atmega32u4 DFU bootloader
 
+usb:v03EBp2FF6*
+ ID_MODEL_FROM_DATABASE=at32uc3b0/1 DFU bootloader
+
+usb:v03EBp2FF7*
+ ID_MODEL_FROM_DATABASE=at90usb82 DFU bootloader
+
+usb:v03EBp2FF8*
+ ID_MODEL_FROM_DATABASE=at32uc3a0/1 DFU bootloader
+
+usb:v03EBp2FF9*
+ ID_MODEL_FROM_DATABASE=at90usb646/647 DFU bootloader
+
 usb:v03EBp2FFA*
  ID_MODEL_FROM_DATABASE=at90usb162 DFU bootloader
 
@@ -695,6 +725,9 @@ usb:v03F0p0D12*
 usb:v03F0p0D17*
  ID_MODEL_FROM_DATABASE=LaserJet 1012
 
+usb:v03F0p0D4A*
+ ID_MODEL_FROM_DATABASE=SK-2025 Keyboard
+
 usb:v03F0p0E17*
  ID_MODEL_FROM_DATABASE=LaserJet 1015
 
@@ -740,6 +773,9 @@ usb:v03F0p1024*
 usb:v03F0p1027*
  ID_MODEL_FROM_DATABASE=Virtual keyboard and mouse
 
+usb:v03F0p102A*
+ ID_MODEL_FROM_DATABASE=LaserJet Professional P 1102w
+
 usb:v03F0p1102*
  ID_MODEL_FROM_DATABASE=PhotoSmart 240 series
 
@@ -1176,7 +1212,7 @@ usb:v03F0p2F11*
  ID_MODEL_FROM_DATABASE=PSC 1200
 
 usb:v03F0p2F17*
- ID_MODEL_FROM_DATABASE=EWS 2605dn
+ ID_MODEL_FROM_DATABASE=Color LaserJet 2605dn
 
 usb:v03F0p2F24*
  ID_MODEL_FROM_DATABASE=LP2475w Monitor Hub
@@ -1229,6 +1265,9 @@ usb:v03F0p3302*
 usb:v03F0p3304*
  ID_MODEL_FROM_DATABASE=DeskJet 990c
 
+usb:v03F0p3307*
+ ID_MODEL_FROM_DATABASE=v125w Stick
+
 usb:v03F0p3312*
  ID_MODEL_FROM_DATABASE=OfficeJet J6410
 
@@ -1496,6 +1535,9 @@ usb:v03F0p5811*
 usb:v03F0p5817*
  ID_MODEL_FROM_DATABASE=LaserJet M1319f MFP
 
+usb:v03F0p581D*
+ ID_MODEL_FROM_DATABASE=lt4112 Gobi 4G Module Network Device
+
 usb:v03F0p5911*
  ID_MODEL_FROM_DATABASE=PhotoSmart C6180
 
@@ -3728,6 +3770,9 @@ usb:v041Ep3061*
 usb:v041Ep3090*
  ID_MODEL_FROM_DATABASE=Sound Blaster Digital Music SX
 
+usb:v041Ep30D0*
+ ID_MODEL_FROM_DATABASE=Xmod
+
 usb:v041Ep30D3*
  ID_MODEL_FROM_DATABASE=Sound Blaster Play!
 
@@ -3752,6 +3797,9 @@ usb:v041Ep3F04*
 usb:v041Ep3F07*
  ID_MODEL_FROM_DATABASE=E-Mu Xmidi 1x1
 
+usb:v041Ep3F0E*
+ ID_MODEL_FROM_DATABASE=Xmidi 1x1 Tab
+
 usb:v041Ep4003*
  ID_MODEL_FROM_DATABASE=VideoBlaster Webcam Go Plus [W9967CF]
 
@@ -3932,6 +3980,9 @@ usb:v041Ep4088*
 usb:v041Ep4095*
  ID_MODEL_FROM_DATABASE=Live! Cam Sync HD [VF0770]
 
+usb:v041Ep4097*
+ ID_MODEL_FROM_DATABASE=Live! Cam Chat HD [VF0700]
+
 usb:v041Ep4100*
  ID_MODEL_FROM_DATABASE=Nomad Jukebox 2
 
@@ -4454,9 +4505,18 @@ usb:v0421p0610*
 usb:v0421p0661*
  ID_MODEL_FROM_DATABASE=Lumia 620/920
 
+usb:v0421p0662*
+ ID_MODEL_FROM_DATABASE=301 Dual SIM (Mass Storage)
+
+usb:v0421p0663*
+ ID_MODEL_FROM_DATABASE=301 Dual SIM
+
 usb:v0421p069A*
  ID_MODEL_FROM_DATABASE=130 [RM-1035] (Charging only)
 
+usb:v0421p06FC*
+ ID_MODEL_FROM_DATABASE=Lumia 640 Phone
+
 usb:v0421p0720*
  ID_MODEL_FROM_DATABASE=X (RM-980)
 
@@ -4514,6 +4574,9 @@ usb:v0424*
 usb:v0424p0001*
  ID_MODEL_FROM_DATABASE=Integrated Hub
 
+usb:v0424p0140*
+ ID_MODEL_FROM_DATABASE=LPC47M14x hub
+
 usb:v0424p0ACD*
  ID_MODEL_FROM_DATABASE=Sitecom Internal Multi Memory reader/writer MD-005
 
@@ -4595,6 +4658,9 @@ usb:v0424p9512*
 usb:v0424p9514*
  ID_MODEL_FROM_DATABASE=SMC9514 Hub
 
+usb:v0424p9904*
+ ID_MODEL_FROM_DATABASE=LAN9512/LAN9514 Ethernet 10/100 Adapter (SAL10)
+
 usb:v0424pA700*
  ID_MODEL_FROM_DATABASE=2 Port Hub
 
@@ -4709,6 +4775,9 @@ usb:v0431p0100*
 usb:v0432*
  ID_VENDOR_FROM_DATABASE=Unisys Corp.
 
+usb:v0432p0031*
+ ID_MODEL_FROM_DATABASE=Document Processor
+
 usb:v0433*
  ID_VENDOR_FROM_DATABASE=Alps Electric, Inc.
 
@@ -5270,6 +5339,18 @@ usb:v0446p6782*
 usb:v0447*
  ID_VENDOR_FROM_DATABASE=Momentum Microsystems
 
+usb:v0449*
+ ID_VENDOR_FROM_DATABASE=Duta Multi Robotik
+
+usb:v0449p0128*
+ ID_MODEL_FROM_DATABASE=Menengah
+
+usb:v0449p0210*
+ ID_MODEL_FROM_DATABASE=Dasar
+
+usb:v0449p0612*
+ ID_MODEL_FROM_DATABASE=Lanjutan
+
 usb:v044A*
  ID_VENDOR_FROM_DATABASE=Shamrock Tech. Co., Ltd
 
@@ -5465,9 +5546,18 @@ usb:v0451p6070*
 usb:v0451p625F*
  ID_MODEL_FROM_DATABASE=TUSB6250 ATA Bridge
 
+usb:v0451p8041*
+ ID_MODEL_FROM_DATABASE=Hub
+
 usb:v0451p8042*
  ID_MODEL_FROM_DATABASE=Hub
 
+usb:v0451p8043*
+ ID_MODEL_FROM_DATABASE=Hub
+
+usb:v0451p8140*
+ ID_MODEL_FROM_DATABASE=TUSB8041 4-Port Hub
+
 usb:v0451p8142*
  ID_MODEL_FROM_DATABASE=TUSB8041 4-Port Hub
 
@@ -6186,7 +6276,7 @@ usb:v045Ep00DD*
  ID_MODEL_FROM_DATABASE=Comfort Curve Keyboard 2000 V1.0
 
 usb:v045Ep00E1*
- ID_MODEL_FROM_DATABASE=Wireless Laser Mouse 6000 Reciever
+ ID_MODEL_FROM_DATABASE=Wireless Laser Mouse 6000 Receiver
 
 usb:v045Ep00F4*
  ID_MODEL_FROM_DATABASE=LifeCam VX-6000 (SN9C20x + OV9650)
@@ -6210,7 +6300,7 @@ usb:v045Ep0202*
  ID_MODEL_FROM_DATABASE=Xbox Controller
 
 usb:v045Ep0280*
- ID_MODEL_FROM_DATABASE=XBox Device
+ ID_MODEL_FROM_DATABASE=Xbox Memory Unit (8MB)
 
 usb:v045Ep0283*
  ID_MODEL_FROM_DATABASE=Xbox Communicator
@@ -6276,7 +6366,7 @@ usb:v045Ep02B0*
  ID_MODEL_FROM_DATABASE=Xbox NUI Motor
 
 usb:v045Ep02B6*
- ID_MODEL_FROM_DATABASE=Xbox 360 / Bluetooth Wireless Headset
+ ID_MODEL_FROM_DATABASE=Xbox360 Bluetooth Wireless Headset
 
 usb:v045Ep02BE*
  ID_MODEL_FROM_DATABASE=Kinect for Windows NUI Audio
@@ -6288,11 +6378,14 @@ usb:v045Ep02C2*
  ID_MODEL_FROM_DATABASE=Kinect for Windows NUI Motor
 
 usb:v045Ep02D1*
- ID_MODEL_FROM_DATABASE=XBOX One Controller for Windows
+ ID_MODEL_FROM_DATABASE=Xbox One Controller
 
 usb:v045Ep02D5*
  ID_MODEL_FROM_DATABASE=Xbox One Digital TV Tuner
 
+usb:v045Ep02DD*
+ ID_MODEL_FROM_DATABASE=Xbox One Controller (Covert Forces/Firmware 2015)
+
 usb:v045Ep0400*
  ID_MODEL_FROM_DATABASE=Windows Powered Pocket PC 2002
 
@@ -6770,6 +6863,9 @@ usb:v045Ep0797*
 usb:v045Ep07A5*
  ID_MODEL_FROM_DATABASE=Wireless Receiver 1461C
 
+usb:v045Ep07CA*
+ ID_MODEL_FROM_DATABASE=Surface Pro 3 Docking Station Audio Device
+
 usb:v045Ep07F8*
  ID_MODEL_FROM_DATABASE=Wired Keyboard 600 (model 1576)
 
@@ -7469,6 +7565,12 @@ usb:v046Dp0A0C*
 usb:v046Dp0A13*
  ID_MODEL_FROM_DATABASE=Z-5 Speakers
 
+usb:v046Dp0A14*
+ ID_MODEL_FROM_DATABASE=USB Headset
+
+usb:v046Dp0A15*
+ ID_MODEL_FROM_DATABASE=G35 Headset
+
 usb:v046Dp0A17*
  ID_MODEL_FROM_DATABASE=G330 Headset
 
@@ -7706,11 +7808,17 @@ usb:v046DpC077*
 usb:v046DpC07C*
  ID_MODEL_FROM_DATABASE=M-R0017 [G700s Rechargeable Gaming Mouse]
 
+usb:v046DpC07D*
+ ID_MODEL_FROM_DATABASE=G502 Mouse
+
+usb:v046DpC07E*
+ ID_MODEL_FROM_DATABASE=G402 Gaming Mouse
+
 usb:v046DpC101*
  ID_MODEL_FROM_DATABASE=UltraX Media Remote
 
 usb:v046DpC110*
- ID_MODEL_FROM_DATABASE=Harmony 785/885 Remote
+ ID_MODEL_FROM_DATABASE=Harmony 785/880/885 Remote
 
 usb:v046DpC111*
  ID_MODEL_FROM_DATABASE=Harmony 525 Remote
@@ -8999,9 +9107,15 @@ usb:v0480pA009*
 usb:v0480pA00D*
  ID_MODEL_FROM_DATABASE=STOR.E BASICS 500GB
 
+usb:v0480pA100*
+ ID_MODEL_FROM_DATABASE=Canvio Alu 2TB 2.5" Black External Disk Model HDTH320EK3CA
+
 usb:v0480pA202*
  ID_MODEL_FROM_DATABASE=Canvio Basics HDD
 
+usb:v0480pA208*
+ ID_MODEL_FROM_DATABASE=Canvio Basics 2TB USB 3.0 Portable Hard Drive
+
 usb:v0480pB001*
  ID_MODEL_FROM_DATABASE=Stor.E Partner
 
@@ -9026,6 +9140,9 @@ usb:v0482p000E*
 usb:v0482p000F*
  ID_MODEL_FROM_DATABASE=FS-1920 Mono Printer
 
+usb:v0482p0015*
+ ID_MODEL_FROM_DATABASE=FS-1030D printer
+
 usb:v0482p0100*
  ID_MODEL_FROM_DATABASE=Finecam S3x
 
@@ -9083,11 +9200,8 @@ usb:v0483p2018*
 usb:v0483p2302*
  ID_MODEL_FROM_DATABASE=Portable Flash Device (PFD)
 
-usb:v0483p347B*
- ID_MODEL_FROM_DATABASE=ST-LINK/V2-1
-
 usb:v0483p3744*
- ID_MODEL_FROM_DATABASE=STLINK Pseudo disk
+ ID_MODEL_FROM_DATABASE=ST-LINK/V1
 
 usb:v0483p3747*
  ID_MODEL_FROM_DATABASE=ST Micro Connect Lite
@@ -9096,7 +9210,7 @@ usb:v0483p3748*
  ID_MODEL_FROM_DATABASE=ST-LINK/V2
 
 usb:v0483p374B*
- ID_MODEL_FROM_DATABASE=ST-LINK/V2.1 (Nucleo-F103RB)
+ ID_MODEL_FROM_DATABASE=ST-LINK/V2.1
 
 usb:v0483p4810*
  ID_MODEL_FROM_DATABASE=ISDN adapter
@@ -10217,6 +10331,9 @@ usb:v04A9p10C2*
 usb:v04A9p10C4*
  ID_MODEL_FROM_DATABASE=Pixma iP4500 Printer
 
+usb:v04A9p10C9*
+ ID_MODEL_FROM_DATABASE=PIXIMA iP4600 Printer
+
 usb:v04A9p1404*
  ID_MODEL_FROM_DATABASE=W6400PG
 
@@ -10361,6 +10478,9 @@ usb:v04A9p174D*
 usb:v04A9p176D*
  ID_MODEL_FROM_DATABASE=PIXMA MG2550
 
+usb:v04A9p178D*
+ ID_MODEL_FROM_DATABASE=PIXMA MG6853
+
 usb:v04A9p1900*
  ID_MODEL_FROM_DATABASE=CanoScan LiDE 90
 
@@ -10391,6 +10511,9 @@ usb:v04A9p190D*
 usb:v04A9p190E*
  ID_MODEL_FROM_DATABASE=CanoScan LiDE 120
 
+usb:v04A9p190F*
+ ID_MODEL_FROM_DATABASE=CanoScan LiDE 220
+
 usb:v04A9p2200*
  ID_MODEL_FROM_DATABASE=CanoScan LiDE 25
 
@@ -10595,6 +10718,9 @@ usb:v04A9p2651*
 usb:v04A9p2655*
  ID_MODEL_FROM_DATABASE=FP-L170/MF350/L380/L398
 
+usb:v04A9p2656*
+ ID_MODEL_FROM_DATABASE=iR1510-1670 CAPT Printer
+
 usb:v04A9p2659*
  ID_MODEL_FROM_DATABASE=MF8100
 
@@ -11594,6 +11720,9 @@ usb:v04A9p329B*
 usb:v04A9p329C*
  ID_MODEL_FROM_DATABASE=PowerShot SX400 IS
 
+usb:v04A9p329D*
+ ID_MODEL_FROM_DATABASE=PowerShot G7 X
+
 usb:v04A9p329F*
  ID_MODEL_FROM_DATABASE=PowerShot SX530 HS
 
@@ -11606,6 +11735,12 @@ usb:v04A9p32AA*
 usb:v04A9p32AC*
  ID_MODEL_FROM_DATABASE=PowerShot ELPH 170 IS / IXUS 170
 
+usb:v04A9p32AD*
+ ID_MODEL_FROM_DATABASE=PowerShot SX410 IS
+
+usb:v04A9p32C1*
+ ID_MODEL_FROM_DATABASE=PowerShot ELPH 180 / IXUS 175
+
 usb:v04AA*
  ID_VENDOR_FROM_DATABASE=DaeWoo Telecom, Ltd
 
@@ -12077,6 +12212,9 @@ usb:v04B4pF111*
 usb:v04B4pF115*
  ID_MODEL_FROM_DATABASE=PSoC FirstTouch Programmer
 
+usb:v04B4pF232*
+ ID_MODEL_FROM_DATABASE=Mono embedded computer
+
 usb:v04B4pFD13*
  ID_MODEL_FROM_DATABASE=Programmable power socket
 
@@ -13010,6 +13148,9 @@ usb:v04CAp2004*
 usb:v04CAp2006*
  ID_MODEL_FROM_DATABASE=Broadcom BCM43142A0 Bluetooth Device
 
+usb:v04CAp3005*
+ ID_MODEL_FROM_DATABASE=Atheros Bluetooth
+
 usb:v04CAp300B*
  ID_MODEL_FROM_DATABASE=Atheros AR3012 Bluetooth
 
@@ -13020,7 +13161,7 @@ usb:v04CAp300F*
  ID_MODEL_FROM_DATABASE=Atheros AR3012 Bluetooth
 
 usb:v04CAp3014*
- ID_MODEL_FROM_DATABASE=Qualcoom Atheros Bluetooth
+ ID_MODEL_FROM_DATABASE=Qualcomm Atheros Bluetooth
 
 usb:v04CAp7025*
  ID_MODEL_FROM_DATABASE=HP HD Webcam
@@ -13556,6 +13697,9 @@ usb:v04D9p1603*
 usb:v04D9p1702*
  ID_MODEL_FROM_DATABASE=Keyboard LKS02
 
+usb:v04D9p1818*
+ ID_MODEL_FROM_DATABASE=Keyboard [Diatec Filco Majestouch 2]
+
 usb:v04D9p2011*
  ID_MODEL_FROM_DATABASE=Keyboard [Diatec Filco Majestouch 1]
 
@@ -13577,6 +13721,9 @@ usb:v04D9p2832*
 usb:v04D9p2834*
  ID_MODEL_FROM_DATABASE=HT82A834R Audio MCU
 
+usb:v04D9pA01C*
+ ID_MODEL_FROM_DATABASE=wireless multimedia keyboard with trackball [Trust ADURA 17911]
+
 usb:v04D9pA055*
  ID_MODEL_FROM_DATABASE=Keyboard
 
@@ -14564,6 +14711,9 @@ usb:v04E8p61B5*
 usb:v04E8p61B6*
  ID_MODEL_FROM_DATABASE=M3 Portable Hard Drive 1TB
 
+usb:v04E8p61F3*
+ ID_MODEL_FROM_DATABASE=MU-PT500B [T3 500GB USB SSD]
+
 usb:v04E8p6601*
  ID_MODEL_FROM_DATABASE=Mobile Phone
 
@@ -14858,6 +15008,9 @@ usb:v04F2p0418*
 usb:v04F2p0618*
  ID_MODEL_FROM_DATABASE=RG-0618U Wireless HID Receiver & KG-0609 Wireless Keyboard with Touchpad
 
+usb:v04F2p0718*
+ ID_MODEL_FROM_DATABASE=wired mouse
+
 usb:v04F2p0760*
  ID_MODEL_FROM_DATABASE=Acer KU-0760 Keyboard
 
@@ -16620,13 +16773,16 @@ usb:v04F9p201A*
  ID_MODEL_FROM_DATABASE=PT-18R P-touch label printer
 
 usb:v04F9p201B*
- ID_MODEL_FROM_DATABASE=QL-650TD P-Touch Label Printer
+ ID_MODEL_FROM_DATABASE=QL-650TD P-touch Label Printer
 
 usb:v04F9p2027*
- ID_MODEL_FROM_DATABASE=QL-560 P-Touch Label Printer
+ ID_MODEL_FROM_DATABASE=QL-560 P-touch Label Printer
+
+usb:v04F9p2028*
+ ID_MODEL_FROM_DATABASE=QL-570 P-touch Label Printer
 
 usb:v04F9p202B*
- ID_MODEL_FROM_DATABASE=PT-7600 P-Touch Label Printer
+ ID_MODEL_FROM_DATABASE=PT-7600 P-touch Label Printer
 
 usb:v04F9p2100*
  ID_MODEL_FROM_DATABASE=Card Reader Writer
@@ -16703,6 +16859,9 @@ usb:v04FCp0561*
 usb:v04FCp05D8*
  ID_MODEL_FROM_DATABASE=Wireless keyboard/mouse
 
+usb:v04FCp05DA*
+ ID_MODEL_FROM_DATABASE=SPEEDLINK SNAPPY Wireless Mouse Nano
+
 usb:v04FCp0C15*
  ID_MODEL_FROM_DATABASE=SPIF215A SATA bridge
 
@@ -17762,6 +17921,9 @@ usb:v0547p2810*
 usb:v0547p4D90*
  ID_MODEL_FROM_DATABASE=AmScope MD1900 camera
 
+usb:v0547p6510*
+ ID_MODEL_FROM_DATABASE=Touptek UCMOS05100KPA
+
 usb:v0547p7000*
  ID_MODEL_FROM_DATABASE=PowerSpec MCE460 Front Panel LED Display
 
@@ -19026,10 +19188,10 @@ usb:v056Ap00C4*
  ID_MODEL_FROM_DATABASE=DTF-720
 
 usb:v056Ap00C5*
- ID_MODEL_FROM_DATABASE=DTZ-20WSX [Cintiq 20WSX]
+ ID_MODEL_FROM_DATABASE=DTZ-2000W [Cintiq 20WSX]
 
 usb:v056Ap00C6*
- ID_MODEL_FROM_DATABASE=DTZ-12WX [Cintiq 12WX]
+ ID_MODEL_FROM_DATABASE=DTZ-1200W [Cintiq 12WX]
 
 usb:v056Ap00C7*
  ID_MODEL_FROM_DATABASE=DTU-1931
@@ -19145,6 +19307,9 @@ usb:v056Ap0116*
 usb:v056Ap012C*
  ID_MODEL_FROM_DATABASE=TPC12C
 
+usb:v056Ap0221*
+ ID_MODEL_FROM_DATABASE=MDP-123 [Inkling]
+
 usb:v056Ap0300*
  ID_MODEL_FROM_DATABASE=CTL-471 [Bamboo Splash, One by Wacom (S)]
 
@@ -19178,6 +19343,9 @@ usb:v056Ap0315*
 usb:v056Ap0317*
  ID_MODEL_FROM_DATABASE=PTH-851 [Intuos pro (L)]
 
+usb:v056Ap0318*
+ ID_MODEL_FROM_DATABASE=CTH-301 [Bamboo]
+
 usb:v056Ap032F*
  ID_MODEL_FROM_DATABASE=DTU-1031X
 
@@ -20778,7 +20946,7 @@ usb:v058Fp9510*
  ID_MODEL_FROM_DATABASE=ChunghwaTL USB02 Smartcard Reader
 
 usb:v058Fp9520*
- ID_MODEL_FROM_DATABASE=EMV Certified Smart Card Reader
+ ID_MODEL_FROM_DATABASE=Watchdata W 1981
 
 usb:v058Fp9540*
  ID_MODEL_FROM_DATABASE=AU9540 Smartcard Reader
@@ -20972,6 +21140,9 @@ usb:v059Bp0251*
 usb:v059Bp0252*
  ID_MODEL_FROM_DATABASE=Optical
 
+usb:v059Bp0275*
+ ID_MODEL_FROM_DATABASE=ST332082 0A
+
 usb:v059Bp0278*
  ID_MODEL_FROM_DATABASE=LDHD-UPS [Professional Desktop Hard Drive eSATA / USB2.0]
 
@@ -21044,6 +21215,9 @@ usb:v059Fp100C*
 usb:v059Fp1010*
  ID_MODEL_FROM_DATABASE=Desktop Hard Drive
 
+usb:v059Fp1016*
+ ID_MODEL_FROM_DATABASE=Desktop Hard Drive
+
 usb:v059Fp1018*
  ID_MODEL_FROM_DATABASE=Desktop Hard Drive
 
@@ -21068,6 +21242,9 @@ usb:v059Fp1052*
 usb:v059Fp1064*
  ID_MODEL_FROM_DATABASE=Rugged 16 and 32 GB
 
+usb:v059Fp106D*
+ ID_MODEL_FROM_DATABASE=Porsche Design Mobile Drive
+
 usb:v059Fp106E*
  ID_MODEL_FROM_DATABASE=Porsche Design Desktop Drive
 
@@ -21437,9 +21614,18 @@ usb:v05ACp0253*
 usb:v05ACp0254*
  ID_MODEL_FROM_DATABASE=Internal Keyboard/Trackpad (JIS)
 
+usb:v05ACp0259*
+ ID_MODEL_FROM_DATABASE=Internal Keyboard/Trackpad
+
 usb:v05ACp0263*
  ID_MODEL_FROM_DATABASE=Apple Internal Keyboard / Trackpad (MacBook Retina)
 
+usb:v05ACp0267*
+ ID_MODEL_FROM_DATABASE=Magic Keyboard A1644
+
+usb:v05ACp0273*
+ ID_MODEL_FROM_DATABASE=Internal Keyboard/Trackpad (ISO)
+
 usb:v05ACp0301*
  ID_MODEL_FROM_DATABASE=USB Mouse [Mitsumi, M4848]
 
@@ -21740,6 +21926,9 @@ usb:v05ACp8286*
 usb:v05ACp828C*
  ID_MODEL_FROM_DATABASE=Bluetooth Host Controller
 
+usb:v05ACp8290*
+ ID_MODEL_FROM_DATABASE=Bluetooth Host Controller
+
 usb:v05ACp8300*
  ID_MODEL_FROM_DATABASE=Built-in iSight (no firmware loaded)
 
@@ -21875,6 +22064,9 @@ usb:v05B8*
 usb:v05B8p3002*
  ID_MODEL_FROM_DATABASE=Scroll Mouse
 
+usb:v05B8p3223*
+ ID_MODEL_FROM_DATABASE=ISY Wireless Presenter
+
 usb:v05B9*
  ID_VENDOR_FROM_DATABASE=Philips Research Laboratories
 
@@ -22067,6 +22259,9 @@ usb:v05C8*
 usb:v05C8p0103*
  ID_MODEL_FROM_DATABASE=FO13FF-65 PC-CAM
 
+usb:v05C8p010B*
+ ID_MODEL_FROM_DATABASE=Webcam (UVC)
+
 usb:v05C8p021A*
  ID_MODEL_FROM_DATABASE=HP Webcam
 
@@ -22892,6 +23087,9 @@ usb:v05DCpA701*
 usb:v05DCpA731*
  ID_MODEL_FROM_DATABASE=JumpDrive FireFly
 
+usb:v05DCpA762*
+ ID_MODEL_FROM_DATABASE=JumpDrive FireFly
+
 usb:v05DCpA768*
  ID_MODEL_FROM_DATABASE=JumpDrive Retrax
 
@@ -22922,9 +23120,15 @@ usb:v05DCpB047*
 usb:v05DCpBA02*
  ID_MODEL_FROM_DATABASE=Workflow CFR1
 
+usb:v05DCpBA0A*
+ ID_MODEL_FROM_DATABASE=Workflow DD512
+
 usb:v05DCpC753*
  ID_MODEL_FROM_DATABASE=JumpDrive TwistTurn
 
+usb:v05DCpC75C*
+ ID_MODEL_FROM_DATABASE=JumpDrive V10
+
 usb:v05DD*
  ID_VENDOR_FROM_DATABASE=Delta Electronics, Inc.
 
@@ -23075,6 +23279,9 @@ usb:v05E3p0608*
 usb:v05E3p0610*
  ID_MODEL_FROM_DATABASE=4-port hub
 
+usb:v05E3p0612*
+ ID_MODEL_FROM_DATABASE=Hub
+
 usb:v05E3p0616*
  ID_MODEL_FROM_DATABASE=hub
 
@@ -23177,6 +23384,9 @@ usb:v05E3p0743*
 usb:v05E3p0745*
  ID_MODEL_FROM_DATABASE=Logilink CR0012
 
+usb:v05E3p0751*
+ ID_MODEL_FROM_DATABASE=microSD Card Reader
+
 usb:v05E3p0760*
  ID_MODEL_FROM_DATABASE=USB 2.0 Card Reader/Writer
 
@@ -23504,6 +23714,9 @@ usb:v060Bp0001*
 usb:v060Bp0230*
  ID_MODEL_FROM_DATABASE=KSK-8003 UX Keyboard
 
+usb:v060Bp0540*
+ ID_MODEL_FROM_DATABASE=DeltaCo TB-106U Keyboard
+
 usb:v060Bp1006*
  ID_MODEL_FROM_DATABASE=Japanese Keyboard - 260U
 
@@ -23720,6 +23933,9 @@ usb:v062Ap0201*
 usb:v062Ap0252*
  ID_MODEL_FROM_DATABASE=Emerge Uni-retractable Laser Mouse
 
+usb:v062Ap2410*
+ ID_MODEL_FROM_DATABASE=Wireless PS3 gamepad
+
 usb:v062Ap3286*
  ID_MODEL_FROM_DATABASE=Nano Receiver [Sandstrom Laser Mouse SMWLL11]
 
@@ -23966,6 +24182,9 @@ usb:v064EpC335*
 usb:v064EpD101*
  ID_MODEL_FROM_DATABASE=Acer CrystalEye Webcam
 
+usb:v064EpD213*
+ ID_MODEL_FROM_DATABASE=UVC HD Webcam
+
 usb:v064EpD217*
  ID_MODEL_FROM_DATABASE=HP TrueVision HD
 
@@ -23978,6 +24197,9 @@ usb:v064EpE203*
 usb:v064EpE258*
  ID_MODEL_FROM_DATABASE=HP TrueVision HD Integrated Webcam
 
+usb:v064EpE263*
+ ID_MODEL_FROM_DATABASE=HP TrueVision HD Integrated Webcam
+
 usb:v064EpF102*
  ID_MODEL_FROM_DATABASE=Lenovo Integrated Webcam [R5U877]
 
@@ -24650,6 +24872,9 @@ usb:v067BpAAA0*
 usb:v067BpAAA2*
  ID_MODEL_FROM_DATABASE=PL2303 Serial Adapter (IODATA USB-RSAQ3)
 
+usb:v067BpAAA3*
+ ID_MODEL_FROM_DATABASE=PL2303x Serial Adapter
+
 usb:v067C*
  ID_VENDOR_FROM_DATABASE=Efficient Networks, Inc.
 
@@ -24986,6 +25211,12 @@ usb:v0694p0001*
 usb:v0694p0002*
  ID_MODEL_FROM_DATABASE=Mindstorms NXT
 
+usb:v0694p0005*
+ ID_MODEL_FROM_DATABASE=Mindstorms EV3
+
+usb:v0694p0006*
+ ID_MODEL_FROM_DATABASE=Mindstorms EV3 Firmware Update
+
 usb:v0698*
  ID_VENDOR_FROM_DATABASE=Chuntex (CTX)
 
@@ -25004,6 +25235,9 @@ usb:v0699*
 usb:v0699p0347*
  ID_MODEL_FROM_DATABASE=AFG 3022B
 
+usb:v0699p036A*
+ ID_MODEL_FROM_DATABASE=TDS 2024B
+
 usb:v069A*
  ID_VENDOR_FROM_DATABASE=Askey Computer Corp.
 
@@ -25847,6 +26081,9 @@ usb:v06D3p0394*
 usb:v06D3p03A1*
  ID_MODEL_FROM_DATABASE=CP9550D/DW Port
 
+usb:v06D3p03A5*
+ ID_MODEL_FROM_DATABASE=CP9550DW-S
+
 usb:v06D3p3B30*
  ID_MODEL_FROM_DATABASE=CP-D70DW / CP-D707DW
 
@@ -26502,7 +26739,7 @@ usb:v0714*
  ID_VENDOR_FROM_DATABASE=NewMotion, Inc.
 
 usb:v0714p0003*
- ID_MODEL_FROM_DATABASE=ADB to USB convertor
+ ID_MODEL_FROM_DATABASE=ADB converter
 
 usb:v0717*
  ID_VENDOR_FROM_DATABASE=ZNK Corp.
@@ -26576,6 +26813,9 @@ usb:v071Bp0002*
 usb:v071Bp0101*
  ID_MODEL_FROM_DATABASE=Audio4-USB DSP Data Acquisition Unit
 
+usb:v071Bp0184*
+ ID_MODEL_FROM_DATABASE=Archos 2 8GB EM184RB
+
 usb:v071Bp0201*
  ID_MODEL_FROM_DATABASE=Audio4-5410 DSP Data Acquisition Unit
 
@@ -26820,10 +27060,10 @@ usb:v0733p0780*
  ID_MODEL_FROM_DATABASE=Smart Cam Deluxe(composite)
 
 usb:v0733p1310*
- ID_MODEL_FROM_DATABASE=Epsilon 1.3/Jenoptik JD C1.3/UMAX AstraPix 470
+ ID_MODEL_FROM_DATABASE=Epsilon 1.3/Jenoptik JD C1.3/UMAX AstraPix 470 (mass storage mode)
 
 usb:v0733p1311*
- ID_MODEL_FROM_DATABASE=Digital Dream Epsilon 1.3
+ ID_MODEL_FROM_DATABASE=Epsilon 1.3/Jenoptik JD C1.3/UMAX AstraPix 470 (PC Cam mode)
 
 usb:v0733p1314*
  ID_MODEL_FROM_DATABASE=Mercury 2.1MEG Deluxe Classic Cam
@@ -27126,7 +27366,7 @@ usb:v0763p1021*
  ID_MODEL_FROM_DATABASE=MidiSport 4x4
 
 usb:v0763p1030*
- ID_MODEL_FROM_DATABASE=Midisport 8x8
+ ID_MODEL_FROM_DATABASE=M-Audio MIDISPORT 8x8
 
 usb:v0763p1031*
  ID_MODEL_FROM_DATABASE=MidiSport 8x8/s Loader
@@ -27201,7 +27441,7 @@ usb:v0763p2024*
  ID_MODEL_FROM_DATABASE=M-Audio Fast Track MKII
 
 usb:v0763p2080*
- ID_MODEL_FROM_DATABASE=M-Audio RunTime DFU
+ ID_MODEL_FROM_DATABASE=M-Audio Fast Track Ultra
 
 usb:v0763p2081*
  ID_MODEL_FROM_DATABASE=M-Audio RunTime DFU / Fast Track Ultra 8R
@@ -27248,6 +27488,9 @@ usb:v0765*
 usb:v0765p5001*
  ID_MODEL_FROM_DATABASE=Huey PRO Colorimeter
 
+usb:v0765p5010*
+ ID_MODEL_FROM_DATABASE=X-Rite Pantone Color Sensor
+
 usb:v0765p5020*
  ID_MODEL_FROM_DATABASE=i1 Display Pro
 
@@ -27542,6 +27785,9 @@ usb:v0781p5530*
 usb:v0781p5567*
  ID_MODEL_FROM_DATABASE=Cruzer Blade
 
+usb:v0781p556B*
+ ID_MODEL_FROM_DATABASE=Cruzer Edge
+
 usb:v0781p556C*
  ID_MODEL_FROM_DATABASE=Ultra
 
@@ -27551,6 +27797,9 @@ usb:v0781p556D*
 usb:v0781p5571*
  ID_MODEL_FROM_DATABASE=Cruzer Fit
 
+usb:v0781p5575*
+ ID_MODEL_FROM_DATABASE=Cruzer Glide
+
 usb:v0781p5576*
  ID_MODEL_FROM_DATABASE=Cruzer Facet
 
@@ -27743,6 +27992,9 @@ usb:v0781pB2B3*
 usb:v0781pB4B5*
  ID_MODEL_FROM_DATABASE=SDDR-89 V4 ImageMate 12-in-1 Reader
 
+usb:v0781pB6BA*
+ ID_MODEL_FROM_DATABASE=CF SDDR-289
+
 usb:v0782*
  ID_VENDOR_FROM_DATABASE=Trackerball
 
@@ -29045,6 +29297,9 @@ usb:v07CFp4500*
 usb:v07CFp6101*
  ID_MODEL_FROM_DATABASE=fx-9750gII
 
+usb:v07CFp6102*
+ ID_MODEL_FROM_DATABASE=fx-CP400
+
 usb:v07CFp6801*
  ID_MODEL_FROM_DATABASE=PL-40R
 
@@ -29258,6 +29513,12 @@ usb:v07DEp2820*
 usb:v07DF*
  ID_VENDOR_FROM_DATABASE=David Electronics Co., Ltd
 
+usb:v07E0*
+ ID_VENDOR_FROM_DATABASE=NCP engineering GmbH
+
+usb:v07E0p4742*
+ ID_MODEL_FROM_DATABASE=VPN GovNet Box
+
 usb:v07E1*
  ID_VENDOR_FROM_DATABASE=Ambient Technologies, Inc.
 
@@ -29363,6 +29624,12 @@ usb:v07FApA904*
 usb:v07FApA905*
  ID_MODEL_FROM_DATABASE=BeWAN ADSL ST
 
+usb:v07FC*
+ ID_VENDOR_FROM_DATABASE=Thomann
+
+usb:v07FCp1113*
+ ID_MODEL_FROM_DATABASE=SWISSONIC EasyKeys61 Midikeyboard
+
 usb:v07FD*
  ID_VENDOR_FROM_DATABASE=Mark of the Unicorn
 
@@ -29370,7 +29637,7 @@ usb:v07FDp0000*
  ID_MODEL_FROM_DATABASE=FastLane MIDI Interface
 
 usb:v07FDp0001*
- ID_MODEL_FROM_DATABASE=FastLane Quad MIDI Interface
+ ID_MODEL_FROM_DATABASE=MIDI Interface
 
 usb:v07FDp0002*
  ID_MODEL_FROM_DATABASE=MOTU Audio for 64 bit
@@ -29975,6 +30242,9 @@ usb:v0846p9011*
 usb:v0846p9012*
  ID_MODEL_FROM_DATABASE=WNDA4100 802.11abgn 3x3:3 [Ralink RT3573]
 
+usb:v0846p9014*
+ ID_MODEL_FROM_DATABASE=WNDA3100v3 802.11abgn 2x2:2 [MediaTek MT7632U]
+
 usb:v0846p9018*
  ID_MODEL_FROM_DATABASE=WNDA3200 802.11abgn Wireless Adapter [Atheros AR7010+AR9280]
 
@@ -30710,6 +30980,9 @@ usb:v08CAp2016*
 usb:v08CAp2018*
  ID_MODEL_FROM_DATABASE=Pencam SD 2M
 
+usb:v08CAp2019*
+ ID_MODEL_FROM_DATABASE=Pencam SD 2M (mass storage mode)
+
 usb:v08CAp2020*
  ID_MODEL_FROM_DATABASE=Slim 3000F
 
@@ -31046,6 +31319,9 @@ usb:v08EE*
 usb:v08F0*
  ID_VENDOR_FROM_DATABASE=Corex Technologies
 
+usb:v08F0p0005*
+ ID_MODEL_FROM_DATABASE=CardScan 800c
+
 usb:v08F1*
  ID_VENDOR_FROM_DATABASE=CTI Electronics Corp.
 
@@ -31646,6 +31922,9 @@ usb:v091Ep253C*
 usb:v091Ep255B*
  ID_MODEL_FROM_DATABASE=Nuvi 2505LM
 
+usb:v091Ep26A1*
+ ID_MODEL_FROM_DATABASE=Nuvi 55
+
 usb:v0920*
  ID_VENDOR_FROM_DATABASE=Echelon Co.
 
@@ -31697,6 +31976,9 @@ usb:v0924p23DD*
 usb:v0924p3CE8*
  ID_MODEL_FROM_DATABASE=Phaser 3428 Printer
 
+usb:v0924p3CEA*
+ ID_MODEL_FROM_DATABASE=Phaser 3125
+
 usb:v0924p3D5B*
  ID_MODEL_FROM_DATABASE=Phaser 6115MFP TWAIN Scanner
 
@@ -31859,6 +32141,9 @@ usb:v0930p070B*
 usb:v0930p0A07*
  ID_MODEL_FROM_DATABASE=WLM-10U1 802.11abgn Wireless Adapter [Ralink RT3572]
 
+usb:v0930p0A08*
+ ID_MODEL_FROM_DATABASE=WLM-20U2/GN-1080 802.11abgn Wireless Adapter [Atheros AR7010+AR9280]
+
 usb:v0930p0A13*
  ID_MODEL_FROM_DATABASE=AX88179 Gigabit Ethernet [Toshiba]
 
@@ -32016,7 +32301,7 @@ usb:v0930p6540*
  ID_MODEL_FROM_DATABASE=TransMemory Flash Memory
 
 usb:v0930p6544*
- ID_MODEL_FROM_DATABASE=TransMemory-Mini / Kingston DataTraveler 2.0 Stick (2GB)
+ ID_MODEL_FROM_DATABASE=TransMemory-Mini / Kingston DataTraveler 2.0 Stick
 
 usb:v0930p6545*
  ID_MODEL_FROM_DATABASE=Kingston DataTraveler 102/2.0 / HEMA Flash Drive 2 GB / PNY Attache 4GB Stick
@@ -32294,6 +32579,9 @@ usb:v0951p1606*
 usb:v0951p1607*
  ID_MODEL_FROM_DATABASE=DataTraveler 100
 
+usb:v0951p160B*
+ ID_MODEL_FROM_DATABASE=DataTraveler 2.0 (2GB)
+
 usb:v0951p160D*
  ID_MODEL_FROM_DATABASE=DataTraveler Vault Privacy
 
@@ -32339,11 +32627,14 @@ usb:v0951p1653*
 usb:v0951p1656*
  ID_MODEL_FROM_DATABASE=DataTraveler Ultimate G2
 
+usb:v0951p1660*
+ ID_MODEL_FROM_DATABASE=Data Traveller 108
+
 usb:v0951p1665*
  ID_MODEL_FROM_DATABASE=Digital DataTraveler SE9 64GB
 
 usb:v0951p1666*
- ID_MODEL_FROM_DATABASE=DataTraveler G4
+ ID_MODEL_FROM_DATABASE=DataTraveler 100 G3/G4/SE9 G2
 
 usb:v0951p1689*
  ID_MODEL_FROM_DATABASE=DataTraveler SE9
@@ -46148,9 +46439,6 @@ usb:v1519*
 usb:v1519p0020*
  ID_MODEL_FROM_DATABASE=HSIC Device
 
-usb:v1519p0443*
- ID_MODEL_FROM_DATABASE=Telit LN930
-
 usb:v1520*
  ID_VENDOR_FROM_DATABASE=Bitwire Corp.
 
@@ -50120,6 +50408,12 @@ usb:v1B1Cp1A0A*
 usb:v1B1Cp1A90*
  ID_MODEL_FROM_DATABASE=Flash Voyager GT
 
+usb:v1B1F*
+ ID_VENDOR_FROM_DATABASE=eQ-3 Entwicklung GmbH
+
+usb:v1B1FpC00F*
+ ID_MODEL_FROM_DATABASE=HM-CFG-USB/HM-CFG-USB-2 [HomeMatic Configuration adapter]
+
 usb:v1B20*
  ID_VENDOR_FROM_DATABASE=MStar Semiconductor, Inc.
 
@@ -51014,15 +51308,99 @@ usb:v1D4Dp000E*
 usb:v1D50*
  ID_VENDOR_FROM_DATABASE=OpenMoko, Inc.
 
+usb:v1D50p1DB5*
+ ID_MODEL_FROM_DATABASE=IDBG DFU
+
+usb:v1D50p1DB6*
+ ID_MODEL_FROM_DATABASE=IDBG
+
+usb:v1D50p5117*
+ ID_MODEL_FROM_DATABASE=Neo1973/FreeRunner kernel usbnet (g_ether, CDC Ethernet) Mode
+
+usb:v1D50p5118*
+ ID_MODEL_FROM_DATABASE=Debug Board (FT2232D) for Neo1973/FreeRunner
+
 usb:v1D50p5119*
  ID_MODEL_FROM_DATABASE=GTA01/GTA02 U-Boot Bootloader
 
+usb:v1D50p511A*
+ ID_MODEL_FROM_DATABASE=HXD8 u-boot usbtty CDC ACM Mode
+
+usb:v1D50p511B*
+ ID_MODEL_FROM_DATABASE=SMDK2440 u-boot usbtty CDC ACM mode
+
+usb:v1D50p511C*
+ ID_MODEL_FROM_DATABASE=SMDK2443 u-boot usbtty CDC ACM mode
+
+usb:v1D50p511D*
+ ID_MODEL_FROM_DATABASE=QT2410 u-boot usbtty CDC ACM mode
+
+usb:v1D50p5120*
+ ID_MODEL_FROM_DATABASE=Neo1973/FreeRunner u-boot generic serial mode
+
+usb:v1D50p5121*
+ ID_MODEL_FROM_DATABASE=Neo1973/FreeRunner kernel mass storage (g_storage) mode
+
+usb:v1D50p5122*
+ ID_MODEL_FROM_DATABASE=Neo1973/FreeRunner kernel usbnet (g_ether, RNDIS) mode
+
+usb:v1D50p5123*
+ ID_MODEL_FROM_DATABASE=Neo1973/FreeRunner internal Bluetooth CSR4 module
+
+usb:v1D50p5124*
+ ID_MODEL_FROM_DATABASE=Neo1973/FreeRunner Bluetooth Device ID service
+
+usb:v1D50p6000*
+ ID_MODEL_FROM_DATABASE=Ubertooth Zero
+
+usb:v1D50p6001*
+ ID_MODEL_FROM_DATABASE=Ubertooth Zero DFU
+
+usb:v1D50p6002*
+ ID_MODEL_FROM_DATABASE=Ubertooth One
+
+usb:v1D50p6003*
+ ID_MODEL_FROM_DATABASE=Ubertooth One DFU
+
+usb:v1D50p6004*
+ ID_MODEL_FROM_DATABASE=LeoLipo
+
+usb:v1D50p6005*
+ ID_MODEL_FROM_DATABASE=LED Flower S
+
+usb:v1D50p6006*
+ ID_MODEL_FROM_DATABASE=LED Cube
+
+usb:v1D50p6007*
+ ID_MODEL_FROM_DATABASE=LED Flower
+
+usb:v1D50p6008*
+ ID_MODEL_FROM_DATABASE=Kisbee 802.15.4 transceiver
+
+usb:v1D50p6009*
+ ID_MODEL_FROM_DATABASE=Adjacent Reality Tracker
+
+usb:v1D50p6028*
+ ID_MODEL_FROM_DATABASE=Teensy 2.0 Development Board [ErgoDox Keyboard]
+
 usb:v1D50p602B*
  ID_MODEL_FROM_DATABASE=FPGALink
 
+usb:v1D50p604B*
+ ID_MODEL_FROM_DATABASE=HackRF Jawbreaker Software-Defined Radio
+
 usb:v1D50p6053*
  ID_MODEL_FROM_DATABASE=Darkgame Controller
 
+usb:v1D50p6089*
+ ID_MODEL_FROM_DATABASE=Great Scott Gadgets HackRF One
+
+usb:v1D50p60A1*
+ ID_MODEL_FROM_DATABASE=Airspy
+
+usb:v1D50pCC15*
+ ID_MODEL_FROM_DATABASE=CCCAMP2015 rad1o badge
+
 usb:v1D57*
  ID_VENDOR_FROM_DATABASE=Xenta
 
diff --git a/src/grp-udev/hwdb/60-evdev.hwdb b/src/grp-udev/hwdb/60-evdev.hwdb
index 90acb44a1c..d4cd61c24d 100644
--- a/src/grp-udev/hwdb/60-evdev.hwdb
+++ b/src/grp-udev/hwdb/60-evdev.hwdb
@@ -104,6 +104,13 @@ evdev:name:ETPS/2 Elantech Touchpad:dmi:*:svnASUSTeKCOMPUTERINC.:pnX550CC:*
  EVDEV_ABS_35=::31
  EVDEV_ABS_36=::30
 
+# Asus UX305
+evdev:name:Elan Touchpad:dmi:*:svnASUSTeKCOMPUTERINC.:pnUX305UA:*
+ EVDEV_ABS_00=0:3097:32
+ EVDEV_ABS_01=0:2119:33
+ EVDEV_ABS_35=0:3097:32
+ EVDEV_ABS_36=0:2119:33
+
 #########################################
 # Dell
 #########################################
@@ -127,6 +134,13 @@ evdev:name:AlpsPS/2 ALPS DualPoint TouchPad:dmi:bvn*:bvr*:bd*:svnDellInc.:pnLati
  EVDEV_ABS_35=76:1815:22
  EVDEV_ABS_36=131:1330:30
 
+# Dell Precision M4700
+evdev:name:AlpsPS/2 ALPS DualPoint TouchPad:dmi:*svnDellInc.:pnPrecisionM4700*
+ EVDEV_ABS_00=0:1960:24
+ EVDEV_ABS_01=113:1436:30
+ EVDEV_ABS_35=0:1960:24
+ EVDEV_ABS_36=113:1436:30
+
 # Dell XPS15 9550
 evdev:name:SynPS/2 Synaptics TouchPad:dmi:bvn*:bvr*:bd*:svnDellInc.:pnXPS159550*
  EVDEV_ABS_00=::41
@@ -188,11 +202,30 @@ evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO*:pn*ThinkPad*T510*
  EVDEV_ABS_35=778:6239:72
  EVDEV_ABS_36=841:5330:100
 
+# Lenovo V360
+evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO:*pvrLenovoV360*
+ EVDEV_ABS_00=1243:5927:60
+ EVDEV_ABS_01=902:5330:108
+
+# Lenovo X220 series
+evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO:*pvrThinkPadX220*
+ EVDEV_ABS_00=1316:5627:58
+ EVDEV_ABS_01=1355:4826:81
+ EVDEV_ABS_35=1316:5627:58
+ EVDEV_ABS_36=1355:4826:81
+
 # Lenovo X230 series
 evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO*:pn*ThinkPad*X230*
  EVDEV_ABS_01=::100
  EVDEV_ABS_36=::100
 
+# Lenovo Y700-14ISK
+evdev:name:AlpsPS/2 ALPS GlidePoint:dmi:*svnLENOVO:*pvrLenovoideapadY700-14ISK*
+ EVDEV_ABS_00=::27
+ EVDEV_ABS_01=::29
+ EVDEV_ABS_35=::27
+ EVDEV_ABS_36=::29
+
 #########################################
 # Samsung
 #########################################
diff --git a/src/grp-udev/hwdb/70-pointingstick.hwdb b/src/grp-udev/hwdb/70-pointingstick.hwdb
index b2af467d5f..ec166ead40 100644
--- a/src/grp-udev/hwdb/70-pointingstick.hwdb
+++ b/src/grp-udev/hwdb/70-pointingstick.hwdb
@@ -69,7 +69,7 @@
 #
 
 #
-# Sort by by brand, model
+# Sort by brand, model
 
 #########################################
 # Dell
@@ -105,6 +105,8 @@ evdev:name:TPPS/2 IBM TrackPoint:dmi:bvn*:bvr*:bd*:svnLENOVO:pn*:pvrThinkPadT540
 evdev:name:TPPS/2 IBM TrackPoint:dmi:bvn*:bvr*:bd*:svnLENOVO:pn*:pvrThinkPadT550:*
 # Lenovo Thinkpad X1 Carbon 3rd gen
 evdev:name:TPPS/2 IBM TrackPoint:dmi:bvn*:bvr*:bd*:svnLENOVO:pn*:pvrThinkPadX1Carbon3rd:*
+# Lenovo Thinkpad X1 Carbon 4th gen
+evdev:name:TPPS/2 IBM TrackPoint:dmi:bvn*:bvr*:bd*:svnLENOVO:pn*:pvrThinkPadX1Carbon4th:*
   POINTINGSTICK_SENSITIVITY=200
   POINTINGSTICK_CONST_ACCEL=1.0
 
diff --git a/src/grp-udev/hwdb/70-touchpad.hwdb b/src/grp-udev/hwdb/70-touchpad.hwdb
new file mode 100644
index 0000000000..11f3f96f04
--- /dev/null
+++ b/src/grp-udev/hwdb/70-touchpad.hwdb
@@ -0,0 +1,49 @@
+# This file is part of systemd.
+#
+# Database for touchpad device information that cannot be queried directly.
+#
+# The lookup keys are composed in:
+#   70-touchpad.rules
+#
+# Note: The format of the "touchpad:" prefix match key is a
+# contract between the rules file and the hardware data, it might
+# change in later revisions to support more or better matches, it
+# is not necessarily expected to be a stable ABI.
+#
+# Match string format:
+# touchpad:<subsystem>:v<vid>p<pid>:name:<name>:
+#
+# vid/pid as 4-digit hex lowercase vendor/product
+#
+# To add local entries, create a new file
+#   /etc/udev/hwdb.d/71-touchpad-local.hwdb
+# and add your rules there. To load the new rules execute (as root):
+#   udevadm hwdb --update
+#   udevadm trigger /dev/input/eventXX
+# where /dev/input/eventXX is the touchpad in question. If in
+# doubt, simply use /dev/input/event* to reload all input rules.
+#
+# If your changes are generally applicable, preferably send them as a pull
+# request to
+#   https://github.com/systemd/systemd
+# or create a bug report on https://github.com/systemd/systemd/issues and
+# include your new rules, a description of the device, and the output of
+#   udevadm info /dev/input/eventXX.
+#
+# Permitted keys:
+#   Specify if a touchpad is a built-in one or external:
+#   ID_INPUT_TOUCHPAD_INTEGRATION=internal|external
+
+touchpad:i8042:*
+touchpad:rmi:*
+ ID_INPUT_TOUCHPAD_INTEGRATION=internal
+
+touchpad:bluetooth:*
+touchpad:usb:*
+ ID_INPUT_TOUCHPAD_INTEGRATION=external
+
+###########################################################
+# Apple
+###########################################################
+touchpad:usb:v05ac*
+ ID_INPUT_TOUCHPAD_INTEGRATION=internal
diff --git a/src/grp-udev/hwdb/Makefile b/src/grp-udev/hwdb/Makefile
index e3e51d5c74..42f6f501f3 100644
--- a/src/grp-udev/hwdb/Makefile
+++ b/src/grp-udev/hwdb/Makefile
@@ -31,6 +31,10 @@ hwdb-update:
 	wget -O ma-large.txt 'http://standards.ieee.org/develop/regauth/oui/oui.txt' && \
 	wget -O ma-medium.txt 'http://standards.ieee.org/develop/regauth/oui28/mam.txt' && \
 	wget -O ma-small.txt 'http://standards.ieee.org/develop/regauth/oui36/oui36.txt' && \
-	./ids-update.pl )
+	wget -O pnp_id_registry.html 'http://www.uefi.org/uefi-pnp-export' && \
+	wget -O acpi_id_registry.html 'http://www.uefi.org/uefi-acpi-export' && \
+	./ids-update.pl && \
+	./acpi-update.py > 20-acpi-vendor.hwdb.base && \
+	patch -p0 -o- 20-acpi-vendor.hwdb.base < 20-acpi-vendor.hwdb.patch > 20-acpi-vendor.hwdb )
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-udev/hwdb/acpi-update.py b/src/grp-udev/hwdb/acpi-update.py
new file mode 100755
index 0000000000..2dc8c7c064
--- /dev/null
+++ b/src/grp-udev/hwdb/acpi-update.py
@@ -0,0 +1,79 @@
+#!/usr/bin/python3
+
+from html.parser import HTMLParser
+from enum import Enum
+
+class State(Enum):
+    NOWHERE = 0
+    COMPANY = 1
+    AFTER_COMPANY = 2
+    PNPID = 3
+    AFTER_PNPID = 4
+    DATE = 5
+
+class PNPTableParser(HTMLParser):
+
+    def __init__(self):
+        HTMLParser.__init__(self)
+        self.state = State.NOWHERE
+        self.data = ""
+        self.pnpid = None
+        self.company = None
+        self.table = []
+
+    def handle_starttag(self, tag, attrs):
+
+        if tag == "td":
+            if self.state == State.NOWHERE:
+                self.state = State.COMPANY
+            elif self.state == State.AFTER_COMPANY:
+                self.state = State.PNPID
+            elif self.state == State.AFTER_PNPID:
+                self.state = State.DATE
+            else:
+                raise Error("Unexpected field")
+
+            self.data = ""
+
+    def handle_endtag(self, tag):
+
+        if tag == "td":
+            if self.state == State.COMPANY:
+                self.company = ' '.join(self.data.strip().split())
+                self.state = State.AFTER_COMPANY
+            elif self.state == State.PNPID:
+                self.pnpid = self.data.strip()
+                self.state = State.AFTER_PNPID
+                self.table.append((self.pnpid, self.company))
+            elif self.state == State.DATE:
+                self.state = State.NOWHERE
+            else:
+                raise Error("Unexpected field")
+
+    def handle_data(self, data):
+        self.data += data
+
+def read_table(a):
+
+    parser = PNPTableParser()
+
+    for line in a:
+        parser.feed(line)
+
+    parser.close()
+    parser.table.sort()
+
+    for pnpid, company in parser.table:
+        print("\nacpi:{0}*:\n ID_VENDOR_FROM_DATABASE={1}".format(pnpid, company))
+
+a = open("acpi_id_registry.html")
+b = open("pnp_id_registry.html")
+
+print('# This file is part of systemd.\n'
+      '#\n'
+      '# Data imported from:\n'
+      '#     http://www.uefi.org/uefi-pnp-export\n'
+      '#     http://www.uefi.org/uefi-acpi-export')
+
+read_table(a)
+read_table(b)
diff --git a/src/grp-udev/libudev-core/udev-builtin-blkid.c b/src/grp-udev/libudev-core/udev-builtin-blkid.c
index 89fa75fa73..a2784aa03e 100644
--- a/src/grp-udev/libudev-core/udev-builtin-blkid.c
+++ b/src/grp-udev/libudev-core/udev-builtin-blkid.c
@@ -147,11 +147,6 @@ static int find_gpt_root(struct udev_device *dev, blkid_probe pr, bool test) {
 
                 if (sd_id128_equal(type, GPT_ESP)) {
                         sd_id128_t id, esp;
-                        unsigned long long flags;
-
-                        flags = blkid_partition_get_flags(pp);
-                        if (flags & GPT_FLAG_NO_AUTO)
-                                continue;
 
                         /* We found an ESP, let's see if it matches
                          * the ESP we booted from. */
@@ -167,6 +162,11 @@ static int find_gpt_root(struct udev_device *dev, blkid_probe pr, bool test) {
                                 found_esp = true;
 
                 } else if (sd_id128_equal(type, GPT_ROOT_NATIVE)) {
+                        unsigned long long flags;
+
+                        flags = blkid_partition_get_flags(pp);
+                        if (flags & GPT_FLAG_NO_AUTO)
+                                continue;
 
                         /* We found a suitable root partition, let's
                          * remember the first one. */
diff --git a/src/grp-udev/libudev-core/udev-builtin-input_id.c b/src/grp-udev/libudev-core/udev-builtin-input_id.c
index 386ef5b5dc..711ec0b665 100644
--- a/src/grp-udev/libudev-core/udev-builtin-input_id.c
+++ b/src/grp-udev/libudev-core/udev-builtin-input_id.c
@@ -211,8 +211,14 @@ static bool test_pointers(struct udev_device *dev,
                 else if (has_joystick_axes_or_buttons)
                         is_joystick = true;
         }
-        if (has_mt_coordinates && (is_direct || has_touch))
-                is_touchscreen = true;
+        if (has_mt_coordinates) {
+                if (stylus_or_pen)
+                        is_tablet = true;
+                else if (finger_but_no_pen && !is_direct)
+                        is_touchpad = true;
+                else if (has_touch || is_direct)
+                        is_touchscreen = true;
+        }
 
         if (has_rel_coordinates && has_mouse_button)
                 is_mouse = true;
diff --git a/src/grp-udev/libudev-core/udev-event.c b/src/grp-udev/libudev-core/udev-event.c
index 59f4e1fb35..5bdf5aad02 100644
--- a/src/grp-udev/libudev-core/udev-event.c
+++ b/src/grp-udev/libudev-core/udev-event.c
@@ -249,7 +249,7 @@ subst:
 
                         if (event->program_result == NULL)
                                 break;
-                        /* get part part of the result string */
+                        /* get part of the result string */
                         i = 0;
                         if (attr != NULL)
                                 i = strtoul(attr, &rest, 10);
diff --git a/src/grp-udev/rules/60-block.rules b/src/grp-udev/rules/60-block.rules
index c74caca49f..42c75974a5 100644
--- a/src/grp-udev/rules/60-block.rules
+++ b/src/grp-udev/rules/60-block.rules
@@ -8,4 +8,4 @@ ACTION=="add", SUBSYSTEM=="module", KERNEL=="block", ATTR{parameters/events_dfl_
 ACTION=="change", SUBSYSTEM=="scsi", ENV{DEVTYPE}=="scsi_device", TEST=="block", ATTR{block/*/uevent}="change"
 
 # watch metadata changes, caused by tools closing the device node which was opened for writing
-ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop*|nvme*|sd*|vd*|xvd*", OPTIONS+="watch"
+ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop*|nvme*|sd*|vd*|xvd*|pmem*", OPTIONS+="watch"
diff --git a/src/grp-udev/rules/60-persistent-input.rules b/src/grp-udev/rules/60-persistent-input.rules
index 0e33e68384..607144bf8a 100644
--- a/src/grp-udev/rules/60-persistent-input.rules
+++ b/src/grp-udev/rules/60-persistent-input.rules
@@ -2,7 +2,9 @@
 
 ACTION=="remove", GOTO="persistent_input_end"
 SUBSYSTEM!="input", GOTO="persistent_input_end"
-SUBSYSTEMS=="bluetooth", GOTO="persistent_input_end"
+SUBSYSTEMS=="bluetooth", ENV{ID_BUS}="bluetooth", GOTO="persistent_input_end"
+SUBSYSTEMS=="rmi4", ENV{ID_BUS}="rmi", GOTO="persistent_input_end"
+SUBSYSTEMS=="serio", ENV{ID_BUS}="i8042", GOTO="persistent_input_end"
 
 SUBSYSTEMS=="usb", ENV{ID_BUS}=="", IMPORT{builtin}="usb_id"
 
diff --git a/src/grp-udev/rules/60-persistent-storage-tape.rules b/src/grp-udev/rules/60-persistent-storage-tape.rules
index f2eabd92a8..b604864ee8 100644
--- a/src/grp-udev/rules/60-persistent-storage-tape.rules
+++ b/src/grp-udev/rules/60-persistent-storage-tape.rules
@@ -3,6 +3,7 @@
 # persistent storage links: /dev/tape/{by-id,by-path}
 
 ACTION=="remove", GOTO="persistent_storage_tape_end"
+ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}=="1", GOTO="persistent_storage_tape_end"
 
 # type 8 devices are "Medium Changers"
 SUBSYSTEM=="scsi_generic", SUBSYSTEMS=="scsi", ATTRS{type}=="8", IMPORT{program}="scsi_id --sg-version=3 --export --whitelisted -d $devnode", \
diff --git a/src/grp-udev/rules/60-persistent-storage.rules b/src/grp-udev/rules/60-persistent-storage.rules
index 408733915c..d7bbbf9866 100644
--- a/src/grp-udev/rules/60-persistent-storage.rules
+++ b/src/grp-udev/rules/60-persistent-storage.rules
@@ -4,9 +4,10 @@
 # scheme based on "Linux persistent device names", 2004, Hannes Reinecke <hare@suse.de>
 
 ACTION=="remove", GOTO="persistent_storage_end"
+ENV{UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG}=="1", GOTO="persistent_storage_end"
 
 SUBSYSTEM!="block", GOTO="persistent_storage_end"
-KERNEL!="loop*|mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|nvme*|sd*|sr*|vd*|xvd*|bcache*|cciss*|dasd*|ubd*", GOTO="persistent_storage_end"
+KERNEL!="loop*|mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|nvme*|sd*|sr*|vd*|xvd*|bcache*|cciss*|dasd*|ubd*|scm*|pmem*", GOTO="persistent_storage_end"
 
 # ignore partitions that span the entire disk
 TEST=="whole_disk", GOTO="persistent_storage_end"
diff --git a/src/grp-udev/rules/70-touchpad.rules b/src/grp-udev/rules/70-touchpad.rules
new file mode 100644
index 0000000000..7bede02dec
--- /dev/null
+++ b/src/grp-udev/rules/70-touchpad.rules
@@ -0,0 +1,13 @@
+# do not edit this file, it will be overwritten on update
+
+ACTION=="remove", GOTO="touchpad_end"
+ENV{ID_INPUT}=="", GOTO="touchpad_end"
+ENV{ID_INPUT_TOUCHPAD}=="", GOTO="touchpad_end"
+KERNEL!="event*", GOTO="touchpad_end"
+
+# touchpad:<subsystem>:v<vid>p<pid>:name:<name>:*
+KERNELS=="input*", ENV{ID_BUS}!="", \
+        IMPORT{builtin}="hwdb 'touchpad:$env{ID_BUS}:v$attr{id/vendor}p$attr{id/product}:name:$attr{name}:'", \
+        GOTO="touchpad_end"
+
+LABEL="touchpad_end"
diff --git a/src/grp-udev/rules/99-systemd.rules.in b/src/grp-udev/rules/99-systemd.rules.in
index fb4517606d..ca52cf165b 100644
--- a/src/grp-udev/rules/99-systemd.rules.in
+++ b/src/grp-udev/rules/99-systemd.rules.in
@@ -56,8 +56,7 @@ SUBSYSTEM=="backlight", TAG+="systemd", IMPORT{builtin}="path_id", ENV{SYSTEMD_W
 SUBSYSTEM=="leds", KERNEL=="*kbd_backlight", TAG+="systemd", IMPORT{builtin}="path_id", ENV{SYSTEMD_WANTS}+="systemd-backlight@leds:$name.service"
 
 # Pull in rfkill save/restore for all rfkill devices
-
-SUBSYSTEM=="rfkill", IMPORT{builtin}="path_id"
+SUBSYSTEM=="rfkill", ENV{SYSTEMD_RFKILL}="1", IMPORT{builtin}="path_id"
 SUBSYSTEM=="misc", KERNEL=="rfkill", TAG+="systemd", ENV{SYSTEMD_WANTS}+="systemd-rfkill.socket"
 
 # Asynchronously mount file systems implemented by these modules as soon as they are loaded.
diff --git a/src/grp-udev/systemd-hwdb/Makefile b/src/grp-udev/systemd-hwdb/Makefile
index ef4e5074ae..8636cc3270 100644
--- a/src/grp-udev/systemd-hwdb/Makefile
+++ b/src/grp-udev/systemd-hwdb/Makefile
@@ -51,7 +51,8 @@ dist_udevhwdb_DATA = \
 	hwdb/60-evdev.hwdb \
 	hwdb/60-keyboard.hwdb \
 	hwdb/70-mouse.hwdb \
-	hwdb/70-pointingstick.hwdb
+	hwdb/70-pointingstick.hwdb \
+	hwdb/70-touchpad.hwdb
 
 SYSINIT_TARGET_WANTS += \
 	systemd-hwdb-update.service
diff --git a/src/grp-udev/systemd-hwdb/hwdb.c b/src/grp-udev/systemd-hwdb/hwdb.c
index 0e96716b0f..2e843249ae 100644
--- a/src/grp-udev/systemd-hwdb/hwdb.c
+++ b/src/grp-udev/systemd-hwdb/hwdb.c
@@ -27,7 +27,9 @@
 #include "basic/fd-util.h"
 #include "basic/fileio.h"
 #include "basic/fs-util.h"
+#include "basic/label.h"
 #include "basic/mkdir.h"
+#include "basic/selinux-util.h"
 #include "basic/strbuf.h"
 #include "basic/string-util.h"
 #include "basic/strv.h"
@@ -643,12 +645,12 @@ static int hwdb_update(int argc, char *argv[], void *userdata) {
         if (!hwdb_bin)
                 return -ENOMEM;
 
-        mkdir_parents(hwdb_bin, 0755);
+        mkdir_parents_label(hwdb_bin, 0755);
         r = trie_store(trie, hwdb_bin);
         if (r < 0)
                 return log_error_errno(r, "Failure writing database %s: %m", hwdb_bin);
 
-        return 0;
+        return label_fix(hwdb_bin, false, false);
 }
 
 static void help(void) {
@@ -732,6 +734,8 @@ int main (int argc, char *argv[]) {
         if (r <= 0)
                 goto finish;
 
+        mac_selinux_init();
+
         r = hwdb_main(argc, argv);
 
 finish:
diff --git a/src/grp-udev/systemd-udevd/Makefile b/src/grp-udev/systemd-udevd/Makefile
index 5bbc548cfe..0ef78eb339 100644
--- a/src/grp-udev/systemd-udevd/Makefile
+++ b/src/grp-udev/systemd-udevd/Makefile
@@ -30,6 +30,7 @@ systemd_udevd_SOURCES = \
 	src/udev/udevd.c
 
 systemd_udevd_LDADD = \
-	libudev-core.la
+	libudev-core.la \
+	libbasic.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-udev/systemd-udevd/systemd-udevd.service.in b/src/grp-udev/systemd-udevd/systemd-udevd.service.in
index 79f28c87c6..67e4c5fcd7 100644
--- a/src/grp-udev/systemd-udevd/systemd-udevd.service.in
+++ b/src/grp-udev/systemd-udevd/systemd-udevd.service.in
@@ -24,3 +24,4 @@ ExecStart=@rootlibexecdir@/systemd-udevd
 MountFlags=slave
 KillMode=mixed
 WatchdogSec=3min
+TasksMax=infinity
diff --git a/src/grp-udev/systemd-udevd/udevd.c b/src/grp-udev/systemd-udevd/udevd.c
index 07edbb3450..6ca4069fca 100644
--- a/src/grp-udev/systemd-udevd/udevd.c
+++ b/src/grp-udev/systemd-udevd/udevd.c
@@ -367,7 +367,6 @@ static void worker_spawn(Manager *manager, struct event *event) {
                 manager->monitor = udev_monitor_unref(manager->monitor);
                 manager->ctrl_conn_blocking = udev_ctrl_connection_unref(manager->ctrl_conn_blocking);
                 manager->ctrl = udev_ctrl_unref(manager->ctrl);
-                manager->ctrl_conn_blocking = udev_ctrl_connection_unref(manager->ctrl_conn_blocking);
                 manager->worker_watch[READ_END] = safe_close(manager->worker_watch[READ_END]);
 
                 manager->ctrl_event = sd_event_source_unref(manager->ctrl_event);
@@ -1256,7 +1255,7 @@ static int on_post(sd_event_source *s, void *userdata) {
                                         return r;
                         } else if (manager->cgroup)
                                 /* cleanup possible left-over processes in our cgroup */
-                                cg_kill(SYSTEMD_CGROUP_CONTROLLER, manager->cgroup, SIGKILL, false, true, NULL);
+                                cg_kill(SYSTEMD_CGROUP_CONTROLLER, manager->cgroup, SIGKILL, CGROUP_IGNORE_SELF, NULL, NULL, NULL);
                 }
         }
 
diff --git a/src/grp-udev/udevadm/Makefile b/src/grp-udev/udevadm/Makefile
index 6fa837f6e3..b556d5c9d1 100644
--- a/src/grp-udev/udevadm/Makefile
+++ b/src/grp-udev/udevadm/Makefile
@@ -40,7 +40,8 @@ udevadm_SOURCES = \
 	src/udev/udevadm-util.h
 
 udevadm_LDADD = \
-	libudev-core.la
+	libudev-core.la \
+	libbasic.la
 
 sd.CPPFLAGS += -DUDEVLIBEXECDIR=\"$(udevlibexecdir)\"
 
diff --git a/src/grp-udev/udevadm/udevadm-hwdb.c b/src/grp-udev/udevadm/udevadm-hwdb.c
index 3446de358c..2b5444f439 100644
--- a/src/grp-udev/udevadm/udevadm-hwdb.c
+++ b/src/grp-udev/udevadm/udevadm-hwdb.c
@@ -26,6 +26,8 @@
 #include "basic/conf-files.h"
 #include "basic/fileio.h"
 #include "basic/fs-util.h"
+#include "basic/label.h"
+#include "basic/mkdir.h"
 #include "basic/strbuf.h"
 #include "basic/string-util.h"
 #include "basic/util.h"
@@ -656,12 +658,16 @@ static int adm_hwdb(struct udev *udev, int argc, char *argv[]) {
                         rc = EXIT_FAILURE;
                         goto out;
                 }
-                mkdir_parents(hwdb_bin, 0755);
+
+                mkdir_parents_label(hwdb_bin, 0755);
+
                 err = trie_store(trie, hwdb_bin);
                 if (err < 0) {
                         log_error_errno(err, "Failure writing database %s: %m", hwdb_bin);
                         rc = EXIT_FAILURE;
                 }
+
+                label_fix(hwdb_bin, false, false);
         }
 
         if (test) {
diff --git a/src/grp-udev/udevadm/udevadm-info.c b/src/grp-udev/udevadm/udevadm-info.c
index f8b2d915a4..9746d82aa4 100644
--- a/src/grp-udev/udevadm/udevadm-info.c
+++ b/src/grp-udev/udevadm/udevadm-info.c
@@ -157,7 +157,7 @@ static int stat_device(const char *name, bool export, const char *prefix) {
         struct stat statbuf;
 
         if (stat(name, &statbuf) != 0)
-                return -1;
+                return -errno;
 
         if (export) {
                 if (prefix == NULL)
@@ -172,23 +172,22 @@ static int stat_device(const char *name, bool export, const char *prefix) {
 }
 
 static int export_devices(struct udev *udev) {
-        struct udev_enumerate *udev_enumerate;
+        _cleanup_udev_enumerate_unref_ struct udev_enumerate *udev_enumerate;
         struct udev_list_entry *list_entry;
 
         udev_enumerate = udev_enumerate_new(udev);
         if (udev_enumerate == NULL)
-                return -1;
+                return -ENOMEM;
+
         udev_enumerate_scan_devices(udev_enumerate);
         udev_list_entry_foreach(list_entry, udev_enumerate_get_list_entry(udev_enumerate)) {
-                struct udev_device *device;
+                _cleanup_udev_device_unref_ struct udev_device *device;
 
                 device = udev_device_new_from_syspath(udev, udev_list_entry_get_name(list_entry));
-                if (device != NULL) {
+                if (device != NULL)
                         print_record(device);
-                        udev_device_unref(device);
-                }
         }
-        udev_enumerate_unref(udev_enumerate);
+
         return 0;
 }
 
@@ -221,39 +220,29 @@ static void cleanup_dir(DIR *dir, mode_t mask, int depth) {
 }
 
 static void cleanup_db(struct udev *udev) {
-        DIR *dir;
+        _cleanup_closedir_ DIR *dir1 = NULL, *dir2 = NULL, *dir3 = NULL, *dir4 = NULL, *dir5 = NULL;
 
-        unlink("/run/udev/queue.bin");
+        (void) unlink("/run/udev/queue.bin");
 
-        dir = opendir("/run/udev/data");
-        if (dir != NULL) {
-                cleanup_dir(dir, S_ISVTX, 1);
-                closedir(dir);
-        }
+        dir1 = opendir("/run/udev/data");
+        if (dir1 != NULL)
+                cleanup_dir(dir1, S_ISVTX, 1);
 
-        dir = opendir("/run/udev/links");
-        if (dir != NULL) {
-                cleanup_dir(dir, 0, 2);
-                closedir(dir);
-        }
+        dir2 = opendir("/run/udev/links");
+        if (dir2 != NULL)
+                cleanup_dir(dir2, 0, 2);
 
-        dir = opendir("/run/udev/tags");
-        if (dir != NULL) {
-                cleanup_dir(dir, 0, 2);
-                closedir(dir);
-        }
+        dir3 = opendir("/run/udev/tags");
+        if (dir3 != NULL)
+                cleanup_dir(dir3, 0, 2);
 
-        dir = opendir("/run/udev/static_node-tags");
-        if (dir != NULL) {
-                cleanup_dir(dir, 0, 2);
-                closedir(dir);
-        }
+        dir4 = opendir("/run/udev/static_node-tags");
+        if (dir4 != NULL)
+                cleanup_dir(dir4, 0, 2);
 
-        dir = opendir("/run/udev/watch");
-        if (dir != NULL) {
-                cleanup_dir(dir, 0, 1);
-                closedir(dir);
-        }
+        dir5 = opendir("/run/udev/watch");
+        if (dir5 != NULL)
+                cleanup_dir(dir5, 0, 1);
 }
 
 static void help(void) {
@@ -375,7 +364,8 @@ static int uinfo(struct udev *udev, int argc, char *argv[]) {
                         action = ACTION_ATTRIBUTE_WALK;
                         break;
                 case 'e':
-                        export_devices(udev);
+                        if (export_devices(udev) < 0)
+                                return 1;
                         return 0;
                 case 'c':
                         cleanup_db(udev);
@@ -444,17 +434,13 @@ static int uinfo(struct udev *udev, int argc, char *argv[]) {
                 case QUERY_PROPERTY:
                         list_entry = udev_device_get_properties_list_entry(device);
                         while (list_entry != NULL) {
-                                if (export) {
-                                        const char *prefix = export_prefix;
-
-                                        if (prefix == NULL)
-                                                prefix = "";
-                                        printf("%s%s='%s'\n", prefix,
+                                if (export)
+                                        printf("%s%s='%s'\n", strempty(export_prefix),
                                                udev_list_entry_get_name(list_entry),
                                                udev_list_entry_get_value(list_entry));
-                                } else {
+                                else
                                         printf("%s=%s\n", udev_list_entry_get_name(list_entry), udev_list_entry_get_value(list_entry));
-                                }
+
                                 list_entry = udev_list_entry_get_next(list_entry);
                         }
                         break;
diff --git a/src/grp-udev/udevadm/udevadm-monitor.c b/src/grp-udev/udevadm/udevadm-monitor.c
index 01f322f721..c6002ce416 100644
--- a/src/grp-udev/udevadm/udevadm-monitor.c
+++ b/src/grp-udev/udevadm/udevadm-monitor.c
@@ -151,6 +151,9 @@ static int adm_monitor(struct udev *udev, int argc, char *argv[]) {
         sigaddset(&mask, SIGTERM);
         sigprocmask(SIG_UNBLOCK, &mask, NULL);
 
+        /* Callers are expecting to see events as they happen: Line buffering */
+        setlinebuf(stdout);
+
         fd_ep = epoll_create1(EPOLL_CLOEXEC);
         if (fd_ep < 0) {
                 log_error_errno(errno, "error creating epoll fd: %m");
diff --git a/src/grp-udev/udevadm/udevadm.xml b/src/grp-udev/udevadm/udevadm.xml
index 8c1abd2770..1c7921f5bd 100644
--- a/src/grp-udev/udevadm/udevadm.xml
+++ b/src/grp-udev/udevadm/udevadm.xml
@@ -380,7 +380,7 @@
       <para>Modify the internal state of the running udev daemon.</para>
       <variablelist>
         <varlistentry>
-          <term><option>-x</option></term>
+          <term><option>-e</option></term>
           <term><option>--exit</option></term>
           <listitem>
             <para>Signal and wait for systemd-udevd to exit.</para>
diff --git a/src/grp-utils/systemd-ac-power/Makefile b/src/grp-utils/systemd-ac-power/Makefile
index ec35048162..4586f01612 100644
--- a/src/grp-utils/systemd-ac-power/Makefile
+++ b/src/grp-utils/systemd-ac-power/Makefile
@@ -28,6 +28,6 @@ systemd_ac_power_SOURCES = \
 	src/ac-power/ac-power.c
 
 systemd_ac_power_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-utils/systemd-escape/Makefile b/src/grp-utils/systemd-escape/Makefile
index 4eb2fe356a..b59575db9b 100644
--- a/src/grp-utils/systemd-escape/Makefile
+++ b/src/grp-utils/systemd-escape/Makefile
@@ -29,6 +29,6 @@ systemd_escape_SOURCES = \
 	src/escape/escape.c
 
 systemd_escape_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-utils/systemd-notify/Makefile b/src/grp-utils/systemd-notify/Makefile
index 60e1336e72..c46897b9e7 100644
--- a/src/grp-utils/systemd-notify/Makefile
+++ b/src/grp-utils/systemd-notify/Makefile
@@ -28,6 +28,6 @@ systemd_notify_SOURCES = \
 	src/notify/notify.c
 
 systemd_notify_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-utils/systemd-socket-activate/Makefile b/src/grp-utils/systemd-socket-activate/Makefile
index da1a1a5e43..dd3e95a5e8 100644
--- a/src/grp-utils/systemd-socket-activate/Makefile
+++ b/src/grp-utils/systemd-socket-activate/Makefile
@@ -30,6 +30,6 @@ systemd_socket_activate_SOURCES = \
 	src/activate/activate.c
 
 systemd_socket_activate_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-utils/systemd-socket-activate/systemd-socket-activate.xml b/src/grp-utils/systemd-socket-activate/systemd-socket-activate.xml
index 5d7f157c72..2cf3a7d377 100644
--- a/src/grp-utils/systemd-socket-activate/systemd-socket-activate.xml
+++ b/src/grp-utils/systemd-socket-activate/systemd-socket-activate.xml
@@ -142,7 +142,7 @@
         <varname>FileDescriptorName=</varname> in socket unit files, and enables use of
         <citerefentry><refentrytitle>sd_listen_fds_with_names</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
         Multiple entries may be specifies using separate options or by separating names with colons
-        (<literal>:</literal>) in one option. In case more names are given than descriptors, superflous ones willl be
+        (<literal>:</literal>) in one option. In case more names are given than descriptors, superfluous ones willl be
         ignored. In case less names are given than descriptors, the remaining file descriptors will be unnamed.
         </para></listitem>
       </varlistentry>
diff --git a/src/libbasic/include/basic/bitmap.h b/src/libbasic/include/basic/bitmap.h
index f5f8f2f018..63fdbe8bea 100644
--- a/src/libbasic/include/basic/bitmap.h
+++ b/src/libbasic/include/basic/bitmap.h
@@ -27,10 +27,9 @@
 typedef struct Bitmap Bitmap;
 
 Bitmap *bitmap_new(void);
-
-void bitmap_free(Bitmap *b);
-
+Bitmap *bitmap_copy(Bitmap *b);
 int bitmap_ensure_allocated(Bitmap **b);
+void bitmap_free(Bitmap *b);
 
 int bitmap_set(Bitmap *b, unsigned n);
 void bitmap_unset(Bitmap *b, unsigned n);
diff --git a/src/libbasic/include/basic/cgroup-util.h b/src/libbasic/include/basic/cgroup-util.h
index 4bb5291296..14ebde5fc9 100644
--- a/src/libbasic/include/basic/cgroup-util.h
+++ b/src/libbasic/include/basic/cgroup-util.h
@@ -135,12 +135,20 @@ int cg_read_event(const char *controller, const char *path, const char *event,
 int cg_enumerate_subgroups(const char *controller, const char *path, DIR **_d);
 int cg_read_subgroup(DIR *d, char **fn);
 
-int cg_kill(const char *controller, const char *path, int sig, bool sigcont, bool ignore_self, Set *s);
-int cg_kill_recursive(const char *controller, const char *path, int sig, bool sigcont, bool ignore_self, bool remove, Set *s);
+typedef enum CGroupFlags {
+        CGROUP_SIGCONT     = 1,
+        CGROUP_IGNORE_SELF = 2,
+        CGROUP_REMOVE      = 4,
+} CGroupFlags;
 
-int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self);
-int cg_migrate_recursive(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self, bool remove);
-int cg_migrate_recursive_fallback(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self, bool rem);
+typedef void (*cg_kill_log_func_t)(pid_t pid, int sig, void *userdata);
+
+int cg_kill(const char *controller, const char *path, int sig, CGroupFlags flags, Set *s, cg_kill_log_func_t kill_log, void *userdata);
+int cg_kill_recursive(const char *controller, const char *path, int sig, CGroupFlags flags, Set *s, cg_kill_log_func_t kill_log, void *userdata);
+
+int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char *pto, CGroupFlags flags);
+int cg_migrate_recursive(const char *cfrom, const char *pfrom, const char *cto, const char *pto, CGroupFlags flags);
+int cg_migrate_recursive_fallback(const char *cfrom, const char *pfrom, const char *cto, const char *pto, CGroupFlags flags);
 
 int cg_split_spec(const char *spec, char **controller, char **path);
 int cg_mangle_path(const char *path, char **result);
diff --git a/src/libbasic/include/basic/exit-status.h b/src/libbasic/include/basic/exit-status.h
index 1208c8feed..2309f68815 100644
--- a/src/libbasic/include/basic/exit-status.h
+++ b/src/libbasic/include/basic/exit-status.h
@@ -25,6 +25,12 @@
 #include "macro.h"
 #include "set.h"
 
+/* This defines pretty names for the LSB 'start' verb exit codes. Note that they shouldn't be confused with the LSB
+ * 'status' verb exit codes which are defined very differently. For details see:
+ *
+ * https://refspecs.linuxbase.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html
+ */
+
 typedef enum ExitStatus {
         /* EXIT_SUCCESS defined by libc */
         /* EXIT_FAILURE defined by libc */
@@ -37,9 +43,7 @@ typedef enum ExitStatus {
 
         /* The LSB suggests that error codes >= 200 are "reserved". We
          * use them here under the assumption that they hence are
-         * unused by init scripts.
-         *
-         * http://refspecs.linuxfoundation.org/LSB_3.2.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html */
+         * unused by init scripts. */
 
         EXIT_CHDIR = 200,
         EXIT_NICE,
@@ -81,9 +85,9 @@ typedef enum ExitStatus {
 } ExitStatus;
 
 typedef enum ExitStatusLevel {
-        EXIT_STATUS_MINIMAL,
-        EXIT_STATUS_SYSTEMD,
-        EXIT_STATUS_LSB,
+        EXIT_STATUS_MINIMAL,   /* only cover libc EXIT_STATUS/EXIT_FAILURE */
+        EXIT_STATUS_SYSTEMD,   /* cover libc and systemd's own exit codes */
+        EXIT_STATUS_LSB,       /* cover libc, systemd's own and LSB exit codes */
         EXIT_STATUS_FULL = EXIT_STATUS_LSB
 } ExitStatusLevel;
 
diff --git a/src/libbasic/include/basic/fd-util.h b/src/libbasic/include/basic/fd-util.h
index b86e41698a..34b98d4aec 100644
--- a/src/libbasic/include/basic/fd-util.h
+++ b/src/libbasic/include/basic/fd-util.h
@@ -63,6 +63,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(DIR*, closedir);
 
 int fd_nonblock(int fd, bool nonblock);
 int fd_cloexec(int fd, bool cloexec);
+void stdio_unset_cloexec(void);
 
 int close_all_fds(const int except[], unsigned n_except);
 
diff --git a/src/libbasic/include/basic/fileio.h b/src/libbasic/include/basic/fileio.h
index 58dbc80c24..9ac497d9eb 100644
--- a/src/libbasic/include/basic/fileio.h
+++ b/src/libbasic/include/basic/fileio.h
@@ -86,3 +86,5 @@ int open_tmpfile_unlinkable(const char *directory, int flags);
 int open_tmpfile_linkable(const char *target, int flags, char **ret_path);
 
 int link_tmpfile(int fd, const char *path, const char *target);
+
+int read_nul_string(FILE *f, char **ret);
diff --git a/src/libbasic/include/basic/formats-util.h b/src/libbasic/include/basic/formats-util.h
index 9b4e8e98fa..39a185f59b 100644
--- a/src/libbasic/include/basic/formats-util.h
+++ b/src/libbasic/include/basic/formats-util.h
@@ -61,3 +61,19 @@
 #else
 #  error Unknown rlim_t size
 #endif
+
+#if SIZEOF_DEV_T == 8
+#  define DEV_FMT "%" PRIu64
+#elif SIZEOF_DEV_T == 4
+#  define DEV_FMT "%" PRIu32
+#else
+#  error Unknown dev_t size
+#endif
+
+#if SIZEOF_INO_T == 8
+#  define INO_FMT "%" PRIu64
+#elif SIZEOF_INO_T == 4
+#  define INO_FMT "%" PRIu32
+#else
+#  error Unknown ino_t size
+#endif
diff --git a/src/libbasic/include/basic/fs-util.h b/src/libbasic/include/basic/fs-util.h
index 517b599d6f..075e5942b1 100644
--- a/src/libbasic/include/basic/fs-util.h
+++ b/src/libbasic/include/basic/fs-util.h
@@ -61,6 +61,8 @@ int mkfifo_atomic(const char *path, mode_t mode);
 
 int get_files_in_directory(const char *path, char ***list);
 
+int var_tmp(char **ret);
+
 #define INOTIFY_EVENT_MAX (sizeof(struct inotify_event) + NAME_MAX + 1)
 
 #define FOREACH_INOTIFY_EVENT(e, buffer, sz) \
diff --git a/src/libbasic/include/basic/in-addr-util.h b/src/libbasic/include/basic/in-addr-util.h
index 17798ce816..d60064aef8 100644
--- a/src/libbasic/include/basic/in-addr-util.h
+++ b/src/libbasic/include/basic/in-addr-util.h
@@ -36,6 +36,9 @@ struct in_addr_data {
         union in_addr_union address;
 };
 
+bool in4_addr_is_null(const struct in_addr *a);
+bool in6_addr_is_null(const struct in6_addr *a);
+
 int in_addr_is_null(int family, const union in_addr_union *u);
 int in_addr_is_link_local(int family, const union in_addr_union *u);
 int in_addr_is_localhost(int family, const union in_addr_union *u);
@@ -43,8 +46,10 @@ int in_addr_equal(int family, const union in_addr_union *a, const union in_addr_
 int in_addr_prefix_intersect(int family, const union in_addr_union *a, unsigned aprefixlen, const union in_addr_union *b, unsigned bprefixlen);
 int in_addr_prefix_next(int family, union in_addr_union *u, unsigned prefixlen);
 int in_addr_to_string(int family, const union in_addr_union *u, char **ret);
+int in_addr_ifindex_to_string(int family, const union in_addr_union *u, int ifindex, char **ret);
 int in_addr_from_string(int family, const char *s, union in_addr_union *ret);
 int in_addr_from_string_auto(const char *s, int *family, union in_addr_union *ret);
+int in_addr_ifindex_from_string_auto(const char *s, int *family, union in_addr_union *ret, int *ifindex);
 unsigned char in_addr_netmask_to_prefixlen(const struct in_addr *addr);
 struct in_addr* in_addr_prefixlen_to_netmask(struct in_addr *addr, unsigned char prefixlen);
 int in_addr_default_prefixlen(const struct in_addr *addr, unsigned char *prefixlen);
diff --git a/src/libbasic/include/basic/macro.h b/src/libbasic/include/basic/macro.h
index e41aa4260f..6b2aeb933f 100644
--- a/src/libbasic/include/basic/macro.h
+++ b/src/libbasic/include/basic/macro.h
@@ -89,6 +89,15 @@
 #define UNIQ_T(x, uniq) CONCATENATE(__unique_prefix_, CONCATENATE(x, uniq))
 #define UNIQ __COUNTER__
 
+/* builtins */
+#if __SIZEOF_INT__ == 4
+#define BUILTIN_FFS_U32(x) __builtin_ffs(x);
+#elif __SIZEOF_LONG__ == 4
+#define BUILTIN_FFS_U32(x) __builtin_ffsl(x);
+#else
+#error "neither int nor long are four bytes long?!?"
+#endif
+
 /* Rounds up */
 
 #define ALIGN4(l) (((l) + 3) & ~3)
diff --git a/src/libbasic/include/basic/missing.h b/src/libbasic/include/basic/missing.h
index 168d8cdb0a..8721b075bb 100644
--- a/src/libbasic/include/basic/missing.h
+++ b/src/libbasic/include/basic/missing.h
@@ -454,6 +454,18 @@ struct btrfs_ioctl_quota_ctl_args {
 #define MQUEUE_MAGIC 0x19800202
 #endif
 
+#ifndef SECURITYFS_MAGIC
+#define SECURITYFS_MAGIC 0x73636673
+#endif
+
+#ifndef TRACEFS_MAGIC
+#define TRACEFS_MAGIC 0x74726163
+#endif
+
+#ifndef BPF_FS_MAGIC
+#define BPF_FS_MAGIC 0xcafe4a11
+#endif
+
 #ifndef MS_MOVE
 #define MS_MOVE 8192
 #endif
@@ -568,6 +580,10 @@ struct btrfs_ioctl_quota_ctl_args {
 #define IN6_ADDR_GEN_MODE_NONE 1
 #endif
 
+#if !HAVE_DECL_IN6_ADDR_GEN_MODE_STABLE_PRIVACY
+#define IN6_ADDR_GEN_MODE_STABLE_PRIVACY 2
+#endif
+
 #if !HAVE_DECL_IFLA_MACVLAN_FLAGS
 #define IFLA_MACVLAN_UNSPEC 0
 #define IFLA_MACVLAN_MODE 1
@@ -747,6 +763,14 @@ struct btrfs_ioctl_quota_ctl_args {
 #define IFLA_BRIDGE_MAX (__IFLA_BRIDGE_MAX - 1)
 #endif
 
+#ifndef BRIDGE_VLAN_INFO_RANGE_BEGIN
+#define BRIDGE_VLAN_INFO_RANGE_BEGIN (1<<3) /* VLAN is start of vlan range */
+#endif
+
+#ifndef BRIDGE_VLAN_INFO_RANGE_END
+#define BRIDGE_VLAN_INFO_RANGE_END (1<<4) /* VLAN is end of vlan range */
+#endif
+
 #if !HAVE_DECL_IFLA_BR_VLAN_DEFAULT_PVID
 #define IFLA_BR_UNSPEC 0
 #define IFLA_BR_FORWARD_DELAY 1
@@ -814,6 +838,10 @@ struct btrfs_ioctl_quota_ctl_args {
 #define IFLA_BRPORT_PROXYARP 10
 #endif
 
+#if !HAVE_DECL_IFLA_VRF_TABLE
+#define IFLA_VRF_TABLE 1
+#endif
+
 #if !HAVE_DECL_NDA_IFINDEX
 #define NDA_UNSPEC 0
 #define NDA_DST 1
diff --git a/src/libbasic/include/basic/missing_syscall.h b/src/libbasic/include/basic/missing_syscall.h
index 2929123679..9afba975fb 100644
--- a/src/libbasic/include/basic/missing_syscall.h
+++ b/src/libbasic/include/basic/missing_syscall.h
@@ -182,18 +182,6 @@ static inline int setns(int fd, int nstype) {
 
 /* ======================================================================= */
 
-static inline int raw_clone(unsigned long flags, void *child_stack) {
-#if defined(__s390__) || defined(__CRIS__)
-        /* On s390 and cris the order of the first and second arguments
-         * of the raw clone() system call is reversed. */
-        return (int) syscall(__NR_clone, child_stack, flags);
-#else
-        return (int) syscall(__NR_clone, flags, child_stack);
-#endif
-}
-
-/* ======================================================================= */
-
 static inline pid_t raw_getpid(void) {
 #if defined(__alpha__)
         return (pid_t) syscall(__NR_getxpid);
@@ -295,6 +283,8 @@ static inline key_serial_t request_key(const char *type, const char *description
 #      define __NR_copy_file_range 391
 #    elif defined __aarch64__
 #      define __NR_copy_file_range 285
+#    elif defined __powerpc__
+#      define __NR_copy_file_range 379
 #    else
 #      warning "__NR_copy_file_range not defined for your architecture"
 #    endif
diff --git a/src/libbasic/include/basic/mount-util.h b/src/libbasic/include/basic/mount-util.h
index bdb525d6b0..f46989ebb3 100644
--- a/src/libbasic/include/basic/mount-util.h
+++ b/src/libbasic/include/basic/mount-util.h
@@ -49,4 +49,6 @@ union file_handle_union {
         char padding[sizeof(struct file_handle) + MAX_HANDLE_SZ];
 };
 
+const char* mode_to_inaccessible_node(mode_t mode);
+
 #define FILE_HANDLE_INIT { .handle.handle_bytes = MAX_HANDLE_SZ }
diff --git a/src/libbasic/include/basic/nss-util.h b/src/libbasic/include/basic/nss-util.h
index bf7c4854fc..e7844fff96 100644
--- a/src/libbasic/include/basic/nss-util.h
+++ b/src/libbasic/include/basic/nss-util.h
@@ -137,7 +137,7 @@ enum nss_status _nss_##module##_getpwnam_r(             \
                 struct passwd *pwd,                     \
                 char *buffer, size_t buflen,            \
                 int *errnop) _public_;                  \
-enum nss_status _nss_mymachines_getpwuid_r(             \
+enum nss_status _nss_##module##_getpwuid_r(             \
                 uid_t uid,                              \
                 struct passwd *pwd,                     \
                 char *buffer, size_t buflen,            \
diff --git a/src/libbasic/include/basic/parse-util.h b/src/libbasic/include/basic/parse-util.h
index 7dc579a159..73441bb6fd 100644
--- a/src/libbasic/include/basic/parse-util.h
+++ b/src/libbasic/include/basic/parse-util.h
@@ -105,3 +105,5 @@ static inline int safe_atozu(const char *s, size_t *ret_u) {
 int safe_atod(const char *s, double *ret_d);
 
 int parse_fractional_part_u(const char **s, size_t digits, unsigned *res);
+
+int parse_percent(const char *p);
diff --git a/src/libbasic/include/basic/raw-clone.h b/src/libbasic/include/basic/raw-clone.h
new file mode 100644
index 0000000000..d473828999
--- /dev/null
+++ b/src/libbasic/include/basic/raw-clone.h
@@ -0,0 +1,81 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2010 Lennart Poettering
+  Copyright 2016 Michael Karcher
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <sched.h>
+#include <sys/syscall.h>
+
+#include "log.h"
+#include "macro.h"
+
+/**
+ * raw_clone() - uses clone to create a new process with clone flags
+ * @flags: Flags to pass to the clone system call
+ *
+ * Uses the clone system call to create a new process with the cloning
+ * flags and termination signal passed in the flags parameter. Opposed
+ * to glibc's clone funtion, using this function does not set up a
+ * separate stack for the child, but relies on copy-on-write semantics
+ * on the one stack at a common virtual address, just as fork does.
+ *
+ * To obtain copy-on-write semantics, flags must not contain CLONE_VM,
+ * and thus CLONE_THREAD and CLONE_SIGHAND (which require CLONE_VM) are
+ * not usabale.
+ * Additionally, as this function does not pass the ptid, newtls and ctid
+ * parameters to the kernel, flags must not contain CLONE_PARENT_SETTID,
+ * CLONE_CHILD_SETTID, CLONE_CHILD_CLEARTID or CLONE_SETTLS.
+ *
+ * Returns: 0 in the child process and the child process id in the parent.
+ */
+static inline int raw_clone(unsigned long flags) {
+        assert((flags & (CLONE_VM|CLONE_PARENT_SETTID|CLONE_CHILD_SETTID|
+                         CLONE_CHILD_CLEARTID|CLONE_SETTLS)) == 0);
+#if defined(__s390__) || defined(__CRIS__)
+        /* On s390 and cris the order of the first and second arguments
+         * of the raw clone() system call is reversed. */
+        return (int) syscall(__NR_clone, NULL, flags);
+#elif defined(__sparc__) && defined(__arch64__)
+        {
+                /**
+                 * sparc64 always returns the other process id in %o0, and
+                 * a boolean flag whether this is the child or the parent in
+                 * %o1. Inline assembly is needed to get the flag returned
+                 * in %o1.
+                 */
+                int in_child;
+                int child_pid;
+                asm volatile("mov %2, %%g1\n\t"
+                             "mov %3, %%o0\n\t"
+                             "mov 0 , %%o1\n\t"
+                             "t 0x6d\n\t"
+                             "mov %%o1, %0\n\t"
+                             "mov %%o0, %1" :
+                             "=r"(in_child), "=r"(child_pid) :
+                             "i"(__NR_clone), "r"(flags) :
+                             "%o1", "%o0", "%g1" );
+                if (in_child)
+                        return 0;
+                else
+                        return child_pid;
+        }
+#else
+        return (int) syscall(__NR_clone, flags, NULL);
+#endif
+}
diff --git a/src/libbasic/include/basic/set.h b/src/libbasic/include/basic/set.h
index e0d9dd001c..12f64a8c57 100644
--- a/src/libbasic/include/basic/set.h
+++ b/src/libbasic/include/basic/set.h
@@ -19,6 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include "extract-word.h"
 #include "hashmap.h"
 #include "macro.h"
 
@@ -122,6 +123,7 @@ static inline char **set_get_strv(Set *s) {
 int set_consume(Set *s, void *value);
 int set_put_strdup(Set *s, const char *p);
 int set_put_strdupv(Set *s, char **l);
+int set_put_strsplit(Set *s, const char *v, const char *separators, ExtractFlags flags);
 
 #define SET_FOREACH(e, s, i) \
         for ((i) = ITERATOR_FIRST; set_iterate((s), &(i), (void**)&(e)); )
diff --git a/src/libbasic/include/basic/string-table.h b/src/libbasic/include/basic/string-table.h
index d88625fca7..369610efc8 100644
--- a/src/libbasic/include/basic/string-table.h
+++ b/src/libbasic/include/basic/string-table.h
@@ -48,6 +48,8 @@ ssize_t string_table_lookup(const char * const *table, size_t len, const char *k
 #define _DEFINE_STRING_TABLE_LOOKUP_FROM_STRING_WITH_BOOLEAN(name,type,yes,scope) \
         scope type name##_from_string(const char *s) {                  \
                 int b;                                                  \
+                if (!s)                                                 \
+                        return -1;                                      \
                 b = parse_boolean(s);                                   \
                 if (b == 0)                                             \
                         return (type) 0;                                \
diff --git a/src/libbasic/include/basic/string-util.h b/src/libbasic/include/basic/string-util.h
index 139cc8c91b..1209e1e2e1 100644
--- a/src/libbasic/include/basic/string-util.h
+++ b/src/libbasic/include/basic/string-util.h
@@ -66,6 +66,10 @@ static inline bool isempty(const char *p) {
         return !p || !p[0];
 }
 
+static inline const char *empty_to_null(const char *p) {
+        return isempty(p) ? NULL : p;
+}
+
 static inline char *startswith(const char *s, const char *prefix) {
         size_t l;
 
diff --git a/src/libbasic/include/basic/strv.h b/src/libbasic/include/basic/strv.h
index f61bbb5386..683ce83a2a 100644
--- a/src/libbasic/include/basic/strv.h
+++ b/src/libbasic/include/basic/strv.h
@@ -69,8 +69,10 @@ bool strv_equal(char **a, char **b);
 char **strv_new(const char *x, ...) _sentinel_;
 char **strv_new_ap(const char *x, va_list ap);
 
+#define STRV_IGNORE ((const char *) -1)
+
 static inline const char* STRV_IFNOTNULL(const char *x) {
-        return x ? x : (const char *) -1;
+        return x ? x : STRV_IGNORE;
 }
 
 static inline bool strv_isempty(char * const *l) {
diff --git a/src/libbasic/include/basic/terminal-util.h b/src/libbasic/include/basic/terminal-util.h
index a7c96a77cb..169ab772ff 100644
--- a/src/libbasic/include/basic/terminal-util.h
+++ b/src/libbasic/include/basic/terminal-util.h
@@ -62,6 +62,7 @@ int ask_string(char **ret, const char *text, ...) _printf_(2, 3);
 int vt_disallocate(const char *name);
 
 char *resolve_dev_console(char **active);
+int get_kernel_consoles(char ***consoles);
 bool tty_is_vc(const char *tty);
 bool tty_is_vc_resolve(const char *tty);
 bool tty_is_console(const char *tty) _pure_;
@@ -79,6 +80,7 @@ unsigned lines(void);
 void columns_lines_cache_reset(int _unused_ signum);
 
 bool on_tty(void);
+bool terminal_is_dumb(void);
 bool colors_enabled(void);
 
 static inline const char *ansi_underline(void) {
diff --git a/src/libbasic/include/basic/time-util.h b/src/libbasic/include/basic/time-util.h
index 8324bb0dd0..aef64d2c8d 100644
--- a/src/libbasic/include/basic/time-util.h
+++ b/src/libbasic/include/basic/time-util.h
@@ -41,6 +41,12 @@ typedef struct dual_timestamp {
         usec_t monotonic;
 } dual_timestamp;
 
+typedef struct triple_timestamp {
+        usec_t realtime;
+        usec_t monotonic;
+        usec_t boottime;
+} triple_timestamp;
+
 #define USEC_INFINITY ((usec_t) -1)
 #define NSEC_INFINITY ((nsec_t) -1)
 
@@ -71,7 +77,8 @@ typedef struct dual_timestamp {
 
 #define TIME_T_MAX (time_t)((UINTMAX_C(1) << ((sizeof(time_t) << 3) - 1)) - 1)
 
-#define DUAL_TIMESTAMP_NULL ((struct dual_timestamp) { 0ULL, 0ULL })
+#define DUAL_TIMESTAMP_NULL ((struct dual_timestamp) {})
+#define TRIPLE_TIMESTAMP_NULL ((struct triple_timestamp) {})
 
 usec_t now(clockid_t clock);
 nsec_t now_nsec(clockid_t clock);
@@ -81,11 +88,28 @@ dual_timestamp* dual_timestamp_from_realtime(dual_timestamp *ts, usec_t u);
 dual_timestamp* dual_timestamp_from_monotonic(dual_timestamp *ts, usec_t u);
 dual_timestamp* dual_timestamp_from_boottime_or_monotonic(dual_timestamp *ts, usec_t u);
 
+triple_timestamp* triple_timestamp_get(triple_timestamp *ts);
+triple_timestamp* triple_timestamp_from_realtime(triple_timestamp *ts, usec_t u);
+
+#define DUAL_TIMESTAMP_HAS_CLOCK(clock)                               \
+        IN_SET(clock, CLOCK_REALTIME, CLOCK_REALTIME_ALARM, CLOCK_MONOTONIC)
+
+#define TRIPLE_TIMESTAMP_HAS_CLOCK(clock)                               \
+        IN_SET(clock, CLOCK_REALTIME, CLOCK_REALTIME_ALARM, CLOCK_MONOTONIC, CLOCK_BOOTTIME, CLOCK_BOOTTIME_ALARM)
+
 static inline bool dual_timestamp_is_set(dual_timestamp *ts) {
         return ((ts->realtime > 0 && ts->realtime != USEC_INFINITY) ||
                 (ts->monotonic > 0 && ts->monotonic != USEC_INFINITY));
 }
 
+static inline bool triple_timestamp_is_set(triple_timestamp *ts) {
+        return ((ts->realtime > 0 && ts->realtime != USEC_INFINITY) ||
+                (ts->monotonic > 0 && ts->monotonic != USEC_INFINITY) ||
+                (ts->boottime > 0 && ts->boottime != USEC_INFINITY));
+}
+
+usec_t triple_timestamp_by_clock(triple_timestamp *ts, clockid_t clock);
+
 usec_t timespec_load(const struct timespec *ts) _pure_;
 struct timespec *timespec_store(struct timespec *ts, usec_t u);
 
@@ -115,6 +139,7 @@ int get_timezones(char ***l);
 bool timezone_is_valid(const char *name);
 
 bool clock_boottime_supported(void);
+bool clock_supported(clockid_t clock);
 clockid_t clock_boottime_or_monotonic(void);
 
 #define xstrftime(buf, fmt, tm) \
diff --git a/src/libbasic/include/basic/unaligned.h b/src/libbasic/include/basic/unaligned.h
index 79be645bed..7c847a3ccb 100644
--- a/src/libbasic/include/basic/unaligned.h
+++ b/src/libbasic/include/basic/unaligned.h
@@ -109,3 +109,21 @@ static inline void unaligned_write_le64(void *_u, uint64_t a) {
         unaligned_write_le32(u, (uint32_t) a);
         unaligned_write_le32(u + 4, (uint32_t) (a >> 32));
 }
+
+#if __BYTE_ORDER == __BIG_ENDIAN
+#define unaligned_read_ne16 unaligned_read_be16
+#define unaligned_read_ne32 unaligned_read_be32
+#define unaligned_read_ne64 unaligned_read_be64
+
+#define unaligned_write_ne16 unaligned_write_be16
+#define unaligned_write_ne32 unaligned_write_be32
+#define unaligned_write_ne64 unaligned_write_be64
+#else
+#define unaligned_read_ne16 unaligned_read_le16
+#define unaligned_read_ne32 unaligned_read_le32
+#define unaligned_read_ne64 unaligned_read_le64
+
+#define unaligned_write_ne16 unaligned_write_le16
+#define unaligned_write_ne32 unaligned_write_le32
+#define unaligned_write_ne64 unaligned_write_le64
+#endif
diff --git a/src/libbasic/include/basic/unit-name.h b/src/libbasic/include/basic/unit-name.h
index f209a84634..44eadf0347 100644
--- a/src/libbasic/include/basic/unit-name.h
+++ b/src/libbasic/include/basic/unit-name.h
@@ -195,7 +195,6 @@ typedef enum SwapState {
         _SWAP_STATE_INVALID = -1
 } SwapState;
 
-
 typedef enum TargetState {
         TARGET_DEAD,
         TARGET_ACTIVE,
diff --git a/src/libbasic/include/basic/util.h b/src/libbasic/include/basic/util.h
index 1c032c15c9..44497dcd78 100644
--- a/src/libbasic/include/basic/util.h
+++ b/src/libbasic/include/basic/util.h
@@ -86,6 +86,7 @@ int prot_from_flags(int flags) _const_;
 int fork_agent(pid_t *pid, const int except[], unsigned n_except, const char *path, ...);
 
 bool in_initrd(void);
+void in_initrd_force(bool value);
 
 void *xbsearch_r(const void *key, const void *base, size_t nmemb, size_t size,
                  int (*compar) (const void *, const void *, void *),
@@ -175,14 +176,16 @@ static inline unsigned log2u_round_up(unsigned x) {
         return log2u(x - 1) + 1;
 }
 
-bool id128_is_valid(const char *s) _pure_;
-
 int container_get_leader(const char *machine, pid_t *pid);
 
 int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *userns_fd, int *root_fd);
 int namespace_enter(int pidns_fd, int mntns_fd, int netns_fd, int userns_fd, int root_fd);
 
 uint64_t physical_memory(void);
+uint64_t physical_memory_scale(uint64_t v, uint64_t max);
+
+uint64_t system_tasks_max(void);
+uint64_t system_tasks_max_scale(uint64_t v, uint64_t max);
 
 int update_reboot_parameter_and_warn(const char *param);
 
diff --git a/src/libbasic/src/Makefile b/src/libbasic/src/Makefile
index 19883d92a1..51fc9dfc84 100644
--- a/src/libbasic/src/Makefile
+++ b/src/libbasic/src/Makefile
@@ -29,6 +29,7 @@ noinst_LTLIBRARIES += \
 libbasic_la_SOURCES = \
 	src/basic/missing.h \
 	src/basic/missing_syscall.h \
+	src/basic/raw-clone.h \
 	src/basic/capability-util.c \
 	src/basic/capability-util.h \
 	src/basic/conf-files.c \
@@ -113,8 +114,6 @@ libbasic_la_SOURCES = \
 	src/basic/ordered-set.c \
 	src/basic/bitmap.c \
 	src/basic/bitmap.h \
-	src/basic/fdset.c \
-	src/basic/fdset.h \
 	src/basic/prioq.c \
 	src/basic/prioq.h \
 	src/basic/web-util.c \
diff --git a/src/libbasic/src/bitmap.c b/src/libbasic/src/bitmap.c
index 8645134022..0b6799ef5a 100644
--- a/src/libbasic/src/bitmap.c
+++ b/src/libbasic/src/bitmap.c
@@ -50,6 +50,23 @@ Bitmap *bitmap_new(void) {
         return new0(Bitmap, 1);
 }
 
+Bitmap *bitmap_copy(Bitmap *b) {
+        Bitmap *ret;
+
+        ret = bitmap_new();
+        if (!ret)
+                return NULL;
+
+        ret->bitmaps = newdup(uint64_t, b->bitmaps, b->n_bitmaps);
+        if (!ret->bitmaps) {
+                free(ret);
+                return NULL;
+        }
+
+        ret->n_bitmaps = ret->bitmaps_allocated = b->n_bitmaps;
+        return ret;
+}
+
 void bitmap_free(Bitmap *b) {
         if (!b)
                 return;
diff --git a/src/libbasic/src/calendarspec.c b/src/libbasic/src/calendarspec.c
index a70eb078c6..de5ef92f80 100644
--- a/src/libbasic/src/calendarspec.c
+++ b/src/libbasic/src/calendarspec.c
@@ -32,6 +32,8 @@
 #include "basic/parse-util.h"
 #include "basic/string-util.h"
 
+/* Longest valid date/time range is 1970..2199 */
+#define MAX_RANGE_LEN   230
 #define BITS_WEEKDAYS   127
 
 static void free_chain(CalendarComponent *c) {
@@ -200,7 +202,7 @@ static void format_weekdays(FILE *f, const CalendarSpec *c) {
         };
 
         int l, x;
-        bool need_colon = false;
+        bool need_comma = false;
 
         assert(f);
         assert(c);
@@ -211,10 +213,10 @@ static void format_weekdays(FILE *f, const CalendarSpec *c) {
                 if (c->weekdays_bits & (1 << x)) {
 
                         if (l < 0) {
-                                if (need_colon)
+                                if (need_comma)
                                         fputc(',', f);
                                 else
-                                        need_colon = true;
+                                        need_comma = true;
 
                                 fputs(days[x], f);
                                 l = x;
@@ -223,7 +225,7 @@ static void format_weekdays(FILE *f, const CalendarSpec *c) {
                 } else if (l >= 0) {
 
                         if (x > l + 1) {
-                                fputc(x > l + 2 ? '-' : ',', f);
+                                fputs(x > l + 2 ? ".." : ",", f);
                                 fputs(days[x-1], f);
                         }
 
@@ -232,7 +234,7 @@ static void format_weekdays(FILE *f, const CalendarSpec *c) {
         }
 
         if (l >= 0 && x > l + 1) {
-                fputc(x > l + 2 ? '-' : ',', f);
+                fputs(x > l + 2 ? ".." : ",", f);
                 fputs(days[x-1], f);
         }
 }
@@ -357,6 +359,7 @@ static int parse_weekdays(const char **p, CalendarSpec *c) {
                         skip = strlen(day_nr[i].name);
 
                         if ((*p)[skip] != '-' &&
+                            (*p)[skip] != '.' &&
                             (*p)[skip] != ',' &&
                             (*p)[skip] != ' ' &&
                             (*p)[skip] != 0)
@@ -394,7 +397,18 @@ static int parse_weekdays(const char **p, CalendarSpec *c) {
                         return 0;
                 }
 
-                if (**p == '-') {
+                if (**p == '.') {
+                        if (l >= 0)
+                                return -EINVAL;
+
+                        if ((*p)[1] != '.')
+                                return -EINVAL;
+
+                        l = day_nr[i].nr;
+                        *p += 1;
+
+                /* Support ranges with "-" for backwards compatibility */
+                } else if (**p == '-') {
                         if (l >= 0)
                                 return -EINVAL;
 
@@ -448,8 +462,26 @@ static int parse_component_decimal(const char **p, bool usec, unsigned long *res
         return 0;
 }
 
+static int const_chain(int value, CalendarComponent **c) {
+        CalendarComponent *cc = NULL;
+
+        assert(c);
+
+        cc = new0(CalendarComponent, 1);
+        if (!cc)
+                return -ENOMEM;
+
+        cc->value = value;
+        cc->repeat = 0;
+        cc->next = *c;
+
+        *c = cc;
+
+        return 0;
+}
+
 static int prepend_component(const char **p, bool usec, CalendarComponent **c) {
-        unsigned long value, repeat = 0;
+        unsigned long i, value, range_end, range_inc, repeat = 0;
         CalendarComponent *cc;
         int r;
         const char *e;
@@ -471,6 +503,30 @@ static int prepend_component(const char **p, bool usec, CalendarComponent **c) {
 
                 if (repeat == 0)
                         return -ERANGE;
+        } else if (e[0] == '.' && e[1] == '.') {
+                e += 2;
+                r = parse_component_decimal(&e, usec, &range_end);
+                if (r < 0)
+                        return r;
+
+                if (value >= range_end)
+                        return -EINVAL;
+
+                range_inc = usec ? USEC_PER_SEC : 1;
+
+                /* Don't allow impossibly large ranges... */
+                if (range_end - value >= MAX_RANGE_LEN * range_inc)
+                        return -EINVAL;
+
+                /* ...or ranges with only a single element */
+                if (range_end - value < range_inc)
+                        return -EINVAL;
+
+                for (i = value; i <= range_end; i += range_inc) {
+                        r = const_chain(i, c);
+                        if (r < 0)
+                                return r;
+                }
         }
 
         if (*e != 0 && *e != ' ' && *e != ',' && *e != '-' && *e != ':')
@@ -495,24 +551,6 @@ static int prepend_component(const char **p, bool usec, CalendarComponent **c) {
         return 0;
 }
 
-static int const_chain(int value, CalendarComponent **c) {
-        CalendarComponent *cc = NULL;
-
-        assert(c);
-
-        cc = new0(CalendarComponent, 1);
-        if (!cc)
-                return -ENOMEM;
-
-        cc->value = value;
-        cc->repeat = 0;
-        cc->next = *c;
-
-        *c = cc;
-
-        return 0;
-}
-
 static int parse_chain(const char **p, bool usec, CalendarComponent **c) {
         const char *t;
         CalendarComponent *cc = NULL;
diff --git a/src/libbasic/src/cgroup-util.c b/src/libbasic/src/cgroup-util.c
index 68c8aae540..c2abcd079d 100644
--- a/src/libbasic/src/cgroup-util.c
+++ b/src/libbasic/src/cgroup-util.c
@@ -197,7 +197,15 @@ int cg_rmdir(const char *controller, const char *path) {
         return 0;
 }
 
-int cg_kill(const char *controller, const char *path, int sig, bool sigcont, bool ignore_self, Set *s) {
+int cg_kill(
+                const char *controller,
+                const char *path,
+                int sig,
+                CGroupFlags flags,
+                Set *s,
+                cg_kill_log_func_t log_kill,
+                void *userdata) {
+
         _cleanup_set_free_ Set *allocated_set = NULL;
         bool done = false;
         int r, ret = 0;
@@ -205,6 +213,11 @@ int cg_kill(const char *controller, const char *path, int sig, bool sigcont, boo
 
         assert(sig >= 0);
 
+         /* Don't send SIGCONT twice. Also, SIGKILL always works even when process is suspended, hence don't send
+          * SIGCONT on SIGKILL. */
+        if (IN_SET(sig, SIGCONT, SIGKILL))
+                flags &= ~CGROUP_SIGCONT;
+
         /* This goes through the tasks list and kills them all. This
          * is repeated until no further processes are added to the
          * tasks list, to properly handle forking processes */
@@ -232,19 +245,22 @@ int cg_kill(const char *controller, const char *path, int sig, bool sigcont, boo
 
                 while ((r = cg_read_pid(f, &pid)) > 0) {
 
-                        if (ignore_self && pid == my_pid)
+                        if ((flags & CGROUP_IGNORE_SELF) && pid == my_pid)
                                 continue;
 
                         if (set_get(s, PID_TO_PTR(pid)) == PID_TO_PTR(pid))
                                 continue;
 
+                        if (log_kill)
+                                log_kill(pid, sig, userdata);
+
                         /* If we haven't killed this process yet, kill
                          * it */
                         if (kill(pid, sig) < 0) {
                                 if (ret >= 0 && errno != ESRCH)
                                         ret = -errno;
                         } else {
-                                if (sigcont && sig != SIGKILL)
+                                if (flags & CGROUP_SIGCONT)
                                         (void) kill(pid, SIGCONT);
 
                                 if (ret == 0)
@@ -278,7 +294,15 @@ int cg_kill(const char *controller, const char *path, int sig, bool sigcont, boo
         return ret;
 }
 
-int cg_kill_recursive(const char *controller, const char *path, int sig, bool sigcont, bool ignore_self, bool rem, Set *s) {
+int cg_kill_recursive(
+                const char *controller,
+                const char *path,
+                int sig,
+                CGroupFlags flags,
+                Set *s,
+                cg_kill_log_func_t log_kill,
+                void *userdata) {
+
         _cleanup_set_free_ Set *allocated_set = NULL;
         _cleanup_closedir_ DIR *d = NULL;
         int r, ret;
@@ -293,7 +317,7 @@ int cg_kill_recursive(const char *controller, const char *path, int sig, bool si
                         return -ENOMEM;
         }
 
-        ret = cg_kill(controller, path, sig, sigcont, ignore_self, s);
+        ret = cg_kill(controller, path, sig, flags, s, log_kill, userdata);
 
         r = cg_enumerate_subgroups(controller, path, &d);
         if (r < 0) {
@@ -311,15 +335,14 @@ int cg_kill_recursive(const char *controller, const char *path, int sig, bool si
                 if (!p)
                         return -ENOMEM;
 
-                r = cg_kill_recursive(controller, p, sig, sigcont, ignore_self, rem, s);
+                r = cg_kill_recursive(controller, p, sig, flags, s, log_kill, userdata);
                 if (r != 0 && ret >= 0)
                         ret = r;
         }
-
         if (ret >= 0 && r < 0)
                 ret = r;
 
-        if (rem) {
+        if (flags & CGROUP_REMOVE) {
                 r = cg_rmdir(controller, path);
                 if (r < 0 && ret >= 0 && r != -ENOENT && r != -EBUSY)
                         return r;
@@ -328,7 +351,13 @@ int cg_kill_recursive(const char *controller, const char *path, int sig, bool si
         return ret;
 }
 
-int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self) {
+int cg_migrate(
+                const char *cfrom,
+                const char *pfrom,
+                const char *cto,
+                const char *pto,
+                CGroupFlags flags) {
+
         bool done = false;
         _cleanup_set_free_ Set *s = NULL;
         int r, ret = 0;
@@ -363,7 +392,7 @@ int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char
                         /* This might do weird stuff if we aren't a
                          * single-threaded program. However, we
                          * luckily know we are not */
-                        if (ignore_self && pid == my_pid)
+                        if ((flags & CGROUP_IGNORE_SELF) && pid == my_pid)
                                 continue;
 
                         if (set_get(s, PID_TO_PTR(pid)) == PID_TO_PTR(pid))
@@ -411,8 +440,7 @@ int cg_migrate_recursive(
                 const char *pfrom,
                 const char *cto,
                 const char *pto,
-                bool ignore_self,
-                bool rem) {
+                CGroupFlags flags) {
 
         _cleanup_closedir_ DIR *d = NULL;
         int r, ret = 0;
@@ -423,7 +451,7 @@ int cg_migrate_recursive(
         assert(cto);
         assert(pto);
 
-        ret = cg_migrate(cfrom, pfrom, cto, pto, ignore_self);
+        ret = cg_migrate(cfrom, pfrom, cto, pto, flags);
 
         r = cg_enumerate_subgroups(cfrom, pfrom, &d);
         if (r < 0) {
@@ -441,7 +469,7 @@ int cg_migrate_recursive(
                 if (!p)
                         return -ENOMEM;
 
-                r = cg_migrate_recursive(cfrom, p, cto, pto, ignore_self, rem);
+                r = cg_migrate_recursive(cfrom, p, cto, pto, flags);
                 if (r != 0 && ret >= 0)
                         ret = r;
         }
@@ -449,7 +477,7 @@ int cg_migrate_recursive(
         if (r < 0 && ret >= 0)
                 ret = r;
 
-        if (rem) {
+        if (flags & CGROUP_REMOVE) {
                 r = cg_rmdir(cfrom, pfrom);
                 if (r < 0 && ret >= 0 && r != -ENOENT && r != -EBUSY)
                         return r;
@@ -463,8 +491,7 @@ int cg_migrate_recursive_fallback(
                 const char *pfrom,
                 const char *cto,
                 const char *pto,
-                bool ignore_self,
-                bool rem) {
+                CGroupFlags flags) {
 
         int r;
 
@@ -473,7 +500,7 @@ int cg_migrate_recursive_fallback(
         assert(cto);
         assert(pto);
 
-        r = cg_migrate_recursive(cfrom, pfrom, cto, pto, ignore_self, rem);
+        r = cg_migrate_recursive(cfrom, pfrom, cto, pto, flags);
         if (r < 0) {
                 char prefix[strlen(pto) + 1];
 
@@ -482,7 +509,7 @@ int cg_migrate_recursive_fallback(
                 PATH_FOREACH_PREFIX(prefix, pto) {
                         int q;
 
-                        q = cg_migrate_recursive(cfrom, pfrom, cto, prefix, ignore_self, rem);
+                        q = cg_migrate_recursive(cfrom, pfrom, cto, prefix, flags);
                         if (q >= 0)
                                 return q;
                 }
@@ -1955,7 +1982,7 @@ int cg_migrate_everywhere(CGroupMask supported, const char *from, const char *to
         int r = 0, unified;
 
         if (!path_equal(from, to))  {
-                r = cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, from, SYSTEMD_CGROUP_CONTROLLER, to, false, true);
+                r = cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, from, SYSTEMD_CGROUP_CONTROLLER, to, CGROUP_REMOVE);
                 if (r < 0)
                         return r;
         }
@@ -1979,7 +2006,7 @@ int cg_migrate_everywhere(CGroupMask supported, const char *from, const char *to
                 if (!p)
                         p = to;
 
-                (void) cg_migrate_recursive_fallback(SYSTEMD_CGROUP_CONTROLLER, to, cgroup_controller_to_string(c), p, false, false);
+                (void) cg_migrate_recursive_fallback(SYSTEMD_CGROUP_CONTROLLER, to, cgroup_controller_to_string(c), p, 0);
         }
 
         return 0;
diff --git a/src/libbasic/src/copy.c b/src/libbasic/src/copy.c
index 4053ac9c16..ed251f739a 100644
--- a/src/libbasic/src/copy.c
+++ b/src/libbasic/src/copy.c
@@ -169,7 +169,7 @@ int copy_bytes(int fdf, int fdt, uint64_t max_bytes, bool try_reflink) {
                 /* sendfile accepts at most SSIZE_MAX-offset bytes to copy,
                  * so reduce our maximum by the amount we already copied,
                  * but don't go below our copy buffer size, unless we are
-                 * close the the limit of bytes we are allowed to copy. */
+                 * close the limit of bytes we are allowed to copy. */
                 m = MAX(MIN(COPY_BUFFER_SIZE, max_bytes), m - n);
         }
 
diff --git a/src/libbasic/src/exit-status.c b/src/libbasic/src/exit-status.c
index c7af63e052..7bf5752b7b 100644
--- a/src/libbasic/src/exit-status.c
+++ b/src/libbasic/src/exit-status.c
@@ -38,8 +38,7 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {
                 return "FAILURE";
         }
 
-
-        if (level == EXIT_STATUS_SYSTEMD || level == EXIT_STATUS_LSB) {
+        if (IN_SET(level, EXIT_STATUS_SYSTEMD, EXIT_STATUS_LSB)) {
                 switch ((int) status) {
 
                 case EXIT_CHDIR:
@@ -189,13 +188,9 @@ bool is_clean_exit(int code, int status, ExitStatusSet *success_status) {
         /* If a daemon does not implement handlers for some of the
          * signals that's not considered an unclean shutdown */
         if (code == CLD_KILLED)
-                return
-                        status == SIGHUP ||
-                        status == SIGINT ||
-                        status == SIGTERM ||
-                        status == SIGPIPE ||
+                return IN_SET(status, SIGHUP, SIGINT, SIGTERM, SIGPIPE) ||
                         (success_status &&
-                        set_contains(success_status->signal, INT_TO_PTR(status)));
+                         set_contains(success_status->signal, INT_TO_PTR(status)));
 
         return false;
 }
@@ -207,15 +202,14 @@ bool is_clean_exit_lsb(int code, int status, ExitStatusSet *success_status) {
 
         return
                 code == CLD_EXITED &&
-                (status == EXIT_NOTINSTALLED || status == EXIT_NOTCONFIGURED);
+                IN_SET(status, EXIT_NOTINSTALLED, EXIT_NOTCONFIGURED);
 }
 
 void exit_status_set_free(ExitStatusSet *x) {
         assert(x);
 
-        set_free(x->status);
-        set_free(x->signal);
-        x->status = x->signal = NULL;
+        x->status = set_free(x->status);
+        x->signal = set_free(x->signal);
 }
 
 bool exit_status_set_is_empty(ExitStatusSet *x) {
diff --git a/src/libbasic/src/fd-util.c b/src/libbasic/src/fd-util.c
index 277a4c1075..1ac711e66d 100644
--- a/src/libbasic/src/fd-util.c
+++ b/src/libbasic/src/fd-util.c
@@ -186,6 +186,12 @@ int fd_cloexec(int fd, bool cloexec) {
         return 0;
 }
 
+void stdio_unset_cloexec(void) {
+        fd_cloexec(STDIN_FILENO, false);
+        fd_cloexec(STDOUT_FILENO, false);
+        fd_cloexec(STDERR_FILENO, false);
+}
+
 _pure_ static bool fd_in_set(int fd, const int fdset[], unsigned n_fdset) {
         unsigned i;
 
diff --git a/src/libbasic/src/fileio.c b/src/libbasic/src/fileio.c
index c784aaac54..02a9a02be8 100644
--- a/src/libbasic/src/fileio.c
+++ b/src/libbasic/src/fileio.c
@@ -1067,7 +1067,7 @@ int fflush_and_check(FILE *f) {
         return 0;
 }
 
-/* This is much like like mkostemp() but is subject to umask(). */
+/* This is much like mkostemp() but is subject to umask(). */
 int mkostemp_safe(char *pattern, int flags) {
         _cleanup_umask_ mode_t u = 0;
         int fd;
@@ -1259,7 +1259,8 @@ int open_tmpfile_unlinkable(const char *directory, int flags) {
         char *p;
         int fd;
 
-        assert(directory);
+        if (!directory)
+                directory = "/tmp";
 
         /* Returns an unlinked temporary file that cannot be linked into the file system anymore */
 
@@ -1354,3 +1355,44 @@ int link_tmpfile(int fd, const char *path, const char *target) {
 
         return 0;
 }
+
+int read_nul_string(FILE *f, char **ret) {
+        _cleanup_free_ char *x = NULL;
+        size_t allocated = 0, n = 0;
+
+        assert(f);
+        assert(ret);
+
+        /* Reads a NUL-terminated string from the specified file. */
+
+        for (;;) {
+                int c;
+
+                if (!GREEDY_REALLOC(x, allocated, n+2))
+                        return -ENOMEM;
+
+                c = fgetc(f);
+                if (c == 0) /* Terminate at NUL byte */
+                        break;
+                if (c == EOF) {
+                        if (ferror(f))
+                                return -errno;
+                        break; /* Terminate at EOF */
+                }
+
+                x[n++] = (char) c;
+        }
+
+        if (x)
+                x[n] = 0;
+        else {
+                x = new0(char, 1);
+                if (!x)
+                        return -ENOMEM;
+        }
+
+        *ret = x;
+        x = NULL;
+
+        return 0;
+}
diff --git a/src/libbasic/src/fs-util.c b/src/libbasic/src/fs-util.c
index 03b06fd2d8..cd56843f09 100644
--- a/src/libbasic/src/fs-util.c
+++ b/src/libbasic/src/fs-util.c
@@ -38,6 +38,7 @@
 #include "basic/mkdir.h"
 #include "basic/parse-util.h"
 #include "basic/path-util.h"
+#include "basic/stat-util.h"
 #include "basic/stdio-util.h"
 #include "basic/string-util.h"
 #include "basic/strv.h"
@@ -495,6 +496,34 @@ int get_files_in_directory(const char *path, char ***list) {
         return n;
 }
 
+int var_tmp(char **ret) {
+        const char *tmp_dir = NULL;
+        const char *env_tmp_dir = NULL;
+        char *c = NULL;
+        int r;
+
+        assert(ret);
+
+        env_tmp_dir = getenv("TMPDIR");
+        if (env_tmp_dir != NULL) {
+                r = is_dir(env_tmp_dir, true);
+                if (r < 0 && r != -ENOENT)
+                        return r;
+                if (r > 0)
+                        tmp_dir = env_tmp_dir;
+        }
+
+        if (!tmp_dir)
+                tmp_dir = "/var/tmp";
+
+        c = strdup(tmp_dir);
+        if (!c)
+                return -ENOMEM;
+        *ret = c;
+
+        return 0;
+}
+
 int inotify_add_watch_fd(int fd, int what, uint32_t mask) {
         char path[strlen("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];
         int r;
diff --git a/src/libbasic/src/hashmap.c b/src/libbasic/src/hashmap.c
index d0cdcc2534..cfd1c14878 100644
--- a/src/libbasic/src/hashmap.c
+++ b/src/libbasic/src/hashmap.c
@@ -1765,6 +1765,9 @@ void *ordered_hashmap_next(OrderedHashmap *h, const void *key) {
 int set_consume(Set *s, void *value) {
         int r;
 
+        assert(s);
+        assert(value);
+
         r = set_put(s, value);
         if (r <= 0)
                 free(value);
@@ -1792,6 +1795,8 @@ int set_put_strdupv(Set *s, char **l) {
         int n = 0, r;
         char **i;
 
+        assert(s);
+
         STRV_FOREACH(i, l) {
                 r = set_put_strdup(s, *i);
                 if (r < 0)
@@ -1802,3 +1807,23 @@ int set_put_strdupv(Set *s, char **l) {
 
         return n;
 }
+
+int set_put_strsplit(Set *s, const char *v, const char *separators, ExtractFlags flags) {
+        const char *p = v;
+        int r;
+
+        assert(s);
+        assert(v);
+
+        for (;;) {
+                char *word;
+
+                r = extract_first_word(&p, &word, separators, flags);
+                if (r <= 0)
+                        return r;
+
+                r = set_consume(s, word);
+                if (r < 0)
+                        return r;
+        }
+}
diff --git a/src/libbasic/src/in-addr-util.c b/src/libbasic/src/in-addr-util.c
index 7d648ce354..01fc83d6d9 100644
--- a/src/libbasic/src/in-addr-util.c
+++ b/src/libbasic/src/in-addr-util.c
@@ -20,26 +20,36 @@
 #include <arpa/inet.h>
 #include <endian.h>
 #include <errno.h>
+#include <net/if.h>
 #include <stdint.h>
 #include <stdlib.h>
 
 #include "basic/alloc-util.h"
 #include "basic/in-addr-util.h"
 #include "basic/macro.h"
+#include "basic/parse-util.h"
 #include "basic/util.h"
 
+bool in4_addr_is_null(const struct in_addr *a) {
+        return a->s_addr == 0;
+}
+
+bool in6_addr_is_null(const struct in6_addr *a) {
+        return
+                a->s6_addr32[0] == 0 &&
+                a->s6_addr32[1] == 0 &&
+                a->s6_addr32[2] == 0 &&
+                a->s6_addr32[3] == 0;
+}
+
 int in_addr_is_null(int family, const union in_addr_union *u) {
         assert(u);
 
         if (family == AF_INET)
-                return u->in.s_addr == 0;
+                return in4_addr_is_null(&u->in);
 
         if (family == AF_INET6)
-                return
-                        u->in6.s6_addr32[0] == 0 &&
-                        u->in6.s6_addr32[1] == 0 &&
-                        u->in6.s6_addr32[2] == 0 &&
-                        u->in6.s6_addr32[3] == 0;
+                return in6_addr_is_null(&u->in6);
 
         return -EAFNOSUPPORT;
 }
@@ -224,6 +234,48 @@ int in_addr_to_string(int family, const union in_addr_union *u, char **ret) {
         return 0;
 }
 
+int in_addr_ifindex_to_string(int family, const union in_addr_union *u, int ifindex, char **ret) {
+        size_t l;
+        char *x;
+        int r;
+
+        assert(u);
+        assert(ret);
+
+        /* Much like in_addr_to_string(), but optionally appends the zone interface index to the address, to properly
+         * handle IPv6 link-local addresses. */
+
+        if (family != AF_INET6)
+                goto fallback;
+        if (ifindex <= 0)
+                goto fallback;
+
+        r = in_addr_is_link_local(family, u);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                goto fallback;
+
+        l = INET6_ADDRSTRLEN + 1 + DECIMAL_STR_MAX(ifindex) + 1;
+        x = new(char, l);
+        if (!x)
+                return -ENOMEM;
+
+        errno = 0;
+        if (!inet_ntop(family, u, x, l)) {
+                free(x);
+                return errno > 0 ? -errno : -EINVAL;
+        }
+
+        sprintf(strchr(x, 0), "%%%i", ifindex);
+        *ret = x;
+
+        return 0;
+
+fallback:
+        return in_addr_to_string(family, u, ret);
+}
+
 int in_addr_from_string(int family, const char *s, union in_addr_union *ret) {
 
         assert(s);
@@ -261,6 +313,47 @@ int in_addr_from_string_auto(const char *s, int *family, union in_addr_union *re
         return -EINVAL;
 }
 
+int in_addr_ifindex_from_string_auto(const char *s, int *family, union in_addr_union *ret, int *ifindex) {
+        const char *suffix;
+        int r, ifi = 0;
+
+        assert(s);
+        assert(family);
+        assert(ret);
+
+        /* Similar to in_addr_from_string_auto() but also parses an optionally appended IPv6 zone suffix ("scope id")
+         * if one is found. */
+
+        suffix = strchr(s, '%');
+        if (suffix) {
+
+                if (ifindex) {
+                        /* If we shall return the interface index, try to parse it */
+                        r = parse_ifindex(suffix + 1, &ifi);
+                        if (r < 0) {
+                                unsigned u;
+
+                                u = if_nametoindex(suffix + 1);
+                                if (u <= 0)
+                                        return -errno;
+
+                                ifi = (int) u;
+                        }
+                }
+
+                s = strndupa(s, suffix - s);
+        }
+
+        r = in_addr_from_string_auto(s, family, ret);
+        if (r < 0)
+                return r;
+
+        if (ifindex)
+                *ifindex = ifi;
+
+        return r;
+}
+
 unsigned char in_addr_netmask_to_prefixlen(const struct in_addr *addr) {
         assert(addr);
 
diff --git a/src/libbasic/src/log.c b/src/libbasic/src/log.c
index 6028cc7a27..84a65b7d54 100644
--- a/src/libbasic/src/log.c
+++ b/src/libbasic/src/log.c
@@ -334,7 +334,7 @@ static int write_to_console(
                 const char *object,
                 const char *buffer) {
 
-        char location[64], prefix[1 + DECIMAL_STR_MAX(int) + 2];
+        char location[256], prefix[1 + DECIMAL_STR_MAX(int) + 2];
         struct iovec iovec[6] = {};
         unsigned n = 0;
         bool highlight;
@@ -350,7 +350,7 @@ static int write_to_console(
         highlight = LOG_PRI(level) <= LOG_ERR && show_color;
 
         if (show_location) {
-                xsprintf(location, "(%s:%i) ", file, line);
+                snprintf(location, sizeof(location), "(%s:%i) ", file, line);
                 IOVEC_SET_STRING(iovec[n++], location);
         }
 
diff --git a/src/libbasic/src/mount-util.c b/src/libbasic/src/mount-util.c
index 274ec9d29c..feb75a2c04 100644
--- a/src/libbasic/src/mount-util.c
+++ b/src/libbasic/src/mount-util.c
@@ -104,7 +104,7 @@ int fd_is_mount_point(int fd, const char *filename, int flags) {
          *
          * As last fallback we do traditional fstat() based st_dev
          * comparisons. This is how things were traditionally done,
-         * but unionfs breaks breaks this since it exposes file
+         * but unionfs breaks this since it exposes file
          * systems with a variety of st_dev reported. Also, btrfs
          * subvolumes have different st_dev, even though they aren't
          * real mounts of their own. */
@@ -448,21 +448,21 @@ int bind_remount_recursive(const char *prefix, bool ro) {
                         if (r < 0)
                                 return r;
 
-                        /* Try to reuse the original flag set, but
-                         * don't care for errors, in case of
-                         * obstructed mounts */
+                        /* Deal with mount points that are obstructed by a
+                         * later mount */
+                        r = path_is_mount_point(x, 0);
+                        if (r == -ENOENT || r == 0)
+                                continue;
+                        if (r < 0)
+                                return r;
+
+                        /* Try to reuse the original flag set */
                         orig_flags = 0;
                         (void) get_mount_flags(x, &orig_flags);
                         orig_flags &= ~MS_RDONLY;
 
-                        if (mount(NULL, x, NULL, orig_flags|MS_BIND|MS_REMOUNT|(ro ? MS_RDONLY : 0), NULL) < 0) {
-
-                                /* Deal with mount points that are
-                                 * obstructed by a later mount */
-
-                                if (errno != ENOENT)
-                                        return -errno;
-                        }
+                        if (mount(NULL, x, NULL, orig_flags|MS_BIND|MS_REMOUNT|(ro ? MS_RDONLY : 0), NULL) < 0)
+                                return -errno;
 
                 }
         }
@@ -500,6 +500,7 @@ bool fstype_is_network(const char *fstype) {
                 "gfs2\0"
                 "glusterfs\0"
                 "pvfs2\0" /* OrangeFS */
+                "ocfs2\0"
                 ;
 
         const char *x;
@@ -531,3 +532,28 @@ int repeat_unmount(const char *path, int flags) {
                 done = true;
         }
 }
+
+const char* mode_to_inaccessible_node(mode_t mode) {
+        /* This function maps a node type to the correspondent inaccessible node type.
+         * Character and block inaccessible devices may not be created (because major=0 and minor=0),
+         * in such case we map character and block devices to the inaccessible node type socket. */
+        switch(mode & S_IFMT) {
+                case S_IFREG:
+                        return "/run/systemd/inaccessible/reg";
+                case S_IFDIR:
+                        return "/run/systemd/inaccessible/dir";
+                case S_IFCHR:
+                        if (access("/run/systemd/inaccessible/chr", F_OK) == 0)
+                                return "/run/systemd/inaccessible/chr";
+                        return "/run/systemd/inaccessible/sock";
+                case S_IFBLK:
+                        if (access("/run/systemd/inaccessible/blk", F_OK) == 0)
+                                return "/run/systemd/inaccessible/blk";
+                        return "/run/systemd/inaccessible/sock";
+                case S_IFIFO:
+                        return "/run/systemd/inaccessible/fifo";
+                case S_IFSOCK:
+                        return "/run/systemd/inaccessible/sock";
+        }
+        return NULL;
+}
diff --git a/src/libbasic/src/parse-util.c b/src/libbasic/src/parse-util.c
index b6a99c7cdb..08e555d870 100644
--- a/src/libbasic/src/parse-util.c
+++ b/src/libbasic/src/parse-util.c
@@ -532,3 +532,22 @@ int parse_fractional_part_u(const char **p, size_t digits, unsigned *res) {
 
         return 0;
 }
+
+int parse_percent(const char *p) {
+        const char *pc, *n;
+        unsigned v;
+        int r;
+
+        pc = endswith(p, "%");
+        if (!pc)
+                return -EINVAL;
+
+        n = strndupa(p, pc - p);
+        r = safe_atou(n, &v);
+        if (r < 0)
+                return r;
+        if (v > 100)
+                return -ERANGE;
+
+        return (int) v;
+}
diff --git a/src/libbasic/src/proc-cmdline.c b/src/libbasic/src/proc-cmdline.c
index e35a21ac0d..db2acbee75 100644
--- a/src/libbasic/src/proc-cmdline.c
+++ b/src/libbasic/src/proc-cmdline.c
@@ -160,17 +160,29 @@ static const char * const rlmap[] = {
         "3",         SPECIAL_MULTI_USER_TARGET,
         "4",         SPECIAL_MULTI_USER_TARGET,
         "5",         SPECIAL_GRAPHICAL_TARGET,
+        NULL
+};
+
+static const char * const rlmap_initrd[] = {
+        "emergency", SPECIAL_EMERGENCY_TARGET,
+        "rescue",    SPECIAL_RESCUE_TARGET,
+        NULL
 };
 
 const char* runlevel_to_target(const char *word) {
         size_t i;
+        const char * const *rlmap_ptr = in_initrd() ? rlmap_initrd
+                                                    : rlmap;
 
         if (!word)
                 return NULL;
 
-        for (i = 0; i < ELEMENTSOF(rlmap); i += 2)
-                if (streq(word, rlmap[i]))
-                        return rlmap[i+1];
+        if (in_initrd() && (word = startswith(word, "rd.")) == NULL)
+                return NULL;
+
+        for (i = 0; rlmap_ptr[i] != NULL; i += 2)
+                if (streq(word, rlmap_ptr[i]))
+                        return rlmap_ptr[i+1];
 
         return NULL;
 }
diff --git a/src/libbasic/src/process-util.c b/src/libbasic/src/process-util.c
index fcda02b7a9..5dd5279374 100644
--- a/src/libbasic/src/process-util.c
+++ b/src/libbasic/src/process-util.c
@@ -49,6 +49,7 @@
 #include "basic/macro.h"
 #include "basic/missing.h"
 #include "basic/process-util.h"
+#include "basic/raw-clone.h"
 #include "basic/signal-util.h"
 #include "basic/stat-util.h"
 #include "basic/string-table.h"
@@ -102,6 +103,7 @@ int get_process_comm(pid_t pid, char **name) {
 
 int get_process_cmdline(pid_t pid, size_t max_length, bool comm_fallback, char **line) {
         _cleanup_fclose_ FILE *f = NULL;
+        bool space = false;
         char *r = NULL, *k;
         const char *p;
         int c;
@@ -109,6 +111,15 @@ int get_process_cmdline(pid_t pid, size_t max_length, bool comm_fallback, char *
         assert(line);
         assert(pid >= 0);
 
+        /* Retrieves a process' command line. Replaces unprintable characters while doing so by whitespace (coalescing
+         * multiple sequential ones into one). If max_length is != 0 will return a string of the specified size at most
+         * (the trailing NUL byte does count towards the length here!), abbreviated with a "..." ellipsis. If
+         * comm_fallback is true and the process has no command line set (the case for kernel threads), or has a
+         * command line that resolves to the empty string will return the "comm" name of the process instead.
+         *
+         * Returns -ESRCH if the process doesn't exist, and -ENOENT if the process has no command line (and
+         * comm_fallback is false). */
+
         p = procfs_file_alloca(pid, "cmdline");
 
         f = fopen(p, "re");
@@ -118,24 +129,44 @@ int get_process_cmdline(pid_t pid, size_t max_length, bool comm_fallback, char *
                 return -errno;
         }
 
-        if (max_length == 0) {
+        if (max_length == 1) {
+
+                /* If there's only room for one byte, return the empty string */
+                r = new0(char, 1);
+                if (!r)
+                        return -ENOMEM;
+
+                *line = r;
+                return 0;
+
+        } else if (max_length == 0) {
                 size_t len = 0, allocated = 0;
 
                 while ((c = getc(f)) != EOF) {
 
-                        if (!GREEDY_REALLOC(r, allocated, len+2)) {
+                        if (!GREEDY_REALLOC(r, allocated, len+3)) {
                                 free(r);
                                 return -ENOMEM;
                         }
 
-                        r[len++] = isprint(c) ? c : ' ';
-                }
+                        if (isprint(c)) {
+                                if (space) {
+                                        r[len++] = ' ';
+                                        space = false;
+                                }
+
+                                r[len++] = c;
+                        } else if (len > 0)
+                                space = true;
+               }
 
                 if (len > 0)
-                        r[len-1] = 0;
+                        r[len] = 0;
+                else
+                        r = mfree(r);
 
         } else {
-                bool space = false;
+                bool dotdotdot = false;
                 size_t left;
 
                 r = new(char, max_length);
@@ -147,28 +178,46 @@ int get_process_cmdline(pid_t pid, size_t max_length, bool comm_fallback, char *
                 while ((c = getc(f)) != EOF) {
 
                         if (isprint(c)) {
+
                                 if (space) {
-                                        if (left <= 4)
+                                        if (left <= 2) {
+                                                dotdotdot = true;
                                                 break;
+                                        }
 
                                         *(k++) = ' ';
                                         left--;
                                         space = false;
                                 }
 
-                                if (left <= 4)
+                                if (left <= 1) {
+                                        dotdotdot = true;
                                         break;
+                                }
 
                                 *(k++) = (char) c;
                                 left--;
-                        }  else
+                        } else if (k > r)
                                 space = true;
                 }
 
-                if (left <= 4) {
-                        size_t n = MIN(left-1, 3U);
-                        memcpy(k, "...", n);
-                        k[n] = 0;
+                if (dotdotdot) {
+                        if (max_length <= 4) {
+                                k = r;
+                                left = max_length;
+                        } else {
+                                k = r + max_length - 4;
+                                left = 4;
+
+                                /* Eat up final spaces */
+                                while (k > r && isspace(k[-1])) {
+                                        k--;
+                                        left++;
+                                }
+                        }
+
+                        strncpy(k, "...", left-1);
+                        k[left-1] = 0;
                 } else
                         *k = 0;
         }
@@ -187,7 +236,37 @@ int get_process_cmdline(pid_t pid, size_t max_length, bool comm_fallback, char *
                 if (h < 0)
                         return h;
 
-                r = strjoin("[", t, "]", NULL);
+                if (max_length == 0)
+                        r = strjoin("[", t, "]", NULL);
+                else {
+                        size_t l;
+
+                        l = strlen(t);
+
+                        if (l + 3 <= max_length)
+                                r = strjoin("[", t, "]", NULL);
+                        else if (max_length <= 6) {
+
+                                r = new(char, max_length);
+                                if (!r)
+                                        return -ENOMEM;
+
+                                memcpy(r, "[...]", max_length-1);
+                                r[max_length-1] = 0;
+                        } else {
+                                char *e;
+
+                                t[max_length - 6] = 0;
+
+                                /* Chop off final spaces */
+                                e = strchr(t, 0);
+                                while (e > t && isspace(e[-1]))
+                                        e--;
+                                *e = 0;
+
+                                r = strjoin("[", t, "...]", NULL);
+                        }
+                }
                 if (!r)
                         return -ENOMEM;
         }
@@ -317,9 +396,6 @@ static int get_process_id(pid_t pid, const char *field, uid_t *uid) {
         assert(field);
         assert(uid);
 
-        if (pid == 0)
-                return getuid();
-
         p = procfs_file_alloca(pid, "status");
         f = fopen(p, "re");
         if (!f) {
@@ -478,7 +554,7 @@ int wait_for_terminate(pid_t pid, siginfo_t *status) {
                         if (errno == EINTR)
                                 continue;
 
-                        return -errno;
+                        return negative_errno();
                 }
 
                 return 0;
@@ -550,8 +626,10 @@ int kill_and_sigcont(pid_t pid, int sig) {
 
         r = kill(pid, sig) < 0 ? -errno : 0;
 
-        if (r >= 0)
-                kill(pid, SIGCONT);
+        /* If this worked, also send SIGCONT, unless we already just sent a SIGCONT, or SIGKILL was sent which isn't
+         * affected by a process being suspended anyway. */
+        if (r >= 0 && !IN_SET(SIGCONT, SIGKILL))
+                (void) kill(pid, SIGCONT);
 
         return r;
 }
@@ -727,7 +805,7 @@ void valgrind_summary_hack(void) {
 #ifdef HAVE_VALGRIND_VALGRIND_H
         if (getpid() == 1 && RUNNING_ON_VALGRIND) {
                 pid_t pid;
-                pid = raw_clone(SIGCHLD, NULL);
+                pid = raw_clone(SIGCHLD);
                 if (pid < 0)
                         log_emergency_errno(errno, "Failed to fork off valgrind helper: %m");
                 else if (pid == 0)
diff --git a/src/libbasic/src/random-util.c b/src/libbasic/src/random-util.c
index f5b7e54a68..585e7976ac 100644
--- a/src/libbasic/src/random-util.c
+++ b/src/libbasic/src/random-util.c
@@ -47,7 +47,7 @@ int dev_urandom(void *p, size_t n) {
          * never block, and will always return some data from the
          * kernel, regardless if the random pool is fully initialized
          * or not. It thus makes no guarantee for the quality of the
-         * returned entropy, but is good enough for or usual usecases
+         * returned entropy, but is good enough for our usual usecases
          * of seeding the hash functions for hashtable */
 
         /* Use the getrandom() syscall unless we know we don't have
diff --git a/src/libbasic/src/selinux-util.c b/src/libbasic/src/selinux-util.c
index 34d2dcdccf..d9d230c189 100644
--- a/src/libbasic/src/selinux-util.c
+++ b/src/libbasic/src/selinux-util.c
@@ -41,10 +41,10 @@
 #include "basic/util.h"
 
 #ifdef HAVE_SELINUX
-DEFINE_TRIVIAL_CLEANUP_FUNC(security_context_t, freecon);
+DEFINE_TRIVIAL_CLEANUP_FUNC(char*, freecon);
 DEFINE_TRIVIAL_CLEANUP_FUNC(context_t, context_free);
 
-#define _cleanup_security_context_free_ _cleanup_(freeconp)
+#define _cleanup_freecon_ _cleanup_(freeconp)
 #define _cleanup_context_free_ _cleanup_(context_freep)
 
 static int cached_use = -1;
@@ -143,7 +143,7 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
 
         r = lstat(path, &st);
         if (r >= 0) {
-                _cleanup_security_context_free_ security_context_t fcon = NULL;
+                _cleanup_freecon_ char* fcon = NULL;
 
                 r = selabel_lookup_raw(label_hnd, &fcon, path, st.st_mode);
 
@@ -186,7 +186,7 @@ int mac_selinux_apply(const char *path, const char *label) {
         assert(path);
         assert(label);
 
-        if (setfilecon(path, (security_context_t) label) < 0) {
+        if (setfilecon(path, label) < 0) {
                 log_enforcing("Failed to set SELinux security context %s on path %s: %m", label, path);
                 if (security_getenforce() > 0)
                         return -errno;
@@ -199,7 +199,7 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
         int r = -EOPNOTSUPP;
 
 #ifdef HAVE_SELINUX
-        _cleanup_security_context_free_ security_context_t mycon = NULL, fcon = NULL;
+        _cleanup_freecon_ char *mycon = NULL, *fcon = NULL;
         security_class_t sclass;
 
         assert(exe);
@@ -217,7 +217,7 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
                 return -errno;
 
         sclass = string_to_security_class("process");
-        r = security_compute_create_raw(mycon, fcon, sclass, (security_context_t *) label);
+        r = security_compute_create_raw(mycon, fcon, sclass, label);
         if (r < 0)
                 return -errno;
 #endif
@@ -246,7 +246,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
         int r = -EOPNOTSUPP;
 
 #ifdef HAVE_SELINUX
-        _cleanup_security_context_free_ security_context_t mycon = NULL, peercon = NULL, fcon = NULL;
+        _cleanup_freecon_ char *mycon = NULL, *peercon = NULL, *fcon = NULL;
         _cleanup_context_free_ context_t pcon = NULL, bcon = NULL;
         security_class_t sclass;
         const char *range = NULL;
@@ -296,7 +296,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
                 return -ENOMEM;
 
         sclass = string_to_security_class("process");
-        r = security_compute_create_raw(mycon, fcon, sclass, (security_context_t *) label);
+        r = security_compute_create_raw(mycon, fcon, sclass, label);
         if (r < 0)
                 return -errno;
 #endif
@@ -314,7 +314,7 @@ char* mac_selinux_free(char *label) {
                 return NULL;
 
 
-        freecon((security_context_t) label);
+        freecon(label);
 #endif
 
         return NULL;
@@ -323,7 +323,7 @@ char* mac_selinux_free(char *label) {
 int mac_selinux_create_file_prepare(const char *path, mode_t mode) {
 
 #ifdef HAVE_SELINUX
-        _cleanup_security_context_free_ security_context_t filecon = NULL;
+        _cleanup_freecon_ char *filecon = NULL;
         int r;
 
         assert(path);
@@ -383,7 +383,7 @@ int mac_selinux_create_socket_prepare(const char *label) {
 
         assert(label);
 
-        if (setsockcreatecon((security_context_t) label) < 0) {
+        if (setsockcreatecon(label) < 0) {
                 log_enforcing("Failed to set SELinux security context %s for sockets: %m", label);
 
                 if (security_getenforce() == 1)
@@ -411,7 +411,7 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
         /* Binds a socket and label its file system object according to the SELinux policy */
 
 #ifdef HAVE_SELINUX
-        _cleanup_security_context_free_ security_context_t fcon = NULL;
+        _cleanup_freecon_ char *fcon = NULL;
         const struct sockaddr_un *un;
         bool context_changed = false;
         char *path;
diff --git a/src/libbasic/src/siphash24.c b/src/libbasic/src/siphash24.c
index 8fbc05b435..f67eff4761 100644
--- a/src/libbasic/src/siphash24.c
+++ b/src/libbasic/src/siphash24.c
@@ -17,6 +17,8 @@
     coding style)
 */
 
+#include <stdio.h>
+
 #include "basic/macro.h"
 #include "basic/siphash24.h"
 #include "basic/unaligned.h"
diff --git a/src/libbasic/src/socket-util.c b/src/libbasic/src/socket-util.c
index 9e1bf1d91d..250d58dfc6 100644
--- a/src/libbasic/src/socket-util.c
+++ b/src/libbasic/src/socket-util.c
@@ -85,7 +85,7 @@ int socket_address_parse(SocketAddress *a, const char *s) {
                         return -EINVAL;
 
                 a->sockaddr.in6.sin6_family = AF_INET6;
-                a->sockaddr.in6.sin6_port = htons((uint16_t) u);
+                a->sockaddr.in6.sin6_port = htobe16((uint16_t)u);
                 a->size = sizeof(struct sockaddr_in6);
 
         } else if (*s == '/') {
@@ -133,7 +133,7 @@ int socket_address_parse(SocketAddress *a, const char *s) {
                         if (r > 0) {
                                 /* Gotcha, it's a traditional IPv4 address */
                                 a->sockaddr.in.sin_family = AF_INET;
-                                a->sockaddr.in.sin_port = htons((uint16_t) u);
+                                a->sockaddr.in.sin_port = htobe16((uint16_t)u);
                                 a->size = sizeof(struct sockaddr_in);
                         } else {
                                 unsigned idx;
@@ -147,7 +147,7 @@ int socket_address_parse(SocketAddress *a, const char *s) {
                                         return -EINVAL;
 
                                 a->sockaddr.in6.sin6_family = AF_INET6;
-                                a->sockaddr.in6.sin6_port = htons((uint16_t) u);
+                                a->sockaddr.in6.sin6_port = htobe16((uint16_t)u);
                                 a->sockaddr.in6.sin6_scope_id = idx;
                                 a->sockaddr.in6.sin6_addr = in6addr_any;
                                 a->size = sizeof(struct sockaddr_in6);
@@ -164,12 +164,12 @@ int socket_address_parse(SocketAddress *a, const char *s) {
 
                         if (socket_ipv6_is_supported()) {
                                 a->sockaddr.in6.sin6_family = AF_INET6;
-                                a->sockaddr.in6.sin6_port = htons((uint16_t) u);
+                                a->sockaddr.in6.sin6_port = htobe16((uint16_t)u);
                                 a->sockaddr.in6.sin6_addr = in6addr_any;
                                 a->size = sizeof(struct sockaddr_in6);
                         } else {
                                 a->sockaddr.in.sin_family = AF_INET;
-                                a->sockaddr.in.sin_port = htons((uint16_t) u);
+                                a->sockaddr.in.sin_port = htobe16((uint16_t)u);
                                 a->sockaddr.in.sin_addr.s_addr = INADDR_ANY;
                                 a->size = sizeof(struct sockaddr_in);
                         }
@@ -488,9 +488,7 @@ int sockaddr_port(const struct sockaddr *_sa) {
         if (!IN_SET(sa->sa.sa_family, AF_INET, AF_INET6))
                 return -EAFNOSUPPORT;
 
-        return ntohs(sa->sa.sa_family == AF_INET6 ?
-                       sa->in6.sin6_port :
-                       sa->in.sin_port);
+        return be16toh(sa->sa.sa_family == AF_INET6 ? sa->in6.sin6_port : sa->in.sin_port);
 }
 
 int sockaddr_pretty(const struct sockaddr *_sa, socklen_t salen, bool translate_ipv6, bool include_port, char **ret) {
@@ -506,13 +504,13 @@ int sockaddr_pretty(const struct sockaddr *_sa, socklen_t salen, bool translate_
         case AF_INET: {
                 uint32_t a;
 
-                a = ntohl(sa->in.sin_addr.s_addr);
+                a = be32toh(sa->in.sin_addr.s_addr);
 
                 if (include_port)
                         r = asprintf(&p,
                                      "%u.%u.%u.%u:%u",
                                      a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
-                                     ntohs(sa->in.sin_port));
+                                     be16toh(sa->in.sin_port));
                 else
                         r = asprintf(&p,
                                      "%u.%u.%u.%u",
@@ -534,7 +532,7 @@ int sockaddr_pretty(const struct sockaddr *_sa, socklen_t salen, bool translate_
                                 r = asprintf(&p,
                                              "%u.%u.%u.%u:%u",
                                              a[0], a[1], a[2], a[3],
-                                             ntohs(sa->in6.sin6_port));
+                                             be16toh(sa->in6.sin6_port));
                         else
                                 r = asprintf(&p,
                                              "%u.%u.%u.%u",
@@ -550,7 +548,7 @@ int sockaddr_pretty(const struct sockaddr *_sa, socklen_t salen, bool translate_
                                 r = asprintf(&p,
                                              "[%s]:%u",
                                              a,
-                                             ntohs(sa->in6.sin6_port));
+                                             be16toh(sa->in6.sin6_port));
                                 if (r < 0)
                                         return -ENOMEM;
                         } else {
@@ -988,7 +986,7 @@ ssize_t next_datagram_size_fd(int fd) {
 
         l = recv(fd, NULL, 0, MSG_PEEK|MSG_TRUNC);
         if (l < 0) {
-                if (errno == EOPNOTSUPP)
+                if (errno == EOPNOTSUPP || errno == EFAULT)
                         goto fallback;
 
                 return -errno;
diff --git a/src/libbasic/src/strv.c b/src/libbasic/src/strv.c
index aadbef953c..bb4f49277d 100644
--- a/src/libbasic/src/strv.c
+++ b/src/libbasic/src/strv.c
@@ -139,16 +139,16 @@ char **strv_new_ap(const char *x, va_list ap) {
         va_list aq;
 
         /* As a special trick we ignore all listed strings that equal
-         * (const char*) -1. This is supposed to be used with the
+         * STRV_IGNORE. This is supposed to be used with the
          * STRV_IFNOTNULL() macro to include possibly NULL strings in
          * the string list. */
 
         if (x) {
-                n = x == (const char*) -1 ? 0 : 1;
+                n = x == STRV_IGNORE ? 0 : 1;
 
                 va_copy(aq, ap);
                 while ((s = va_arg(aq, const char*))) {
-                        if (s == (const char*) -1)
+                        if (s == STRV_IGNORE)
                                 continue;
 
                         n++;
@@ -162,7 +162,7 @@ char **strv_new_ap(const char *x, va_list ap) {
                 return NULL;
 
         if (x) {
-                if (x != (const char*) -1) {
+                if (x != STRV_IGNORE) {
                         a[i] = strdup(x);
                         if (!a[i])
                                 goto fail;
@@ -171,7 +171,7 @@ char **strv_new_ap(const char *x, va_list ap) {
 
                 while ((s = va_arg(ap, const char*))) {
 
-                        if (s == (const char*) -1)
+                        if (s == STRV_IGNORE)
                                 continue;
 
                         a[i] = strdup(s);
@@ -638,6 +638,17 @@ char **strv_remove(char **l, const char *s) {
 }
 
 char **strv_parse_nulstr(const char *s, size_t l) {
+        /* l is the length of the input data, which will be split at NULs into
+         * elements of the resulting strv. Hence, the number of items in the resulting strv
+         * will be equal to one plus the number of NUL bytes in the l bytes starting at s,
+         * unless s[l-1] is NUL, in which case the final empty string is not stored in
+         * the resulting strv, and length is equal to the number of NUL bytes.
+         *
+         * Note that contrary to a normal nulstr which cannot contain empty strings, because
+         * the input data is terminated by any two consequent NUL bytes, this parser accepts
+         * empty strings in s.
+         */
+
         const char *p;
         unsigned c = 0, i = 0;
         char **v;
@@ -700,6 +711,13 @@ char **strv_split_nulstr(const char *s) {
 }
 
 int strv_make_nulstr(char **l, char **p, size_t *q) {
+        /* A valid nulstr with two NULs at the end will be created, but
+         * q will be the length without the two trailing NULs. Thus the output
+         * string is a valid nulstr and can be iterated over using NULSTR_FOREACH,
+         * and can also be parsed by strv_parse_nulstr as long as the length
+         * is provided separately.
+         */
+
         size_t n_allocated = 0, n = 0;
         _cleanup_free_ char *m = NULL;
         char **i;
@@ -712,7 +730,7 @@ int strv_make_nulstr(char **l, char **p, size_t *q) {
 
                 z = strlen(*i);
 
-                if (!GREEDY_REALLOC(m, n_allocated, n + z + 1))
+                if (!GREEDY_REALLOC(m, n_allocated, n + z + 2))
                         return -ENOMEM;
 
                 memcpy(m + n, *i, z + 1);
@@ -723,11 +741,14 @@ int strv_make_nulstr(char **l, char **p, size_t *q) {
                 m = new0(char, 1);
                 if (!m)
                         return -ENOMEM;
-                n = 0;
-        }
+                n = 1;
+        } else
+                /* make sure there is a second extra NUL at the end of resulting nulstr */
+                m[n] = '\0';
 
+        assert(n > 0);
         *p = m;
-        *q = n;
+        *q = n - 1;
 
         m = NULL;
 
@@ -803,13 +824,8 @@ char **strv_reverse(char **l) {
         if (n <= 1)
                 return l;
 
-        for (i = 0; i < n / 2; i++) {
-                char *t;
-
-                t = l[i];
-                l[i] = l[n-1-i];
-                l[n-1-i] = t;
-        }
+        for (i = 0; i < n / 2; i++)
+                SWAP_TWO(l[i], l[n-1-i]);
 
         return l;
 }
@@ -838,7 +854,7 @@ bool strv_fnmatch(char* const* patterns, const char *s, int flags) {
         char* const* p;
 
         STRV_FOREACH(p, patterns)
-                if (fnmatch(*p, s, 0) == 0)
+                if (fnmatch(*p, s, flags) == 0)
                         return true;
 
         return false;
@@ -880,7 +896,7 @@ int strv_extend_n(char ***l, const char *value, size_t n) {
         if (n == 0)
                 return 0;
 
-        /* Adds the value value n times to l */
+        /* Adds the value n times to l */
 
         k = strv_length(*l);
 
diff --git a/src/libbasic/src/terminal-util.c b/src/libbasic/src/terminal-util.c
index 45b7864a2f..225ffa588a 100644
--- a/src/libbasic/src/terminal-util.c
+++ b/src/libbasic/src/terminal-util.c
@@ -51,6 +51,7 @@
 #include "basic/socket-util.h"
 #include "basic/stat-util.h"
 #include "basic/string-util.h"
+#include "basic/strv.h"
 #include "basic/terminal-util.h"
 #include "basic/time-util.h"
 #include "basic/util.h"
@@ -155,14 +156,14 @@ int ask_char(char *ret, const char *replies, const char *text, ...) {
                 char c;
                 bool need_nl = true;
 
-                if (on_tty())
+                if (colors_enabled())
                         fputs(ANSI_HIGHLIGHT, stdout);
 
                 va_start(ap, text);
                 vprintf(text, ap);
                 va_end(ap);
 
-                if (on_tty())
+                if (colors_enabled())
                         fputs(ANSI_NORMAL, stdout);
 
                 fflush(stdout);
@@ -199,14 +200,14 @@ int ask_string(char **ret, const char *text, ...) {
                 char line[LINE_MAX];
                 va_list ap;
 
-                if (on_tty())
+                if (colors_enabled())
                         fputs(ANSI_HIGHLIGHT, stdout);
 
                 va_start(ap, text);
                 vprintf(text, ap);
                 va_end(ap);
 
-                if (on_tty())
+                if (colors_enabled())
                         fputs(ANSI_NORMAL, stdout);
 
                 fflush(stdout);
@@ -709,6 +710,64 @@ char *resolve_dev_console(char **active) {
         return tty;
 }
 
+int get_kernel_consoles(char ***consoles) {
+        _cleanup_strv_free_ char **con = NULL;
+        _cleanup_free_ char *line = NULL;
+        const char *active;
+        int r;
+
+        assert(consoles);
+
+        r = read_one_line_file("/sys/class/tty/console/active", &line);
+        if (r < 0)
+                return r;
+
+        active = line;
+        for (;;) {
+                _cleanup_free_ char *tty = NULL;
+                char *path;
+
+                r = extract_first_word(&active, &tty, NULL, 0);
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        break;
+
+                if (streq(tty, "tty0")) {
+                        tty = mfree(tty);
+                        r = read_one_line_file("/sys/class/tty/tty0/active", &tty);
+                        if (r < 0)
+                                return r;
+                }
+
+                path = strappend("/dev/", tty);
+                if (!path)
+                        return -ENOMEM;
+
+                if (access(path, F_OK) < 0) {
+                        log_debug_errno(errno, "Console device %s is not accessible, skipping: %m", path);
+                        free(path);
+                        continue;
+                }
+
+                r = strv_consume(&con, path);
+                if (r < 0)
+                        return r;
+        }
+
+        if (strv_isempty(con)) {
+                log_debug("No devices found for system console");
+
+                r = strv_extend(&con, "/dev/console");
+                if (r < 0)
+                        return r;
+        }
+
+        *consoles = con;
+        con = NULL;
+        return 0;
+}
+
 bool tty_is_vc_resolve(const char *tty) {
         _cleanup_free_ char *active = NULL;
 
@@ -830,9 +889,7 @@ int make_stdio(int fd) {
 
         /* Explicitly unset O_CLOEXEC, since if fd was < 3, then
          * dup2() was a NOP and the bit hence possibly set. */
-        fd_cloexec(STDIN_FILENO, false);
-        fd_cloexec(STDOUT_FILENO, false);
-        fd_cloexec(STDERR_FILENO, false);
+        stdio_unset_cloexec();
 
         return 0;
 }
@@ -1135,6 +1192,19 @@ int open_terminal_in_namespace(pid_t pid, const char *name, int mode) {
         return receive_one_fd(pair[0], 0);
 }
 
+bool terminal_is_dumb(void) {
+        const char *e;
+
+        if (!on_tty())
+                return true;
+
+        e = getenv("TERM");
+        if (!e)
+                return true;
+
+        return streq(e, "dumb");
+}
+
 bool colors_enabled(void) {
         static int enabled = -1;
 
@@ -1144,10 +1214,8 @@ bool colors_enabled(void) {
                 colors = getenv("SYSTEMD_COLORS");
                 if (colors)
                         enabled = parse_boolean(colors) != 0;
-                else if (streq_ptr(getenv("TERM"), "dumb"))
-                        enabled = false;
                 else
-                        enabled = on_tty();
+                        enabled = !terminal_is_dumb();
         }
 
         return enabled;
diff --git a/src/libbasic/src/time-util.c b/src/libbasic/src/time-util.c
index 05f5ad7dc7..1352c59295 100644
--- a/src/libbasic/src/time-util.c
+++ b/src/libbasic/src/time-util.c
@@ -87,6 +87,16 @@ dual_timestamp* dual_timestamp_get(dual_timestamp *ts) {
         return ts;
 }
 
+triple_timestamp* triple_timestamp_get(triple_timestamp *ts) {
+        assert(ts);
+
+        ts->realtime = now(CLOCK_REALTIME);
+        ts->monotonic = now(CLOCK_MONOTONIC);
+        ts->boottime = clock_boottime_supported() ? now(CLOCK_BOOTTIME) : USEC_INFINITY;
+
+        return ts;
+}
+
 dual_timestamp* dual_timestamp_from_realtime(dual_timestamp *ts, usec_t u) {
         int64_t delta;
         assert(ts);
@@ -104,6 +114,24 @@ dual_timestamp* dual_timestamp_from_realtime(dual_timestamp *ts, usec_t u) {
         return ts;
 }
 
+triple_timestamp* triple_timestamp_from_realtime(triple_timestamp *ts, usec_t u) {
+        int64_t delta;
+
+        assert(ts);
+
+        if (u == USEC_INFINITY || u <= 0) {
+                ts->realtime = ts->monotonic = ts->boottime = u;
+                return ts;
+        }
+
+        ts->realtime = u;
+        delta = (int64_t) now(CLOCK_REALTIME) - (int64_t) u;
+        ts->monotonic = usec_sub(now(CLOCK_MONOTONIC), delta);
+        ts->boottime = clock_boottime_supported() ? usec_sub(now(CLOCK_BOOTTIME), delta) : USEC_INFINITY;
+
+        return ts;
+}
+
 dual_timestamp* dual_timestamp_from_monotonic(dual_timestamp *ts, usec_t u) {
         int64_t delta;
         assert(ts);
@@ -136,6 +164,26 @@ dual_timestamp* dual_timestamp_from_boottime_or_monotonic(dual_timestamp *ts, us
         return ts;
 }
 
+usec_t triple_timestamp_by_clock(triple_timestamp *ts, clockid_t clock) {
+
+        switch (clock) {
+
+        case CLOCK_REALTIME:
+        case CLOCK_REALTIME_ALARM:
+                return ts->realtime;
+
+        case CLOCK_MONOTONIC:
+                return ts->monotonic;
+
+        case CLOCK_BOOTTIME:
+        case CLOCK_BOOTTIME_ALARM:
+                return ts->boottime;
+
+        default:
+                return USEC_INFINITY;
+        }
+}
+
 usec_t timespec_load(const struct timespec *ts) {
         assert(ts);
 
@@ -1107,6 +1155,30 @@ clockid_t clock_boottime_or_monotonic(void) {
                 return CLOCK_MONOTONIC;
 }
 
+bool clock_supported(clockid_t clock) {
+        struct timespec ts;
+
+        switch (clock) {
+
+        case CLOCK_MONOTONIC:
+        case CLOCK_REALTIME:
+                return true;
+
+        case CLOCK_BOOTTIME:
+                return clock_boottime_supported();
+
+        case CLOCK_BOOTTIME_ALARM:
+                if (!clock_boottime_supported())
+                        return false;
+
+                /* fall through, after checking the cached value for CLOCK_BOOTTIME. */
+
+        default:
+                /* For everything else, check properly */
+                return clock_gettime(clock, &ts) >= 0;
+        }
+}
+
 int get_timezone(char **tz) {
         _cleanup_free_ char *t = NULL;
         const char *e;
diff --git a/src/libbasic/src/user-util.c b/src/libbasic/src/user-util.c
index c85eb06491..692f2a3db3 100644
--- a/src/libbasic/src/user-util.c
+++ b/src/libbasic/src/user-util.c
@@ -458,7 +458,7 @@ int take_etc_passwd_lock(const char *root) {
          *
          * Note that shadow-utils also takes per-database locks in
          * addition to lckpwdf(). However, we don't given that they
-         * are redundant as they they invoke lckpwdf() first and keep
+         * are redundant as they invoke lckpwdf() first and keep
          * it during everything they do. The per-database locks are
          * awfully racy, and thus we just won't do them. */
 
diff --git a/src/libbasic/src/util.c b/src/libbasic/src/util.c
index d0db8a28fb..a7831e118a 100644
--- a/src/libbasic/src/util.c
+++ b/src/libbasic/src/util.c
@@ -36,6 +36,7 @@
 
 #include "basic/alloc-util.h"
 #include "basic/build.h"
+#include "basic/cgroup-util.h"
 #include "basic/def.h"
 #include "basic/dirent-util.h"
 #include "basic/fd-util.h"
@@ -64,6 +65,7 @@ assert_cc(EAGAIN == EWOULDBLOCK);
 
 int saved_argc = 0;
 char **saved_argv = NULL;
+static int saved_in_initrd = -1;
 
 size_t page_size(void) {
         static thread_local size_t pgsz = 0;
@@ -454,11 +456,10 @@ int fork_agent(pid_t *pid, const int except[], unsigned n_except, const char *pa
 }
 
 bool in_initrd(void) {
-        static int saved = -1;
         struct statfs s;
 
-        if (saved >= 0)
-                return saved;
+        if (saved_in_initrd >= 0)
+                return saved_in_initrd;
 
         /* We make two checks here:
          *
@@ -470,11 +471,15 @@ bool in_initrd(void) {
          * emptying when transititioning to the main systemd.
          */
 
-        saved = access("/etc/initrd-release", F_OK) >= 0 &&
-                statfs("/", &s) >= 0 &&
-                is_temporary_fs(&s);
+        saved_in_initrd = access("/etc/initrd-release", F_OK) >= 0 &&
+                          statfs("/", &s) >= 0 &&
+                          is_temporary_fs(&s);
 
-        return saved;
+        return saved_in_initrd;
+}
+
+void in_initrd_force(bool value) {
+        saved_in_initrd = value;
 }
 
 /* hey glibc, APIs with callbacks without a user pointer are so useless */
@@ -576,47 +581,6 @@ int on_ac_power(void) {
         return found_online || !found_offline;
 }
 
-bool id128_is_valid(const char *s) {
-        size_t i, l;
-
-        l = strlen(s);
-        if (l == 32) {
-
-                /* Simple formatted 128bit hex string */
-
-                for (i = 0; i < l; i++) {
-                        char c = s[i];
-
-                        if (!(c >= '0' && c <= '9') &&
-                            !(c >= 'a' && c <= 'z') &&
-                            !(c >= 'A' && c <= 'Z'))
-                                return false;
-                }
-
-        } else if (l == 36) {
-
-                /* Formatted UUID */
-
-                for (i = 0; i < l; i++) {
-                        char c = s[i];
-
-                        if ((i == 8 || i == 13 || i == 18 || i == 23)) {
-                                if (c != '-')
-                                        return false;
-                        } else {
-                                if (!(c >= '0' && c <= '9') &&
-                                    !(c >= 'a' && c <= 'z') &&
-                                    !(c >= 'A' && c <= 'Z'))
-                                        return false;
-                        }
-                }
-
-        } else
-                return false;
-
-        return true;
-}
-
 int container_get_leader(const char *machine, pid_t *pid) {
         _cleanup_free_ char *s = NULL, *class = NULL;
         const char *p;
@@ -767,15 +731,119 @@ int namespace_enter(int pidns_fd, int mntns_fd, int netns_fd, int userns_fd, int
 }
 
 uint64_t physical_memory(void) {
-        long mem;
+        _cleanup_free_ char *root = NULL, *value = NULL;
+        uint64_t mem, lim;
+        size_t ps;
+        long sc;
+
+        /* We return this as uint64_t in case we are running as 32bit process on a 64bit kernel with huge amounts of
+         * memory.
+         *
+         * In order to support containers nicely that have a configured memory limit we'll take the minimum of the
+         * physically reported amount of memory and the limit configured for the root cgroup, if there is any. */
+
+        sc = sysconf(_SC_PHYS_PAGES);
+        assert(sc > 0);
+
+        ps = page_size();
+        mem = (uint64_t) sc * (uint64_t) ps;
+
+        if (cg_get_root_path(&root) < 0)
+                return mem;
+
+        if (cg_get_attribute("memory", root, "memory.limit_in_bytes", &value))
+                return mem;
+
+        if (safe_atou64(value, &lim) < 0)
+                return mem;
+
+        /* Make sure the limit is a multiple of our own page size */
+        lim /= ps;
+        lim *= ps;
+
+        return MIN(mem, lim);
+}
+
+uint64_t physical_memory_scale(uint64_t v, uint64_t max) {
+        uint64_t p, m, ps, r;
+
+        assert(max > 0);
+
+        /* Returns the physical memory size, multiplied by v divided by max. Returns UINT64_MAX on overflow. On success
+         * the result is a multiple of the page size (rounds down). */
+
+        ps = page_size();
+        assert(ps > 0);
+
+        p = physical_memory() / ps;
+        assert(p > 0);
+
+        m = p * v;
+        if (m / p != v)
+                return UINT64_MAX;
+
+        m /= max;
+
+        r = m * ps;
+        if (r / ps != m)
+                return UINT64_MAX;
+
+        return r;
+}
+
+uint64_t system_tasks_max(void) {
+
+#if SIZEOF_PID_T == 4
+#define TASKS_MAX ((uint64_t) (INT32_MAX-1))
+#elif SIZEOF_PID_T == 2
+#define TASKS_MAX ((uint64_t) (INT16_MAX-1))
+#else
+#error "Unknown pid_t size"
+#endif
+
+        _cleanup_free_ char *value = NULL, *root = NULL;
+        uint64_t a = TASKS_MAX, b = TASKS_MAX;
+
+        /* Determine the maximum number of tasks that may run on this system. We check three sources to determine this
+         * limit:
+         *
+         * a) the maximum value for the pid_t type
+         * b) the cgroups pids_max attribute for the system
+         * c) the kernel's configure maximum PID value
+         *
+         * And then pick the smallest of the three */
+
+        if (read_one_line_file("/proc/sys/kernel/pid_max", &value) >= 0)
+                (void) safe_atou64(value, &a);
+
+        if (cg_get_root_path(&root) >= 0) {
+                value = mfree(value);
+
+                if (cg_get_attribute("pids", root, "pids.max", &value) >= 0)
+                        (void) safe_atou64(value, &b);
+        }
+
+        return MIN3(TASKS_MAX,
+                    a <= 0 ? TASKS_MAX : a,
+                    b <= 0 ? TASKS_MAX : b);
+}
+
+uint64_t system_tasks_max_scale(uint64_t v, uint64_t max) {
+        uint64_t t, m;
+
+        assert(max > 0);
+
+        /* Multiply the system's task value by the fraction v/max. Hence, if max==100 this calculates percentages
+         * relative to the system's maximum number of tasks. Returns UINT64_MAX on overflow. */
 
-        /* We return this as uint64_t in case we are running as 32bit
-         * process on a 64bit kernel with huge amounts of memory */
+        t = system_tasks_max();
+        assert(t > 0);
 
-        mem = sysconf(_SC_PHYS_PAGES);
-        assert(mem > 0);
+        m = t * v;
+        if (m / t != v) /* overflow? */
+                return UINT64_MAX;
 
-        return (uint64_t) mem * (uint64_t) page_size();
+        return m / max;
 }
 
 int update_reboot_parameter_and_warn(const char *param) {
diff --git a/src/libshared/include/shared/bus-util.h b/src/libshared/include/shared/bus-util.h
index 73f2ea0749..71237e9fc1 100644
--- a/src/libshared/include/shared/bus-util.h
+++ b/src/libshared/include/shared/bus-util.h
@@ -157,7 +157,4 @@ int bus_log_create_error(int r);
 int bus_path_encode_unique(sd_bus *b, const char *prefix, const char *sender_id, const char *external_id, char **ret_path);
 int bus_path_decode_unique(const char *path, const char *prefix, char **ret_sender, char **ret_external);
 
-bool is_kdbus_wanted(void);
-bool is_kdbus_available(void);
-
 int bus_property_get_rlimit(sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, void *userdata, sd_bus_error *error);
diff --git a/src/libbasic/include/basic/fdset.h b/src/libshared/include/shared/fdset.h
index 16efe5bdf2..3ff5d519af 100644
--- a/src/libbasic/include/basic/fdset.h
+++ b/src/libshared/include/shared/fdset.h
@@ -21,9 +21,9 @@
 
 #include <stdbool.h>
 
-#include "hashmap.h"
-#include "macro.h"
-#include "set.h"
+#include "basic/hashmap.h"
+#include "basic/macro.h"
+#include "basic/set.h"
 
 typedef struct FDSet FDSet;
 
diff --git a/src/libshared/include/shared/seccomp-util.h b/src/libshared/include/shared/seccomp-util.h
index 4ed2afc1b2..be33eecb85 100644
--- a/src/libshared/include/shared/seccomp-util.h
+++ b/src/libshared/include/shared/seccomp-util.h
@@ -26,3 +26,10 @@ const char* seccomp_arch_to_string(uint32_t c);
 int seccomp_arch_from_string(const char *n, uint32_t *ret);
 
 int seccomp_add_secondary_archs(scmp_filter_ctx *c);
+
+typedef struct SystemCallFilterSet {
+        const char *set_name;
+        const char *value;
+} SystemCallFilterSet;
+
+extern const SystemCallFilterSet syscall_filter_sets[];
diff --git a/src/libshared/include/shared/vlan-util.h b/src/libshared/include/shared/vlan-util.h
new file mode 100644
index 0000000000..b7c2f03383
--- /dev/null
+++ b/src/libshared/include/shared/vlan-util.h
@@ -0,0 +1,35 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <inttypes.h>
+#include <stdbool.h>
+
+#define VLANID_MAX 4094
+#define VLANID_INVALID UINT16_MAX
+
+/* Note that we permit VLAN Id 0 here, as that is apparently OK by the Linux kernel */
+static inline bool vlanid_is_valid(uint16_t id) {
+        return id <= VLANID_MAX;
+}
+
+int parse_vlanid(const char *p, uint16_t *ret);
+
+int config_parse_vlanid(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
diff --git a/src/libshared/src/Makefile b/src/libshared/src/Makefile
index 9ac9ba59ac..25332590ac 100644
--- a/src/libshared/src/Makefile
+++ b/src/libshared/src/Makefile
@@ -106,8 +106,12 @@ libshared_la_SOURCES = \
 	src/shared/resolve-util.h \
 	src/shared/bus-unit-util.c \
 	src/shared/bus-unit-util.h \
+	src/shared/vlan-util.h \
+	src/shared/vlan-util.c \
 	src/shared/tests.h \
-	src/shared/tests.c
+	src/shared/tests.c \
+	src/shared/fdset.c \
+	src/shared/fdset.h
 
 ifneq ($(HAVE_UTMP),)
 libshared_la_SOURCES += \
@@ -134,11 +138,50 @@ libshared_la_CFLAGS = \
 
 libshared_la_LIBADD = \
 	libsystemd-internal.la \
+	libbasic.la \
+	libsystemd-journal-internal.la \
 	libudev-internal.la \
 	$(ACL_LIBS) \
 	$(LIBIDN_LIBS) \
 	$(SECCOMP_LIBS)
 
+rootlibexec_LTLIBRARIES += \
+	libsystemd-shared.la
+
+libsystemd_shared_la_SOURCES = \
+	$(libbasic_la_SOURCES) \
+	$(libshared_la_SOURCES) \
+	$(libsystemd_internal_la_SOURCES) \
+	$(libsystemd_journal_internal_la_SOURCES) \
+	$(libudev_internal_la_SOURCES)
+
+libsystemd_shared_la_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(libbasic_la_CFLAGS) \
+	$(libshared_la_CFLAGS) \
+	$(libsystemd_internal_la_CFLAGS) \
+	$(libsystemd_journal_internal_la_CFLAGS) \
+	$(libudev_internal_la_CFLAGS) \
+	$(ACL_CFLAGS) \
+	$(LIBIDN_CFLAGS) \
+	$(SECCOMP_CFLAGS) \
+	-fvisibility=default
+
+# We can't use libshared_la_LIBADD here because it would
+# pull in libsystemd*-internal.la
+libsystemd_shared_la_LIBADD = \
+	$(libbasic_la_LIBADD) \
+	$(libsystemd_internal_la_LIBADD) \
+	$(libsystemd_journal_internal_la_LIBADD) \
+	$(libudev_internal_la_LIBADD) \
+	$(ACL_LIBS) \
+	$(LIBIDN_LIBS) \
+	$(SECCOMP_LIBS)
+
+libsystemd_shared_la_LDFLAGS = \
+	$(AM_LDFLAGS) \
+	-release $(PACKAGE_VERSION)
+
 sd.CPPFLAGS += $(addprefix -I,$(call at.path,$(srcdir)/../include $(srcdir)/../include/shared))
 sd.CPPFLAGS += -DPKGSYSCONFDIR=\"$(pkgsysconfdir)\"
 sd.CPPFLAGS += -DSYSTEM_CONFIG_UNIT_PATH=\"$(pkgsysconfdir)/system\"
diff --git a/src/libshared/src/ask-password-api.c b/src/libshared/src/ask-password-api.c
index 9be47256aa..5848ff5582 100644
--- a/src/libshared/src/ask-password-api.c
+++ b/src/libshared/src/ask-password-api.c
@@ -139,11 +139,7 @@ static int add_to_keyring(const char *keyname, AskPasswordFlags flags, char **pa
         if (r < 0)
                 return r;
 
-        /* Truncate trailing NUL */
-        assert(n > 0);
-        assert(p[n-1] == 0);
-
-        serial = add_key("user", keyname, p, n-1, KEY_SPEC_USER_KEYRING);
+        serial = add_key("user", keyname, p, n, KEY_SPEC_USER_KEYRING);
         memory_erase(p, n);
         if (serial == -1)
                 return -errno;
@@ -253,10 +249,12 @@ int ask_password_tty(
                         goto finish;
                 }
 
-                loop_write(ttyfd, ANSI_HIGHLIGHT, strlen(ANSI_HIGHLIGHT), false);
+                if (colors_enabled())
+                        loop_write(ttyfd, ANSI_HIGHLIGHT, strlen(ANSI_HIGHLIGHT), false);
                 loop_write(ttyfd, message, strlen(message), false);
                 loop_write(ttyfd, " ", 1, false);
-                loop_write(ttyfd, ANSI_NORMAL, strlen(ANSI_NORMAL), false);
+                if (colors_enabled())
+                        loop_write(ttyfd, ANSI_NORMAL, strlen(ANSI_NORMAL), false);
 
                 new_termios = old_termios;
                 new_termios.c_lflag &= ~(ICANON|ECHO);
diff --git a/src/libshared/src/bus-unit-util.c b/src/libshared/src/bus-unit-util.c
index 08c495aae5..eadf2fa14f 100644
--- a/src/libshared/src/bus-unit-util.c
+++ b/src/libshared/src/bus-unit-util.c
@@ -83,18 +83,14 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
 
                 if (isempty(eq))
                         r = sd_bus_message_append(m, "sv", "CPUQuotaPerSecUSec", "t", USEC_INFINITY);
-                else if (endswith(eq, "%")) {
-                        double percent;
-
-                        if (sscanf(eq, "%lf%%", &percent) != 1 || percent <= 0) {
-                                log_error("CPU quota '%s' invalid.", eq);
+                else {
+                        r = parse_percent(eq);
+                        if (r <= 0) {
+                                log_error_errno(r, "CPU quota '%s' invalid.", eq);
                                 return -EINVAL;
                         }
 
-                        r = sd_bus_message_append(m, "sv", "CPUQuotaPerSecUSec", "t", (usec_t) percent * USEC_PER_SEC / 100);
-                } else {
-                        log_error("CPU quota needs to be in percent.");
-                        return -EINVAL;
+                        r = sd_bus_message_append(m, "sv", "CPUQuotaPerSecUSec", "t", (usec_t) r * USEC_PER_SEC / 100U);
                 }
 
                 goto finish;
@@ -110,6 +106,7 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
                 char *n;
                 usec_t t;
                 size_t l;
+
                 r = parse_sec(eq, &t);
                 if (r < 0)
                         return log_error_errno(r, "Failed to parse %s= parameter: %s", field, eq);
@@ -123,6 +120,54 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
                 strcpy(mempcpy(n, field, l - 3), "USec");
                 r = sd_bus_message_append(m, "sv", n, "t", t);
                 goto finish;
+
+        } else if (STR_IN_SET(field, "MemoryLow", "MemoryHigh", "MemoryMax", "MemoryLimit")) {
+                uint64_t bytes;
+
+                if (isempty(eq) || streq(eq, "infinity"))
+                        bytes = CGROUP_LIMIT_MAX;
+                else {
+                        r = parse_percent(eq);
+                        if (r >= 0) {
+                                char *n;
+
+                                /* When this is a percentage we'll convert this into a relative value in the range
+                                 * 0…UINT32_MAX and pass it in the MemoryLowScale property (and related
+                                 * ones). This way the physical memory size can be determined server-side */
+
+                                n = strjoina(field, "Scale");
+                                r = sd_bus_message_append(m, "sv", n, "u", (uint32_t) (((uint64_t) UINT32_MAX * r) / 100U));
+                                goto finish;
+
+                        } else {
+                                r = parse_size(eq, 1024, &bytes);
+                                if (r < 0)
+                                        return log_error_errno(r, "Failed to parse bytes specification %s", assignment);
+                        }
+                }
+
+                r = sd_bus_message_append(m, "sv", field, "t", bytes);
+                goto finish;
+        } else if (streq(field, "TasksMax")) {
+                uint64_t t;
+
+                if (isempty(eq) || streq(eq, "infinity"))
+                        t = (uint64_t) -1;
+                else {
+                        r = parse_percent(eq);
+                        if (r >= 0) {
+                                r = sd_bus_message_append(m, "sv", "TasksMaxScale", "u", (uint32_t) (((uint64_t) UINT32_MAX * r) / 100U));
+                                goto finish;
+                        } else {
+                                r = safe_atou64(eq, &t);
+                                if (r < 0)
+                                        return log_error_errno(r, "Failed to parse maximum tasks specification %s", assignment);
+                        }
+
+                }
+
+                r = sd_bus_message_append(m, "sv", "TasksMax", "t", t);
+                goto finish;
         }
 
         r = sd_bus_message_append_basic(m, SD_BUS_TYPE_STRING, field);
@@ -158,7 +203,7 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
                        "SendSIGHUP", "SendSIGKILL", "WakeSystem", "DefaultDependencies",
                        "IgnoreSIGPIPE", "TTYVHangup", "TTYReset", "RemainAfterExit",
                        "PrivateTmp", "PrivateDevices", "PrivateNetwork", "NoNewPrivileges",
-                       "SyslogLevelPrefix", "Delegate", "RemainAfterElapse")) {
+                       "SyslogLevelPrefix", "Delegate", "RemainAfterElapse", "MemoryDenyWriteExecute")) {
 
                 r = parse_boolean(eq);
                 if (r < 0)
@@ -166,36 +211,6 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
 
                 r = sd_bus_message_append(m, "v", "b", r);
 
-        } else if (streq(field, "MemoryLimit")) {
-                uint64_t bytes;
-
-                if (isempty(eq) || streq(eq, "infinity"))
-                        bytes = (uint64_t) -1;
-                else {
-                        r = parse_size(eq, 1024, &bytes);
-                        if (r < 0) {
-                                log_error("Failed to parse bytes specification %s", assignment);
-                                return -EINVAL;
-                        }
-                }
-
-                r = sd_bus_message_append(m, "v", "t", bytes);
-
-        } else if (streq(field, "TasksMax")) {
-                uint64_t n;
-
-                if (isempty(eq) || streq(eq, "infinity"))
-                        n = (uint64_t) -1;
-                else {
-                        r = safe_atou64(eq, &n);
-                        if (r < 0) {
-                                log_error("Failed to parse maximum tasks specification %s", assignment);
-                                return -EINVAL;
-                        }
-                }
-
-                r = sd_bus_message_append(m, "v", "t", n);
-
         } else if (STR_IN_SET(field, "CPUShares", "StartupCPUShares")) {
                 uint64_t u;
 
@@ -306,7 +321,7 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
                                 return -EINVAL;
                         }
 
-                        if (streq(bandwidth, "max")) {
+                        if (streq(bandwidth, "infinity")) {
                                 bytes = CGROUP_LIMIT_MAX;
                         } else {
                                 r = parse_size(bandwidth, 1000, &bytes);
@@ -443,7 +458,8 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
                 }
 
                 r = sd_bus_message_append(m, "v", "i", oa);
-        } else if (STR_IN_SET(field, "ReadWriteDirectories", "ReadOnlyDirectories", "InaccessibleDirectories")) {
+        } else if (STR_IN_SET(field, "ReadWriteDirectories", "ReadOnlyDirectories", "InaccessibleDirectories",
+                              "ReadWritePaths", "ReadOnlyPaths", "InaccessiblePaths")) {
                 const char *p;
 
                 r = sd_bus_message_open_container(m, 'v', "as");
@@ -1113,7 +1129,8 @@ static int dump_processes(
                 assert(n == cg->n_children);
                 qsort_safe(children, n, sizeof(struct CGroupInfo*), cgroup_info_compare_func);
 
-                n_columns = MAX(LESS_BY(n_columns, 2U), 20U);
+                if (n_columns != 0)
+                        n_columns = MAX(LESS_BY(n_columns, 2U), 20U);
 
                 for (i = 0; i < n; i++) {
                         _cleanup_free_ char *pp = NULL;
diff --git a/src/libshared/src/bus-util.c b/src/libshared/src/bus-util.c
index b303509f34..d5eb857b85 100644
--- a/src/libshared/src/bus-util.c
+++ b/src/libshared/src/bus-util.c
@@ -1048,7 +1048,7 @@ static int map_basic(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_
 
         case SD_BUS_TYPE_BOOLEAN: {
                 unsigned b;
-                bool *p = userdata;
+                int *p = userdata;
 
                 r = sd_bus_message_read_basic(m, type, &b);
                 if (r < 0)
@@ -1085,6 +1085,19 @@ static int map_basic(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_
                 break;
         }
 
+        case SD_BUS_TYPE_DOUBLE: {
+                double d;
+                double *p = userdata;
+
+                r = sd_bus_message_read_basic(m, type, &d);
+                if (r < 0)
+                        break;
+
+                *p = d;
+
+                break;
+        }
+
         default:
                 break;
         }
@@ -1492,40 +1505,6 @@ int bus_path_decode_unique(const char *path, const char *prefix, char **ret_send
         return 1;
 }
 
-bool is_kdbus_wanted(void) {
-        _cleanup_free_ char *value = NULL;
-#ifdef ENABLE_KDBUS
-        const bool configured = true;
-#else
-        const bool configured = false;
-#endif
-
-        int r;
-
-        if (get_proc_cmdline_key("kdbus", NULL) > 0)
-                return true;
-
-        r = get_proc_cmdline_key("kdbus=", &value);
-        if (r <= 0)
-                return configured;
-
-        return parse_boolean(value) == 1;
-}
-
-bool is_kdbus_available(void) {
-        _cleanup_close_ int fd = -1;
-        struct kdbus_cmd cmd = { .size = sizeof(cmd), .flags = KDBUS_FLAG_NEGOTIATE };
-
-        if (!is_kdbus_wanted())
-                return false;
-
-        fd = open("/sys/fs/kdbus/control", O_RDWR | O_CLOEXEC | O_NONBLOCK | O_NOCTTY);
-        if (fd < 0)
-                return false;
-
-        return ioctl(fd, KDBUS_CMD_BUS_MAKE, &cmd) >= 0;
-}
-
 int bus_property_get_rlimit(
                 sd_bus *bus,
                 const char *path,
diff --git a/src/libshared/src/condition.c b/src/libshared/src/condition.c
index fdfa3b0941..12d5faf493 100644
--- a/src/libshared/src/condition.c
+++ b/src/libshared/src/condition.c
@@ -182,10 +182,11 @@ static int condition_test_architecture(Condition *c) {
 
         if (streq(c->parameter, "native"))
                 b = native_architecture();
-        else
+        else {
                 b = architecture_from_string(c->parameter);
-        if (b < 0)
-                return b;
+                if (b < 0) /* unknown architecture? Then it's definitely not ours */
+                        return false;
+        }
 
         return a == b;
 }
diff --git a/src/libshared/src/conf-parser.c b/src/libshared/src/conf-parser.c
index 6631ff966f..18a9b6332b 100644
--- a/src/libshared/src/conf-parser.c
+++ b/src/libshared/src/conf-parser.c
@@ -323,8 +323,7 @@ int config_parse(const char *unit,
                         if (feof(f))
                                 break;
 
-                        log_error_errno(errno, "Failed to read configuration file '%s': %m", filename);
-                        return -errno;
+                        return log_error_errno(errno, "Failed to read configuration file '%s': %m", filename);
                 }
 
                 l = buf;
@@ -708,6 +707,7 @@ int config_parse_strv(const char *unit,
                       void *userdata) {
 
         char ***sv = data;
+        int r;
 
         assert(filename);
         assert(lvalue);
@@ -721,18 +721,19 @@ int config_parse_strv(const char *unit,
                  * we actually fill in a real empty array here rather
                  * than NULL, since some code wants to know if
                  * something was set at all... */
-                empty = strv_new(NULL, NULL);
+                empty = new0(char*, 1);
                 if (!empty)
                         return log_oom();
 
                 strv_free(*sv);
                 *sv = empty;
+
                 return 0;
         }
 
         for (;;) {
                 char *word = NULL;
-                int r;
+
                 r = extract_first_word(&rvalue, &word, WHITESPACE, EXTRACT_QUOTES|EXTRACT_RETAIN_ESCAPE);
                 if (r == 0)
                         break;
diff --git a/src/libbasic/src/fdset.c b/src/libshared/src/fdset.c
index 71e920d08e..2988e4a9dc 100644
--- a/src/libbasic/src/fdset.c
+++ b/src/libshared/src/fdset.c
@@ -26,12 +26,12 @@
 #include <systemd/sd-daemon.h>
 
 #include "basic/fd-util.h"
-#include "basic/fdset.h"
 #include "basic/log.h"
 #include "basic/macro.h"
 #include "basic/parse-util.h"
 #include "basic/path-util.h"
 #include "basic/set.h"
+#include "shared/fdset.h"
 
 #define MAKE_SET(s) ((Set*) s)
 #define MAKE_FDSET(s) ((FDSet*) s)
diff --git a/src/libshared/src/install.c b/src/libshared/src/install.c
index bd360abcee..977fc2e486 100644
--- a/src/libshared/src/install.c
+++ b/src/libshared/src/install.c
@@ -779,7 +779,7 @@ static int find_symlinks(
 
         fd = open(config_path, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
         if (fd < 0) {
-                if (errno == ENOENT)
+                if (IN_SET(errno, ENOENT, ENOTDIR, EACCES))
                         return 0;
                 return -errno;
         }
@@ -1271,7 +1271,7 @@ static int unit_file_search(
                         info->path = path;
                         path = NULL;
                         return r;
-                } else if (r != -ENOENT)
+                } else if (!IN_SET(r, -ENOENT, -ENOTDIR, -EACCES))
                         return r;
         }
 
@@ -1296,7 +1296,7 @@ static int unit_file_search(
                                 info->path = path;
                                 path = NULL;
                                 return r;
-                        } else if (r != -ENOENT)
+                        } else if (!IN_SET(r, -ENOENT, -ENOTDIR, -EACCES))
                                 return r;
                 }
         }
@@ -2215,7 +2215,7 @@ int unit_file_enable(
         config_path = runtime ? paths.runtime_config : paths.persistent_config;
 
         STRV_FOREACH(f, files) {
-                r = install_info_discover(scope, &c, &paths, *f, SEARCH_LOAD, &i);
+                r = install_info_discover(scope, &c, &paths, *f, SEARCH_LOAD|SEARCH_FOLLOW_CONFIG_SYMLINKS, &i);
                 if (r < 0)
                         return r;
                 r = install_info_may_process(i, &paths, changes, n_changes);
@@ -2870,6 +2870,10 @@ int unit_file_get_list(
                 if (!d) {
                         if (errno == ENOENT)
                                 continue;
+                        if (IN_SET(errno, ENOTDIR, EACCES)) {
+                                log_debug("Failed to open \"%s\": %m", *i);
+                                continue;
+                        }
 
                         return -errno;
                 }
diff --git a/src/libshared/src/logs-show.c b/src/libshared/src/logs-show.c
index 1e5a7c6f01..ca145f074d 100644
--- a/src/libshared/src/logs-show.c
+++ b/src/libshared/src/logs-show.c
@@ -489,7 +489,7 @@ static int output_verbose(
                         off = ANSI_NORMAL;
                 }
 
-                if (flags & OUTPUT_SHOW_ALL ||
+                if ((flags & OUTPUT_SHOW_ALL) ||
                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
                      && utf8_is_printable(data, length))) {
                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
@@ -607,7 +607,7 @@ void json_escape(
         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
                 fputs("null", f);
 
-        else if (!utf8_is_printable(p, l)) {
+        else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
                 bool not_first = false;
 
                 fputs("[ ", f);
diff --git a/src/libshared/src/pager.c b/src/libshared/src/pager.c
index 8598d8e51a..a019cf4ec7 100644
--- a/src/libshared/src/pager.c
+++ b/src/libshared/src/pager.c
@@ -63,7 +63,7 @@ int pager_open(bool no_pager, bool jump_to_end) {
         if (pager_pid > 0)
                 return 1;
 
-        if (!on_tty())
+        if (terminal_is_dumb())
                 return 0;
 
         pager = getenv("SYSTEMD_PAGER");
diff --git a/src/libshared/src/path-lookup.c b/src/libshared/src/path-lookup.c
index 6ce89f4ed4..7c692156f5 100644
--- a/src/libshared/src/path-lookup.c
+++ b/src/libshared/src/path-lookup.c
@@ -88,7 +88,7 @@ static int user_data_dir(char **ret, const char *suffix) {
         assert(suffix);
 
         /* We don't treat /etc/xdg/systemd here as the spec
-         * suggests because we assume that that is a link to
+         * suggests because we assume that is a link to
          * /etc/systemd/ anyway. */
 
         e = getenv("XDG_DATA_HOME");
diff --git a/src/libshared/src/seccomp-util.c b/src/libshared/src/seccomp-util.c
index a7063539fb..6417df1e88 100644
--- a/src/libshared/src/seccomp-util.c
+++ b/src/libshared/src/seccomp-util.c
@@ -88,3 +88,236 @@ int seccomp_add_secondary_archs(scmp_filter_ctx *c) {
         return 0;
 
 }
+
+const SystemCallFilterSet syscall_filter_sets[] = {
+        {
+                /* Clock */
+                .set_name = "@clock",
+                .value =
+                "adjtimex\0"
+                "clock_adjtime\0"
+                "clock_settime\0"
+                "settimeofday\0"
+                "stime\0"
+        }, {
+                /* CPU emulation calls */
+                .set_name = "@cpu-emulation",
+                .value =
+                "modify_ldt\0"
+                "subpage_prot\0"
+                "switch_endian\0"
+                "vm86\0"
+                "vm86old\0"
+        }, {
+                /* Debugging/Performance Monitoring/Tracing */
+                .set_name = "@debug",
+                .value =
+                "lookup_dcookie\0"
+                "perf_event_open\0"
+                "process_vm_readv\0"
+                "process_vm_writev\0"
+                "ptrace\0"
+                "rtas\0"
+                "s390_runtime_instr\0"
+                "sys_debug_setcontext\0"
+        }, {
+                /* Default list */
+                .set_name = "@default",
+                .value =
+                "execve\0"
+                "exit\0"
+                "exit_group\0"
+                "rt_sigreturn\0"
+                "sigreturn\0"
+        }, {
+                /* Event loop use */
+                .set_name = "@io-event",
+                .value =
+                "_newselect\0"
+                "epoll_create1\0"
+                "epoll_create\0"
+                "epoll_ctl\0"
+                "epoll_ctl_old\0"
+                "epoll_pwait\0"
+                "epoll_wait\0"
+                "epoll_wait_old\0"
+                "eventfd2\0"
+                "eventfd\0"
+                "poll\0"
+                "ppoll\0"
+                "pselect6\0"
+                "select\0"
+        }, {
+                /* Message queues, SYSV IPC or other IPC: unusual */
+                .set_name = "@ipc",
+                .value = "ipc\0"
+                "mq_getsetattr\0"
+                "mq_notify\0"
+                "mq_open\0"
+                "mq_timedreceive\0"
+                "mq_timedsend\0"
+                "mq_unlink\0"
+                "msgctl\0"
+                "msgget\0"
+                "msgrcv\0"
+                "msgsnd\0"
+                "process_vm_readv\0"
+                "process_vm_writev\0"
+                "semctl\0"
+                "semget\0"
+                "semop\0"
+                "semtimedop\0"
+                "shmat\0"
+                "shmctl\0"
+                "shmdt\0"
+                "shmget\0"
+        }, {
+                /* Keyring */
+                .set_name = "@keyring",
+                .value =
+                "add_key\0"
+                "keyctl\0"
+                "request_key\0"
+        }, {
+                /* Kernel module control */
+                .set_name = "@module",
+                .value =
+                "delete_module\0"
+                "finit_module\0"
+                "init_module\0"
+        }, {
+                /* Mounting */
+                .set_name = "@mount",
+                .value =
+                "chroot\0"
+                "mount\0"
+                "oldumount\0"
+                "pivot_root\0"
+                "umount2\0"
+                "umount\0"
+        }, {
+                /* Network or Unix socket IO, should not be needed if not network facing */
+                .set_name = "@network-io",
+                .value =
+                "accept4\0"
+                "accept\0"
+                "bind\0"
+                "connect\0"
+                "getpeername\0"
+                "getsockname\0"
+                "getsockopt\0"
+                "listen\0"
+                "recv\0"
+                "recvfrom\0"
+                "recvmmsg\0"
+                "recvmsg\0"
+                "send\0"
+                "sendmmsg\0"
+                "sendmsg\0"
+                "sendto\0"
+                "setsockopt\0"
+                "shutdown\0"
+                "socket\0"
+                "socketcall\0"
+                "socketpair\0"
+        }, {
+                /* Unusual, obsolete or unimplemented, some unknown even to libseccomp */
+                .set_name = "@obsolete",
+                .value =
+                "_sysctl\0"
+                "afs_syscall\0"
+                "break\0"
+                "create_module\0"
+                "ftime\0"
+                "get_kernel_syms\0"
+                "getpmsg\0"
+                "gtty\0"
+                "lock\0"
+                "mpx\0"
+                "prof\0"
+                "profil\0"
+                "putpmsg\0"
+                "query_module\0"
+                "security\0"
+                "sgetmask\0"
+                "ssetmask\0"
+                "stty\0"
+                "sysfs\0"
+                "tuxcall\0"
+                "ulimit\0"
+                "uselib\0"
+                "ustat\0"
+                "vserver\0"
+        }, {
+                /* Nice grab-bag of all system calls which need superuser capabilities */
+                .set_name = "@privileged",
+                .value =
+                "@clock\0"
+                "@module\0"
+                "@raw-io\0"
+                "acct\0"
+                "bdflush\0"
+                "bpf\0"
+                "capset\0"
+                "chown32\0"
+                "chown\0"
+                "chroot\0"
+                "fchown32\0"
+                "fchown\0"
+                "fchownat\0"
+                "kexec_file_load\0"
+                "kexec_load\0"
+                "lchown32\0"
+                "lchown\0"
+                "nfsservctl\0"
+                "pivot_root\0"
+                "quotactl\0"
+                "reboot\0"
+                "setdomainname\0"
+                "setfsuid32\0"
+                "setfsuid\0"
+                "setgroups32\0"
+                "setgroups\0"
+                "sethostname\0"
+                "setresuid32\0"
+                "setresuid\0"
+                "setreuid32\0"
+                "setreuid\0"
+                "setuid32\0"
+                "setuid\0"
+                "swapoff\0"
+                "swapon\0"
+                "sysctl\0"
+                "vhangup\0"
+        }, {
+                /* Process control, execution, namespaces */
+                .set_name = "@process",
+                .value =
+                "arch_prctl\0"
+                "clone\0"
+                "execve\0"
+                "execveat\0"
+                "fork\0"
+                "kill\0"
+                "prctl\0"
+                "setns\0"
+                "tgkill\0"
+                "tkill\0"
+                "unshare\0"
+                "vfork\0"
+        }, {
+                /* Raw I/O ports */
+                .set_name = "@raw-io",
+                .value =
+                "ioperm\0"
+                "iopl\0"
+                "pciconfig_iobase\0"
+                "pciconfig_read\0"
+                "pciconfig_write\0"
+                "s390_pci_mmio_read\0"
+                "s390_pci_mmio_write\0"
+        }, {
+                .set_name = NULL,
+                .value = NULL
+        }
+};
diff --git a/src/libshared/src/vlan-util.c b/src/libshared/src/vlan-util.c
new file mode 100644
index 0000000000..ccf60a0cb0
--- /dev/null
+++ b/src/libshared/src/vlan-util.c
@@ -0,0 +1,69 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "basic/parse-util.h"
+#include "shared/conf-parser.h"
+#include "shared/vlan-util.h"
+
+int parse_vlanid(const char *p, uint16_t *ret) {
+        uint16_t id;
+        int r;
+
+        r = safe_atou16(p, &id);
+        if (r < 0)
+                return r;
+        if (!vlanid_is_valid(id))
+                return -ERANGE;
+
+        *ret = id;
+        return 0;
+}
+
+int config_parse_vlanid(
+                const char *unit,
+                const char *filename,
+                unsigned line,
+                const char *section,
+                unsigned section_line,
+                const char *lvalue,
+                int ltype,
+                const char *rvalue,
+                void *data,
+                void *userdata) {
+
+        uint16_t *id = data;
+        int r;
+
+        assert(filename);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+
+        r = parse_vlanid(rvalue, id);
+        if (r == -ERANGE) {
+                log_syntax(unit, LOG_ERR, filename, line, r, "VLAN identifier outside of valid range 0…4094, ignoring: %s", rvalue);
+                return 0;
+        }
+        if (r < 0) {
+                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse VLAN identifier value, ignoring: %s", rvalue);
+                return 0;
+        }
+
+        return 0;
+}
diff --git a/src/libsystemd-network/include/systemd-network/dhcp-internal.h b/src/libsystemd-network/include/systemd-network/dhcp-internal.h
index 63c85b853c..8ea7254ff1 100644
--- a/src/libsystemd-network/include/systemd-network/dhcp-internal.h
+++ b/src/libsystemd-network/include/systemd-network/dhcp-internal.h
@@ -66,4 +66,5 @@ int dhcp_packet_verify_headers(DHCPPacket *packet, size_t len, bool checksum);
 #define DHCP_CLIENT_DONT_DESTROY(client) \
         _cleanup_(sd_dhcp_client_unrefp) _unused_ sd_dhcp_client *_dont_destroy_##client = sd_dhcp_client_ref(client)
 
-#define log_dhcp_client(client, fmt, ...) log_internal(LOG_DEBUG, 0, __FILE__, __LINE__, __func__, "DHCP CLIENT (0x%x): " fmt, client->xid, ##__VA_ARGS__)
+#define log_dhcp_client_errno(client, error, fmt, ...) log_internal(LOG_DEBUG, error, __FILE__, __LINE__, __func__, "DHCP CLIENT (0x%x): " fmt, client->xid, ##__VA_ARGS__)
+#define log_dhcp_client(client, fmt, ...) log_dhcp_client_errno(client, 0, fmt, ##__VA_ARGS__)
diff --git a/src/libsystemd-network/include/systemd-network/dhcp-protocol.h b/src/libsystemd-network/include/systemd-network/dhcp-protocol.h
index b4ca0b73a0..9c7197b79a 100644
--- a/src/libsystemd-network/include/systemd-network/dhcp-protocol.h
+++ b/src/libsystemd-network/include/systemd-network/dhcp-protocol.h
@@ -59,7 +59,7 @@ typedef struct DHCPPacket DHCPPacket;
 #define DHCP_IP_UDP_SIZE        (int32_t)(sizeof(struct udphdr) + DHCP_IP_SIZE)
 #define DHCP_MESSAGE_SIZE       (int32_t)(sizeof(DHCPMessage))
 #define DHCP_DEFAULT_MIN_SIZE   576 /* the minimum internet hosts must be able to receive */
-#define DHCP_MIN_OPTIONS_SIZE   DHCP_DEFAULT_MIN_SIZE - DHCP_IP_UDP_SIZE - DHCP_MESSAGE_SIZE
+#define DHCP_MIN_OPTIONS_SIZE   (DHCP_DEFAULT_MIN_SIZE - DHCP_IP_UDP_SIZE - DHCP_MESSAGE_SIZE)
 #define DHCP_MAGIC_COOKIE       (uint32_t)(0x63825363)
 
 enum {
diff --git a/src/libsystemd-network/include/systemd-network/lldp-internal.h b/src/libsystemd-network/include/systemd-network/lldp-internal.h
index f657a1d0af..7992db6158 100644
--- a/src/libsystemd-network/include/systemd-network/lldp-internal.h
+++ b/src/libsystemd-network/include/systemd-network/lldp-internal.h
@@ -29,6 +29,8 @@
 #include "sd-lldp.h"
 
 struct sd_lldp {
+        unsigned n_ref;
+
         int ifindex;
         int fd;
 
diff --git a/src/libsystemd-network/include/systemd-network/lldp-neighbor.h b/src/libsystemd-network/include/systemd-network/lldp-neighbor.h
index b5944164fc..142872f2ad 100644
--- a/src/libsystemd-network/include/systemd-network/lldp-neighbor.h
+++ b/src/libsystemd-network/include/systemd-network/lldp-neighbor.h
@@ -43,6 +43,8 @@ struct sd_lldp_neighbor {
         sd_lldp *lldp;
         unsigned n_ref;
 
+        triple_timestamp timestamp;
+
         usec_t until;
         unsigned prioq_idx;
 
@@ -81,18 +83,18 @@ static inline void *LLDP_NEIGHBOR_RAW(const sd_lldp_neighbor *n) {
         return (uint8_t*) n + ALIGN(sizeof(sd_lldp_neighbor));
 }
 
-static inline uint8_t LLDP_NEIGHBOR_TYPE(const sd_lldp_neighbor *n) {
+static inline uint8_t LLDP_NEIGHBOR_TLV_TYPE(const sd_lldp_neighbor *n) {
         return ((uint8_t*) LLDP_NEIGHBOR_RAW(n))[n->rindex] >> 1;
 }
 
-static inline size_t LLDP_NEIGHBOR_LENGTH(const sd_lldp_neighbor *n) {
+static inline size_t LLDP_NEIGHBOR_TLV_LENGTH(const sd_lldp_neighbor *n) {
         uint8_t *p;
 
         p = (uint8_t*) LLDP_NEIGHBOR_RAW(n) + n->rindex;
         return p[1] + (((size_t) (p[0] & 1)) << 8);
 }
 
-static inline void* LLDP_NEIGHBOR_DATA(const sd_lldp_neighbor *n) {
+static inline void* LLDP_NEIGHBOR_TLV_DATA(const sd_lldp_neighbor *n) {
         return ((uint8_t*) LLDP_NEIGHBOR_RAW(n)) + n->rindex + 2;
 }
 
diff --git a/src/libsystemd-network/include/systemd-network/ndisc-internal.h b/src/libsystemd-network/include/systemd-network/ndisc-internal.h
new file mode 100644
index 0000000000..b58d29750e
--- /dev/null
+++ b/src/libsystemd-network/include/systemd-network/ndisc-internal.h
@@ -0,0 +1,49 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright (C) 2014 Intel Corporation. All rights reserved.
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "basic/log.h"
+
+#include "sd-ndisc.h"
+
+struct sd_ndisc {
+        unsigned n_ref;
+
+        int ifindex;
+        int fd;
+
+        sd_event *event;
+        int event_priority;
+
+        struct ether_addr mac_addr;
+        uint8_t hop_limit;
+        uint32_t mtu;
+
+        sd_event_source *recv_event_source;
+        sd_event_source *timeout_event_source;
+
+        unsigned nd_sent;
+
+        sd_ndisc_callback_t callback;
+        void *userdata;
+};
+
+#define log_ndisc_errno(error, fmt, ...) log_internal(LOG_DEBUG, error, __FILE__, __LINE__, __func__, "NDISC: " fmt, ##__VA_ARGS__)
+#define log_ndisc(fmt, ...) log_ndisc_errno(0, fmt, ##__VA_ARGS__)
diff --git a/src/libsystemd-network/include/systemd-network/ndisc-router.h b/src/libsystemd-network/include/systemd-network/ndisc-router.h
new file mode 100644
index 0000000000..d1b071da7f
--- /dev/null
+++ b/src/libsystemd-network/include/systemd-network/ndisc-router.h
@@ -0,0 +1,62 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright (C) 2014 Intel Corporation. All rights reserved.
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "basic/time-util.h"
+
+#include "sd-ndisc.h"
+
+struct sd_ndisc_router {
+        unsigned n_ref;
+
+        triple_timestamp timestamp;
+        struct in6_addr address;
+
+        /* The raw packet size. The data is appended to the object, accessible via NDIS_ROUTER_RAW() */
+        size_t raw_size;
+
+        /* The current read index for the iterative option interface */
+        size_t rindex;
+
+        uint64_t flags;
+        unsigned preference;
+        uint16_t lifetime;
+
+        uint8_t hop_limit;
+        uint32_t mtu;
+};
+
+static inline void* NDISC_ROUTER_RAW(const sd_ndisc_router *rt) {
+        return (uint8_t*) rt + ALIGN(sizeof(sd_ndisc_router));
+}
+
+static inline void *NDISC_ROUTER_OPTION_DATA(const sd_ndisc_router *rt) {
+        return ((uint8_t*) NDISC_ROUTER_RAW(rt)) + rt->rindex;
+}
+
+static inline uint8_t NDISC_ROUTER_OPTION_TYPE(const sd_ndisc_router *rt) {
+        return ((uint8_t*) NDISC_ROUTER_OPTION_DATA(rt))[0];
+}
+static inline size_t NDISC_ROUTER_OPTION_LENGTH(const sd_ndisc_router *rt) {
+        return ((uint8_t*) NDISC_ROUTER_OPTION_DATA(rt))[1] * 8;
+}
+
+sd_ndisc_router *ndisc_router_new(size_t raw_size);
+int ndisc_router_parse(sd_ndisc_router *rt);
diff --git a/src/libsystemd-network/include/systemd-network/sd-dhcp-client.h b/src/libsystemd-network/include/systemd-network/sd-dhcp-client.h
index 958a5a18a6..ce1145a575 100644
--- a/src/libsystemd-network/include/systemd-network/sd-dhcp-client.h
+++ b/src/libsystemd-network/include/systemd-network/sd-dhcp-client.h
@@ -98,7 +98,7 @@ int sd_dhcp_client_set_request_address(
 int sd_dhcp_client_set_request_broadcast(
                 sd_dhcp_client *client,
                 int broadcast);
-int sd_dhcp_client_set_index(
+int sd_dhcp_client_set_ifindex(
                 sd_dhcp_client *client,
                 int interface_index);
 int sd_dhcp_client_set_mac(
diff --git a/src/libsystemd-network/include/systemd-network/sd-dhcp6-client.h b/src/libsystemd-network/include/systemd-network/sd-dhcp6-client.h
index d56497ee59..cfd5f35135 100644
--- a/src/libsystemd-network/include/systemd-network/sd-dhcp6-client.h
+++ b/src/libsystemd-network/include/systemd-network/sd-dhcp6-client.h
@@ -81,7 +81,7 @@ int sd_dhcp6_client_set_callback(
                 sd_dhcp6_client_callback_t cb,
                 void *userdata);
 
-int sd_dhcp6_client_set_index(
+int sd_dhcp6_client_set_ifindex(
                 sd_dhcp6_client *client,
                 int interface_index);
 int sd_dhcp6_client_set_local_address(
diff --git a/src/libsystemd-network/include/systemd-network/sd-ipv4acd.h b/src/libsystemd-network/include/systemd-network/sd-ipv4acd.h
index 93db7a4a6c..e5ccb4b971 100644
--- a/src/libsystemd-network/include/systemd-network/sd-ipv4acd.h
+++ b/src/libsystemd-network/include/systemd-network/sd-ipv4acd.h
@@ -37,20 +37,20 @@ enum {
 };
 
 typedef struct sd_ipv4acd sd_ipv4acd;
-typedef void (*sd_ipv4acd_callback_t)(sd_ipv4acd *ll, int event, void *userdata);
-
-int sd_ipv4acd_detach_event(sd_ipv4acd *ll);
-int sd_ipv4acd_attach_event(sd_ipv4acd *ll, sd_event *event, int64_t priority);
-int sd_ipv4acd_get_address(sd_ipv4acd *ll, struct in_addr *address);
-int sd_ipv4acd_set_callback(sd_ipv4acd *ll, sd_ipv4acd_callback_t cb, void *userdata);
-int sd_ipv4acd_set_mac(sd_ipv4acd *ll, const struct ether_addr *addr);
-int sd_ipv4acd_set_index(sd_ipv4acd *ll, int interface_index);
-int sd_ipv4acd_set_address(sd_ipv4acd *ll, const struct in_addr *address);
-int sd_ipv4acd_is_running(sd_ipv4acd *ll);
-int sd_ipv4acd_start(sd_ipv4acd *ll);
-int sd_ipv4acd_stop(sd_ipv4acd *ll);
-sd_ipv4acd *sd_ipv4acd_ref(sd_ipv4acd *ll);
-sd_ipv4acd *sd_ipv4acd_unref(sd_ipv4acd *ll);
+typedef void (*sd_ipv4acd_callback_t)(sd_ipv4acd *acd, int event, void *userdata);
+
+int sd_ipv4acd_detach_event(sd_ipv4acd *acd);
+int sd_ipv4acd_attach_event(sd_ipv4acd *acd, sd_event *event, int64_t priority);
+int sd_ipv4acd_get_address(sd_ipv4acd *acd, struct in_addr *address);
+int sd_ipv4acd_set_callback(sd_ipv4acd *acd, sd_ipv4acd_callback_t cb, void *userdata);
+int sd_ipv4acd_set_mac(sd_ipv4acd *acd, const struct ether_addr *addr);
+int sd_ipv4acd_set_ifindex(sd_ipv4acd *acd, int interface_index);
+int sd_ipv4acd_set_address(sd_ipv4acd *acd, const struct in_addr *address);
+int sd_ipv4acd_is_running(sd_ipv4acd *acd);
+int sd_ipv4acd_start(sd_ipv4acd *acd);
+int sd_ipv4acd_stop(sd_ipv4acd *acd);
+sd_ipv4acd *sd_ipv4acd_ref(sd_ipv4acd *acd);
+sd_ipv4acd *sd_ipv4acd_unref(sd_ipv4acd *acd);
 int sd_ipv4acd_new(sd_ipv4acd **ret);
 
 _SD_DEFINE_POINTER_CLEANUP_FUNC(sd_ipv4acd, sd_ipv4acd_unref);
diff --git a/src/libsystemd-network/include/systemd-network/sd-ipv4ll.h b/src/libsystemd-network/include/systemd-network/sd-ipv4ll.h
index 9167623167..cff1865d05 100644
--- a/src/libsystemd-network/include/systemd-network/sd-ipv4ll.h
+++ b/src/libsystemd-network/include/systemd-network/sd-ipv4ll.h
@@ -43,15 +43,15 @@ int sd_ipv4ll_attach_event(sd_ipv4ll *ll, sd_event *event, int64_t priority);
 int sd_ipv4ll_get_address(sd_ipv4ll *ll, struct in_addr *address);
 int sd_ipv4ll_set_callback(sd_ipv4ll *ll, sd_ipv4ll_callback_t cb, void *userdata);
 int sd_ipv4ll_set_mac(sd_ipv4ll *ll, const struct ether_addr *addr);
-int sd_ipv4ll_set_index(sd_ipv4ll *ll, int interface_index);
+int sd_ipv4ll_set_ifindex(sd_ipv4ll *ll, int interface_index);
 int sd_ipv4ll_set_address(sd_ipv4ll *ll, const struct in_addr *address);
-int sd_ipv4ll_set_address_seed(sd_ipv4ll *ll, unsigned seed);
+int sd_ipv4ll_set_address_seed(sd_ipv4ll *ll, uint64_t seed);
 int sd_ipv4ll_is_running(sd_ipv4ll *ll);
 int sd_ipv4ll_start(sd_ipv4ll *ll);
 int sd_ipv4ll_stop(sd_ipv4ll *ll);
 sd_ipv4ll *sd_ipv4ll_ref(sd_ipv4ll *ll);
 sd_ipv4ll *sd_ipv4ll_unref(sd_ipv4ll *ll);
-int sd_ipv4ll_new (sd_ipv4ll **ret);
+int sd_ipv4ll_new(sd_ipv4ll **ret);
 
 _SD_DEFINE_POINTER_CLEANUP_FUNC(sd_ipv4ll, sd_ipv4ll_unref);
 
diff --git a/src/libsystemd-network/include/systemd-network/sd-lldp.h b/src/libsystemd-network/include/systemd-network/sd-lldp.h
index 391e7c2a2e..928f77f0ab 100644
--- a/src/libsystemd-network/include/systemd-network/sd-lldp.h
+++ b/src/libsystemd-network/include/systemd-network/sd-lldp.h
@@ -23,6 +23,7 @@
 
 #include <inttypes.h>
 #include <net/ethernet.h>
+#include <sys/types.h>
 
 #include <systemd/sd-event.h>
 
@@ -30,9 +31,6 @@
 
 _SD_BEGIN_DECLARATIONS;
 
-typedef struct sd_lldp sd_lldp;
-typedef struct sd_lldp_neighbor sd_lldp_neighbor;
-
 /* IEEE 802.3AB Clause 9: TLV Types */
 enum {
         SD_LLDP_TYPE_END                 = 0,
@@ -111,6 +109,9 @@ enum {
         SD_LLDP_OUI_802_1_SUBTYPE_LINK_AGGREGATION      = 7,
 };
 
+typedef struct sd_lldp sd_lldp;
+typedef struct sd_lldp_neighbor sd_lldp_neighbor;
+
 typedef enum sd_lldp_event {
         SD_LLDP_EVENT_ADDED     = 'a',
         SD_LLDP_EVENT_REMOVED   = 'r',
@@ -120,7 +121,8 @@ typedef enum sd_lldp_event {
 
 typedef void (*sd_lldp_callback_t)(sd_lldp *lldp, sd_lldp_event event, sd_lldp_neighbor *n, void *userdata);
 
-int sd_lldp_new(sd_lldp **ret, int ifindex);
+int sd_lldp_new(sd_lldp **ret);
+sd_lldp* sd_lldp_ref(sd_lldp *lldp);
 sd_lldp* sd_lldp_unref(sd_lldp *lldp);
 
 int sd_lldp_start(sd_lldp *lldp);
@@ -128,8 +130,10 @@ int sd_lldp_stop(sd_lldp *lldp);
 
 int sd_lldp_attach_event(sd_lldp *lldp, sd_event *event, int64_t priority);
 int sd_lldp_detach_event(sd_lldp *lldp);
+sd_event *sd_lldp_get_event(sd_lldp *lldp);
 
 int sd_lldp_set_callback(sd_lldp *lldp, sd_lldp_callback_t cb, void *userdata);
+int sd_lldp_set_ifindex(sd_lldp *lldp, int ifindex);
 
 /* Controls how much and what to store in the neighbors database */
 int sd_lldp_set_neighbors_max(sd_lldp *lldp, uint64_t n);
@@ -145,6 +149,7 @@ sd_lldp_neighbor *sd_lldp_neighbor_unref(sd_lldp_neighbor *n);
 /* Access to LLDP frame metadata */
 int sd_lldp_neighbor_get_source_address(sd_lldp_neighbor *n, struct ether_addr* address);
 int sd_lldp_neighbor_get_destination_address(sd_lldp_neighbor *n, struct ether_addr* address);
+int sd_lldp_neighbor_get_timestamp(sd_lldp_neighbor *n, clockid_t clock, uint64_t *ret);
 int sd_lldp_neighbor_get_raw(sd_lldp_neighbor *n, const void **ret, size_t *size);
 
 /* High-level, direct, parsed out field access. These fields exist at most once, hence may be queried directly. */
@@ -152,7 +157,7 @@ int sd_lldp_neighbor_get_chassis_id(sd_lldp_neighbor *n, uint8_t *type, const vo
 int sd_lldp_neighbor_get_chassis_id_as_string(sd_lldp_neighbor *n, const char **ret);
 int sd_lldp_neighbor_get_port_id(sd_lldp_neighbor *n, uint8_t *type, const void **ret, size_t *size);
 int sd_lldp_neighbor_get_port_id_as_string(sd_lldp_neighbor *n, const char **ret);
-int sd_lldp_neighbor_get_ttl(sd_lldp_neighbor *n, uint16_t *ret);
+int sd_lldp_neighbor_get_ttl(sd_lldp_neighbor *n, uint16_t *ret_sec);
 int sd_lldp_neighbor_get_system_name(sd_lldp_neighbor *n, const char **ret);
 int sd_lldp_neighbor_get_system_description(sd_lldp_neighbor *n, const char **ret);
 int sd_lldp_neighbor_get_port_description(sd_lldp_neighbor *n, const char **ret);
diff --git a/src/libsystemd-network/include/systemd-network/sd-ndisc.h b/src/libsystemd-network/include/systemd-network/sd-ndisc.h
index 9ef96a8aa0..de2329458a 100644
--- a/src/libsystemd-network/include/systemd-network/sd-ndisc.h
+++ b/src/libsystemd-network/include/systemd-network/sd-ndisc.h
@@ -23,6 +23,7 @@
 #include <inttypes.h>
 #include <net/ethernet.h>
 #include <netinet/in.h>
+#include <sys/types.h>
 
 #include <systemd/sd-event.h>
 
@@ -30,54 +31,99 @@
 
 _SD_BEGIN_DECLARATIONS;
 
+/* Neightbor Discovery Options, RFC 4861, Section 4.6 and
+ * https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-5 */
 enum {
-        SD_NDISC_EVENT_STOP     = 0,
-        SD_NDISC_EVENT_TIMEOUT  = 1,
+        SD_NDISC_OPTION_SOURCE_LL_ADDRESS  = 1,
+        SD_NDISC_OPTION_TARGET_LL_ADDRESS  = 2,
+        SD_NDISC_OPTION_PREFIX_INFORMATION = 3,
+        SD_NDISC_OPTION_MTU                = 5,
+        SD_NDISC_OPTION_ROUTE_INFORMATION  = 24,
+        SD_NDISC_OPTION_RDNSS              = 25,
+        SD_NDISC_OPTION_FLAGS_EXTENSION    = 26,
+        SD_NDISC_OPTION_DNSSL              = 31,
+        SD_NDISC_OPTION_CAPTIVE_PORTAL     = 37,
+};
+
+/* Route preference, RFC 4191, Section 2.1 */
+enum {
+        SD_NDISC_PREFERENCE_LOW    = 3U,
+        SD_NDISC_PREFERENCE_MEDIUM = 0U,
+        SD_NDISC_PREFERENCE_HIGH   = 1U,
 };
 
 typedef struct sd_ndisc sd_ndisc;
-typedef void(*sd_ndisc_router_callback_t)(sd_ndisc *nd, uint8_t flags, const struct in6_addr *gateway, unsigned lifetime, int pref, void *userdata);
-typedef void(*sd_ndisc_prefix_onlink_callback_t)(sd_ndisc *nd, const struct in6_addr *prefix, unsigned prefixlen,
-                                                 unsigned lifetime, void *userdata);
-typedef void(*sd_ndisc_prefix_autonomous_callback_t)(sd_ndisc *nd, const struct in6_addr *prefix, unsigned prefixlen,
-                                                     unsigned lifetime_prefered, unsigned lifetime_valid, void *userdata);
-typedef void(*sd_ndisc_callback_t)(sd_ndisc *nd, int event, void *userdata);
-
-int sd_ndisc_set_callback(sd_ndisc *nd,
-                          sd_ndisc_router_callback_t rcb,
-                          sd_ndisc_prefix_onlink_callback_t plcb,
-                          sd_ndisc_prefix_autonomous_callback_t pacb,
-                          sd_ndisc_callback_t cb,
-                          void *userdata);
-int sd_ndisc_set_index(sd_ndisc *nd, int interface_index);
-int sd_ndisc_set_mac(sd_ndisc *nd, const struct ether_addr *mac_addr);
+typedef struct sd_ndisc_router sd_ndisc_router;
 
-int sd_ndisc_attach_event(sd_ndisc *nd, sd_event *event, int64_t priority);
-int sd_ndisc_detach_event(sd_ndisc *nd);
-sd_event *sd_ndisc_get_event(sd_ndisc *nd);
+typedef enum sd_ndisc_event {
+        SD_NDISC_EVENT_TIMEOUT = 't',
+        SD_NDISC_EVENT_ROUTER  = 'r',
+} sd_ndisc_event;
+
+typedef void (*sd_ndisc_callback_t)(sd_ndisc *nd, sd_ndisc_event event, sd_ndisc_router *rt, void *userdata);
 
+int sd_ndisc_new(sd_ndisc **ret);
 sd_ndisc *sd_ndisc_ref(sd_ndisc *nd);
 sd_ndisc *sd_ndisc_unref(sd_ndisc *nd);
-int sd_ndisc_new(sd_ndisc **ret);
-
-int sd_ndisc_get_mtu(sd_ndisc *nd, uint32_t *mtu);
 
+int sd_ndisc_start(sd_ndisc *nd);
 int sd_ndisc_stop(sd_ndisc *nd);
-int sd_ndisc_router_discovery_start(sd_ndisc *nd);
 
-#define SD_NDISC_ADDRESS_FORMAT_STR "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x"
+int sd_ndisc_attach_event(sd_ndisc *nd, sd_event *event, int64_t priority);
+int sd_ndisc_detach_event(sd_ndisc *nd);
+sd_event *sd_ndisc_get_event(sd_ndisc *nd);
+
+int sd_ndisc_set_callback(sd_ndisc *nd, sd_ndisc_callback_t cb, void *userdata);
+int sd_ndisc_set_ifindex(sd_ndisc *nd, int interface_index);
+int sd_ndisc_set_mac(sd_ndisc *nd, const struct ether_addr *mac_addr);
 
-#define SD_NDISC_ADDRESS_FORMAT_VAL(address) \
-        be16toh((address).s6_addr16[0]),        \
-        be16toh((address).s6_addr16[1]),        \
-        be16toh((address).s6_addr16[2]),        \
-        be16toh((address).s6_addr16[3]),        \
-        be16toh((address).s6_addr16[4]),        \
-        be16toh((address).s6_addr16[5]),        \
-        be16toh((address).s6_addr16[6]),        \
-        be16toh((address).s6_addr16[7])
+int sd_ndisc_get_mtu(sd_ndisc *nd, uint32_t *ret);
+int sd_ndisc_get_hop_limit(sd_ndisc *nd, uint8_t *ret);
+
+int sd_ndisc_router_from_raw(sd_ndisc_router **ret, const void *raw, size_t raw_size);
+sd_ndisc_router *sd_ndisc_router_ref(sd_ndisc_router *rt);
+sd_ndisc_router *sd_ndisc_router_unref(sd_ndisc_router *rt);
+
+int sd_ndisc_router_get_address(sd_ndisc_router *rt, struct in6_addr *ret_addr);
+int sd_ndisc_router_get_timestamp(sd_ndisc_router *rt, clockid_t clock, uint64_t *ret);
+int sd_ndisc_router_get_raw(sd_ndisc_router *rt, const void **ret, size_t *size);
+
+int sd_ndisc_router_get_hop_limit(sd_ndisc_router *rt, uint8_t *ret);
+int sd_ndisc_router_get_flags(sd_ndisc_router *rt, uint64_t *ret_flags);
+int sd_ndisc_router_get_preference(sd_ndisc_router *rt, unsigned *ret);
+int sd_ndisc_router_get_lifetime(sd_ndisc_router *rt, uint16_t *ret_lifetime);
+int sd_ndisc_router_get_mtu(sd_ndisc_router *rt, uint32_t *ret);
+
+/* Generic option access */
+int sd_ndisc_router_option_rewind(sd_ndisc_router *rt);
+int sd_ndisc_router_option_next(sd_ndisc_router *rt);
+int sd_ndisc_router_option_get_type(sd_ndisc_router *rt, uint8_t *ret);
+int sd_ndisc_router_option_is_type(sd_ndisc_router *rt, uint8_t type);
+int sd_ndisc_router_option_get_raw(sd_ndisc_router *rt, const void **ret, size_t *size);
+
+/* Specific option access: SD_NDISC_OPTION_PREFIX_INFORMATION */
+int sd_ndisc_router_prefix_get_valid_lifetime(sd_ndisc_router *rt, uint32_t *ret);
+int sd_ndisc_router_prefix_get_preferred_lifetime(sd_ndisc_router *rt, uint32_t *ret);
+int sd_ndisc_router_prefix_get_flags(sd_ndisc_router *rt, uint8_t *ret);
+int sd_ndisc_router_prefix_get_address(sd_ndisc_router *rt, struct in6_addr *ret_addr);
+int sd_ndisc_router_prefix_get_prefixlen(sd_ndisc_router *rt, unsigned *prefixlen);
+
+/* Specific option access: SD_NDISC_OPTION_ROUTE_INFORMATION */
+int sd_ndisc_router_route_get_lifetime(sd_ndisc_router *rt, uint32_t *ret);
+int sd_ndisc_router_route_get_address(sd_ndisc_router *rt, struct in6_addr *ret_addr);
+int sd_ndisc_router_route_get_prefixlen(sd_ndisc_router *rt, unsigned *prefixlen);
+int sd_ndisc_router_route_get_preference(sd_ndisc_router *rt, unsigned *ret);
+
+/* Specific option access: SD_NDISC_OPTION_RDNSS */
+int sd_ndisc_router_rdnss_get_addresses(sd_ndisc_router *rt, const struct in6_addr **ret);
+int sd_ndisc_router_rdnss_get_lifetime(sd_ndisc_router *rt, uint32_t *ret);
+
+/* Specific option access: SD_NDISC_OPTION_DNSSL */
+int sd_ndisc_router_dnssl_get_domains(sd_ndisc_router *rt, char ***ret);
+int sd_ndisc_router_dnssl_get_lifetime(sd_ndisc_router *rt, uint32_t *ret);
 
 _SD_DEFINE_POINTER_CLEANUP_FUNC(sd_ndisc, sd_ndisc_unref);
+_SD_DEFINE_POINTER_CLEANUP_FUNC(sd_ndisc_router, sd_ndisc_router_unref);
 
 _SD_END_DECLARATIONS;
 
diff --git a/src/libsystemd-network/src/Makefile b/src/libsystemd-network/src/Makefile
index 30afeae1ef..5d5ed6a227 100644
--- a/src/libsystemd-network/src/Makefile
+++ b/src/libsystemd-network/src/Makefile
@@ -57,6 +57,9 @@ libsystemd_network_la_SOURCES = \
 	src/libsystemd-network/network-internal.c \
 	src/libsystemd-network/network-internal.h \
 	src/libsystemd-network/sd-ndisc.c \
+	src/libsystemd-network/ndisc-internal.h \
+	src/libsystemd-network/ndisc-router.h \
+	src/libsystemd-network/ndisc-router.c \
 	src/libsystemd-network/icmp6-util.h \
 	src/libsystemd-network/icmp6-util.c \
 	src/libsystemd-network/sd-dhcp6-client.c \
diff --git a/src/libsystemd-network/src/arp-util.c b/src/libsystemd-network/src/arp-util.c
index 1299269672..bf66a75b16 100644
--- a/src/libsystemd-network/src/arp-util.c
+++ b/src/libsystemd-network/src/arp-util.c
@@ -80,7 +80,7 @@ int arp_network_bind_raw_socket(int ifindex, be32_t address, const struct ether_
         };
         union sockaddr_union link = {
                 .ll.sll_family = AF_PACKET,
-                .ll.sll_protocol = htons(ETH_P_ARP),
+                .ll.sll_protocol = htobe16(ETH_P_ARP),
                 .ll.sll_ifindex = ifindex,
                 .ll.sll_halen = ETH_ALEN,
                 .ll.sll_addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
@@ -113,17 +113,17 @@ static int arp_send_packet(int fd, int ifindex,
                            bool announce) {
         union sockaddr_union link = {
                 .ll.sll_family = AF_PACKET,
-                .ll.sll_protocol = htons(ETH_P_ARP),
+                .ll.sll_protocol = htobe16(ETH_P_ARP),
                 .ll.sll_ifindex = ifindex,
                 .ll.sll_halen = ETH_ALEN,
                 .ll.sll_addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
         };
         struct ether_arp arp = {
-                .ea_hdr.ar_hrd = htons(ARPHRD_ETHER), /* HTYPE */
-                .ea_hdr.ar_pro = htons(ETHERTYPE_IP), /* PTYPE */
+                .ea_hdr.ar_hrd = htobe16(ARPHRD_ETHER), /* HTYPE */
+                .ea_hdr.ar_pro = htobe16(ETHERTYPE_IP), /* PTYPE */
                 .ea_hdr.ar_hln = ETH_ALEN, /* HLEN */
                 .ea_hdr.ar_pln = sizeof(be32_t), /* PLEN */
-                .ea_hdr.ar_op = htons(ARPOP_REQUEST), /* REQUEST */
+                .ea_hdr.ar_op = htobe16(ARPOP_REQUEST), /* REQUEST */
         };
         int r;
 
diff --git a/src/libsystemd-network/src/dhcp-network.c b/src/libsystemd-network/src/dhcp-network.c
index 242d61a05c..4984d49ab7 100644
--- a/src/libsystemd-network/src/dhcp-network.c
+++ b/src/libsystemd-network/src/dhcp-network.c
@@ -108,9 +108,9 @@ static int _bind_raw_socket(int ifindex, union sockaddr_union *link,
                 return -errno;
 
         link->ll.sll_family = AF_PACKET;
-        link->ll.sll_protocol = htons(ETH_P_IP);
+        link->ll.sll_protocol = htobe16(ETH_P_IP);
         link->ll.sll_ifindex = ifindex;
-        link->ll.sll_hatype = htons(arp_type);
+        link->ll.sll_hatype = htobe16(arp_type);
         link->ll.sll_halen = mac_addr_len;
         memcpy(link->ll.sll_addr, bcast_addr, mac_addr_len);
 
diff --git a/src/libsystemd-network/src/icmp6-util.c b/src/libsystemd-network/src/icmp6-util.c
index 0e78e58444..39f9f5785f 100644
--- a/src/libsystemd-network/src/icmp6-util.c
+++ b/src/libsystemd-network/src/icmp6-util.c
@@ -18,6 +18,7 @@
 ***/
 
 #include <errno.h>
+#include <net/if.h>
 #include <netinet/icmp6.h>
 #include <netinet/in.h>
 #include <netinet/ip6.h>
@@ -48,7 +49,9 @@ int icmp6_bind_router_solicitation(int index) {
                 .ipv6mr_interface = index,
         };
         _cleanup_close_ int s = -1;
-        int r, zero = 0, one = 1, hops = 255;
+        char ifname[IF_NAMESIZE] = "";
+        static const int zero = 0, one = 1, hops = 255;
+        int r;
 
         s = socket(AF_INET6, SOCK_RAW | SOCK_CLOEXEC | SOCK_NONBLOCK, IPPROTO_ICMPV6);
         if (s < 0)
@@ -84,6 +87,17 @@ int icmp6_bind_router_solicitation(int index) {
         if (r < 0)
                 return -errno;
 
+        r = setsockopt(s, SOL_SOCKET, SO_TIMESTAMP, &one, sizeof(one));
+        if (r < 0)
+                return -errno;
+
+        if (if_indextoname(index, ifname) == 0)
+                return -errno;
+
+        r = setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, ifname, strlen(ifname));
+        if (r < 0)
+                return -errno;
+
         r = s;
         s = -1;
         return r;
diff --git a/src/libsystemd-network/src/lldp-neighbor.c b/src/libsystemd-network/src/lldp-neighbor.c
index 406af019f5..afe2e8d1eb 100644
--- a/src/libsystemd-network/src/lldp-neighbor.c
+++ b/src/libsystemd-network/src/lldp-neighbor.c
@@ -197,7 +197,7 @@ int lldp_neighbor_parse(sd_lldp_neighbor *n) {
         assert(n);
 
         if (n->raw_size < sizeof(struct ether_header)) {
-                log_lldp("Recieved truncated packet, ignoring.");
+                log_lldp("Received truncated packet, ignoring.");
                 return -EBADMSG;
         }
 
@@ -360,9 +360,16 @@ end_marker:
 void lldp_neighbor_start_ttl(sd_lldp_neighbor *n) {
         assert(n);
 
-        if (n->ttl > 0)
-                n->until = usec_add(now(clock_boottime_or_monotonic()), n->ttl * USEC_PER_SEC);
-        else
+        if (n->ttl > 0) {
+                usec_t base;
+
+                /* Use the packet's timestamp if there is one known */
+                base = triple_timestamp_by_clock(&n->timestamp, clock_boottime_or_monotonic());
+                if (base <= 0 || base == USEC_INFINITY)
+                        base = now(clock_boottime_or_monotonic()); /* Otherwise, take the current time */
+
+                n->until = usec_add(base, n->ttl * USEC_PER_SEC);
+        } else
                 n->until = 0;
 
         if (n->lldp)
@@ -588,11 +595,11 @@ done:
         return 0;
 }
 
-_public_ int sd_lldp_neighbor_get_ttl(sd_lldp_neighbor *n, uint16_t *ret) {
+_public_ int sd_lldp_neighbor_get_ttl(sd_lldp_neighbor *n, uint16_t *ret_sec) {
         assert_return(n, -EINVAL);
-        assert_return(ret, -EINVAL);
+        assert_return(ret_sec, -EINVAL);
 
-        *ret = n->ttl;
+        *ret_sec = n->ttl;
         return 0;
 }
 
@@ -651,7 +658,7 @@ _public_ int sd_lldp_neighbor_get_enabled_capabilities(sd_lldp_neighbor *n, uint
         return 0;
 }
 
-int sd_lldp_neighbor_from_raw(sd_lldp_neighbor **ret, const void *raw, size_t raw_size) {
+_public_ int sd_lldp_neighbor_from_raw(sd_lldp_neighbor **ret, const void *raw, size_t raw_size) {
         _cleanup_(sd_lldp_neighbor_unrefp) sd_lldp_neighbor *n = NULL;
         int r;
 
@@ -668,7 +675,7 @@ int sd_lldp_neighbor_from_raw(sd_lldp_neighbor **ret, const void *raw, size_t ra
                 return r;
 
         *ret = n;
-        n = 0;
+        n = NULL;
 
         return r;
 }
@@ -679,7 +686,7 @@ _public_ int sd_lldp_neighbor_tlv_rewind(sd_lldp_neighbor *n) {
         assert(n->raw_size >= sizeof(struct ether_header));
         n->rindex = sizeof(struct ether_header);
 
-        return 0;
+        return n->rindex < n->raw_size;
 }
 
 _public_ int sd_lldp_neighbor_tlv_next(sd_lldp_neighbor *n) {
@@ -693,7 +700,7 @@ _public_ int sd_lldp_neighbor_tlv_next(sd_lldp_neighbor *n) {
         if (n->rindex + 2 > n->raw_size) /* Truncated message */
                 return -EBADMSG;
 
-        length = LLDP_NEIGHBOR_LENGTH(n);
+        length = LLDP_NEIGHBOR_TLV_LENGTH(n);
         if (n->rindex + 2 + length > n->raw_size)
                 return -EBADMSG;
 
@@ -711,7 +718,7 @@ _public_ int sd_lldp_neighbor_tlv_get_type(sd_lldp_neighbor *n, uint8_t *type) {
         if (n->rindex + 2 > n->raw_size)
                 return -EBADMSG;
 
-        *type = LLDP_NEIGHBOR_TYPE(n);
+        *type = LLDP_NEIGHBOR_TLV_TYPE(n);
         return 0;
 }
 
@@ -743,14 +750,14 @@ _public_ int sd_lldp_neighbor_tlv_get_oui(sd_lldp_neighbor *n, uint8_t oui[3], u
         if (r == 0)
                 return -ENXIO;
 
-        length = LLDP_NEIGHBOR_LENGTH(n);
+        length = LLDP_NEIGHBOR_TLV_LENGTH(n);
         if (length < 4)
                 return -EBADMSG;
 
         if (n->rindex + 2 + length > n->raw_size)
                 return -EBADMSG;
 
-        d = LLDP_NEIGHBOR_DATA(n);
+        d = LLDP_NEIGHBOR_TLV_DATA(n);
         memcpy(oui, d, 3);
         *subtype = d[3];
 
@@ -782,8 +789,7 @@ _public_ int sd_lldp_neighbor_tlv_get_raw(sd_lldp_neighbor *n, const void **ret,
         if (n->rindex + 2 > n->raw_size)
                 return -EBADMSG;
 
-        length = LLDP_NEIGHBOR_LENGTH(n);
-
+        length = LLDP_NEIGHBOR_TLV_LENGTH(n);
         if (n->rindex + 2 + length > n->raw_size)
                 return -EBADMSG;
 
@@ -792,3 +798,16 @@ _public_ int sd_lldp_neighbor_tlv_get_raw(sd_lldp_neighbor *n, const void **ret,
 
         return 0;
 }
+
+_public_ int sd_lldp_neighbor_get_timestamp(sd_lldp_neighbor *n, clockid_t clock, uint64_t *ret) {
+        assert_return(n, -EINVAL);
+        assert_return(TRIPLE_TIMESTAMP_HAS_CLOCK(clock), -EOPNOTSUPP);
+        assert_return(clock_supported(clock), -EOPNOTSUPP);
+        assert_return(ret, -EINVAL);
+
+        if (!triple_timestamp_is_set(&n->timestamp))
+                return -ENODATA;
+
+        *ret = triple_timestamp_by_clock(&n->timestamp, clock);
+        return 0;
+}
diff --git a/src/libsystemd-network/src/lldp-network.c b/src/libsystemd-network/src/lldp-network.c
index 6a525e7089..9d1d592a36 100644
--- a/src/libsystemd-network/src/lldp-network.c
+++ b/src/libsystemd-network/src/lldp-network.c
@@ -58,7 +58,8 @@ int lldp_network_bind_raw_socket(int ifindex) {
 
         assert(ifindex > 0);
 
-        fd = socket(PF_PACKET, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, htons(ETHERTYPE_LLDP));
+        fd = socket(PF_PACKET, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK,
+                    htobe16(ETHERTYPE_LLDP));
         if (fd < 0)
                 return -errno;
 
diff --git a/src/libsystemd-network/src/ndisc-router.c b/src/libsystemd-network/src/ndisc-router.c
new file mode 100644
index 0000000000..2fa77d391e
--- /dev/null
+++ b/src/libsystemd-network/src/ndisc-router.c
@@ -0,0 +1,778 @@
+/***
+  This file is part of systemd.
+
+  Copyright (C) 2014 Intel Corporation. All rights reserved.
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <netinet/icmp6.h>
+
+#include "basic/alloc-util.h"
+#include "basic/hostname-util.h"
+#include "basic/missing.h"
+#include "basic/strv.h"
+#include "shared/dns-domain.h"
+#include "systemd-network/ndisc-internal.h"
+#include "systemd-network/ndisc-router.h"
+#include "systemd-network/sd-ndisc.h"
+
+_public_ sd_ndisc_router* sd_ndisc_router_ref(sd_ndisc_router *rt) {
+        if (!rt)
+                return NULL;
+
+        assert(rt->n_ref > 0);
+        rt->n_ref++;
+
+        return rt;
+}
+
+_public_ sd_ndisc_router* sd_ndisc_router_unref(sd_ndisc_router *rt) {
+        if (!rt)
+                return NULL;
+
+        assert(rt->n_ref > 0);
+        rt->n_ref--;
+
+        if (rt->n_ref > 0)
+                return NULL;
+
+        free(rt);
+        return NULL;
+}
+
+sd_ndisc_router *ndisc_router_new(size_t raw_size) {
+        sd_ndisc_router *rt;
+
+        rt = malloc0(ALIGN(sizeof(sd_ndisc_router)) + raw_size);
+        if (!rt)
+                return NULL;
+
+        rt->raw_size = raw_size;
+        rt->n_ref = 1;
+
+        return rt;
+}
+
+_public_ int sd_ndisc_router_from_raw(sd_ndisc_router **ret, const void *raw, size_t raw_size) {
+        _cleanup_(sd_ndisc_router_unrefp) sd_ndisc_router *rt = NULL;
+        int r;
+
+        assert_return(ret, -EINVAL);
+        assert_return(raw || raw_size <= 0, -EINVAL);
+
+        rt = ndisc_router_new(raw_size);
+        if (!rt)
+                return -ENOMEM;
+
+        memcpy(NDISC_ROUTER_RAW(rt), raw, raw_size);
+        r = ndisc_router_parse(rt);
+        if (r < 0)
+                return r;
+
+        *ret = rt;
+        rt = NULL;
+
+        return r;
+}
+
+_public_ int sd_ndisc_router_get_address(sd_ndisc_router *rt, struct in6_addr *ret_addr) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret_addr, -EINVAL);
+
+        if (in6_addr_is_null(&rt->address))
+                return -ENODATA;
+
+        *ret_addr = rt->address;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_timestamp(sd_ndisc_router *rt, clockid_t clock, uint64_t *ret) {
+        assert_return(rt, -EINVAL);
+        assert_return(TRIPLE_TIMESTAMP_HAS_CLOCK(clock), -EOPNOTSUPP);
+        assert_return(clock_supported(clock), -EOPNOTSUPP);
+        assert_return(ret, -EINVAL);
+
+        if (!triple_timestamp_is_set(&rt->timestamp))
+                return -ENODATA;
+
+        *ret = triple_timestamp_by_clock(&rt->timestamp, clock);
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_raw(sd_ndisc_router *rt, const void **ret, size_t *size) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+        assert_return(size, -EINVAL);
+
+        *ret = NDISC_ROUTER_RAW(rt);
+        *size = rt->raw_size;
+
+        return 0;
+}
+
+int ndisc_router_parse(sd_ndisc_router *rt) {
+        struct nd_router_advert *a;
+        const uint8_t *p;
+        bool has_mtu = false, has_flag_extension = false;
+        size_t left;
+
+        assert(rt);
+
+        if (rt->raw_size < sizeof(struct nd_router_advert)) {
+                log_ndisc("Too small to be a router advertisement, ignoring.");
+                return -EBADMSG;
+        }
+
+        /* Router advertisement packets are neatly aligned to 64bit boundaries, hence we can access them directly */
+        a = NDISC_ROUTER_RAW(rt);
+
+        if (a->nd_ra_type != ND_ROUTER_ADVERT) {
+                log_ndisc("Received ND packet that is not a router advertisement, ignoring.");
+                return -EBADMSG;
+        }
+
+        if (a->nd_ra_code != 0) {
+                log_ndisc("Received ND packet with wrong RA code, ignoring.");
+                return -EBADMSG;
+        }
+
+        rt->hop_limit = a->nd_ra_curhoplimit;
+        rt->flags = a->nd_ra_flags_reserved; /* the first 8bit */
+        rt->lifetime = be16toh(a->nd_ra_router_lifetime);
+
+        rt->preference = (rt->flags >> 3) & 3;
+        if (!IN_SET(rt->preference, SD_NDISC_PREFERENCE_LOW, SD_NDISC_PREFERENCE_HIGH))
+                rt->preference = SD_NDISC_PREFERENCE_MEDIUM;
+
+        p = (const uint8_t*) NDISC_ROUTER_RAW(rt) + sizeof(struct nd_router_advert);
+        left = rt->raw_size - sizeof(struct nd_router_advert);
+
+        for (;;) {
+                uint8_t type;
+                size_t length;
+
+                if (left == 0)
+                        break;
+
+                if (left < 2) {
+                        log_ndisc("Option lacks header, ignoring datagram.");
+                        return -EBADMSG;
+                }
+
+                type = p[0];
+                length = p[1] * 8;
+
+                if (length == 0) {
+                        log_ndisc("Zero-length option, ignoring datagram.");
+                        return -EBADMSG;
+                }
+                if (left < length) {
+                        log_ndisc("Option truncated, ignoring datagram.");
+                        return -EBADMSG;
+                }
+
+                switch (type) {
+
+                case SD_NDISC_OPTION_PREFIX_INFORMATION:
+
+                        if (length != 4*8) {
+                                log_ndisc("Prefix option of invalid size, ignoring datagram.");
+                                return -EBADMSG;
+                        }
+
+                        if (p[2] > 128) {
+                                log_ndisc("Bad prefix length, ignoring datagram.");
+                                return -EBADMSG;
+                        }
+
+                        break;
+
+                case SD_NDISC_OPTION_MTU: {
+                        uint32_t m;
+
+                        if (has_mtu) {
+                                log_ndisc("MTU option specified twice, ignoring.");
+                                continue;
+                        }
+
+                        if (length != 8) {
+                                log_ndisc("MTU option of invalid size, ignoring datagram.");
+                                return -EBADMSG;
+                        }
+
+                        m = be32toh(*(uint32_t*) (p + 4));
+                        if (m >= IPV6_MIN_MTU) /* ignore invalidly small MTUs */
+                                rt->mtu = m;
+
+                        has_mtu = true;
+                        break;
+                }
+
+                case SD_NDISC_OPTION_ROUTE_INFORMATION:
+                        if (length < 1*8 || length > 3*8) {
+                                log_ndisc("Route information option of invalid size, ignoring datagram.");
+                                return -EBADMSG;
+                        }
+
+                        if (p[2] > 128) {
+                                log_ndisc("Bad route prefix length, ignoring datagram.");
+                                return -EBADMSG;
+                        }
+
+                        break;
+
+                case SD_NDISC_OPTION_RDNSS:
+                        if (length < 3*8 || (length % (2*8)) != 1*8) {
+                                log_ndisc("RDNSS option has invalid size.");
+                                return -EBADMSG;
+                        }
+
+                        break;
+
+                case SD_NDISC_OPTION_FLAGS_EXTENSION:
+
+                        if (has_flag_extension) {
+                                log_ndisc("Flags extension option specified twice, ignoring.");
+                                continue;
+                        }
+
+                        if (length < 1*8) {
+                                log_ndisc("Flags extension option has invalid size.");
+                                return -EBADMSG;
+                        }
+
+                        /* Add in the additional flags bits */
+                        rt->flags |=
+                                ((uint64_t) p[2] << 8) |
+                                ((uint64_t) p[3] << 16) |
+                                ((uint64_t) p[4] << 24) |
+                                ((uint64_t) p[5] << 32) |
+                                ((uint64_t) p[6] << 40) |
+                                ((uint64_t) p[7] << 48);
+
+                        has_flag_extension = true;
+                        break;
+
+                case SD_NDISC_OPTION_DNSSL:
+                        if (length < 2*8) {
+                                log_ndisc("DNSSL option has invalid size.");
+                                return -EBADMSG;
+                        }
+
+                        break;
+                }
+
+                p += length, left -= length;
+        }
+
+        rt->rindex = sizeof(struct nd_router_advert);
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_hop_limit(sd_ndisc_router *rt, uint8_t *ret) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        *ret = rt->hop_limit;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_flags(sd_ndisc_router *rt, uint64_t *ret_flags) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret_flags, -EINVAL);
+
+        *ret_flags = rt->flags;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_lifetime(sd_ndisc_router *rt, uint16_t *ret_lifetime) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret_lifetime, -EINVAL);
+
+        *ret_lifetime = rt->lifetime;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_preference(sd_ndisc_router *rt, unsigned *ret) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        *ret = rt->preference;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_get_mtu(sd_ndisc_router *rt, uint32_t *ret) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        if (rt->mtu <= 0)
+                return -ENODATA;
+
+        *ret = rt->mtu;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_option_rewind(sd_ndisc_router *rt) {
+        assert_return(rt, -EINVAL);
+
+        assert(rt->raw_size >= sizeof(struct nd_router_advert));
+        rt->rindex = sizeof(struct nd_router_advert);
+
+        return rt->rindex < rt->raw_size;
+}
+
+_public_ int sd_ndisc_router_option_next(sd_ndisc_router *rt) {
+        size_t length;
+
+        assert_return(rt, -EINVAL);
+
+        if (rt->rindex == rt->raw_size) /* EOF */
+                return -ESPIPE;
+
+        if (rt->rindex + 2 > rt->raw_size) /* Truncated message */
+                return -EBADMSG;
+
+        length = NDISC_ROUTER_OPTION_LENGTH(rt);
+        if (rt->rindex + length > rt->raw_size)
+                return -EBADMSG;
+
+        rt->rindex += length;
+        return rt->rindex < rt->raw_size;
+}
+
+_public_ int sd_ndisc_router_option_get_type(sd_ndisc_router *rt, uint8_t *ret) {
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        if (rt->rindex == rt->raw_size) /* EOF */
+                return -ESPIPE;
+
+        if (rt->rindex + 2 > rt->raw_size) /* Truncated message */
+                return -EBADMSG;
+
+        *ret = NDISC_ROUTER_OPTION_TYPE(rt);
+        return 0;
+}
+
+_public_ int sd_ndisc_router_option_is_type(sd_ndisc_router *rt, uint8_t type) {
+        uint8_t k;
+        int r;
+
+        assert_return(rt, -EINVAL);
+
+        r = sd_ndisc_router_option_get_type(rt, &k);
+        if (r < 0)
+                return r;
+
+        return type == k;
+}
+
+_public_ int sd_ndisc_router_option_get_raw(sd_ndisc_router *rt, const void **ret, size_t *size) {
+        size_t length;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+        assert_return(size, -EINVAL);
+
+        /* Note that this returns the full option, including the option header */
+
+        if (rt->rindex + 2 > rt->raw_size)
+                return -EBADMSG;
+
+        length = NDISC_ROUTER_OPTION_LENGTH(rt);
+        if (rt->rindex + length > rt->raw_size)
+                return -EBADMSG;
+
+        *ret = (uint8_t*) NDISC_ROUTER_RAW(rt) + rt->rindex;
+        *size = length;
+
+        return 0;
+}
+
+static int get_prefix_info(sd_ndisc_router *rt, struct nd_opt_prefix_info **ret) {
+        struct nd_opt_prefix_info *ri;
+        size_t length;
+        int r;
+
+        assert(rt);
+        assert(ret);
+
+        r = sd_ndisc_router_option_is_type(rt, SD_NDISC_OPTION_PREFIX_INFORMATION);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return -EMEDIUMTYPE;
+
+        length = NDISC_ROUTER_OPTION_LENGTH(rt);
+        if (length != sizeof(struct nd_opt_prefix_info))
+                return -EBADMSG;
+
+        ri = (struct nd_opt_prefix_info*) ((uint8_t*) NDISC_ROUTER_RAW(rt) + rt->rindex);
+        if (ri->nd_opt_pi_prefix_len > 128)
+                return -EBADMSG;
+
+        *ret = ri;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_prefix_get_valid_lifetime(sd_ndisc_router *rt, uint32_t *ret) {
+        struct nd_opt_prefix_info *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_prefix_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret = be32toh(ri->nd_opt_pi_valid_time);
+        return 0;
+}
+
+_public_ int sd_ndisc_router_prefix_get_preferred_lifetime(sd_ndisc_router *rt, uint32_t *ret) {
+        struct nd_opt_prefix_info *pi;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_prefix_info(rt, &pi);
+        if (r < 0)
+                return r;
+
+        *ret = be32toh(pi->nd_opt_pi_preferred_time);
+        return 0;
+}
+
+_public_ int sd_ndisc_router_prefix_get_flags(sd_ndisc_router *rt, uint8_t *ret) {
+        struct nd_opt_prefix_info *pi;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_prefix_info(rt, &pi);
+        if (r < 0)
+                return r;
+
+        *ret = pi->nd_opt_pi_flags_reserved;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_prefix_get_address(sd_ndisc_router *rt, struct in6_addr *ret_addr) {
+        struct nd_opt_prefix_info *pi;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret_addr, -EINVAL);
+
+        r = get_prefix_info(rt, &pi);
+        if (r < 0)
+                return r;
+
+        *ret_addr = pi->nd_opt_pi_prefix;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_prefix_get_prefixlen(sd_ndisc_router *rt, unsigned *ret) {
+        struct nd_opt_prefix_info *pi;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_prefix_info(rt, &pi);
+        if (r < 0)
+                return r;
+
+        if (pi->nd_opt_pi_prefix_len > 128)
+                return -EBADMSG;
+
+        *ret = pi->nd_opt_pi_prefix_len;
+        return 0;
+}
+
+static int get_route_info(sd_ndisc_router *rt, uint8_t **ret) {
+        uint8_t *ri;
+        size_t length;
+        int r;
+
+        assert(rt);
+        assert(ret);
+
+        r = sd_ndisc_router_option_is_type(rt, SD_NDISC_OPTION_ROUTE_INFORMATION);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return -EMEDIUMTYPE;
+
+        length = NDISC_ROUTER_OPTION_LENGTH(rt);
+        if (length < 1*8 || length > 3*8)
+                return -EBADMSG;
+
+        ri = (uint8_t*) NDISC_ROUTER_RAW(rt) + rt->rindex;
+
+        if (ri[2] > 128)
+                return -EBADMSG;
+
+        *ret = ri;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_route_get_lifetime(sd_ndisc_router *rt, uint32_t *ret) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_route_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret = be32toh(*(uint32_t*) (ri + 4));
+        return 0;
+}
+
+_public_ int sd_ndisc_router_route_get_address(sd_ndisc_router *rt, struct in6_addr *ret_addr) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret_addr, -EINVAL);
+
+        r = get_route_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        zero(*ret_addr);
+        memcpy(ret_addr, ri + 8, NDISC_ROUTER_OPTION_LENGTH(rt) - 8);
+
+        return 0;
+}
+
+_public_ int sd_ndisc_router_route_get_prefixlen(sd_ndisc_router *rt, unsigned *ret) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_route_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret = ri[2];
+        return 0;
+}
+
+_public_ int sd_ndisc_router_route_get_preference(sd_ndisc_router *rt, unsigned *ret) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_route_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret = (ri[3] >> 3) & 3;
+        if (!IN_SET(*ret, SD_NDISC_PREFERENCE_LOW, SD_NDISC_PREFERENCE_HIGH))
+                *ret = SD_NDISC_PREFERENCE_MEDIUM;
+
+        return 0;
+}
+
+static int get_rdnss_info(sd_ndisc_router *rt, uint8_t **ret) {
+        size_t length;
+        int r;
+
+        assert(rt);
+        assert(ret);
+
+        r = sd_ndisc_router_option_is_type(rt, SD_NDISC_OPTION_RDNSS);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return -EMEDIUMTYPE;
+
+        length = NDISC_ROUTER_OPTION_LENGTH(rt);
+        if (length < 3*8 || (length % (2*8)) != 1*8)
+                return -EBADMSG;
+
+        *ret = (uint8_t*) NDISC_ROUTER_RAW(rt) + rt->rindex;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_rdnss_get_addresses(sd_ndisc_router *rt, const struct in6_addr **ret) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_rdnss_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret = (const struct in6_addr*) (ri + 8);
+        return (NDISC_ROUTER_OPTION_LENGTH(rt) - 8) / 16;
+}
+
+_public_ int sd_ndisc_router_rdnss_get_lifetime(sd_ndisc_router *rt, uint32_t *ret) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_rdnss_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret = be32toh(*(uint32_t*) (ri + 4));
+        return 0;
+}
+
+static int get_dnssl_info(sd_ndisc_router *rt, uint8_t **ret) {
+        size_t length;
+        int r;
+
+        assert(rt);
+        assert(ret);
+
+        r = sd_ndisc_router_option_is_type(rt, SD_NDISC_OPTION_DNSSL);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return -EMEDIUMTYPE;
+
+        length = NDISC_ROUTER_OPTION_LENGTH(rt);
+        if (length < 2*8)
+                return -EBADMSG;
+
+        *ret = (uint8_t*) NDISC_ROUTER_RAW(rt) + rt->rindex;
+        return 0;
+}
+
+_public_ int sd_ndisc_router_dnssl_get_domains(sd_ndisc_router *rt, char ***ret) {
+        _cleanup_strv_free_ char **l = NULL;
+        _cleanup_free_ char *e = NULL;
+        size_t allocated = 0, n = 0, left;
+        uint8_t *ri, *p;
+        bool first = true;
+        int r;
+        unsigned k = 0;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret, -EINVAL);
+
+        r = get_dnssl_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        p = ri + 8;
+        left = NDISC_ROUTER_OPTION_LENGTH(rt) - 8;
+
+        for (;;) {
+                if (left == 0) {
+
+                        if (n > 0) /* Not properly NUL terminated */
+                                return -EBADMSG;
+
+                        break;
+                }
+
+                if (*p == 0) {
+                        /* Found NUL termination */
+
+                        if (n > 0) {
+                                _cleanup_free_ char *normalized = NULL;
+
+                                e[n] = 0;
+                                r = dns_name_normalize(e, &normalized);
+                                if (r < 0)
+                                        return r;
+
+                                /* Ignore the root domain name or "localhost" and friends */
+                                if (!is_localhost(normalized) &&
+                                    !dns_name_is_root(normalized)) {
+
+                                        if (strv_push(&l, normalized) < 0)
+                                                return -ENOMEM;
+
+                                        normalized = NULL;
+                                        k++;
+                                }
+                        }
+
+                        n = 0;
+                        first = true;
+                        p++, left--;
+                        continue;
+                }
+
+                /* Check for compression (which is not allowed) */
+                if (*p > 63)
+                        return -EBADMSG;
+
+                if (1U + *p + 1U > left)
+                        return -EBADMSG;
+
+                if (!GREEDY_REALLOC(e, allocated, n + !first + DNS_LABEL_ESCAPED_MAX + 1U))
+                        return -ENOMEM;
+
+                if (first)
+                        first = false;
+                else
+                        e[n++] = '.';
+
+                r = dns_label_escape((char*) p+1, *p, e + n, DNS_LABEL_ESCAPED_MAX);
+                if (r < 0)
+                        return r;
+
+                n += r;
+
+                left -= 1 + *p;
+                p += 1 + *p;
+        }
+
+        if (strv_isempty(l)) {
+                *ret = NULL;
+                return 0;
+        }
+
+        *ret = l;
+        l = NULL;
+
+        return k;
+}
+
+_public_ int sd_ndisc_router_dnssl_get_lifetime(sd_ndisc_router *rt, uint32_t *ret_sec) {
+        uint8_t *ri;
+        int r;
+
+        assert_return(rt, -EINVAL);
+        assert_return(ret_sec, -EINVAL);
+
+        r = get_dnssl_info(rt, &ri);
+        if (r < 0)
+                return r;
+
+        *ret_sec = be32toh(*(uint32_t*) (ri + 4));
+        return 0;
+}
diff --git a/src/libsystemd-network/src/network-internal.c b/src/libsystemd-network/src/network-internal.c
index 53a2202068..df0d335ca0 100644
--- a/src/libsystemd-network/src/network-internal.c
+++ b/src/libsystemd-network/src/network-internal.c
@@ -102,16 +102,16 @@ bool net_match_config(const struct ether_addr *match_mac,
                       const char *dev_type,
                       const char *dev_name) {
 
-        if (match_host && !condition_test(match_host))
+        if (match_host && condition_test(match_host) <= 0)
                 return false;
 
-        if (match_virt && !condition_test(match_virt))
+        if (match_virt && condition_test(match_virt) <= 0)
                 return false;
 
-        if (match_kernel && !condition_test(match_kernel))
+        if (match_kernel && condition_test(match_kernel) <= 0)
                 return false;
 
-        if (match_arch && !condition_test(match_arch))
+        if (match_arch && condition_test(match_arch) <= 0)
                 return false;
 
         if (match_mac && (!dev_mac || memcmp(match_mac, dev_mac, ETH_ALEN)))
@@ -380,18 +380,21 @@ int deserialize_in_addrs(struct in_addr **ret, const char *string) {
         return size;
 }
 
-void serialize_in6_addrs(FILE *f, const struct in6_addr *addresses,
-                         size_t size) {
+void serialize_in6_addrs(FILE *f, const struct in6_addr *addresses, size_t size) {
         unsigned i;
 
         assert(f);
         assert(addresses);
         assert(size);
 
-        for (i = 0; i < size; i++)
-                fprintf(f, SD_NDISC_ADDRESS_FORMAT_STR"%s",
-                        SD_NDISC_ADDRESS_FORMAT_VAL(addresses[i]),
-                        (i < (size - 1)) ? " ": "");
+        for (i = 0; i < size; i++) {
+                char buffer[INET6_ADDRSTRLEN];
+
+                fputs(inet_ntop(AF_INET6, addresses+i, buffer, sizeof(buffer)), f);
+
+                if (i < size - 1)
+                        fputc(' ', f);
+        }
 }
 
 int deserialize_in6_addrs(struct in6_addr **ret, const char *string) {
diff --git a/src/libsystemd-network/src/sd-dhcp-client.c b/src/libsystemd-network/src/sd-dhcp-client.c
index 5bf04ed028..75895f2e58 100644
--- a/src/libsystemd-network/src/sd-dhcp-client.c
+++ b/src/libsystemd-network/src/sd-dhcp-client.c
@@ -53,7 +53,7 @@ struct sd_dhcp_client {
         sd_event *event;
         int event_priority;
         sd_event_source *timeout_resend;
-        int index;
+        int ifindex;
         int fd;
         union sockaddr_union link;
         sd_event_source *receive_message;
@@ -101,7 +101,7 @@ struct sd_dhcp_client {
         sd_event_source *timeout_t1;
         sd_event_source *timeout_t2;
         sd_event_source *timeout_expire;
-        sd_dhcp_client_callback_t cb;
+        sd_dhcp_client_callback_t callback;
         void *userdata;
         sd_dhcp_lease *lease;
         usec_t start_delay;
@@ -131,9 +131,10 @@ int sd_dhcp_client_set_callback(
                 sd_dhcp_client *client,
                 sd_dhcp_client_callback_t cb,
                 void *userdata) {
+
         assert_return(client, -EINVAL);
 
-        client->cb = cb;
+        client->callback = cb;
         client->userdata = userdata;
 
         return 0;
@@ -151,10 +152,10 @@ int sd_dhcp_client_set_request_option(sd_dhcp_client *client, uint8_t option) {
         size_t i;
 
         assert_return(client, -EINVAL);
-        assert_return (IN_SET(client->state, DHCP_STATE_INIT,
-                              DHCP_STATE_STOPPED), -EBUSY);
+        assert_return(IN_SET(client->state, DHCP_STATE_INIT, DHCP_STATE_STOPPED), -EBUSY);
 
         switch(option) {
+
         case SD_DHCP_OPTION_PAD:
         case SD_DHCP_OPTION_OVERLOAD:
         case SD_DHCP_OPTION_MESSAGE_TYPE:
@@ -182,9 +183,9 @@ int sd_dhcp_client_set_request_option(sd_dhcp_client *client, uint8_t option) {
 int sd_dhcp_client_set_request_address(
                 sd_dhcp_client *client,
                 const struct in_addr *last_addr) {
+
         assert_return(client, -EINVAL);
-        assert_return (IN_SET(client->state, DHCP_STATE_INIT,
-                              DHCP_STATE_STOPPED), -EBUSY);
+        assert_return(IN_SET(client->state, DHCP_STATE_INIT, DHCP_STATE_STOPPED), -EBUSY);
 
         if (last_addr)
                 client->last_addr = last_addr->s_addr;
@@ -194,14 +195,13 @@ int sd_dhcp_client_set_request_address(
         return 0;
 }
 
-int sd_dhcp_client_set_index(sd_dhcp_client *client, int interface_index) {
-        assert_return(client, -EINVAL);
-        assert_return (IN_SET(client->state, DHCP_STATE_INIT,
-                              DHCP_STATE_STOPPED), -EBUSY);
-        assert_return(interface_index > 0, -EINVAL);
+int sd_dhcp_client_set_ifindex(sd_dhcp_client *client, int ifindex) {
 
-        client->index = interface_index;
+        assert_return(client, -EINVAL);
+        assert_return(IN_SET(client->state, DHCP_STATE_INIT, DHCP_STATE_STOPPED), -EBUSY);
+        assert_return(ifindex > 0, -EINVAL);
 
+        client->ifindex = ifindex;
         return 0;
 }
 
@@ -231,8 +231,7 @@ int sd_dhcp_client_set_mac(
                 return 0;
 
         if (!IN_SET(client->state, DHCP_STATE_INIT, DHCP_STATE_STOPPED)) {
-                log_dhcp_client(client, "Changing MAC address on running DHCP "
-                                "client, restarting");
+                log_dhcp_client(client, "Changing MAC address on running DHCP client, restarting");
                 need_restart = true;
                 client_stop(client, SD_DHCP_CLIENT_EVENT_STOP);
         }
@@ -284,14 +283,17 @@ int sd_dhcp_client_set_client_id(
         assert_return(data_len > 0 && data_len <= MAX_CLIENT_ID_LEN, -EINVAL);
 
         switch (type) {
+
         case ARPHRD_ETHER:
                 if (data_len != ETH_ALEN)
                         return -EINVAL;
                 break;
+
         case ARPHRD_INFINIBAND:
                 if (data_len != INFINIBAND_ALEN)
                         return -EINVAL;
                 break;
+
         default:
                 break;
         }
@@ -348,7 +350,7 @@ int sd_dhcp_client_set_iaid_duid(
 
         /* If IAID is not configured, generate it. */
         if (iaid == 0) {
-                r = dhcp_identifier_set_iaid(client->index, client->mac_addr,
+                r = dhcp_identifier_set_iaid(client->ifindex, client->mac_addr,
                                              client->mac_addr_len,
                                              &client->client_id.ns.iaid);
                 if (r < 0)
@@ -435,28 +437,29 @@ int sd_dhcp_client_set_mtu(sd_dhcp_client *client, uint32_t mtu) {
 
 int sd_dhcp_client_get_lease(sd_dhcp_client *client, sd_dhcp_lease **ret) {
         assert_return(client, -EINVAL);
-        assert_return(ret, -EINVAL);
 
         if (client->state != DHCP_STATE_BOUND &&
             client->state != DHCP_STATE_RENEWING &&
             client->state != DHCP_STATE_REBINDING)
                 return -EADDRNOTAVAIL;
 
-        *ret = client->lease;
+        if (ret)
+                *ret = client->lease;
 
         return 0;
 }
 
 static void client_notify(sd_dhcp_client *client, int event) {
-        if (client->cb)
-                client->cb(client, event, client->userdata);
+        assert(client);
+
+        if (client->callback)
+                client->callback(client, event, client->userdata);
 }
 
 static int client_initialize(sd_dhcp_client *client) {
         assert_return(client, -EINVAL);
 
-        client->receive_message =
-                sd_event_source_unref(client->receive_message);
+        client->receive_message = sd_event_source_unref(client->receive_message);
 
         client->fd = asynchronous_close(client->fd);
 
@@ -565,7 +568,7 @@ static int client_message_init(
 
                 client->client_id.type = 255;
 
-                r = dhcp_identifier_set_iaid(client->index, client->mac_addr, client->mac_addr_len, &client->client_id.ns.iaid);
+                r = dhcp_identifier_set_iaid(client->ifindex, client->mac_addr, client->mac_addr_len, &client->client_id.ns.iaid);
                 if (r < 0)
                         return r;
 
@@ -751,8 +754,9 @@ static int client_send_request(sd_dhcp_client *client) {
         size_t optoffset, optlen;
         int r;
 
-        r = client_message_init(client, &request, DHCP_REQUEST,
-                                &optlen, &optoffset);
+        assert(client);
+
+        r = client_message_init(client, &request, DHCP_REQUEST, &optlen, &optoffset);
         if (r < 0)
                 return r;
 
@@ -849,18 +853,23 @@ static int client_send_request(sd_dhcp_client *client) {
                 return r;
 
         switch (client->state) {
+
         case DHCP_STATE_REQUESTING:
                 log_dhcp_client(client, "REQUEST (requesting)");
                 break;
+
         case DHCP_STATE_INIT_REBOOT:
                 log_dhcp_client(client, "REQUEST (init-reboot)");
                 break;
+
         case DHCP_STATE_RENEWING:
                 log_dhcp_client(client, "REQUEST (renewing)");
                 break;
+
         case DHCP_STATE_REBINDING:
                 log_dhcp_client(client, "REQUEST (rebinding)");
                 break;
+
         default:
                 log_dhcp_client(client, "REQUEST (invalid)");
                 break;
@@ -892,6 +901,7 @@ static int client_timeout_resend(
                 goto error;
 
         switch (client->state) {
+
         case DHCP_STATE_RENEWING:
 
                 time_left = (client->lease->t2 - client->lease->t1) / 2;
@@ -1101,15 +1111,14 @@ static int client_start_delayed(sd_dhcp_client *client) {
 
         assert_return(client, -EINVAL);
         assert_return(client->event, -EINVAL);
-        assert_return(client->index > 0, -EINVAL);
+        assert_return(client->ifindex > 0, -EINVAL);
         assert_return(client->fd < 0, -EBUSY);
         assert_return(client->xid == 0, -EINVAL);
-        assert_return(client->state == DHCP_STATE_INIT ||
-                      client->state == DHCP_STATE_INIT_REBOOT, -EBUSY);
+        assert_return(IN_SET(client->state, DHCP_STATE_INIT, DHCP_STATE_INIT_REBOOT), -EBUSY);
 
         client->xid = random_u32();
 
-        r = dhcp_network_bind_raw_socket(client->index, &client->link,
+        r = dhcp_network_bind_raw_socket(client->ifindex, &client->link,
                                          client->xid, client->mac_addr,
                                          client->mac_addr_len, client->arp_type);
         if (r < 0) {
@@ -1151,13 +1160,15 @@ static int client_timeout_t2(sd_event_source *s, uint64_t usec, void *userdata)
         DHCP_CLIENT_DONT_DESTROY(client);
         int r;
 
+        assert(client);
+
         client->receive_message = sd_event_source_unref(client->receive_message);
         client->fd = asynchronous_close(client->fd);
 
         client->state = DHCP_STATE_REBINDING;
         client->attempt = 1;
 
-        r = dhcp_network_bind_raw_socket(client->index, &client->link,
+        r = dhcp_network_bind_raw_socket(client->ifindex, &client->link,
                                          client->xid, client->mac_addr,
                                          client->mac_addr_len, client->arp_type);
         if (r < 0) {
@@ -1624,7 +1635,7 @@ static int client_receive_message_udp(
 
         sd_dhcp_client *client = userdata;
         _cleanup_free_ DHCPMessage *message = NULL;
-        const struct ether_addr zero_mac = { { 0, 0, 0, 0, 0, 0 } };
+        const struct ether_addr zero_mac = {};
         const struct ether_addr *expected_chaddr = NULL;
         uint8_t expected_hlen = 0;
         ssize_t len, buflen;
@@ -1645,9 +1656,9 @@ static int client_receive_message_udp(
                 if (errno == EAGAIN || errno == EINTR)
                         return 0;
 
-                log_dhcp_client(client, "Could not receive message from UDP socket: %m");
-                return -errno;
-        } else if ((size_t)len < sizeof(DHCPMessage)) {
+                return log_dhcp_client_errno(client, errno, "Could not receive message from UDP socket: %m");
+        }
+        if ((size_t) len < sizeof(DHCPMessage)) {
                 log_dhcp_client(client, "Too small to be a DHCP message: ignoring");
                 return 0;
         }
@@ -1778,7 +1789,7 @@ int sd_dhcp_client_start(sd_dhcp_client *client) {
 
         r = client_start(client);
         if (r >= 0)
-                log_dhcp_client(client, "STARTED on ifindex %i", client->index);
+                log_dhcp_client(client, "STARTED on ifindex %i", client->ifindex);
 
         return r;
 }
@@ -1822,8 +1833,7 @@ int sd_dhcp_client_detach_event(sd_dhcp_client *client) {
 }
 
 sd_event *sd_dhcp_client_get_event(sd_dhcp_client *client) {
-        if (!client)
-                return NULL;
+        assert_return(client, NULL);
 
         return client->event;
 }
@@ -1879,13 +1889,12 @@ int sd_dhcp_client_new(sd_dhcp_client **ret) {
 
         client->n_ref = 1;
         client->state = DHCP_STATE_INIT;
-        client->index = -1;
+        client->ifindex = -1;
         client->fd = -1;
         client->attempt = 1;
         client->mtu = DHCP_DEFAULT_MIN_SIZE;
 
         client->req_opts_size = ELEMENTSOF(default_req_opts);
-
         client->req_opts = memdup(default_req_opts, client->req_opts_size);
         if (!client->req_opts)
                 return -ENOMEM;
diff --git a/src/libsystemd-network/src/sd-dhcp-server.c b/src/libsystemd-network/src/sd-dhcp-server.c
index 5abc923d92..4a6c14e80c 100644
--- a/src/libsystemd-network/src/sd-dhcp-server.c
+++ b/src/libsystemd-network/src/sd-dhcp-server.c
@@ -25,6 +25,7 @@
 #include "basic/in-addr-util.h"
 #include "basic/siphash24.h"
 #include "basic/string-util.h"
+#include "basic/unaligned.h"
 #include "systemd-network/dhcp-internal.h"
 #include "systemd-network/dhcp-server-internal.h"
 #include "systemd-network/sd-dhcp-server.h"
@@ -258,7 +259,7 @@ static int dhcp_server_send_unicast_raw(sd_dhcp_server *server,
                                         DHCPPacket *packet, size_t len) {
         union sockaddr_union link = {
                 .ll.sll_family = AF_PACKET,
-                .ll.sll_protocol = htons(ETH_P_IP),
+                .ll.sll_protocol = htobe16(ETH_P_IP),
                 .ll.sll_ifindex = server->ifindex,
                 .ll.sll_halen = ETH_ALEN,
         };
@@ -603,17 +604,17 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us
         switch(code) {
         case SD_DHCP_OPTION_IP_ADDRESS_LEASE_TIME:
                 if (len == 4)
-                        req->lifetime = be32toh(*(be32_t*)option);
+                        req->lifetime = unaligned_read_be32(option);
 
                 break;
         case SD_DHCP_OPTION_REQUESTED_IP_ADDRESS:
                 if (len == 4)
-                        req->requested_ip = *(be32_t*)option;
+                        memcpy(&req->requested_ip, option, sizeof(be32_t));
 
                 break;
         case SD_DHCP_OPTION_SERVER_IDENTIFIER:
                 if (len == 4)
-                        req->server_id = *(be32_t*)option;
+                        memcpy(&req->server_id, option, sizeof(be32_t));
 
                 break;
         case SD_DHCP_OPTION_CLIENT_IDENTIFIER:
@@ -631,9 +632,9 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us
 
                 break;
         case SD_DHCP_OPTION_MAXIMUM_MESSAGE_SIZE:
-                if (len == 2)
-                        req->max_optlen = be16toh(*(be16_t*)option) -
-                                          - sizeof(DHCPPacket);
+
+                if (len == 2 && unaligned_read_be16(option) >= sizeof(DHCPPacket))
+                        req->max_optlen = unaligned_read_be16(option) - sizeof(DHCPPacket);
 
                 break;
         }
diff --git a/src/libsystemd-network/src/sd-dhcp6-client.c b/src/libsystemd-network/src/sd-dhcp6-client.c
index ec652d4625..af5d91c946 100644
--- a/src/libsystemd-network/src/sd-dhcp6-client.c
+++ b/src/libsystemd-network/src/sd-dhcp6-client.c
@@ -45,7 +45,7 @@ struct sd_dhcp6_client {
         enum DHCP6State state;
         sd_event *event;
         int event_priority;
-        int index;
+        int ifindex;
         struct in6_addr local_address;
         uint8_t mac_addr[MAX_MAC_ADDR_LEN];
         size_t mac_addr_len;
@@ -64,7 +64,7 @@ struct sd_dhcp6_client {
         uint8_t retransmit_count;
         sd_event_source *timeout_resend;
         sd_event_source *timeout_resend_expire;
-        sd_dhcp6_client_callback_t cb;
+        sd_dhcp6_client_callback_t callback;
         void *userdata;
         struct duid duid;
         size_t duid_len;
@@ -115,22 +115,22 @@ int sd_dhcp6_client_set_callback(
                 sd_dhcp6_client *client,
                 sd_dhcp6_client_callback_t cb,
                 void *userdata) {
+
         assert_return(client, -EINVAL);
 
-        client->cb = cb;
+        client->callback = cb;
         client->userdata = userdata;
 
         return 0;
 }
 
-int sd_dhcp6_client_set_index(sd_dhcp6_client *client, int interface_index) {
-        assert_return(client, -EINVAL);
-        assert_return(interface_index >= -1, -EINVAL);
+int sd_dhcp6_client_set_ifindex(sd_dhcp6_client *client, int ifindex) {
 
+        assert_return(client, -EINVAL);
+        assert_return(ifindex >= -1, -EINVAL);
         assert_return(IN_SET(client->state, DHCP6_STATE_STOPPED), -EBUSY);
 
-        client->index = interface_index;
-
+        client->ifindex = ifindex;
         return 0;
 }
 
@@ -256,6 +256,7 @@ int sd_dhcp6_client_set_request_option(sd_dhcp6_client *client, uint16_t option)
         assert_return(client->state == DHCP6_STATE_STOPPED, -EBUSY);
 
         switch(option) {
+
         case SD_DHCP6_OPTION_DNS_SERVERS:
         case SD_DHCP6_OPTION_DOMAIN_LIST:
         case SD_DHCP6_OPTION_SNTP_SERVERS:
@@ -292,20 +293,25 @@ int sd_dhcp6_client_get_lease(sd_dhcp6_client *client, sd_dhcp6_lease **ret) {
 }
 
 static void client_notify(sd_dhcp6_client *client, int event) {
-        if (client->cb)
-                client->cb(client, event, client->userdata);
+        assert(client);
+
+        if (client->callback)
+                client->callback(client, event, client->userdata);
 }
 
 static void client_set_lease(sd_dhcp6_client *client, sd_dhcp6_lease *lease) {
+        assert(client);
+
         if (client->lease) {
                 dhcp6_lease_clear_timers(&client->lease->ia);
                 sd_dhcp6_lease_unref(client->lease);
         }
+
         client->lease = lease;
 }
 
 static int client_reset(sd_dhcp6_client *client) {
-        assert_return(client, -EINVAL);
+        assert(client);
 
         client_set_lease(client, NULL);
 
@@ -353,6 +359,8 @@ static int client_send_message(sd_dhcp6_client *client, usec_t time_now) {
         usec_t elapsed_usec;
         be16_t elapsed_time;
 
+        assert(client);
+
         len = sizeof(DHCP6Message) + optlen;
 
         message = malloc0(len);
@@ -454,9 +462,9 @@ static int client_send_message(sd_dhcp6_client *client, usec_t time_now) {
 static int client_timeout_t2(sd_event_source *s, uint64_t usec, void *userdata) {
         sd_dhcp6_client *client = userdata;
 
-        assert_return(s, -EINVAL);
-        assert_return(client, -EINVAL);
-        assert_return(client->lease, -EINVAL);
+        assert(s);
+        assert(client);
+        assert(client->lease);
 
         client->lease->ia.timeout_t2 =
                 sd_event_source_unref(client->lease->ia.timeout_t2);
@@ -471,9 +479,9 @@ static int client_timeout_t2(sd_event_source *s, uint64_t usec, void *userdata)
 static int client_timeout_t1(sd_event_source *s, uint64_t usec, void *userdata) {
         sd_dhcp6_client *client = userdata;
 
-        assert_return(s, -EINVAL);
-        assert_return(client, -EINVAL);
-        assert_return(client->lease, -EINVAL);
+        assert(s);
+        assert(client);
+        assert(client->lease);
 
         client->lease->ia.timeout_t1 =
                 sd_event_source_unref(client->lease->ia.timeout_t1);
@@ -671,7 +679,7 @@ static int client_ensure_iaid(sd_dhcp6_client *client) {
         if (client->ia_na.id)
                 return 0;
 
-        r = dhcp_identifier_set_iaid(client->index, client->mac_addr, client->mac_addr_len, &client->ia_na.id);
+        r = dhcp_identifier_set_iaid(client->ifindex, client->mac_addr, client->mac_addr_len, &client->ia_na.id);
         if (r < 0)
                 return r;
 
@@ -690,6 +698,11 @@ static int client_parse_message(
         bool clientid = false;
         be32_t iaid_lease;
 
+        assert(client);
+        assert(message);
+        assert(len >= sizeof(DHCP6Message));
+        assert(lease);
+
         option = (uint8_t *)message + sizeof(DHCP6Message);
         len -= sizeof(DHCP6Message);
 
@@ -834,9 +847,12 @@ static int client_parse_message(
 }
 
 static int client_receive_reply(sd_dhcp6_client *client, DHCP6Message *reply, size_t len) {
-        int r;
         _cleanup_(sd_dhcp6_lease_unrefp) sd_dhcp6_lease *lease = NULL;
         bool rapid_commit;
+        int r;
+
+        assert(client);
+        assert(reply);
 
         if (reply->type != DHCP6_REPLY)
                 return 0;
@@ -865,9 +881,9 @@ static int client_receive_reply(sd_dhcp6_client *client, DHCP6Message *reply, si
 }
 
 static int client_receive_advertise(sd_dhcp6_client *client, DHCP6Message *advertise, size_t len) {
-        int r;
         _cleanup_(sd_dhcp6_lease_unrefp) sd_dhcp6_lease *lease = NULL;
         uint8_t pref_advertise = 0, pref_lease = 0;
+        int r;
 
         if (advertise->type != DHCP6_ADVERTISE)
                 return 0;
@@ -898,7 +914,12 @@ static int client_receive_advertise(sd_dhcp6_client *client, DHCP6Message *adver
         return r;
 }
 
-static int client_receive_message(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
+static int client_receive_message(
+                sd_event_source *s,
+                int fd, uint32_t
+                revents,
+                void *userdata) {
+
         sd_dhcp6_client *client = userdata;
         DHCP6_CLIENT_DONT_DESTROY(client);
         _cleanup_free_ DHCP6Message *message = NULL;
@@ -924,8 +945,11 @@ static int client_receive_message(sd_event_source *s, int fd, uint32_t revents,
 
                 return log_dhcp6_client_errno(client, errno, "Could not receive message from UDP socket: %m");
 
-        } else if ((size_t)len < sizeof(DHCP6Message))
+        }
+        if ((size_t) len < sizeof(DHCP6Message)) {
+                log_dhcp6_client(client, "Too small to be DHCP6 message: ignoring");
                 return 0;
+        }
 
         switch(message->type) {
         case DHCP6_SOLICIT:
@@ -1019,7 +1043,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) {
 
         assert_return(client, -EINVAL);
         assert_return(client->event, -EINVAL);
-        assert_return(client->index > 0, -EINVAL);
+        assert_return(client->ifindex > 0, -EINVAL);
         assert_return(client->state != state, -EINVAL);
 
         client->timeout_resend_expire =
@@ -1152,12 +1176,12 @@ int sd_dhcp6_client_is_running(sd_dhcp6_client *client) {
 }
 
 int sd_dhcp6_client_start(sd_dhcp6_client *client) {
-        int r = 0;
         enum DHCP6State state = DHCP6_STATE_SOLICITATION;
+        int r = 0;
 
         assert_return(client, -EINVAL);
         assert_return(client->event, -EINVAL);
-        assert_return(client->index > 0, -EINVAL);
+        assert_return(client->ifindex > 0, -EINVAL);
         assert_return(in_addr_is_link_local(AF_INET6, (const union in_addr_union *) &client->local_address) > 0, -EINVAL);
 
         if (!IN_SET(client->state, DHCP6_STATE_STOPPED))
@@ -1175,7 +1199,7 @@ int sd_dhcp6_client_start(sd_dhcp6_client *client) {
         if (r < 0)
                 return r;
 
-        r = dhcp6_network_bind_udp_socket(client->index, &client->local_address);
+        r = dhcp6_network_bind_udp_socket(client->ifindex, &client->local_address);
         if (r < 0) {
                 _cleanup_free_ char *p = NULL;
 
@@ -1244,8 +1268,7 @@ int sd_dhcp6_client_detach_event(sd_dhcp6_client *client) {
 }
 
 sd_event *sd_dhcp6_client_get_event(sd_dhcp6_client *client) {
-        if (!client)
-                return NULL;
+        assert_return(client, NULL);
 
         return client->event;
 }
@@ -1293,15 +1316,11 @@ int sd_dhcp6_client_new(sd_dhcp6_client **ret) {
                 return -ENOMEM;
 
         client->n_ref = 1;
-
         client->ia_na.type = SD_DHCP6_OPTION_IA_NA;
-
-        client->index = -1;
-
+        client->ifindex = -1;
         client->fd = -1;
 
         client->req_opts_len = ELEMENTSOF(default_req_opts);
-
         client->req_opts = new0(be16_t, client->req_opts_len);
         if (!client->req_opts)
                 return -ENOMEM;
diff --git a/src/libsystemd-network/src/sd-ipv4acd.c b/src/libsystemd-network/src/sd-ipv4acd.c
index b361b16e7f..418a686150 100644
--- a/src/libsystemd-network/src/sd-ipv4acd.c
+++ b/src/libsystemd-network/src/sd-ipv4acd.c
@@ -25,47 +25,32 @@
 #include <string.h>
 
 #include "basic/alloc-util.h"
+#include "basic/ether-addr-util.h"
 #include "basic/fd-util.h"
 #include "basic/in-addr-util.h"
 #include "basic/list.h"
 #include "basic/random-util.h"
-#include "basic/refcnt.h"
 #include "basic/siphash24.h"
+#include "basic/string-util.h"
 #include "basic/util.h"
 #include "systemd-network/arp-util.h"
 #include "systemd-network/sd-ipv4acd.h"
 
 /* Constants from the RFC */
-#define PROBE_WAIT 1
-#define PROBE_NUM 3
-#define PROBE_MIN 1
-#define PROBE_MAX 2
-#define ANNOUNCE_WAIT 2
-#define ANNOUNCE_NUM 2
-#define ANNOUNCE_INTERVAL 2
-#define MAX_CONFLICTS 10
-#define RATE_LIMIT_INTERVAL 60
-#define DEFEND_INTERVAL 10
-
-#define IPV4ACD_NETWORK 0xA9FE0000L
-#define IPV4ACD_NETMASK 0xFFFF0000L
-
-#define log_ipv4acd_full(ll, level, error, fmt, ...) log_internal(level, error, __FILE__, __LINE__, __func__, "ACD: " fmt, ##__VA_ARGS__)
-
-#define log_ipv4acd_debug(ll, ...)   log_ipv4acd_full(ll, LOG_DEBUG, 0, ##__VA_ARGS__)
-#define log_ipv4acd_info(ll, ...)    log_ipv4acd_full(ll, LOG_INFO, 0, ##__VA_ARGS__)
-#define log_ipv4acd_notice(ll, ...)  log_ipv4acd_full(ll, LOG_NOTICE, 0, ##__VA_ARGS__)
-#define log_ipv4acd_warning(ll, ...) log_ipv4acd_full(ll, LOG_WARNING, 0, ##__VA_ARGS__)
-#define log_ipv4acd_error(ll, ...)   log_ipv4acd_full(ll, LOG_ERR, 0, ##__VA_ARGS__)
-
-#define log_ipv4acd_debug_errno(ll, error, ...)   log_ipv4acd_full(ll, LOG_DEBUG, error, ##__VA_ARGS__)
-#define log_ipv4acd_info_errno(ll, error, ...)    log_ipv4acd_full(ll, LOG_INFO, error, ##__VA_ARGS__)
-#define log_ipv4acd_notice_errno(ll, error, ...)  log_ipv4acd_full(ll, LOG_NOTICE, error, ##__VA_ARGS__)
-#define log_ipv4acd_warning_errno(ll, error, ...) log_ipv4acd_full(ll, LOG_WARNING, error, ##__VA_ARGS__)
-#define log_ipv4acd_error_errno(ll, error, ...)   log_ipv4acd_full(ll, LOG_ERR, error, ##__VA_ARGS__)
+#define PROBE_WAIT_USEC (1U * USEC_PER_SEC)
+#define PROBE_NUM 3U
+#define PROBE_MIN_USEC (1U * USEC_PER_SEC)
+#define PROBE_MAX_USEC (2U * USEC_PER_SEC)
+#define ANNOUNCE_WAIT_USEC (2U * USEC_PER_SEC)
+#define ANNOUNCE_NUM 2U
+#define ANNOUNCE_INTERVAL_USEC (2U * USEC_PER_SEC)
+#define MAX_CONFLICTS 10U
+#define RATE_LIMIT_INTERVAL_USEC (60U * USEC_PER_SEC)
+#define DEFEND_INTERVAL_USEC (10U * USEC_PER_SEC)
 
 typedef enum IPv4ACDState {
         IPV4ACD_STATE_INIT,
+        IPV4ACD_STATE_STARTED,
         IPV4ACD_STATE_WAITING_PROBE,
         IPV4ACD_STATE_PROBING,
         IPV4ACD_STATE_WAITING_ANNOUNCE,
@@ -76,156 +61,164 @@ typedef enum IPv4ACDState {
 } IPv4ACDState;
 
 struct sd_ipv4acd {
-        RefCount n_ref;
+        unsigned n_ref;
 
         IPv4ACDState state;
-        int index;
+        int ifindex;
         int fd;
-        int iteration;
-        int conflict;
-        sd_event_source *receive_message;
-        sd_event_source *timer;
+
+        unsigned n_iteration;
+        unsigned n_conflict;
+
+        sd_event_source *receive_message_event_source;
+        sd_event_source *timer_event_source;
+
         usec_t defend_window;
         be32_t address;
+
         /* External */
         struct ether_addr mac_addr;
+
         sd_event *event;
         int event_priority;
-        sd_ipv4acd_callback_t cb;
+        sd_ipv4acd_callback_t callback;
         void* userdata;
 };
 
-sd_ipv4acd *sd_ipv4acd_ref(sd_ipv4acd *ll) {
-        if (ll)
-                assert_se(REFCNT_INC(ll->n_ref) >= 2);
+#define log_ipv4acd_errno(acd, error, fmt, ...) log_internal(LOG_DEBUG, error, __FILE__, __LINE__, __func__, "IPV4ACD: " fmt, ##__VA_ARGS__)
+#define log_ipv4acd(acd, fmt, ...) log_ipv4acd_errno(acd, 0, fmt, ##__VA_ARGS__)
+
+static void ipv4acd_set_state(sd_ipv4acd *acd, IPv4ACDState st, bool reset_counter) {
+        assert(acd);
+        assert(st < _IPV4ACD_STATE_MAX);
+
+        if (st == acd->state && !reset_counter)
+                acd->n_iteration++;
+        else {
+                acd->state = st;
+                acd->n_iteration = 0;
+        }
+}
+
+static void ipv4acd_reset(sd_ipv4acd *acd) {
+        assert(acd);
+
+        acd->timer_event_source = sd_event_source_unref(acd->timer_event_source);
+        acd->receive_message_event_source = sd_event_source_unref(acd->receive_message_event_source);
+
+        acd->fd = safe_close(acd->fd);
+
+        ipv4acd_set_state(acd, IPV4ACD_STATE_INIT, true);
+}
+
+sd_ipv4acd *sd_ipv4acd_ref(sd_ipv4acd *acd) {
+        if (!acd)
+                return NULL;
+
+        assert_se(acd->n_ref >= 1);
+        acd->n_ref++;
 
-        return ll;
+        return acd;
 }
 
-sd_ipv4acd *sd_ipv4acd_unref(sd_ipv4acd *ll) {
-        if (!ll || REFCNT_DEC(ll->n_ref) > 0)
+sd_ipv4acd *sd_ipv4acd_unref(sd_ipv4acd *acd) {
+        if (!acd)
                 return NULL;
 
-        ll->receive_message = sd_event_source_unref(ll->receive_message);
-        ll->fd = safe_close(ll->fd);
+        assert_se(acd->n_ref >= 1);
+        acd->n_ref--;
 
-        ll->timer = sd_event_source_unref(ll->timer);
+        if (acd->n_ref > 0)
+                return NULL;
 
-        sd_ipv4acd_detach_event(ll);
+        ipv4acd_reset(acd);
+        sd_ipv4acd_detach_event(acd);
 
-        free(ll);
+        free(acd);
 
         return NULL;
 }
 
 int sd_ipv4acd_new(sd_ipv4acd **ret) {
-        _cleanup_(sd_ipv4acd_unrefp) sd_ipv4acd *ll = NULL;
+        _cleanup_(sd_ipv4acd_unrefp) sd_ipv4acd *acd = NULL;
 
         assert_return(ret, -EINVAL);
 
-        ll = new0(sd_ipv4acd, 1);
-        if (!ll)
+        acd = new0(sd_ipv4acd, 1);
+        if (!acd)
                 return -ENOMEM;
 
-        ll->n_ref = REFCNT_INIT;
-        ll->state = IPV4ACD_STATE_INIT;
-        ll->index = -1;
-        ll->fd = -1;
+        acd->n_ref = 1;
+        acd->state = IPV4ACD_STATE_INIT;
+        acd->ifindex = -1;
+        acd->fd = -1;
 
-        *ret = ll;
-        ll = NULL;
+        *ret = acd;
+        acd = NULL;
 
         return 0;
 }
 
-static void ipv4acd_set_state(sd_ipv4acd *ll, IPv4ACDState st, bool reset_counter) {
-
-        assert(ll);
-        assert(st < _IPV4ACD_STATE_MAX);
-
-        if (st == ll->state && !reset_counter)
-                ll->iteration++;
-        else {
-                ll->state = st;
-                ll->iteration = 0;
-        }
-}
+static void ipv4acd_client_notify(sd_ipv4acd *acd, int event) {
+        assert(acd);
 
-static void ipv4acd_client_notify(sd_ipv4acd *ll, int event) {
-        assert(ll);
+        if (!acd->callback)
+                return;
 
-        if (ll->cb)
-                ll->cb(ll, event, ll->userdata);
+        acd->callback(acd, event, acd->userdata);
 }
 
-static void ipv4acd_stop(sd_ipv4acd *ll) {
-        assert(ll);
+int sd_ipv4acd_stop(sd_ipv4acd *acd) {
+        assert_return(acd, -EINVAL);
 
-        ll->receive_message = sd_event_source_unref(ll->receive_message);
-        ll->fd = safe_close(ll->fd);
+        ipv4acd_reset(acd);
 
-        ll->timer = sd_event_source_unref(ll->timer);
+        log_ipv4acd(acd, "STOPPED");
 
-        log_ipv4acd_debug(ll, "STOPPED");
-
-        ipv4acd_set_state (ll, IPV4ACD_STATE_INIT, true);
-}
-
-int sd_ipv4acd_stop(sd_ipv4acd *ll) {
-        assert_return(ll, -EINVAL);
-
-        ipv4acd_stop(ll);
-
-        ipv4acd_client_notify(ll, SD_IPV4ACD_EVENT_STOP);
+        ipv4acd_client_notify(acd, SD_IPV4ACD_EVENT_STOP);
 
         return 0;
 }
 
 static int ipv4acd_on_timeout(sd_event_source *s, uint64_t usec, void *userdata);
 
-static int ipv4acd_set_next_wakeup(sd_ipv4acd *ll, int sec, int random_sec) {
+static int ipv4acd_set_next_wakeup(sd_ipv4acd *acd, usec_t usec, usec_t random_usec) {
         _cleanup_(sd_event_source_unrefp) sd_event_source *timer = NULL;
-        usec_t next_timeout;
-        usec_t time_now;
+        usec_t next_timeout, time_now;
         int r;
 
-        assert(sec >= 0);
-        assert(random_sec >= 0);
-        assert(ll);
+        assert(acd);
 
-        next_timeout = sec * USEC_PER_SEC;
+        next_timeout = usec;
 
-        if (random_sec)
-                next_timeout += random_u32() % (random_sec * USEC_PER_SEC);
+        if (random_usec > 0)
+                next_timeout += (usec_t) random_u64() % random_usec;
 
-        assert_se(sd_event_now(ll->event, clock_boottime_or_monotonic(), &time_now) >= 0);
+        assert_se(sd_event_now(acd->event, clock_boottime_or_monotonic(), &time_now) >= 0);
 
-        r = sd_event_add_time(ll->event, &timer, clock_boottime_or_monotonic(),
-                              time_now + next_timeout, 0, ipv4acd_on_timeout, ll);
+        r = sd_event_add_time(acd->event, &timer, clock_boottime_or_monotonic(), time_now + next_timeout, 0, ipv4acd_on_timeout, acd);
         if (r < 0)
                 return r;
 
-        r = sd_event_source_set_priority(timer, ll->event_priority);
+        r = sd_event_source_set_priority(timer, acd->event_priority);
         if (r < 0)
                 return r;
 
-        r = sd_event_source_set_description(timer, "ipv4acd-timer");
-        if (r < 0)
-                return r;
+        (void) sd_event_source_set_description(timer, "ipv4acd-timer");
 
-        ll->timer = sd_event_source_unref(ll->timer);
-        ll->timer = timer;
+        sd_event_source_unref(acd->timer_event_source);
+        acd->timer_event_source = timer;
         timer = NULL;
 
         return 0;
 }
 
-static bool ipv4acd_arp_conflict(sd_ipv4acd *ll, struct ether_arp *arp) {
-        assert(ll);
+static bool ipv4acd_arp_conflict(sd_ipv4acd *acd, struct ether_arp *arp) {
+        assert(acd);
         assert(arp);
 
         /* see the BPF */
-        if (memcmp(arp->arp_spa, &ll->address, sizeof(ll->address)) == 0)
+        if (memcmp(arp->arp_spa, &acd->address, sizeof(acd->address)) == 0)
                 return true;
 
         /* the TPA matched instead of the SPA, this is not a conflict */
@@ -233,294 +226,300 @@ static bool ipv4acd_arp_conflict(sd_ipv4acd *ll, struct ether_arp *arp) {
 }
 
 static int ipv4acd_on_timeout(sd_event_source *s, uint64_t usec, void *userdata) {
-        sd_ipv4acd *ll = userdata;
+        sd_ipv4acd *acd = userdata;
         int r = 0;
 
-        assert(ll);
+        assert(acd);
+
+        switch (acd->state) {
 
-        switch (ll->state) {
-        case IPV4ACD_STATE_INIT:
+        case IPV4ACD_STATE_STARTED:
+                ipv4acd_set_state(acd, IPV4ACD_STATE_WAITING_PROBE, true);
 
-                ipv4acd_set_state(ll, IPV4ACD_STATE_WAITING_PROBE, true);
+                if (acd->n_conflict >= MAX_CONFLICTS) {
+                        char ts[FORMAT_TIMESPAN_MAX];
+                        log_ipv4acd(acd, "Max conflicts reached, delaying by %s", format_timespan(ts, sizeof(ts), RATE_LIMIT_INTERVAL_USEC, 0));
 
-                if (ll->conflict >= MAX_CONFLICTS) {
-                        log_ipv4acd_notice(ll, "Max conflicts reached, delaying by %us", RATE_LIMIT_INTERVAL);
-                        r = ipv4acd_set_next_wakeup(ll, RATE_LIMIT_INTERVAL, PROBE_WAIT);
+                        r = ipv4acd_set_next_wakeup(acd, RATE_LIMIT_INTERVAL_USEC, PROBE_WAIT_USEC);
                         if (r < 0)
-                                goto out;
+                                goto fail;
 
-                        ll->conflict = 0;
+                        acd->n_conflict = 0;
                 } else {
-                        r = ipv4acd_set_next_wakeup(ll, 0, PROBE_WAIT);
+                        r = ipv4acd_set_next_wakeup(acd, 0, PROBE_WAIT_USEC);
                         if (r < 0)
-                                goto out;
+                                goto fail;
                 }
 
                 break;
+
         case IPV4ACD_STATE_WAITING_PROBE:
         case IPV4ACD_STATE_PROBING:
                 /* Send a probe */
-                r = arp_send_probe(ll->fd, ll->index, ll->address, &ll->mac_addr);
+                r = arp_send_probe(acd->fd, acd->ifindex, acd->address, &acd->mac_addr);
                 if (r < 0) {
-                        log_ipv4acd_error_errno(ll, r, "Failed to send ARP probe: %m");
-                        goto out;
+                        log_ipv4acd_errno(acd, r, "Failed to send ARP probe: %m");
+                        goto fail;
                 } else {
                         _cleanup_free_ char *address = NULL;
-                        union in_addr_union addr = { .in.s_addr = ll->address };
+                        union in_addr_union addr = { .in.s_addr = acd->address };
 
-                        r = in_addr_to_string(AF_INET, &addr, &address);
-                        if (r >= 0)
-                                log_ipv4acd_debug(ll, "Probing %s", address);
+                        (void) in_addr_to_string(AF_INET, &addr, &address);
+                        log_ipv4acd(acd, "Probing %s", strna(address));
                 }
 
-                if (ll->iteration < PROBE_NUM - 2) {
-                        ipv4acd_set_state(ll, IPV4ACD_STATE_PROBING, false);
+                if (acd->n_iteration < PROBE_NUM - 2) {
+                        ipv4acd_set_state(acd, IPV4ACD_STATE_PROBING, false);
 
-                        r = ipv4acd_set_next_wakeup(ll, PROBE_MIN, (PROBE_MAX-PROBE_MIN));
+                        r = ipv4acd_set_next_wakeup(acd, PROBE_MIN_USEC, (PROBE_MAX_USEC-PROBE_MIN_USEC));
                         if (r < 0)
-                                goto out;
+                                goto fail;
                 } else {
-                        ipv4acd_set_state(ll, IPV4ACD_STATE_WAITING_ANNOUNCE, true);
+                        ipv4acd_set_state(acd, IPV4ACD_STATE_WAITING_ANNOUNCE, true);
 
-                        r = ipv4acd_set_next_wakeup(ll, ANNOUNCE_WAIT, 0);
+                        r = ipv4acd_set_next_wakeup(acd, ANNOUNCE_WAIT_USEC, 0);
                         if (r < 0)
-                                goto out;
+                                goto fail;
                 }
 
                 break;
 
         case IPV4ACD_STATE_ANNOUNCING:
-                if (ll->iteration >= ANNOUNCE_NUM - 1) {
-                        ipv4acd_set_state(ll, IPV4ACD_STATE_RUNNING, false);
-
+                if (acd->n_iteration >= ANNOUNCE_NUM - 1) {
+                        ipv4acd_set_state(acd, IPV4ACD_STATE_RUNNING, false);
                         break;
                 }
+
+                /* fall through */
+
         case IPV4ACD_STATE_WAITING_ANNOUNCE:
                 /* Send announcement packet */
-                r = arp_send_announcement(ll->fd, ll->index, ll->address, &ll->mac_addr);
+                r = arp_send_announcement(acd->fd, acd->ifindex, acd->address, &acd->mac_addr);
                 if (r < 0) {
-                        log_ipv4acd_error_errno(ll, r, "Failed to send ARP announcement: %m");
-                        goto out;
+                        log_ipv4acd_errno(acd, r, "Failed to send ARP announcement: %m");
+                        goto fail;
                 } else
-                        log_ipv4acd_debug(ll, "ANNOUNCE");
+                        log_ipv4acd(acd, "ANNOUNCE");
 
-                ipv4acd_set_state(ll, IPV4ACD_STATE_ANNOUNCING, false);
+                ipv4acd_set_state(acd, IPV4ACD_STATE_ANNOUNCING, false);
 
-                r = ipv4acd_set_next_wakeup(ll, ANNOUNCE_INTERVAL, 0);
+                r = ipv4acd_set_next_wakeup(acd, ANNOUNCE_INTERVAL_USEC, 0);
                 if (r < 0)
-                        goto out;
+                        goto fail;
 
-                if (ll->iteration == 0) {
-                        ll->conflict = 0;
-                        ipv4acd_client_notify(ll, SD_IPV4ACD_EVENT_BIND);
+                if (acd->n_iteration == 0) {
+                        acd->n_conflict = 0;
+                        ipv4acd_client_notify(acd, SD_IPV4ACD_EVENT_BIND);
                 }
 
                 break;
+
         default:
                 assert_not_reached("Invalid state.");
         }
 
-out:
-        if (r < 0)
-                sd_ipv4acd_stop(ll);
+        return 0;
 
-        return 1;
+fail:
+        sd_ipv4acd_stop(acd);
+        return 0;
 }
 
-static void ipv4acd_on_conflict(sd_ipv4acd *ll) {
+static void ipv4acd_on_conflict(sd_ipv4acd *acd) {
         _cleanup_free_ char *address = NULL;
-        union in_addr_union addr = { .in.s_addr = ll->address };
-        int r;
+        union in_addr_union addr = { .in.s_addr = acd->address };
 
-        assert(ll);
+        assert(acd);
 
-        ll->conflict++;
+        acd->n_conflict++;
 
-        r = in_addr_to_string(AF_INET, &addr, &address);
-        if (r >= 0)
-                log_ipv4acd_debug(ll, "Conflict on %s (%u)", address, ll->conflict);
+        (void) in_addr_to_string(AF_INET, &addr, &address);
+        log_ipv4acd(acd, "Conflict on %s (%u)", strna(address), acd->n_conflict);
 
-        ipv4acd_stop(ll);
-
-        ipv4acd_client_notify(ll, SD_IPV4ACD_EVENT_CONFLICT);
+        ipv4acd_reset(acd);
+        ipv4acd_client_notify(acd, SD_IPV4ACD_EVENT_CONFLICT);
 }
 
-static int ipv4acd_on_packet(sd_event_source *s, int fd,
-                            uint32_t revents, void *userdata) {
-        sd_ipv4acd *ll = userdata;
+static int ipv4acd_on_packet(
+                sd_event_source *s,
+                int fd,
+                uint32_t revents,
+                void *userdata) {
+
+        sd_ipv4acd *acd = userdata;
         struct ether_arp packet;
+        ssize_t n;
         int r;
 
-        assert(ll);
+        assert(s);
+        assert(acd);
         assert(fd >= 0);
 
-        r = read(fd, &packet, sizeof(struct ether_arp));
-        if (r < (int) sizeof(struct ether_arp))
-                goto out;
+        n = recv(fd, &packet, sizeof(struct ether_arp), 0);
+        if (n < 0) {
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
+                log_ipv4acd_errno(acd, errno, "Failed to read ARP packet: %m");
+                goto fail;
+        }
+        if ((size_t) n != sizeof(struct ether_arp)) {
+                log_ipv4acd(acd, "Ignoring too short ARP packet.");
+                return 0;
+        }
+
+        switch (acd->state) {
 
-        switch (ll->state) {
         case IPV4ACD_STATE_ANNOUNCING:
         case IPV4ACD_STATE_RUNNING:
-                if (ipv4acd_arp_conflict(ll, &packet)) {
+
+                if (ipv4acd_arp_conflict(acd, &packet)) {
                         usec_t ts;
 
-                        assert_se(sd_event_now(ll->event, clock_boottime_or_monotonic(), &ts) >= 0);
+                        assert_se(sd_event_now(acd->event, clock_boottime_or_monotonic(), &ts) >= 0);
 
                         /* Defend address */
-                        if (ts > ll->defend_window) {
-                                ll->defend_window = ts + DEFEND_INTERVAL * USEC_PER_SEC;
-                                r = arp_send_announcement(ll->fd, ll->index, ll->address, &ll->mac_addr);
+                        if (ts > acd->defend_window) {
+                                acd->defend_window = ts + DEFEND_INTERVAL_USEC;
+                                r = arp_send_announcement(acd->fd, acd->ifindex, acd->address, &acd->mac_addr);
                                 if (r < 0) {
-                                        log_ipv4acd_error_errno(ll, r, "Failed to send ARP announcement: %m");
-                                        goto out;
+                                        log_ipv4acd_errno(acd, r, "Failed to send ARP announcement: %m");
+                                        goto fail;
                                 } else
-                                        log_ipv4acd_debug(ll, "DEFEND");
+                                        log_ipv4acd(acd, "DEFEND");
 
                         } else
-                                ipv4acd_on_conflict(ll);
+                                ipv4acd_on_conflict(acd);
                 }
-
                 break;
+
         case IPV4ACD_STATE_WAITING_PROBE:
         case IPV4ACD_STATE_PROBING:
         case IPV4ACD_STATE_WAITING_ANNOUNCE:
                 /* BPF ensures this packet indicates a conflict */
-                ipv4acd_on_conflict(ll);
-
+                ipv4acd_on_conflict(acd);
                 break;
+
         default:
                 assert_not_reached("Invalid state.");
         }
 
-out:
-        if (r < 0)
-                sd_ipv4acd_stop(ll);
+        return 0;
 
-        return 1;
+fail:
+        sd_ipv4acd_stop(acd);
+        return 0;
 }
 
-int sd_ipv4acd_set_index(sd_ipv4acd *ll, int interface_index) {
-        assert_return(ll, -EINVAL);
-        assert_return(interface_index > 0, -EINVAL);
-        assert_return(ll->state == IPV4ACD_STATE_INIT, -EBUSY);
+int sd_ipv4acd_set_ifindex(sd_ipv4acd *acd, int ifindex) {
+        assert_return(acd, -EINVAL);
+        assert_return(ifindex > 0, -EINVAL);
+        assert_return(acd->state == IPV4ACD_STATE_INIT, -EBUSY);
 
-        ll->index = interface_index;
+        acd->ifindex = ifindex;
 
         return 0;
 }
 
-int sd_ipv4acd_set_mac(sd_ipv4acd *ll, const struct ether_addr *addr) {
-        assert_return(ll, -EINVAL);
+int sd_ipv4acd_set_mac(sd_ipv4acd *acd, const struct ether_addr *addr) {
+        assert_return(acd, -EINVAL);
         assert_return(addr, -EINVAL);
-        assert_return(ll->state == IPV4ACD_STATE_INIT, -EBUSY);
+        assert_return(acd->state == IPV4ACD_STATE_INIT, -EBUSY);
 
-        memcpy(&ll->mac_addr, addr, ETH_ALEN);
+        acd->mac_addr = *addr;
 
         return 0;
 }
 
-int sd_ipv4acd_detach_event(sd_ipv4acd *ll) {
-        assert_return(ll, -EINVAL);
+int sd_ipv4acd_detach_event(sd_ipv4acd *acd) {
+        assert_return(acd, -EINVAL);
 
-        ll->event = sd_event_unref(ll->event);
+        acd->event = sd_event_unref(acd->event);
 
         return 0;
 }
 
-int sd_ipv4acd_attach_event(sd_ipv4acd *ll, sd_event *event, int64_t priority) {
+int sd_ipv4acd_attach_event(sd_ipv4acd *acd, sd_event *event, int64_t priority) {
         int r;
 
-        assert_return(ll, -EINVAL);
-        assert_return(!ll->event, -EBUSY);
+        assert_return(acd, -EINVAL);
+        assert_return(!acd->event, -EBUSY);
 
         if (event)
-                ll->event = sd_event_ref(event);
+                acd->event = sd_event_ref(event);
         else {
-                r = sd_event_default(&ll->event);
+                r = sd_event_default(&acd->event);
                 if (r < 0)
                         return r;
         }
 
-        ll->event_priority = priority;
+        acd->event_priority = priority;
 
         return 0;
 }
 
-int sd_ipv4acd_set_callback(sd_ipv4acd *ll, sd_ipv4acd_callback_t cb, void *userdata) {
-        assert_return(ll, -EINVAL);
+int sd_ipv4acd_set_callback(sd_ipv4acd *acd, sd_ipv4acd_callback_t cb, void *userdata) {
+        assert_return(acd, -EINVAL);
 
-        ll->cb = cb;
-        ll->userdata = userdata;
+        acd->callback = cb;
+        acd->userdata = userdata;
 
         return 0;
 }
 
-int sd_ipv4acd_set_address(sd_ipv4acd *ll, const struct in_addr *address) {
-        assert_return(ll, -EINVAL);
+int sd_ipv4acd_set_address(sd_ipv4acd *acd, const struct in_addr *address) {
+        assert_return(acd, -EINVAL);
         assert_return(address, -EINVAL);
-        assert_return(ll->state == IPV4ACD_STATE_INIT, -EBUSY);
+        assert_return(acd->state == IPV4ACD_STATE_INIT, -EBUSY);
 
-        ll->address = address->s_addr;
+        acd->address = address->s_addr;
 
         return 0;
 }
 
-int sd_ipv4acd_is_running(sd_ipv4acd *ll) {
-        assert_return(ll, false);
+int sd_ipv4acd_is_running(sd_ipv4acd *acd) {
+        assert_return(acd, false);
 
-        return ll->state != IPV4ACD_STATE_INIT;
+        return acd->state != IPV4ACD_STATE_INIT;
 }
 
-static bool ether_addr_is_nul(const struct ether_addr *addr) {
-        const struct ether_addr nul_addr = {};
-
-        assert(addr);
-
-        return memcmp(addr, &nul_addr, sizeof(struct ether_addr)) == 0;
-}
-
-#define HASH_KEY SD_ID128_MAKE(df,04,22,98,3f,ad,14,52,f9,87,2e,d1,9c,70,e2,f2)
-
-int sd_ipv4acd_start(sd_ipv4acd *ll) {
+int sd_ipv4acd_start(sd_ipv4acd *acd) {
         int r;
 
-        assert_return(ll, -EINVAL);
-        assert_return(ll->event, -EINVAL);
-        assert_return(ll->index > 0, -EINVAL);
-        assert_return(ll->address != 0, -EINVAL);
-        assert_return(!ether_addr_is_nul(&ll->mac_addr), -EINVAL);
-        assert_return(ll->state == IPV4ACD_STATE_INIT, -EBUSY);
+        assert_return(acd, -EINVAL);
+        assert_return(acd->event, -EINVAL);
+        assert_return(acd->ifindex > 0, -EINVAL);
+        assert_return(acd->address != 0, -EINVAL);
+        assert_return(!ether_addr_is_null(&acd->mac_addr), -EINVAL);
+        assert_return(acd->state == IPV4ACD_STATE_INIT, -EBUSY);
 
-        ll->defend_window = 0;
-
-        r = arp_network_bind_raw_socket(ll->index, ll->address, &ll->mac_addr);
+        r = arp_network_bind_raw_socket(acd->ifindex, acd->address, &acd->mac_addr);
         if (r < 0)
-                goto out;
+                return r;
 
-        ll->fd = safe_close(ll->fd);
-        ll->fd = r;
+        safe_close(acd->fd);
+        acd->fd = r;
+        acd->defend_window = 0;
+        acd->n_conflict = 0;
 
-        r = sd_event_add_io(ll->event, &ll->receive_message, ll->fd,
-                            EPOLLIN, ipv4acd_on_packet, ll);
+        r = sd_event_add_io(acd->event, &acd->receive_message_event_source, acd->fd, EPOLLIN, ipv4acd_on_packet, acd);
         if (r < 0)
-                goto out;
+                goto fail;
 
-        r = sd_event_source_set_priority(ll->receive_message, ll->event_priority);
+        r = sd_event_source_set_priority(acd->receive_message_event_source, acd->event_priority);
         if (r < 0)
-                goto out;
+                goto fail;
 
-        r = sd_event_source_set_description(ll->receive_message, "ipv4acd-receive-message");
-        if (r < 0)
-                goto out;
+        (void) sd_event_source_set_description(acd->receive_message_event_source, "ipv4acd-receive-message");
 
-        r = ipv4acd_set_next_wakeup(ll, 0, 0);
+        r = ipv4acd_set_next_wakeup(acd, 0, 0);
         if (r < 0)
-                goto out;
-out:
-        if (r < 0) {
-                ipv4acd_stop(ll);
-                return r;
-        }
+                goto fail;
 
+        ipv4acd_set_state(acd, IPV4ACD_STATE_STARTED, true);
         return 0;
+
+fail:
+        ipv4acd_reset(acd);
+        return r;
 }
diff --git a/src/libsystemd-network/src/sd-ipv4ll.c b/src/libsystemd-network/src/sd-ipv4ll.c
index c8428ba489..85c5b20a81 100644
--- a/src/libsystemd-network/src/sd-ipv4ll.c
+++ b/src/libsystemd-network/src/sd-ipv4ll.c
@@ -25,18 +25,19 @@
 #include <string.h>
 
 #include "basic/alloc-util.h"
+#include "basic/ether-addr-util.h"
 #include "basic/in-addr-util.h"
 #include "basic/list.h"
 #include "basic/random-util.h"
-#include "basic/refcnt.h"
 #include "basic/siphash24.h"
 #include "basic/sparse-endian.h"
+#include "basic/string-util.h"
 #include "basic/util.h"
 #include "systemd-network/sd-ipv4acd.h"
 #include "systemd-network/sd-ipv4ll.h"
 
-#define IPV4LL_NETWORK 0xA9FE0000L
-#define IPV4LL_NETMASK 0xFFFF0000L
+#define IPV4LL_NETWORK UINT32_C(0xA9FE0000)
+#define IPV4LL_NETMASK UINT32_C(0xFFFF0000)
 
 #define IPV4LL_DONT_DESTROY(ll) \
         _cleanup_(sd_ipv4ll_unrefp) _unused_ sd_ipv4ll *_dont_destroy_##ll = sd_ipv4ll_ref(ll)
@@ -45,16 +46,28 @@ struct sd_ipv4ll {
         unsigned n_ref;
 
         sd_ipv4acd *acd;
+
         be32_t address; /* the address pushed to ACD */
-        struct random_data *random_data;
-        char *random_data_state;
+        struct ether_addr mac;
+
+        struct {
+                le64_t value;
+                le64_t generation;
+        } seed;
+        bool seed_set;
 
         /* External */
         be32_t claimed_address;
-        sd_ipv4ll_callback_t cb;
+
+        sd_ipv4ll_callback_t callback;
         void* userdata;
 };
 
+#define log_ipv4ll_errno(ll, error, fmt, ...) log_internal(LOG_DEBUG, error, __FILE__, __LINE__, __func__, "IPV4LL: " fmt, ##__VA_ARGS__)
+#define log_ipv4ll(ll, fmt, ...) log_ipv4ll_errno(ll, 0, fmt, ##__VA_ARGS__)
+
+static void ipv4ll_on_acd(sd_ipv4acd *ll, int event, void *userdata);
+
 sd_ipv4ll *sd_ipv4ll_ref(sd_ipv4ll *ll) {
         if (!ll)
                 return NULL;
@@ -76,16 +89,11 @@ sd_ipv4ll *sd_ipv4ll_unref(sd_ipv4ll *ll) {
                 return NULL;
 
         sd_ipv4acd_unref(ll->acd);
-
-        free(ll->random_data);
-        free(ll->random_data_state);
         free(ll);
 
         return NULL;
 }
 
-static void ipv4ll_on_acd(sd_ipv4acd *ll, int event, void *userdata);
-
 int sd_ipv4ll_new(sd_ipv4ll **ret) {
         _cleanup_(sd_ipv4ll_unrefp) sd_ipv4ll *ll = NULL;
         int r;
@@ -113,44 +121,32 @@ int sd_ipv4ll_new(sd_ipv4ll **ret) {
 }
 
 int sd_ipv4ll_stop(sd_ipv4ll *ll) {
-        int r;
-
         assert_return(ll, -EINVAL);
 
-        r = sd_ipv4acd_stop(ll->acd);
-        if (r < 0)
-                return r;
-
-        return 0;
+        return sd_ipv4acd_stop(ll->acd);
 }
 
-int sd_ipv4ll_set_index(sd_ipv4ll *ll, int interface_index) {
+int sd_ipv4ll_set_ifindex(sd_ipv4ll *ll, int ifindex) {
         assert_return(ll, -EINVAL);
+        assert_return(ifindex > 0, -EINVAL);
+        assert_return(sd_ipv4ll_is_running(ll) == 0, -EBUSY);
 
-        return sd_ipv4acd_set_index(ll->acd, interface_index);
+        return sd_ipv4acd_set_ifindex(ll->acd, ifindex);
 }
 
-#define HASH_KEY SD_ID128_MAKE(df,04,22,98,3f,ad,14,52,f9,87,2e,d1,9c,70,e2,f2)
-
 int sd_ipv4ll_set_mac(sd_ipv4ll *ll, const struct ether_addr *addr) {
         int r;
 
         assert_return(ll, -EINVAL);
+        assert_return(addr, -EINVAL);
+        assert_return(sd_ipv4ll_is_running(ll) == 0, -EBUSY);
 
-        if (!ll->random_data) {
-                uint64_t seed;
-
-                /* If no random data is set, generate some from the MAC */
-                seed = siphash24(&addr->ether_addr_octet, ETH_ALEN, HASH_KEY.bytes);
-
-                assert_cc(sizeof(unsigned) <= 8);
-
-                r = sd_ipv4ll_set_address_seed(ll, (unsigned) htole64(seed));
-                if (r < 0)
-                        return r;
-        }
+        r = sd_ipv4acd_set_mac(ll->acd, addr);
+        if (r < 0)
+                return r;
 
-        return sd_ipv4acd_set_mac(ll->acd, addr);
+        ll->mac = *addr;
+        return 0;
 }
 
 int sd_ipv4ll_detach_event(sd_ipv4ll *ll) {
@@ -160,21 +156,15 @@ int sd_ipv4ll_detach_event(sd_ipv4ll *ll) {
 }
 
 int sd_ipv4ll_attach_event(sd_ipv4ll *ll, sd_event *event, int64_t priority) {
-        int r;
-
         assert_return(ll, -EINVAL);
 
-        r = sd_ipv4acd_attach_event(ll->acd, event, priority);
-        if (r < 0)
-                return r;
-
-        return 0;
+        return sd_ipv4acd_attach_event(ll->acd, event, priority);
 }
 
 int sd_ipv4ll_set_callback(sd_ipv4ll *ll, sd_ipv4ll_callback_t cb, void *userdata) {
         assert_return(ll, -EINVAL);
 
-        ll->cb = cb;
+        ll->callback = cb;
         ll->userdata = userdata;
 
         return 0;
@@ -192,32 +182,12 @@ int sd_ipv4ll_get_address(sd_ipv4ll *ll, struct in_addr *address) {
         return 0;
 }
 
-int sd_ipv4ll_set_address_seed(sd_ipv4ll *ll, unsigned seed) {
-        _cleanup_free_ struct random_data *random_data = NULL;
-        _cleanup_free_ char *random_data_state = NULL;
-        int r;
-
+int sd_ipv4ll_set_address_seed(sd_ipv4ll *ll, uint64_t seed) {
         assert_return(ll, -EINVAL);
+        assert_return(sd_ipv4ll_is_running(ll) == 0, -EBUSY);
 
-        random_data = new0(struct random_data, 1);
-        if (!random_data)
-                return -ENOMEM;
-
-        random_data_state = new0(char, 128);
-        if (!random_data_state)
-                return -ENOMEM;
-
-        r = initstate_r(seed, random_data_state, 128, random_data);
-        if (r < 0)
-                return r;
-
-        free(ll->random_data);
-        ll->random_data = random_data;
-        random_data = NULL;
-
-        free(ll->random_data_state);
-        ll->random_data_state = random_data_state;
-        random_data_state = NULL;
+        ll->seed.value = htole64(seed);
+        ll->seed_set = true;
 
         return 0;
 }
@@ -229,20 +199,12 @@ int sd_ipv4ll_is_running(sd_ipv4ll *ll) {
 }
 
 static bool ipv4ll_address_is_valid(const struct in_addr *address) {
-        uint32_t addr;
-
         assert(address);
 
         if (!in_addr_is_link_local(AF_INET, (const union in_addr_union *) address))
                 return false;
 
-        addr = be32toh(address->s_addr);
-
-        if ((addr & 0x0000FF00) == 0x0000 ||
-            (addr & 0x0000FF00) == 0xFF00)
-                return false;
-
-        return true;
+        return !IN_SET(be32toh(address->s_addr) & 0x0000FF00U, 0x0000U, 0xFF00U);
 }
 
 int sd_ipv4ll_set_address(sd_ipv4ll *ll, const struct in_addr *address) {
@@ -261,48 +223,67 @@ int sd_ipv4ll_set_address(sd_ipv4ll *ll, const struct in_addr *address) {
         return 0;
 }
 
+#define PICK_HASH_KEY SD_ID128_MAKE(15,ac,82,a6,d6,3f,49,78,98,77,5d,0c,69,02,94,0b)
+
 static int ipv4ll_pick_address(sd_ipv4ll *ll) {
-        struct in_addr in_addr;
+        _cleanup_free_ char *address = NULL;
         be32_t addr;
-        int r;
-        int32_t random;
 
         assert(ll);
-        assert(ll->random_data);
 
         do {
-                r = random_r(ll->random_data, &random);
-                if (r < 0)
-                        return r;
-                addr = htonl((random & 0x0000FFFF) | IPV4LL_NETWORK);
-        } while (addr == ll->address ||
-                (ntohl(addr) & 0x0000FF00) == 0x0000 ||
-                (ntohl(addr) & 0x0000FF00) == 0xFF00);
+                uint64_t h;
 
-        in_addr.s_addr = addr;
+                h = siphash24(&ll->seed, sizeof(ll->seed), PICK_HASH_KEY.bytes);
 
-        r = sd_ipv4ll_set_address(ll, &in_addr);
-        if (r < 0)
-                return r;
+                /* Increase the generation counter by one */
+                ll->seed.generation = htole64(le64toh(ll->seed.generation) + 1);
 
-        return 0;
+                addr = htobe32((h & UINT32_C(0x0000FFFF)) | IPV4LL_NETWORK);
+        } while (addr == ll->address ||
+                 IN_SET(be32toh(addr) & 0x0000FF00U, 0x0000U, 0xFF00U));
+
+        (void) in_addr_to_string(AF_INET, &(union in_addr_union) { .in.s_addr = addr }, &address);
+        log_ipv4ll(ll, "Picked new IP address %s.", strna(address));
+
+        return sd_ipv4ll_set_address(ll, &(struct in_addr) { addr });
 }
 
+#define MAC_HASH_KEY SD_ID128_MAKE(df,04,22,98,3f,ad,14,52,f9,87,2e,d1,9c,70,e2,f2)
+
 int sd_ipv4ll_start(sd_ipv4ll *ll) {
         int r;
+        bool picked_address = false;
 
         assert_return(ll, -EINVAL);
-        assert_return(ll->random_data, -EINVAL);
+        assert_return(!ether_addr_is_null(&ll->mac), -EINVAL);
+        assert_return(sd_ipv4ll_is_running(ll) == 0, -EBUSY);
+
+        /* If no random seed is set, generate some from the MAC address */
+        if (!ll->seed_set)
+                ll->seed.value = htole64(siphash24(ll->mac.ether_addr_octet, ETH_ALEN, MAC_HASH_KEY.bytes));
+
+        /* Restart the generation counter. */
+        ll->seed.generation = 0;
 
         if (ll->address == 0) {
                 r = ipv4ll_pick_address(ll);
                 if (r < 0)
                         return r;
+
+                picked_address = true;
         }
 
         r = sd_ipv4acd_start(ll->acd);
-        if (r < 0)
+        if (r < 0) {
+
+                /* We couldn't start? If so, let's forget the picked address again, the user might make a change and
+                 * retry, and we want the new data to take effect when picking an address. */
+                if (picked_address)
+                        ll->address = 0;
+
                 return r;
+        }
 
         return 0;
 }
@@ -310,8 +291,8 @@ int sd_ipv4ll_start(sd_ipv4ll *ll) {
 static void ipv4ll_client_notify(sd_ipv4ll *ll, int event) {
         assert(ll);
 
-        if (ll->cb)
-                ll->cb(ll, event, ll->userdata);
+        if (ll->callback)
+                ll->callback(ll, event, ll->userdata);
 }
 
 void ipv4ll_on_acd(sd_ipv4acd *acd, int event, void *userdata) {
@@ -323,17 +304,17 @@ void ipv4ll_on_acd(sd_ipv4acd *acd, int event, void *userdata) {
         assert(ll);
 
         switch (event) {
+
         case SD_IPV4ACD_EVENT_STOP:
                 ipv4ll_client_notify(ll, SD_IPV4LL_EVENT_STOP);
-
                 ll->claimed_address = 0;
-
                 break;
+
         case SD_IPV4ACD_EVENT_BIND:
                 ll->claimed_address = ll->address;
                 ipv4ll_client_notify(ll, SD_IPV4LL_EVENT_BIND);
-
                 break;
+
         case SD_IPV4ACD_EVENT_CONFLICT:
                 /* if an address was already bound we must call up to the
                    user to handle this, otherwise we just try again */
@@ -352,6 +333,7 @@ void ipv4ll_on_acd(sd_ipv4acd *acd, int event, void *userdata) {
                 }
 
                 break;
+
         default:
                 assert_not_reached("Invalid IPv4ACD event.");
         }
diff --git a/src/libsystemd-network/src/sd-lldp.c b/src/libsystemd-network/src/sd-lldp.c
index 412c070ebb..7a3fcb9472 100644
--- a/src/libsystemd-network/src/sd-lldp.c
+++ b/src/libsystemd-network/src/sd-lldp.c
@@ -42,7 +42,6 @@ static void lldp_flush_neighbors(sd_lldp *lldp) {
 
 static void lldp_callback(sd_lldp *lldp, sd_lldp_event event, sd_lldp_neighbor *n) {
         assert(lldp);
-        assert(n);
 
         log_lldp("Invoking callback for '%c'.", event);
 
@@ -137,6 +136,7 @@ static int lldp_add_neighbor(sd_lldp *lldp, sd_lldp_neighbor *n) {
 
                 if (lldp_neighbor_equal(n, old)) {
                         /* Is this equal, then restart the TTL counter, but don't do anyting else. */
+                        old->timestamp = n->timestamp;
                         lldp_start_timer(lldp, old);
                         lldp_callback(lldp, SD_LLDP_EVENT_REFRESHED, old);
                         return 0;
@@ -170,7 +170,7 @@ static int lldp_add_neighbor(sd_lldp *lldp, sd_lldp_neighbor *n) {
 
 finish:
         if (old)
-                lldp_callback(lldp, SD_LLDP_EVENT_REMOVED, n);
+                lldp_callback(lldp, SD_LLDP_EVENT_REMOVED, old);
 
         return r;
 }
@@ -201,6 +201,7 @@ static int lldp_receive_datagram(sd_event_source *s, int fd, uint32_t revents, v
         _cleanup_(sd_lldp_neighbor_unrefp) sd_lldp_neighbor *n = NULL;
         ssize_t space, length;
         sd_lldp *lldp = userdata;
+        struct timespec ts;
 
         assert(fd >= 0);
         assert(lldp);
@@ -214,21 +215,41 @@ static int lldp_receive_datagram(sd_event_source *s, int fd, uint32_t revents, v
                 return -ENOMEM;
 
         length = recv(fd, LLDP_NEIGHBOR_RAW(n), n->raw_size, MSG_DONTWAIT);
-        if (length < 0)
+        if (length < 0) {
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
                 return log_lldp_errno(errno, "Failed to read LLDP datagram: %m");
+        }
 
         if ((size_t) length != n->raw_size) {
                 log_lldp("Packet size mismatch.");
                 return -EINVAL;
         }
 
+        /* Try to get the timestamp of this packet if it is known */
+        if (ioctl(fd, SIOCGSTAMPNS, &ts) >= 0)
+                triple_timestamp_from_realtime(&n->timestamp, timespec_load(&ts));
+        else
+                triple_timestamp_get(&n->timestamp);
+
         return lldp_handle_datagram(lldp, n);
 }
 
+static void lldp_reset(sd_lldp *lldp) {
+        assert(lldp);
+
+        lldp->timer_event_source = sd_event_source_unref(lldp->timer_event_source);
+        lldp->io_event_source = sd_event_source_unref(lldp->io_event_source);
+        lldp->fd = safe_close(lldp->fd);
+}
+
 _public_ int sd_lldp_start(sd_lldp *lldp) {
         int r;
 
         assert_return(lldp, -EINVAL);
+        assert_return(lldp->event, -EINVAL);
+        assert_return(lldp->ifindex > 0, -EINVAL);
 
         if (lldp->fd >= 0)
                 return 0;
@@ -239,24 +260,21 @@ _public_ int sd_lldp_start(sd_lldp *lldp) {
         if (lldp->fd < 0)
                 return lldp->fd;
 
-        if (lldp->event) {
-                r = sd_event_add_io(lldp->event, &lldp->io_event_source, lldp->fd, EPOLLIN, lldp_receive_datagram, lldp);
-                if (r < 0)
-                        goto fail;
+        r = sd_event_add_io(lldp->event, &lldp->io_event_source, lldp->fd, EPOLLIN, lldp_receive_datagram, lldp);
+        if (r < 0)
+                goto fail;
 
-                r = sd_event_source_set_priority(lldp->io_event_source, lldp->event_priority);
-                if (r < 0)
-                        goto fail;
+        r = sd_event_source_set_priority(lldp->io_event_source, lldp->event_priority);
+        if (r < 0)
+                goto fail;
 
-                (void) sd_event_source_set_description(lldp->io_event_source, "lldp-io");
-        }
+        (void) sd_event_source_set_description(lldp->io_event_source, "lldp-io");
 
+        log_lldp("Started LLDP client");
         return 1;
 
 fail:
-        lldp->io_event_source = sd_event_source_unref(lldp->io_event_source);
-        lldp->fd = safe_close(lldp->fd);
-
+        lldp_reset(lldp);
         return r;
 }
 
@@ -266,10 +284,9 @@ _public_ int sd_lldp_stop(sd_lldp *lldp) {
         if (lldp->fd < 0)
                 return 0;
 
-        lldp->timer_event_source = sd_event_source_unref(lldp->timer_event_source);
-        lldp->io_event_source = sd_event_source_unref(lldp->io_event_source);
-        lldp->fd = safe_close(lldp->fd);
+        log_lldp("Stopping LLDP client");
 
+        lldp_reset(lldp);
         lldp_flush_neighbors(lldp);
 
         return 1;
@@ -304,6 +321,12 @@ _public_ int sd_lldp_detach_event(sd_lldp *lldp) {
         return 0;
 }
 
+_public_ sd_event* sd_lldp_get_event(sd_lldp *lldp) {
+        assert_return(lldp, NULL);
+
+        return lldp->event;
+}
+
 _public_ int sd_lldp_set_callback(sd_lldp *lldp, sd_lldp_callback_t cb, void *userdata) {
         assert_return(lldp, -EINVAL);
 
@@ -313,39 +336,60 @@ _public_ int sd_lldp_set_callback(sd_lldp *lldp, sd_lldp_callback_t cb, void *us
         return 0;
 }
 
+_public_ int sd_lldp_set_ifindex(sd_lldp *lldp, int ifindex) {
+        assert_return(lldp, -EINVAL);
+        assert_return(ifindex > 0, -EINVAL);
+        assert_return(lldp->fd < 0, -EBUSY);
+
+        lldp->ifindex = ifindex;
+        return 0;
+}
+
+_public_ sd_lldp* sd_lldp_ref(sd_lldp *lldp) {
+
+        if (!lldp)
+                return NULL;
+
+        assert(lldp->n_ref > 0);
+        lldp->n_ref++;
+
+        return lldp;
+}
+
 _public_ sd_lldp* sd_lldp_unref(sd_lldp *lldp) {
 
         if (!lldp)
                 return NULL;
 
+        assert(lldp->n_ref > 0);
+        lldp->n_ref --;
+
+        if (lldp->n_ref > 0)
+                return NULL;
+
+        lldp_reset(lldp);
+        sd_lldp_detach_event(lldp);
         lldp_flush_neighbors(lldp);
 
         hashmap_free(lldp->neighbor_by_id);
         prioq_free(lldp->neighbor_by_expiry);
-
-        sd_event_source_unref(lldp->io_event_source);
-        sd_event_source_unref(lldp->timer_event_source);
-        sd_event_unref(lldp->event);
-        safe_close(lldp->fd);
-
         free(lldp);
 
         return NULL;
 }
 
-_public_ int sd_lldp_new(sd_lldp **ret, int ifindex) {
+_public_ int sd_lldp_new(sd_lldp **ret) {
         _cleanup_(sd_lldp_unrefp) sd_lldp *lldp = NULL;
         int r;
 
         assert_return(ret, -EINVAL);
-        assert_return(ifindex > 0, -EINVAL);
 
         lldp = new0(sd_lldp, 1);
         if (!lldp)
                 return -ENOMEM;
 
+        lldp->n_ref = 1;
         lldp->fd = -1;
-        lldp->ifindex = ifindex;
         lldp->neighbors_max = LLDP_DEFAULT_NEIGHBORS_MAX;
         lldp->capability_mask = (uint16_t) -1;
 
@@ -485,11 +529,10 @@ _public_ int sd_lldp_set_filter_address(sd_lldp *lldp, const struct ether_addr *
         /* In order to deal nicely with bridges that send back our own packets, allow one address to be filtered, so
          * that our own can be filtered out here. */
 
-        if (!addr) {
+        if (addr)
+                lldp->filter_address = *addr;
+        else
                 zero(lldp->filter_address);
-                return 0;
-        }
 
-        lldp->filter_address = *addr;
         return 0;
 }
diff --git a/src/libsystemd-network/src/sd-ndisc.c b/src/libsystemd-network/src/sd-ndisc.c
index 7d19373f18..91e4467371 100644
--- a/src/libsystemd-network/src/sd-ndisc.c
+++ b/src/libsystemd-network/src/sd-ndisc.c
@@ -19,156 +19,70 @@
 
 #include <netinet/icmp6.h>
 #include <netinet/in.h>
-#include <netinet/ip6.h>
-#include <stdbool.h>
-#include <string.h>
-#include <sys/ioctl.h>
 
 #include "basic/alloc-util.h"
-#include "basic/async.h"
+#include "basic/fd-util.h"
 #include "basic/in-addr-util.h"
-#include "basic/list.h"
 #include "basic/socket-util.h"
 #include "basic/string-util.h"
+#include "basic/util.h"
 #include "systemd-network/icmp6-util.h"
+#include "systemd-network/ndisc-internal.h"
+#include "systemd-network/ndisc-router.h"
 #include "systemd-network/sd-ndisc.h"
 
-#define NDISC_ROUTER_SOLICITATION_INTERVAL      4 * USEC_PER_SEC
-#define NDISC_MAX_ROUTER_SOLICITATIONS          3
-
-enum NDiscState {
-        NDISC_STATE_IDLE,
-        NDISC_STATE_SOLICITATION_SENT,
-        NDISC_STATE_ADVERTISMENT_LISTEN,
-        _NDISC_STATE_MAX,
-        _NDISC_STATE_INVALID = -1,
-};
-
-#define IP6_MIN_MTU (unsigned)1280
-#define ICMP6_RECV_SIZE (IP6_MIN_MTU - sizeof(struct ip6_hdr))
-#define NDISC_OPT_LEN_UNITS 8
-
-#define ND_RA_FLAG_PREF                0x18
-#define ND_RA_FLAG_PREF_LOW            0x03
-#define ND_RA_FLAG_PREF_MEDIUM         0x0
-#define ND_RA_FLAG_PREF_HIGH           0x1
-#define ND_RA_FLAG_PREF_INVALID        0x2
-
-typedef struct NDiscPrefix NDiscPrefix;
-
-struct NDiscPrefix {
-        unsigned n_ref;
-
-        sd_ndisc *nd;
-
-        LIST_FIELDS(NDiscPrefix, prefixes);
-
-        uint8_t len;
-        usec_t valid_until;
-        struct in6_addr addr;
-};
-
-struct sd_ndisc {
-        unsigned n_ref;
-
-        enum NDiscState state;
-        sd_event *event;
-        int event_priority;
-        int index;
-        struct ether_addr mac_addr;
-        uint32_t mtu;
-        LIST_HEAD(NDiscPrefix, prefixes);
-        int fd;
-        sd_event_source *recv;
-        sd_event_source *timeout;
-        int nd_sent;
-        sd_ndisc_router_callback_t router_callback;
-        sd_ndisc_prefix_autonomous_callback_t prefix_autonomous_callback;
-        sd_ndisc_prefix_onlink_callback_t prefix_onlink_callback;
-        sd_ndisc_callback_t callback;
-        void *userdata;
-};
-
-#define log_ndisc(p, fmt, ...) log_internal(LOG_DEBUG, 0, __FILE__, __LINE__, __func__, "NDisc CLIENT: " fmt, ##__VA_ARGS__)
-
-static NDiscPrefix *ndisc_prefix_unref(NDiscPrefix *prefix) {
-
-        if (!prefix)
-                return NULL;
-
-        assert(prefix->n_ref > 0);
-        prefix->n_ref--;
+#define NDISC_ROUTER_SOLICITATION_INTERVAL (4U * USEC_PER_SEC)
+#define NDISC_MAX_ROUTER_SOLICITATIONS 3U
 
-        if (prefix->n_ref > 0)
-                return NULL;
+static void ndisc_callback(sd_ndisc *ndisc, sd_ndisc_event event, sd_ndisc_router *rt) {
+        assert(ndisc);
 
-        if (prefix->nd)
-                LIST_REMOVE(prefixes, prefix->nd->prefixes, prefix);
+        log_ndisc("Invoking callback for '%c'.", event);
 
-        free(prefix);
+        if (!ndisc->callback)
+                return;
 
-        return NULL;
+        ndisc->callback(ndisc, event, rt, ndisc->userdata);
 }
 
-static int ndisc_prefix_new(sd_ndisc *nd, NDiscPrefix **ret) {
-        NDiscPrefix *prefix;
-
-        assert(ret);
-
-        prefix = new0(NDiscPrefix, 1);
-        if (!prefix)
-                return -ENOMEM;
-
-        prefix->n_ref = 1;
-        LIST_INIT(prefixes, prefix);
-        prefix->nd = nd;
-
-        *ret = prefix;
-        return 0;
-}
+_public_ int sd_ndisc_set_callback(
+                sd_ndisc *nd,
+                sd_ndisc_callback_t callback,
+                void *userdata) {
 
-int sd_ndisc_set_callback(sd_ndisc *nd,
-                          sd_ndisc_router_callback_t router_callback,
-                          sd_ndisc_prefix_onlink_callback_t prefix_onlink_callback,
-                          sd_ndisc_prefix_autonomous_callback_t prefix_autonomous_callback,
-                          sd_ndisc_callback_t callback,
-                          void *userdata) {
-        assert(nd);
+        assert_return(nd, -EINVAL);
 
-        nd->router_callback = router_callback;
-        nd->prefix_onlink_callback = prefix_onlink_callback;
-        nd->prefix_autonomous_callback = prefix_autonomous_callback;
         nd->callback = callback;
         nd->userdata = userdata;
 
         return 0;
 }
 
-int sd_ndisc_set_index(sd_ndisc *nd, int interface_index) {
-        assert(nd);
-        assert(interface_index >= -1);
-
-        nd->index = interface_index;
+_public_ int sd_ndisc_set_ifindex(sd_ndisc *nd, int ifindex) {
+        assert_return(nd, -EINVAL);
+        assert_return(ifindex > 0, -EINVAL);
+        assert_return(nd->fd < 0, -EBUSY);
 
+        nd->ifindex = ifindex;
         return 0;
 }
 
-int sd_ndisc_set_mac(sd_ndisc *nd, const struct ether_addr *mac_addr) {
-        assert(nd);
+_public_ int sd_ndisc_set_mac(sd_ndisc *nd, const struct ether_addr *mac_addr) {
+        assert_return(nd, -EINVAL);
 
         if (mac_addr)
-                memcpy(&nd->mac_addr, mac_addr, sizeof(nd->mac_addr));
+                nd->mac_addr = *mac_addr;
         else
                 zero(nd->mac_addr);
 
         return 0;
-
 }
 
-int sd_ndisc_attach_event(sd_ndisc *nd, sd_event *event, int64_t priority) {
+_public_ int sd_ndisc_attach_event(sd_ndisc *nd, sd_event *event, int64_t priority) {
         int r;
 
         assert_return(nd, -EINVAL);
+        assert_return(nd->fd < 0, -EBUSY);
         assert_return(!nd->event, -EBUSY);
 
         if (event)
@@ -184,21 +98,22 @@ int sd_ndisc_attach_event(sd_ndisc *nd, sd_event *event, int64_t priority) {
         return 0;
 }
 
-int sd_ndisc_detach_event(sd_ndisc *nd) {
+_public_ int sd_ndisc_detach_event(sd_ndisc *nd) {
+
         assert_return(nd, -EINVAL);
+        assert_return(nd->fd < 0, -EBUSY);
 
         nd->event = sd_event_unref(nd->event);
-
         return 0;
 }
 
-sd_event *sd_ndisc_get_event(sd_ndisc *nd) {
-        assert(nd);
+_public_ sd_event *sd_ndisc_get_event(sd_ndisc *nd) {
+        assert_return(nd, NULL);
 
         return nd->event;
 }
 
-sd_ndisc *sd_ndisc_ref(sd_ndisc *nd) {
+_public_ sd_ndisc *sd_ndisc_ref(sd_ndisc *nd) {
 
         if (!nd)
                 return NULL;
@@ -209,18 +124,17 @@ sd_ndisc *sd_ndisc_ref(sd_ndisc *nd) {
         return nd;
 }
 
-static int ndisc_init(sd_ndisc *nd) {
+static int ndisc_reset(sd_ndisc *nd) {
         assert(nd);
 
-        nd->recv = sd_event_source_unref(nd->recv);
-        nd->fd = asynchronous_close(nd->fd);
-        nd->timeout = sd_event_source_unref(nd->timeout);
+        nd->timeout_event_source = sd_event_source_unref(nd->timeout_event_source);
+        nd->recv_event_source = sd_event_source_unref(nd->recv_event_source);
+        nd->fd = safe_close(nd->fd);
 
         return 0;
 }
 
-sd_ndisc *sd_ndisc_unref(sd_ndisc *nd) {
-        NDiscPrefix *prefix, *p;
+_public_ sd_ndisc *sd_ndisc_unref(sd_ndisc *nd) {
 
         if (!nd)
                 return NULL;
@@ -231,251 +145,87 @@ sd_ndisc *sd_ndisc_unref(sd_ndisc *nd) {
         if (nd->n_ref > 0)
                 return NULL;
 
-        ndisc_init(nd);
+        ndisc_reset(nd);
         sd_ndisc_detach_event(nd);
-
-        LIST_FOREACH_SAFE(prefixes, prefix, p, nd->prefixes)
-                prefix = ndisc_prefix_unref(prefix);
-
         free(nd);
 
         return NULL;
 }
 
-int sd_ndisc_new(sd_ndisc **ret) {
+_public_ int sd_ndisc_new(sd_ndisc **ret) {
         _cleanup_(sd_ndisc_unrefp) sd_ndisc *nd = NULL;
 
-        assert(ret);
+        assert_return(ret, -EINVAL);
 
         nd = new0(sd_ndisc, 1);
         if (!nd)
                 return -ENOMEM;
 
         nd->n_ref = 1;
-
-        nd->index = -1;
         nd->fd = -1;
 
-        LIST_HEAD_INIT(nd->prefixes);
-
         *ret = nd;
         nd = NULL;
 
         return 0;
 }
 
-int sd_ndisc_get_mtu(sd_ndisc *nd, uint32_t *mtu) {
+_public_ int sd_ndisc_get_mtu(sd_ndisc *nd, uint32_t *mtu) {
         assert_return(nd, -EINVAL);
         assert_return(mtu, -EINVAL);
 
         if (nd->mtu == 0)
-                return -ENOMSG;
+                return -ENODATA;
 
         *mtu = nd->mtu;
-
         return 0;
 }
 
-static int prefix_match(const struct in6_addr *prefix, uint8_t prefixlen,
-                        const struct in6_addr *addr,
-                        uint8_t addr_prefixlen) {
-        uint8_t bytes, mask, len;
-
-        assert_return(prefix, -EINVAL);
-        assert_return(addr, -EINVAL);
-
-        len = MIN(prefixlen, addr_prefixlen);
-
-        bytes = len / 8;
-        mask = 0xff << (8 - len % 8);
+_public_ int sd_ndisc_get_hop_limit(sd_ndisc *nd, uint8_t *ret) {
+        assert_return(nd, -EINVAL);
+        assert_return(ret, -EINVAL);
 
-        if (memcmp(prefix, addr, bytes) != 0 ||
-            (prefix->s6_addr[bytes] & mask) != (addr->s6_addr[bytes] & mask))
-                return -EADDRNOTAVAIL;
+        if (nd->hop_limit == 0)
+                return -ENODATA;
 
+        *ret = nd->hop_limit;
         return 0;
 }
 
-static int ndisc_prefix_match(sd_ndisc *nd, const struct in6_addr *addr,
-                              uint8_t addr_len, NDiscPrefix **result) {
-        NDiscPrefix *prefix, *p;
-        usec_t time_now;
-        int r;
-
-        assert(nd);
-
-        r = sd_event_now(nd->event, clock_boottime_or_monotonic(), &time_now);
-        if (r < 0)
-                return r;
-
-        LIST_FOREACH_SAFE(prefixes, prefix, p, nd->prefixes) {
-                if (prefix->valid_until < time_now) {
-                        prefix = ndisc_prefix_unref(prefix);
-                        continue;
-                }
-
-                if (prefix_match(&prefix->addr, prefix->len, addr, addr_len) >= 0) {
-                        *result = prefix;
-                        return 0;
-                }
-        }
-
-        return -EADDRNOTAVAIL;
-}
-
-static int ndisc_prefix_update(sd_ndisc *nd, ssize_t len,
-                               const struct nd_opt_prefix_info *prefix_opt) {
-        NDiscPrefix *prefix;
-        uint32_t lifetime_valid, lifetime_preferred;
-        usec_t time_now;
-        char time_string[FORMAT_TIMESPAN_MAX];
+static int ndisc_handle_datagram(sd_ndisc *nd, sd_ndisc_router *rt) {
         int r;
 
         assert(nd);
-        assert(prefix_opt);
-
-        if (len < prefix_opt->nd_opt_pi_len)
-                return -ENOMSG;
-
-        if (!(prefix_opt->nd_opt_pi_flags_reserved & (ND_OPT_PI_FLAG_ONLINK | ND_OPT_PI_FLAG_AUTO)))
-                return 0;
+        assert(rt);
 
-        if (in_addr_is_link_local(AF_INET6, (const union in_addr_union *) &prefix_opt->nd_opt_pi_prefix) > 0)
+        r = ndisc_router_parse(rt);
+        if (r == -EBADMSG) /* Bad packet */
                 return 0;
-
-        lifetime_valid = be32toh(prefix_opt->nd_opt_pi_valid_time);
-        lifetime_preferred = be32toh(prefix_opt->nd_opt_pi_preferred_time);
-
-        if (lifetime_valid < lifetime_preferred)
-                return 0;
-
-        r = ndisc_prefix_match(nd, &prefix_opt->nd_opt_pi_prefix,
-                               prefix_opt->nd_opt_pi_prefix_len, &prefix);
-        if (r < 0) {
-                if (r != -EADDRNOTAVAIL)
-                        return r;
-
-                /* if router advertisment prefix valid timeout is zero, the timeout
-                   callback will be called immediately to clean up the prefix */
-
-                r = ndisc_prefix_new(nd, &prefix);
-                if (r < 0)
-                        return r;
-
-                prefix->len = prefix_opt->nd_opt_pi_prefix_len;
-
-                memcpy(&prefix->addr, &prefix_opt->nd_opt_pi_prefix,
-                        sizeof(prefix->addr));
-
-                log_ndisc(nd, "New prefix "SD_NDISC_ADDRESS_FORMAT_STR"/%d lifetime %d expires in %s",
-                          SD_NDISC_ADDRESS_FORMAT_VAL(prefix->addr),
-                          prefix->len, lifetime_valid,
-                          format_timespan(time_string, FORMAT_TIMESPAN_MAX, lifetime_valid * USEC_PER_SEC, USEC_PER_SEC));
-
-                LIST_PREPEND(prefixes, nd->prefixes, prefix);
-
-        } else {
-                if (prefix->len != prefix_opt->nd_opt_pi_prefix_len) {
-                        uint8_t prefixlen;
-
-                        prefixlen = MIN(prefix->len, prefix_opt->nd_opt_pi_prefix_len);
-
-                        log_ndisc(nd, "Prefix length mismatch %d/%d using %d",
-                                  prefix->len,
-                                  prefix_opt->nd_opt_pi_prefix_len,
-                                  prefixlen);
-
-                        prefix->len = prefixlen;
-                }
-
-                log_ndisc(nd, "Update prefix "SD_NDISC_ADDRESS_FORMAT_STR"/%d lifetime %d expires in %s",
-                          SD_NDISC_ADDRESS_FORMAT_VAL(prefix->addr),
-                          prefix->len, lifetime_valid,
-                          format_timespan(time_string, FORMAT_TIMESPAN_MAX, lifetime_valid * USEC_PER_SEC, USEC_PER_SEC));
-        }
-
-        r = sd_event_now(nd->event, clock_boottime_or_monotonic(), &time_now);
         if (r < 0)
-                return r;
-
-        prefix->valid_until = time_now + lifetime_valid * USEC_PER_SEC;
-
-        if ((prefix_opt->nd_opt_pi_flags_reserved & ND_OPT_PI_FLAG_ONLINK) && nd->prefix_onlink_callback)
-                nd->prefix_onlink_callback(nd, &prefix->addr, prefix->len, prefix->valid_until, nd->userdata);
-
-        if ((prefix_opt->nd_opt_pi_flags_reserved & ND_OPT_PI_FLAG_AUTO) && nd->prefix_autonomous_callback)
-                nd->prefix_autonomous_callback(nd, &prefix->addr, prefix->len, lifetime_preferred, lifetime_valid,
-                                               nd->userdata);
-
-        return 0;
-}
-
-static int ndisc_ra_parse(sd_ndisc *nd, struct nd_router_advert *ra, ssize_t len) {
-        void *opt;
-        struct nd_opt_hdr *opt_hdr;
-
-        assert_return(nd, -EINVAL);
-        assert_return(ra, -EINVAL);
-
-        len -= sizeof(*ra);
-        if (len < NDISC_OPT_LEN_UNITS) {
-                log_ndisc(nd, "Router Advertisement below minimum length");
-
-                return -ENOMSG;
-        }
-
-        opt = ra + 1;
-        opt_hdr = opt;
-
-        while (len != 0 && len >= opt_hdr->nd_opt_len * NDISC_OPT_LEN_UNITS) {
-                struct nd_opt_mtu *opt_mtu;
-                uint32_t mtu;
-                struct nd_opt_prefix_info *opt_prefix;
-
-                if (opt_hdr->nd_opt_len == 0)
-                        return -ENOMSG;
-
-                switch (opt_hdr->nd_opt_type) {
-                case ND_OPT_MTU:
-                        opt_mtu = opt;
-
-                        mtu = be32toh(opt_mtu->nd_opt_mtu_mtu);
-
-                        if (mtu != nd->mtu) {
-                                nd->mtu = MAX(mtu, IP6_MIN_MTU);
-
-                                log_ndisc(nd, "Router Advertisement link MTU %d using %d",
-                                          mtu, nd->mtu);
-                        }
-
-                        break;
-
-                case ND_OPT_PREFIX_INFORMATION:
-                        opt_prefix = opt;
-
-                        ndisc_prefix_update(nd, len, opt_prefix);
-
-                        break;
-                }
+                return 0;
 
-                len -= opt_hdr->nd_opt_len * NDISC_OPT_LEN_UNITS;
-                opt = (void *)((char *)opt +
-                        opt_hdr->nd_opt_len * NDISC_OPT_LEN_UNITS);
-                opt_hdr = opt;
-        }
+        /* Update global variables we keep */
+        if (rt->mtu > 0)
+                nd->mtu = rt->mtu;
+        if (rt->hop_limit > 0)
+                nd->hop_limit = rt->hop_limit;
 
-        if (len > 0)
-                log_ndisc(nd, "Router Advertisement contains %zd bytes of trailing garbage", len);
+        log_ndisc("Received Router Advertisement: flags %s preference %s lifetime %" PRIu16 " sec",
+                  rt->flags & ND_RA_FLAG_MANAGED ? "MANAGED" : rt->flags & ND_RA_FLAG_OTHER ? "OTHER" : "none",
+                  rt->preference == SD_NDISC_PREFERENCE_HIGH ? "high" : rt->preference == SD_NDISC_PREFERENCE_LOW ? "low" : "medium",
+                  rt->lifetime);
 
+        ndisc_callback(nd, SD_NDISC_EVENT_ROUTER, rt);
         return 0;
 }
 
-static int ndisc_router_advertisment_recv(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
-        _cleanup_free_ struct nd_router_advert *ra = NULL;
+static int ndisc_recv(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
+        _cleanup_(sd_ndisc_router_unrefp) sd_ndisc_router *rt = NULL;
         sd_ndisc *nd = userdata;
         union {
                 struct cmsghdr cmsghdr;
-                uint8_t buf[CMSG_LEN(sizeof(int))];
+                uint8_t buf[CMSG_SPACE(sizeof(int)) + /* ttl */
+                            CMSG_SPACE(sizeof(struct timeval))];
         } control = {};
         struct iovec iov = {};
         union sockaddr_union sa = {};
@@ -488,10 +238,7 @@ static int ndisc_router_advertisment_recv(sd_event_source *s, int fd, uint32_t r
                 .msg_controllen = sizeof(control),
         };
         struct cmsghdr *cmsg;
-        struct in6_addr *gw;
-        unsigned lifetime;
         ssize_t len, buflen;
-        int r, pref, stateful;
 
         assert(s);
         assert(nd);
@@ -499,32 +246,47 @@ static int ndisc_router_advertisment_recv(sd_event_source *s, int fd, uint32_t r
 
         buflen = next_datagram_size_fd(fd);
         if (buflen < 0)
-                return buflen;
+                return log_ndisc_errno(buflen, "Failed to determine datagram size to read: %m");
 
-        iov.iov_len = buflen;
-
-        ra = malloc(iov.iov_len);
-        if (!ra)
+        rt = ndisc_router_new(buflen);
+        if (!rt)
                 return -ENOMEM;
 
-        iov.iov_base = ra;
+        iov.iov_base = NDISC_ROUTER_RAW(rt);
+        iov.iov_len = rt->raw_size;
 
-        len = recvmsg(fd, &msg, 0);
+        len = recvmsg(fd, &msg, MSG_DONTWAIT);
         if (len < 0) {
                 if (errno == EAGAIN || errno == EINTR)
                         return 0;
 
-                log_ndisc(nd, "Could not receive message from ICMPv6 socket: %m");
-                return -errno;
-        } else if ((size_t)len < sizeof(struct nd_router_advert)) {
-                return 0;
-        } else if (msg.msg_namelen == 0)
-                gw = NULL; /* only happens when running the test-suite over a socketpair */
-        else if (msg.msg_namelen != sizeof(sa.in6)) {
-                log_ndisc(nd, "Received invalid source address size from ICMPv6 socket: %zu bytes", (size_t)msg.msg_namelen);
-                return 0;
-        } else
-                gw = &sa.in6.sin6_addr;
+                return log_ndisc_errno(errno, "Could not receive message from ICMPv6 socket: %m");
+        }
+
+        if ((size_t) len != rt->raw_size) {
+                log_ndisc("Packet size mismatch.");
+                return -EINVAL;
+        }
+
+        if (msg.msg_namelen == sizeof(struct sockaddr_in6) &&
+            sa.in6.sin6_family == AF_INET6)  {
+
+                if (in_addr_is_link_local(AF_INET6, (union in_addr_union*) &sa.in6.sin6_addr) <= 0) {
+                        _cleanup_free_ char *addr = NULL;
+
+                        (void) in_addr_to_string(AF_INET6, (union in_addr_union*) &sa.in6.sin6_addr, &addr);
+                        log_ndisc("Received RA from non-link-local address %s. Ignoring.", strna(addr));
+                        return 0;
+                }
+
+                rt->address = sa.in6.sin6_addr;
+
+        } else if (msg.msg_namelen > 0) {
+                log_ndisc("Received invalid source address size from ICMPv6 socket: %zu bytes", (size_t) msg.msg_namelen);
+                return -EINVAL;
+        }
+
+        /* namelen == 0 only happens when running the test-suite over a socketpair */
 
         assert(!(msg.msg_flags & MSG_CTRUNC));
         assert(!(msg.msg_flags & MSG_TRUNC));
@@ -533,180 +295,127 @@ static int ndisc_router_advertisment_recv(sd_event_source *s, int fd, uint32_t r
                 if (cmsg->cmsg_level == SOL_IPV6 &&
                     cmsg->cmsg_type == IPV6_HOPLIMIT &&
                     cmsg->cmsg_len == CMSG_LEN(sizeof(int))) {
-                        int hops = *(int*)CMSG_DATA(cmsg);
+                        int hops = *(int*) CMSG_DATA(cmsg);
 
                         if (hops != 255) {
-                                log_ndisc(nd, "Received RA with invalid hop limit %d. Ignoring.", hops);
+                                log_ndisc("Received RA with invalid hop limit %d. Ignoring.", hops);
                                 return 0;
                         }
-
-                        break;
                 }
-        }
-
-        if (gw && !in_addr_is_link_local(AF_INET6, (const union in_addr_union*) gw)) {
-                _cleanup_free_ char *addr = NULL;
-
-                (void)in_addr_to_string(AF_INET6, (const union in_addr_union*) gw, &addr);
-
-                log_ndisc(nd, "Received RA from non-link-local address %s. Ignoring.", strna(addr));
-                return 0;
-        }
-
-        if (ra->nd_ra_type != ND_ROUTER_ADVERT)
-                return 0;
-
-        if (ra->nd_ra_code != 0)
-                return 0;
-
-        nd->timeout = sd_event_source_unref(nd->timeout);
-
-        nd->state = NDISC_STATE_ADVERTISMENT_LISTEN;
-
-        stateful = ra->nd_ra_flags_reserved & (ND_RA_FLAG_MANAGED | ND_RA_FLAG_OTHER);
-        pref = (ra->nd_ra_flags_reserved & ND_RA_FLAG_PREF) >> 3;
 
-        switch (pref) {
-        case ND_RA_FLAG_PREF_LOW:
-        case ND_RA_FLAG_PREF_HIGH:
-                break;
-        default:
-                pref = ND_RA_FLAG_PREF_MEDIUM;
-                break;
+                if (cmsg->cmsg_level == SOL_SOCKET &&
+                    cmsg->cmsg_type == SO_TIMESTAMP &&
+                    cmsg->cmsg_len == CMSG_LEN(sizeof(struct timeval)))
+                        triple_timestamp_from_realtime(&rt->timestamp, timeval_load((struct timeval*) CMSG_DATA(cmsg)));
         }
 
-        lifetime = be16toh(ra->nd_ra_router_lifetime);
+        if (!triple_timestamp_is_set(&rt->timestamp))
+                triple_timestamp_get(&rt->timestamp);
 
-        log_ndisc(nd, "Received Router Advertisement: flags %s preference %s lifetime %u sec",
-                  stateful & ND_RA_FLAG_MANAGED ? "MANAGED" : stateful & ND_RA_FLAG_OTHER ? "OTHER" : "none",
-                  pref == ND_RA_FLAG_PREF_HIGH ? "high" : pref == ND_RA_FLAG_PREF_LOW ? "low" : "medium",
-                  lifetime);
+        nd->timeout_event_source = sd_event_source_unref(nd->timeout_event_source);
 
-        r = ndisc_ra_parse(nd, ra, len);
-        if (r < 0) {
-                log_ndisc(nd, "Could not parse Router Advertisement: %s", strerror(-r));
-                return 0;
-        }
-
-        if (nd->router_callback)
-                nd->router_callback(nd, stateful, gw, lifetime, pref, nd->userdata);
-
-        return 0;
+        return ndisc_handle_datagram(nd, rt);
 }
 
-static int ndisc_router_solicitation_timeout(sd_event_source *s, uint64_t usec, void *userdata) {
+static int ndisc_timeout(sd_event_source *s, uint64_t usec, void *userdata) {
         sd_ndisc *nd = userdata;
-        uint64_t time_now, next_timeout;
+        usec_t time_now, next_timeout;
         int r;
 
         assert(s);
         assert(nd);
         assert(nd->event);
 
-        nd->timeout = sd_event_source_unref(nd->timeout);
-
         if (nd->nd_sent >= NDISC_MAX_ROUTER_SOLICITATIONS) {
-                if (nd->callback)
-                        nd->callback(nd, SD_NDISC_EVENT_TIMEOUT, nd->userdata);
-                nd->state = NDISC_STATE_ADVERTISMENT_LISTEN;
-        } else {
-                r = icmp6_send_router_solicitation(nd->fd, &nd->mac_addr);
-                if (r < 0)
-                        log_ndisc(nd, "Error sending Router Solicitation");
-                else {
-                        nd->state = NDISC_STATE_SOLICITATION_SENT;
-                        log_ndisc(nd, "Sent Router Solicitation");
-                }
-
-                nd->nd_sent++;
+                nd->timeout_event_source = sd_event_source_unref(nd->timeout_event_source);
+                ndisc_callback(nd, SD_NDISC_EVENT_TIMEOUT, NULL);
+                return 0;
+        }
 
-                assert_se(sd_event_now(nd->event, clock_boottime_or_monotonic(), &time_now) >= 0);
+        r = icmp6_send_router_solicitation(nd->fd, &nd->mac_addr);
+        if (r < 0) {
+                log_ndisc_errno(r, "Error sending Router Solicitation: %m");
+                goto fail;
+        }
 
-                next_timeout = time_now + NDISC_ROUTER_SOLICITATION_INTERVAL;
+        log_ndisc("Sent Router Solicitation");
+        nd->nd_sent++;
 
-                r = sd_event_add_time(nd->event, &nd->timeout, clock_boottime_or_monotonic(),
-                                      next_timeout, 0,
-                                      ndisc_router_solicitation_timeout, nd);
-                if (r < 0) {
-                        /* we cannot continue if we are unable to rearm the timer */
-                        sd_ndisc_stop(nd);
-                        return 0;
-                }
+        assert_se(sd_event_now(nd->event, clock_boottime_or_monotonic(), &time_now) >= 0);
+        next_timeout = time_now + NDISC_ROUTER_SOLICITATION_INTERVAL;
 
-                r = sd_event_source_set_priority(nd->timeout, nd->event_priority);
-                if (r < 0)
-                        return 0;
+        r = sd_event_source_set_time(nd->timeout_event_source, next_timeout);
+        if (r < 0) {
+                log_ndisc_errno(r, "Error updating timer: %m");
+                goto fail;
+        }
 
-                r = sd_event_source_set_description(nd->timeout, "ndisc-timeout");
-                if (r < 0)
-                        return 0;
+        r = sd_event_source_set_enabled(nd->timeout_event_source, SD_EVENT_ONESHOT);
+        if (r < 0) {
+                log_ndisc_errno(r, "Error reenabling timer: %m");
+                goto fail;
         }
 
         return 0;
+
+fail:
+        sd_ndisc_stop(nd);
+        return 0;
 }
 
-int sd_ndisc_stop(sd_ndisc *nd) {
+_public_ int sd_ndisc_stop(sd_ndisc *nd) {
         assert_return(nd, -EINVAL);
-        assert_return(nd->event, -EINVAL);
-
-        log_ndisc(client, "Stop NDisc");
 
-        ndisc_init(nd);
-
-        nd->state = NDISC_STATE_IDLE;
+        if (nd->fd < 0)
+                return 0;
 
-        if (nd->callback)
-                nd->callback(nd, SD_NDISC_EVENT_STOP, nd->userdata);
+        log_ndisc("Stopping IPv6 Router Solicitation client");
 
-        return 0;
+        ndisc_reset(nd);
+        return 1;
 }
 
-int sd_ndisc_router_discovery_start(sd_ndisc *nd) {
+_public_ int sd_ndisc_start(sd_ndisc *nd) {
         int r;
 
-        assert(nd);
-        assert(nd->event);
-
-        if (nd->state != NDISC_STATE_IDLE)
-                return -EBUSY;
+        assert_return(nd, -EINVAL);
+        assert_return(nd->event, -EINVAL);
+        assert_return(nd->ifindex > 0, -EINVAL);
 
-        if (nd->index < 1)
-                return -EINVAL;
+        if (nd->fd >= 0)
+                return 0;
 
-        r = icmp6_bind_router_solicitation(nd->index);
-        if (r < 0)
-                return r;
+        assert(!nd->recv_event_source);
+        assert(!nd->timeout_event_source);
 
-        nd->fd = r;
+        nd->fd = icmp6_bind_router_solicitation(nd->ifindex);
+        if (nd->fd < 0)
+                return nd->fd;
 
-        r = sd_event_add_io(nd->event, &nd->recv, nd->fd, EPOLLIN,
-                            ndisc_router_advertisment_recv, nd);
+        r = sd_event_add_io(nd->event, &nd->recv_event_source, nd->fd, EPOLLIN, ndisc_recv, nd);
         if (r < 0)
-                goto error;
+                goto fail;
 
-        r = sd_event_source_set_priority(nd->recv, nd->event_priority);
+        r = sd_event_source_set_priority(nd->recv_event_source, nd->event_priority);
         if (r < 0)
-                goto error;
+                goto fail;
 
-        r = sd_event_source_set_description(nd->recv, "ndisc-receive-message");
-        if (r < 0)
-                goto error;
+        (void) sd_event_source_set_description(nd->recv_event_source, "ndisc-receive-message");
 
-        r = sd_event_add_time(nd->event, &nd->timeout, clock_boottime_or_monotonic(),
-                              0, 0, ndisc_router_solicitation_timeout, nd);
+        r = sd_event_add_time(nd->event, &nd->timeout_event_source, clock_boottime_or_monotonic(), 0, 0, ndisc_timeout, nd);
         if (r < 0)
-                goto error;
+                goto fail;
 
-        r = sd_event_source_set_priority(nd->timeout, nd->event_priority);
+        r = sd_event_source_set_priority(nd->timeout_event_source, nd->event_priority);
         if (r < 0)
-                goto error;
+                goto fail;
 
-        r = sd_event_source_set_description(nd->timeout, "ndisc-timeout");
-error:
-        if (r < 0)
-                ndisc_init(nd);
-        else
-                log_ndisc(client, "Start Router Solicitation");
+        (void) sd_event_source_set_description(nd->timeout_event_source, "ndisc-timeout");
+
+        log_ndisc("Started IPv6 Router Solicitation client");
+        return 1;
 
+fail:
+        ndisc_reset(nd);
         return r;
 }
diff --git a/src/libsystemd-network/test/Makefile b/src/libsystemd-network/test/Makefile
index dab8ee0beb..8cc38bb547 100644
--- a/src/libsystemd-network/test/Makefile
+++ b/src/libsystemd-network/test/Makefile
@@ -30,7 +30,7 @@ test_dhcp_option_SOURCES = \
 
 test_dhcp_option_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_dhcp_client_SOURCES = \
 	src/systemd/sd-dhcp-client.h \
@@ -40,14 +40,14 @@ test_dhcp_client_SOURCES = \
 
 test_dhcp_client_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_dhcp_server_SOURCES = \
 	src/libsystemd-network/test-dhcp-server.c
 
 test_dhcp_server_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_ipv4ll_SOURCES = \
 	src/systemd/sd-ipv4ll.h \
@@ -56,7 +56,7 @@ test_ipv4ll_SOURCES = \
 
 test_ipv4ll_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_ipv4ll_manual_SOURCES = \
 	src/systemd/sd-ipv4ll.h \
@@ -64,7 +64,7 @@ test_ipv4ll_manual_SOURCES = \
 
 test_ipv4ll_manual_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_acd_SOURCES = \
 	src/systemd/sd-ipv4acd.h \
@@ -72,7 +72,7 @@ test_acd_SOURCES = \
 
 test_acd_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_ndisc_rs_SOURCES = \
 	src/systemd/sd-dhcp6-client.h \
@@ -85,7 +85,7 @@ test_ndisc_rs_SOURCES = \
 test_ndisc_rs_LDADD = \
 	libsystemd-network.la \
 	libudev.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_dhcp6_client_SOURCES = \
 	src/systemd/sd-dhcp6-client.h \
@@ -97,14 +97,14 @@ test_dhcp6_client_SOURCES = \
 test_dhcp6_client_LDADD = \
 	libsystemd-network.la \
 	libudev.la \
-	libshared.la
+	libsystemd-shared.la
 
 test_lldp_SOURCES = \
 	src/libsystemd-network/test-lldp.c
 
 test_lldp_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la
 
 tests += \
 	test-dhcp-option \
diff --git a/src/libsystemd-network/test/test-acd.c b/src/libsystemd-network/test/test-acd.c
index 850c2cb2a4..d79e71ab90 100644
--- a/src/libsystemd-network/test/test-acd.c
+++ b/src/libsystemd-network/test/test-acd.c
@@ -56,7 +56,7 @@ static int client_run(int ifindex, const struct in_addr *pa, const struct ether_
         assert_se(sd_ipv4acd_new(&acd) >= 0);
         assert_se(sd_ipv4acd_attach_event(acd, e, 0) >= 0);
 
-        assert_se(sd_ipv4acd_set_index(acd, ifindex) >= 0);
+        assert_se(sd_ipv4acd_set_ifindex(acd, ifindex) >= 0);
         assert_se(sd_ipv4acd_set_mac(acd, ha) >= 0);
         assert_se(sd_ipv4acd_set_address(acd, pa) >= 0);
         assert_se(sd_ipv4acd_set_callback(acd, acd_handler, NULL) >= 0);
diff --git a/src/libsystemd-network/test/test-dhcp-client.c b/src/libsystemd-network/test/test-dhcp-client.c
index c116696c8d..2b40ab8f48 100644
--- a/src/libsystemd-network/test/test-dhcp-client.c
+++ b/src/libsystemd-network/test/test-dhcp-client.c
@@ -66,13 +66,13 @@ static void test_request_basic(sd_event *e) {
 
         assert_se(sd_dhcp_client_set_request_option(NULL, 0) == -EINVAL);
         assert_se(sd_dhcp_client_set_request_address(NULL, NULL) == -EINVAL);
-        assert_se(sd_dhcp_client_set_index(NULL, 0) == -EINVAL);
+        assert_se(sd_dhcp_client_set_ifindex(NULL, 0) == -EINVAL);
 
-        assert_se(sd_dhcp_client_set_index(client, 15) == 0);
-        assert_se(sd_dhcp_client_set_index(client, -42) == -EINVAL);
-        assert_se(sd_dhcp_client_set_index(client, -1) == -EINVAL);
-        assert_se(sd_dhcp_client_set_index(client, 0) == -EINVAL);
-        assert_se(sd_dhcp_client_set_index(client, 1) == 0);
+        assert_se(sd_dhcp_client_set_ifindex(client, 15) == 0);
+        assert_se(sd_dhcp_client_set_ifindex(client, -42) == -EINVAL);
+        assert_se(sd_dhcp_client_set_ifindex(client, -1) == -EINVAL);
+        assert_se(sd_dhcp_client_set_ifindex(client, 0) == -EINVAL);
+        assert_se(sd_dhcp_client_set_ifindex(client, 1) == 0);
 
         assert_se(sd_dhcp_client_set_request_option(client,
                                         SD_DHCP_OPTION_SUBNET_MASK) == -EEXIST);
@@ -243,7 +243,7 @@ static void test_discover_message(sd_event *e) {
         r = sd_dhcp_client_attach_event(client, e, 0);
         assert_se(r >= 0);
 
-        assert_se(sd_dhcp_client_set_index(client, 42) >= 0);
+        assert_se(sd_dhcp_client_set_ifindex(client, 42) >= 0);
         assert_se(sd_dhcp_client_set_mac(client, mac_addr, ETH_ALEN, ARPHRD_ETHER) >= 0);
 
         assert_se(sd_dhcp_client_set_request_option(client, 248) >= 0);
@@ -458,7 +458,7 @@ static void test_addr_acq(sd_event *e) {
         r = sd_dhcp_client_attach_event(client, e, 0);
         assert_se(r >= 0);
 
-        assert_se(sd_dhcp_client_set_index(client, 42) >= 0);
+        assert_se(sd_dhcp_client_set_ifindex(client, 42) >= 0);
         assert_se(sd_dhcp_client_set_mac(client, mac_addr, ETH_ALEN, ARPHRD_ETHER) >= 0);
 
         assert_se(sd_dhcp_client_set_callback(client, test_addr_acq_acquired, e) >= 0);
diff --git a/src/libsystemd-network/test/test-dhcp6-client.c b/src/libsystemd-network/test/test-dhcp6-client.c
index 66424bc624..20019f4bba 100644
--- a/src/libsystemd-network/test/test-dhcp6-client.c
+++ b/src/libsystemd-network/test/test-dhcp6-client.c
@@ -59,10 +59,10 @@ static int test_client_basic(sd_event *e) {
 
         assert_se(sd_dhcp6_client_attach_event(client, e, 0) >= 0);
 
-        assert_se(sd_dhcp6_client_set_index(client, 15) == 0);
-        assert_se(sd_dhcp6_client_set_index(client, -42) == -EINVAL);
-        assert_se(sd_dhcp6_client_set_index(client, -1) == 0);
-        assert_se(sd_dhcp6_client_set_index(client, 42) >= 0);
+        assert_se(sd_dhcp6_client_set_ifindex(client, 15) == 0);
+        assert_se(sd_dhcp6_client_set_ifindex(client, -42) == -EINVAL);
+        assert_se(sd_dhcp6_client_set_ifindex(client, -1) == 0);
+        assert_se(sd_dhcp6_client_set_ifindex(client, 42) >= 0);
 
         assert_se(sd_dhcp6_client_set_mac(client, (const uint8_t *) &mac_addr,
                                           sizeof (mac_addr),
@@ -712,7 +712,7 @@ static int test_client_solicit(sd_event *e) {
 
         assert_se(sd_dhcp6_client_attach_event(client, e, 0) >= 0);
 
-        assert_se(sd_dhcp6_client_set_index(client, test_index) == 0);
+        assert_se(sd_dhcp6_client_set_ifindex(client, test_index) == 0);
         assert_se(sd_dhcp6_client_set_mac(client, (const uint8_t *) &mac_addr,
                                           sizeof (mac_addr),
                                           ARPHRD_ETHER) >= 0);
diff --git a/src/libsystemd-network/test/test-ipv4ll-manual.c b/src/libsystemd-network/test/test-ipv4ll-manual.c
index 83c2b46124..8dac0b1ca8 100644
--- a/src/libsystemd-network/test/test-ipv4ll-manual.c
+++ b/src/libsystemd-network/test/test-ipv4ll-manual.c
@@ -65,7 +65,7 @@ static int client_run(int ifindex, const char *seed_str, const struct ether_addr
         assert_se(sd_ipv4ll_new(&ll) >= 0);
         assert_se(sd_ipv4ll_attach_event(ll, e, 0) >= 0);
 
-        assert_se(sd_ipv4ll_set_index(ll, ifindex) >= 0);
+        assert_se(sd_ipv4ll_set_ifindex(ll, ifindex) >= 0);
         assert_se(sd_ipv4ll_set_mac(ll, ha) >= 0);
         assert_se(sd_ipv4ll_set_callback(ll, ll_handler, NULL) >= 0);
 
diff --git a/src/libsystemd-network/test/test-ipv4ll.c b/src/libsystemd-network/test/test-ipv4ll.c
index af259cf0de..6d3e7f35d5 100644
--- a/src/libsystemd-network/test/test-ipv4ll.c
+++ b/src/libsystemd-network/test/test-ipv4ll.c
@@ -37,7 +37,8 @@ static int test_fd[2];
 
 static int basic_request_handler_bind = 0;
 static int basic_request_handler_stop = 0;
-static void* basic_request_handler_userdata = (void*)0xCABCAB;
+static void* basic_request_handler_userdata = (void*) 0xCABCAB;
+
 static void basic_request_handler(sd_ipv4ll *ll, int event, void *userdata) {
         assert_se(userdata == basic_request_handler_userdata);
 
@@ -99,7 +100,7 @@ int arp_network_bind_raw_socket(int index, be32_t address, const struct ether_ad
 
 static void test_public_api_setters(sd_event *e) {
         struct in_addr address = {};
-        unsigned seed = 0;
+        uint64_t seed = 0;
         sd_ipv4ll *ll;
         struct ether_addr mac_addr = {
                 .ether_addr_octet = {'A', 'B', 'C', '1', '2', '3'}};
@@ -134,11 +135,11 @@ static void test_public_api_setters(sd_event *e) {
         assert_se(sd_ipv4ll_set_mac(ll, NULL) == -EINVAL);
         assert_se(sd_ipv4ll_set_mac(ll, &mac_addr) == 0);
 
-        assert_se(sd_ipv4ll_set_index(NULL, -1) == -EINVAL);
-        assert_se(sd_ipv4ll_set_index(ll, -1) == -EINVAL);
-        assert_se(sd_ipv4ll_set_index(ll, -99) == -EINVAL);
-        assert_se(sd_ipv4ll_set_index(ll, 1) == 0);
-        assert_se(sd_ipv4ll_set_index(ll, 99) == 0);
+        assert_se(sd_ipv4ll_set_ifindex(NULL, -1) == -EINVAL);
+        assert_se(sd_ipv4ll_set_ifindex(ll, -1) == -EINVAL);
+        assert_se(sd_ipv4ll_set_ifindex(ll, -99) == -EINVAL);
+        assert_se(sd_ipv4ll_set_ifindex(ll, 1) == 0);
+        assert_se(sd_ipv4ll_set_ifindex(ll, 99) == 0);
 
         assert_se(sd_ipv4ll_ref(ll) == ll);
         assert_se(sd_ipv4ll_unref(ll) == NULL);
@@ -170,7 +171,7 @@ static void test_basic_request(sd_event *e) {
                                          basic_request_handler_userdata) == 0);
         assert_se(sd_ipv4ll_start(ll) == -EINVAL);
 
-        assert_se(sd_ipv4ll_set_index(ll, 1) == 0);
+        assert_se(sd_ipv4ll_set_ifindex(ll, 1) == 0);
         assert_se(sd_ipv4ll_start(ll) == 0);
 
         sd_event_run(e, (uint64_t) -1);
@@ -180,16 +181,16 @@ static void test_basic_request(sd_event *e) {
 
         /* PROBE */
         sd_event_run(e, (uint64_t) -1);
-        assert_se(read(test_fd[1], &arp, sizeof(struct ether_arp)) == sizeof(struct ether_arp));
+        assert_se(recv(test_fd[1], &arp, sizeof(struct ether_arp), 0) == sizeof(struct ether_arp));
 
         if (extended) {
                 /* PROBE */
                 sd_event_run(e, (uint64_t) -1);
-                assert_se(read(test_fd[1], &arp, sizeof(struct ether_arp)) == sizeof(struct ether_arp));
+                assert_se(recv(test_fd[1], &arp, sizeof(struct ether_arp), 0) == sizeof(struct ether_arp));
 
                 /* PROBE */
                 sd_event_run(e, (uint64_t) -1);
-                assert_se(read(test_fd[1], &arp, sizeof(struct ether_arp)) == sizeof(struct ether_arp));
+                assert_se(recv(test_fd[1], &arp, sizeof(struct ether_arp), 0) == sizeof(struct ether_arp));
 
                 sd_event_run(e, (uint64_t) -1);
                 assert_se(basic_request_handler_bind == 1);
diff --git a/src/libsystemd-network/test/test-lldp.c b/src/libsystemd-network/test/test-lldp.c
index 858c7789d7..ad321621e4 100644
--- a/src/libsystemd-network/test/test-lldp.c
+++ b/src/libsystemd-network/test/test-lldp.c
@@ -54,11 +54,11 @@ static void lldp_handler(sd_lldp *lldp, sd_lldp_event event, sd_lldp_neighbor *n
 static int start_lldp(sd_lldp **lldp, sd_event *e, sd_lldp_callback_t cb, void *cb_data) {
         int r;
 
-        r = sd_lldp_new(lldp, 42);
+        r = sd_lldp_new(lldp);
         if (r < 0)
                 return r;
 
-        r = sd_lldp_attach_event(*lldp, e, 0);
+        r = sd_lldp_set_ifindex(*lldp, 42);
         if (r < 0)
                 return r;
 
@@ -66,6 +66,10 @@ static int start_lldp(sd_lldp **lldp, sd_event *e, sd_lldp_callback_t cb, void *
         if (r < 0)
                 return r;
 
+        r = sd_lldp_attach_event(*lldp, e, 0);
+        if (r < 0)
+                return r;
+
         r = sd_lldp_start(*lldp);
         if (r < 0)
                 return r;
diff --git a/src/libsystemd-network/test/test-ndisc-rs.c b/src/libsystemd-network/test/test-ndisc-rs.c
index 92445eff5d..ff4b5c72ec 100644
--- a/src/libsystemd-network/test/test-ndisc-rs.c
+++ b/src/libsystemd-network/test/test-ndisc-rs.c
@@ -17,9 +17,13 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include <arpa/inet.h>
 #include <netinet/icmp6.h>
 
+#include "basic/alloc-util.h"
+#include "basic/hexdecoct.h"
 #include "basic/socket-util.h"
+#include "basic/strv.h"
 #include "systemd-network/icmp6-util.h"
 #include "systemd-network/sd-ndisc.h"
 
@@ -34,6 +38,144 @@ static int test_fd[2];
 typedef int (*send_ra_t)(uint8_t flags);
 static send_ra_t send_ra_function;
 
+static void router_dump(sd_ndisc_router *rt) {
+        struct in6_addr addr;
+        char buf[FORMAT_TIMESTAMP_MAX];
+        uint8_t hop_limit;
+        uint64_t t, flags;
+        uint32_t mtu;
+        uint16_t lifetime;
+        unsigned preference;
+        int r;
+
+        assert_se(rt);
+
+        log_info("--");
+        assert_se(sd_ndisc_router_get_address(rt, &addr) == -ENODATA);
+
+        assert_se(sd_ndisc_router_get_timestamp(rt, CLOCK_REALTIME, &t) >= 0);
+        log_info("Timestamp: %s", format_timestamp(buf, sizeof(buf), t));
+
+        assert_se(sd_ndisc_router_get_timestamp(rt, CLOCK_MONOTONIC, &t) >= 0);
+        log_info("Monotonic: %" PRIu64, t);
+
+        if (sd_ndisc_router_get_hop_limit(rt, &hop_limit) < 0)
+                log_info("No hop limit set");
+        else
+                log_info("Hop limit: %u", hop_limit);
+
+        assert_se(sd_ndisc_router_get_flags(rt, &flags) >= 0);
+        log_info("Flags: <%s|%s>",
+                 flags & ND_RA_FLAG_OTHER ? "OTHER" : "",
+                 flags & ND_RA_FLAG_MANAGED ? "MANAGED" : "");
+
+        assert_se(sd_ndisc_router_get_preference(rt, &preference) >= 0);
+        log_info("Preference: %s",
+                 preference == SD_NDISC_PREFERENCE_LOW ? "low" :
+                 preference == SD_NDISC_PREFERENCE_HIGH ? "high" : "medium");
+
+        assert_se(sd_ndisc_router_get_lifetime(rt, &lifetime) >= 0);
+        log_info("Lifetime: %" PRIu16, lifetime);
+
+        if (sd_ndisc_router_get_mtu(rt, &mtu) < 0)
+                log_info("No MTU set");
+        else
+                log_info("MTU: %" PRIu32, mtu);
+
+        r = sd_ndisc_router_option_rewind(rt);
+        for (;;) {
+                uint8_t type;
+
+                assert_se(r >= 0);
+
+                if (r == 0)
+                        break;
+
+                assert_se(sd_ndisc_router_option_get_type(rt, &type) >= 0);
+
+                log_info(">> Option %u", type);
+
+                switch (type) {
+
+                case SD_NDISC_OPTION_SOURCE_LL_ADDRESS:
+                case SD_NDISC_OPTION_TARGET_LL_ADDRESS: {
+                        _cleanup_free_ char *c = NULL;
+                        const void *p;
+                        size_t n;
+
+                        assert_se(sd_ndisc_router_option_get_raw(rt, &p, &n) >= 0);
+                        assert_se(n > 2);
+                        assert_se(c = hexmem((uint8_t*) p + 2, n - 2));
+
+                        log_info("Address: %s", c);
+                        break;
+                }
+
+                case SD_NDISC_OPTION_PREFIX_INFORMATION: {
+                        uint32_t lifetime_valid, lifetime_preferred;
+                        unsigned prefix_len;
+                        uint8_t pfl;
+                        struct in6_addr a;
+                        char buff[INET6_ADDRSTRLEN];
+
+                        assert_se(sd_ndisc_router_prefix_get_valid_lifetime(rt, &lifetime_valid) >= 0);
+                        log_info("Valid Lifetime: %" PRIu32, lifetime_valid);
+
+                        assert_se(sd_ndisc_router_prefix_get_preferred_lifetime(rt, &lifetime_preferred) >= 0);
+                        log_info("Preferred Lifetime: %" PRIu32, lifetime_preferred);
+
+                        assert_se(sd_ndisc_router_prefix_get_flags(rt, &pfl) >= 0);
+                        log_info("Flags: <%s|%s>",
+                                 pfl & ND_OPT_PI_FLAG_ONLINK ? "ONLINK" : "",
+                                 pfl & ND_OPT_PI_FLAG_AUTO ? "AUTO" : "");
+
+                        assert_se(sd_ndisc_router_prefix_get_prefixlen(rt, &prefix_len) >= 0);
+                        log_info("Prefix Length: %u", prefix_len);
+
+                        assert_se(sd_ndisc_router_prefix_get_address(rt, &a) >= 0);
+                        log_info("Prefix: %s", inet_ntop(AF_INET6, &a, buff, sizeof(buff)));
+
+                        break;
+                }
+
+                case SD_NDISC_OPTION_RDNSS: {
+                        const struct in6_addr *a;
+                        uint32_t lt;
+                        int n, i;
+
+                        n = sd_ndisc_router_rdnss_get_addresses(rt, &a);
+                        assert_se(n > 0);
+
+                        for (i = 0; i < n; i++) {
+                                char buff[INET6_ADDRSTRLEN];
+                                log_info("DNS: %s", inet_ntop(AF_INET6, a + i, buff, sizeof(buff)));
+                        }
+
+                        assert_se(sd_ndisc_router_rdnss_get_lifetime(rt, &lt) >= 0);
+                        log_info("Lifetime: %" PRIu32, lt);
+                        break;
+                }
+
+                case SD_NDISC_OPTION_DNSSL: {
+                        _cleanup_strv_free_ char **l = NULL;
+                        uint32_t lt;
+                        int n, i;
+
+                        n = sd_ndisc_router_dnssl_get_domains(rt, &l);
+                        assert_se(n > 0);
+
+                        for (i = 0; i < n; i++)
+                                log_info("Domain: %s", l[i]);
+
+                        assert_se(sd_ndisc_router_dnssl_get_lifetime(rt, &lt) >= 0);
+                        log_info("Lifetime: %" PRIu32, lt);
+                        break;
+                }}
+
+                r = sd_ndisc_router_option_next(rt);
+        }
+}
+
 static int test_rs_hangcheck(sd_event_source *s, uint64_t usec,
                              void *userdata) {
         assert_se(false);
@@ -82,32 +224,39 @@ int icmp6_send_router_solicitation(int s, const struct ether_addr *ether_addr) {
         return send_ra_function(0);
 }
 
-static void test_rs_done(sd_ndisc *nd, uint8_t flags, const struct in6_addr *gateway, unsigned lifetime, int pref, void *userdata) {
+static void test_callback(sd_ndisc *nd, sd_ndisc_event event, sd_ndisc_router *rt, void *userdata) {
         sd_event *e = userdata;
         static unsigned idx = 0;
-        uint8_t flags_array[] = {
+        uint64_t flags_array[] = {
                 0,
                 0,
                 0,
                 ND_RA_FLAG_OTHER,
                 ND_RA_FLAG_MANAGED
         };
+        uint64_t flags;
         uint32_t mtu;
 
         assert_se(nd);
 
+        if (event != SD_NDISC_EVENT_ROUTER)
+                return;
+
+        router_dump(rt);
+
+        assert_se(sd_ndisc_router_get_flags(rt, &flags) >= 0);
         assert_se(flags == flags_array[idx]);
         idx++;
 
         if (verbose)
-                printf("  got event 0x%02x\n", flags);
+                printf("  got event 0x%02" PRIx64 "\n", flags);
 
         if (idx < ELEMENTSOF(flags_array)) {
                 send_ra(flags_array[idx]);
                 return;
         }
 
-        assert_se(sd_ndisc_get_mtu(nd, &mtu) == -ENOMSG);
+        assert_se(sd_ndisc_get_mtu(nd, &mtu) == -ENODATA);
 
         sd_event_exit(e, 0);
 }
@@ -129,19 +278,19 @@ static void test_rs(void) {
 
         assert_se(sd_ndisc_attach_event(nd, e, 0) >= 0);
 
-        assert_se(sd_ndisc_set_index(nd, 42) >= 0);
+        assert_se(sd_ndisc_set_ifindex(nd, 42) >= 0);
         assert_se(sd_ndisc_set_mac(nd, &mac_addr) >= 0);
-        assert_se(sd_ndisc_set_callback(nd, test_rs_done, NULL, NULL, NULL, e) >= 0);
+        assert_se(sd_ndisc_set_callback(nd, test_callback, e) >= 0);
 
         assert_se(sd_event_add_time(e, &test_hangcheck, clock_boottime_or_monotonic(),
                                  time_now + 2 *USEC_PER_SEC, 0,
                                  test_rs_hangcheck, NULL) >= 0);
 
         assert_se(sd_ndisc_stop(nd) >= 0);
-        assert_se(sd_ndisc_router_discovery_start(nd) >= 0);
+        assert_se(sd_ndisc_start(nd) >= 0);
         assert_se(sd_ndisc_stop(nd) >= 0);
 
-        assert_se(sd_ndisc_router_discovery_start(nd) >= 0);
+        assert_se(sd_ndisc_start(nd) >= 0);
 
         sd_event_loop(e);
 
diff --git a/src/libsystemd/Makefile b/src/libsystemd/Makefile
index 23a2bddfee..77fa162d58 100644
--- a/src/libsystemd/Makefile
+++ b/src/libsystemd/Makefile
@@ -23,9 +23,9 @@
 include $(dir $(lastword $(MAKEFILE_LIST)))/../../config.mk
 include $(topsrcdir)/build-aux/Makefile.head.mk
 
-LIBSYSTEMD_CURRENT=15
+LIBSYSTEMD_CURRENT=16
 LIBSYSTEMD_REVISION=0
-LIBSYSTEMD_AGE=15
+LIBSYSTEMD_AGE=16
 
 EXTRA_DIST += \
 	src/libsystemd/libsystemd.pc.in \
@@ -48,9 +48,10 @@ libsystemd_la_LDFLAGS = \
 	-version-info $(LIBSYSTEMD_CURRENT):$(LIBSYSTEMD_REVISION):$(LIBSYSTEMD_AGE) \
 	-Wl,--version-script=$(srcdir)/libsystemd.sym
 
-#libsystemd_la_LIBADD = \
-	$(libsystemd_internal_la_LIBADD) \
-	$(libsystemd_journal_internal_la_LIBADD)
+libsystemd_la_LIBADD = \
+	libsystemd-internal.la \
+	libbasic.la \
+	libsystemd-journal-internal.la
 
 libsystemd_la_LIBADD = $(libsystemd-internal.DEPENDS)
 
diff --git a/src/libsystemd/include/systemd/sd-daemon.h b/src/libsystemd/include/systemd/sd-daemon.h
index e6787b0a64..740b176903 100644
--- a/src/libsystemd/include/systemd/sd-daemon.h
+++ b/src/libsystemd/include/systemd/sd-daemon.h
@@ -196,6 +196,11 @@ int sd_is_mq(int fd, const char *path);
                   invocation. This variable is only supported with
                   sd_pid_notify_with_fds().
 
+     WATCHDOG_USEC=...
+                  Reset watchdog_usec value during runtime.
+                  To reset watchdog_usec value, start the service again.
+                  Example: "WATCHDOG_USEC=20000000"
+
   Daemons can choose to send additional variables. However, it is
   recommended to prefix variable names not listed above with X_.
 
diff --git a/src/libsystemd/include/systemd/sd-event.h b/src/libsystemd/include/systemd/sd-event.h
index 531ace1c34..cc26b7df55 100644
--- a/src/libsystemd/include/systemd/sd-event.h
+++ b/src/libsystemd/include/systemd/sd-event.h
@@ -104,6 +104,7 @@ int sd_event_get_tid(sd_event *e, pid_t *tid);
 int sd_event_get_exit_code(sd_event *e, int *code);
 int sd_event_set_watchdog(sd_event *e, int b);
 int sd_event_get_watchdog(sd_event *e);
+int sd_event_get_iteration(sd_event *e, uint64_t *ret);
 
 sd_event_source* sd_event_source_ref(sd_event_source *s);
 sd_event_source* sd_event_source_unref(sd_event_source *s);
diff --git a/src/libsystemd/libsystemd.sym b/src/libsystemd/libsystemd.sym
index 0b3a1708dc..542254295c 100644
--- a/src/libsystemd/libsystemd.sym
+++ b/src/libsystemd/libsystemd.sym
@@ -495,3 +495,8 @@ global:
         sd_journal_open_directory_fd;
         sd_journal_open_files_fd;
 } LIBSYSTEMD_229;
+
+LIBSYSTEMD_231 {
+global:
+        sd_event_get_iteration;
+} LIBSYSTEMD_230;
diff --git a/src/libsystemd/sd_bus_add_match.xml b/src/libsystemd/sd_bus_add_match.xml
new file mode 100644
index 0000000000..8bcf7164a0
--- /dev/null
+++ b/src/libsystemd/sd_bus_add_match.xml
@@ -0,0 +1,119 @@
+<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+
+<!--
+  This file is part of systemd.
+
+  Copyright 2016 Julian Orth
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<refentry id="sd_bus_add_match">
+
+  <refentryinfo>
+    <title>sd_bus_add_match</title>
+    <productname>systemd</productname>
+
+    <authorgroup>
+      <author>
+        <firstname>Julian</firstname>
+        <surname>Orth</surname>
+        <email>ju.orth@gmail.com</email>
+      </author>
+    </authorgroup>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>sd_bus_add_match</refentrytitle>
+    <manvolnum>3</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>sd_bus_add_match</refname>
+
+    <refpurpose>Add a match rule for message dispatching</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <funcsynopsis>
+      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>
+
+      <funcprototype>
+        <funcdef>int <function>sd_bus_add_match</function></funcdef>
+        <paramdef>sd_bus *<parameter>bus</parameter></paramdef>
+        <paramdef>sd_bus_slot **<parameter>slot</parameter></paramdef>
+        <paramdef>const char *<parameter>match</parameter></paramdef>
+        <paramdef>sd_bus_message_handler_t <parameter>callback</parameter></paramdef>
+        <paramdef>void *<parameter>userdata</parameter></paramdef>
+      </funcprototype>
+
+      <funcprototype>
+        <funcdef>typedef int (*<function>sd_bus_message_handler_t</function>)</funcdef>
+        <paramdef>sd_bus_message *<parameter>m</parameter></paramdef>
+        <paramdef>void *<parameter>userdata</parameter></paramdef>
+        <paramdef>sd_bus_error *<parameter>ret_error</parameter></paramdef>
+      </funcprototype>
+    </funcsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>
+      <function>sd_bus_add_match()</function> adds a match rule used to dispatch
+      incoming messages. The syntax of the rule passed in
+      <parameter>match</parameter> is described in the
+      <ulink url="https://dbus.freedesktop.org/doc/dbus-specification.html">D-Bus Specification</ulink>.
+    </para>
+
+    <para>
+      The message <parameter>m</parameter> passed to the callback is only
+      borrowed, that is, the callback should not call
+      <citerefentry><refentrytitle>sd_bus_message_unref</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      on it. If the callback wants to hold on to the message beyond the lifetime
+      of the callback, it needs to call
+      <citerefentry><refentrytitle>sd_bus_message_ref</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      to create a new reference.
+    </para>
+
+    <para>
+      If an error occurs during the callback invocation, the callback should
+      return a negative error number. If it wants other callbacks that match the
+      same rule to be called, it should return 0. Otherwise it should return a
+      positive integer.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Return Value</title>
+
+    <para>
+      On success, <function>sd_bus_add_match()</function> returns 0 or a
+      positive integer. On failure, it returns a negative errno-style error
+      code.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+
+    <para>
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>sd-bus</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    </para>
+  </refsect1>
+
+</refentry>
diff --git a/src/libsystemd/sd_bus_get_fd.xml b/src/libsystemd/sd_bus_get_fd.xml
new file mode 100644
index 0000000000..9f7019069f
--- /dev/null
+++ b/src/libsystemd/sd_bus_get_fd.xml
@@ -0,0 +1,101 @@
+<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+
+<!--
+  This file is part of systemd.
+
+  Copyright 2016 Julian Orth
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<refentry id="sd_bus_get_fd">
+
+  <refentryinfo>
+    <title>sd_bus_get_fd</title>
+    <productname>systemd</productname>
+
+    <authorgroup>
+      <author>
+        <firstname>Julian</firstname>
+        <surname>Orth</surname>
+        <email>ju.orth@gmail.com</email>
+      </author>
+    </authorgroup>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>sd_bus_get_fd</refentrytitle>
+    <manvolnum>3</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>sd_bus_get_fd</refname>
+
+    <refpurpose>Get the file descriptor connected to the message bus</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <funcsynopsis>
+      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>
+
+      <funcprototype>
+        <funcdef>int <function>sd_bus_get_fd</function></funcdef>
+        <paramdef>sd_bus *<parameter>bus</parameter></paramdef>
+      </funcprototype>
+    </funcsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>
+      <function>sd_bus_get_fd()</function> returns the file descriptor used to
+      communicate with the message bus. This descriptor can be used with
+      <citerefentry
+        project='die-net'><refentrytitle>select</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+      <citerefentry
+        project='die-net'><refentrytitle>poll</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+      or similar functions to wait for incoming messages.
+    </para>
+
+    <para>
+      If the bus was created with the
+      <citerefentry><refentrytitle>sd_bus_set_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      function, then the <parameter>input_fd</parameter> used in that call is
+      returned.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Return Value</title>
+
+    <para>
+      Returns the file descriptor used for incoming messages from the message
+      bus.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+
+    <para>
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>sd-bus</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>sd_bus_set_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    </para>
+  </refsect1>
+
+</refentry>
diff --git a/src/libsystemd/sd_bus_message_read_basic.xml b/src/libsystemd/sd_bus_message_read_basic.xml
new file mode 100644
index 0000000000..6a46403159
--- /dev/null
+++ b/src/libsystemd/sd_bus_message_read_basic.xml
@@ -0,0 +1,113 @@
+<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+
+<!--
+  This file is part of systemd.
+
+  Copyright 2016 Julian Orth
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<refentry id="sd_bus_message_read_basic">
+
+  <refentryinfo>
+    <title>sd_bus_message_read_basic</title>
+    <productname>systemd</productname>
+
+    <authorgroup>
+      <author>
+        <firstname>Julian</firstname>
+        <surname>Orth</surname>
+        <email>ju.orth@gmail.com</email>
+      </author>
+    </authorgroup>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>sd_bus_message_read_basic</refentrytitle>
+    <manvolnum>3</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>sd_bus_message_read_basic</refname>
+
+    <refpurpose>Read a basic type from a message</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <funcsynopsis>
+      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>
+
+      <funcprototype>
+        <funcdef>int <function>sd_bus_message_read_basic</function></funcdef>
+        <paramdef>sd_bus_message *<parameter>m</parameter></paramdef>
+        <paramdef>char <parameter>type</parameter></paramdef>
+        <paramdef>void *<parameter>p</parameter></paramdef>
+      </funcprototype>
+    </funcsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>
+      <function>sd_bus_message_read_basic()</function> reads a basic type from a
+      message and advances the read position in the message. The set of basic
+      types and their ascii codes passed in <parameter>type</parameter> are
+      described in the <ulink
+        url="https://dbus.freedesktop.org/doc/dbus-specification.html">D-Bus
+        Specification</ulink>.
+    </para>
+
+    <para>
+      If <parameter>p</parameter> is not NULL, it should contain a pointer to an
+      appropriate object. For example, if <parameter>type</parameter> is
+      <constant>'y'</constant>, the object passed in <parameter>p</parameter>
+      should have type <code>uint8_t *</code>. If <parameter>type</parameter>
+      is <constant>'s'</constant>, the object passed in <parameter>p</parameter>
+      should have type <code>const char **</code>. Note that, if the basic type
+      is a pointer (e.g., <code>const char *</code> in the case of a string),
+      the pointer is only borrowed and the contents must be copied if they are
+      to be used after the end of the messages lifetime. Similarly, during the
+      lifetime of such a pointer, the message must not be modified.
+    </para>
+
+    <para>
+      If there is no object of the specified type at the current position in the
+      message, an error is returned.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Return Value</title>
+
+    <para>
+      On success, <function>sd_bus_message_read_basic()</function> returns 0 or
+      a positive integer. On failure, it returns a negative errno-style error
+      code.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+
+    <para>
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>sd-bus</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    </para>
+  </refsect1>
+
+</refentry>
diff --git a/src/libsystemd/sd_bus_process.xml b/src/libsystemd/sd_bus_process.xml
new file mode 100644
index 0000000000..4b9f52e52f
--- /dev/null
+++ b/src/libsystemd/sd_bus_process.xml
@@ -0,0 +1,111 @@
+<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+
+<!--
+  This file is part of systemd.
+
+  Copyright 2016 Julian Orth
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<refentry id="sd_bus_process">
+
+  <refentryinfo>
+    <title>sd_bus_process</title>
+    <productname>systemd</productname>
+
+    <authorgroup>
+      <author>
+        <firstname>Julian</firstname>
+        <surname>Orth</surname>
+        <email>ju.orth@gmail.com</email>
+      </author>
+    </authorgroup>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>sd_bus_process</refentrytitle>
+    <manvolnum>3</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>sd_bus_process</refname>
+
+    <refpurpose>Drive the connection</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <funcsynopsis>
+      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>
+
+      <funcprototype>
+        <funcdef>int <function>sd_bus_process</function></funcdef>
+        <paramdef>sd_bus *<parameter>bus</parameter></paramdef>
+        <paramdef>sd_bus_message **<parameter>r</parameter></paramdef>
+      </funcprototype>
+    </funcsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>
+      <function>sd_bus_process()</function> drives the connection between the
+      message bus and the client. That is, it handles connecting,
+      authentication, and message processing. It should be called in a loop
+      until no further progress can be made or an error occurs.
+    </para>
+
+    <para>
+      Once no further progress can be made,
+      <citerefentry><refentrytitle>sd_bus_wait</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      should be called. Alternatively the user can wait for incoming data on
+      the file descriptor returned by
+      <citerefentry><refentrytitle>sd_bus_get_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+    </para>
+
+    <para>
+      <function>sd_bus_process</function> processes at most one incoming
+      message per call.  If the parameter <parameter>r</parameter> is not NULL
+      and the call processed a message, <code>*r</code> is set to this message.
+      The caller owns a reference to this message and should call
+      <citerefentry><refentrytitle>sd_bus_message_unref</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      when the message is no longer needed. If <parameter>r</parameter> is not
+      NULL, progress was made, but no message was processed, <code>*r</code> is
+      set to NULL.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Return Value</title>
+
+    <para>
+      If progress was made, a positive integer is returned. If no progress was
+      made, 0 is returned. If an error occurs, a negative errno-style error code
+      is returned.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+
+    <para>
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>sd-bus</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    </para>
+  </refsect1>
+
+</refentry>
diff --git a/src/libsystemd/sd_event_add_time.xml b/src/libsystemd/sd_event_add_time.xml
index a2c0d54b56..5496b71529 100644
--- a/src/libsystemd/sd_event_add_time.xml
+++ b/src/libsystemd/sd_event_add_time.xml
@@ -123,7 +123,7 @@
     regarding the various types of clocks. The <parameter>usec</parameter> parameter specifies the earliest time, in
     microseconds (µs), relative to the clock's epoch, when the timer shall be triggered. If a time already in the past
     is specified (including <constant>0</constant>), this timer source "fires" immediately and is ready to be
-    dispatched. If the paramater is specified as <constant>UINT64_MAX</constant> the timer event will never elapse,
+    dispatched. If the parameter is specified as <constant>UINT64_MAX</constant> the timer event will never elapse,
     which may be used as an alternative to explicitly disabling a timer event source with
     <citerefentry><refentrytitle>sd_event_source_set_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>. The
     <parameter>accuracy</parameter> parameter specifies an additional accuracy value in µs specifying how much the
@@ -213,7 +213,7 @@
     in µs.</para>
 
     <para><function>sd_event_source_get_time_accuracy()</function>
-    retrieves the configured accuracy value of a event source
+    retrieves the configured accuracy value of an event source
     created previously with <function>sd_event_add_time()</function>. It
     takes the event source object and a pointer to a variable to store
     the accuracy in. The accuracy is specified in µs.</para>
@@ -224,7 +224,7 @@
     the event source object and accuracy, in µs.</para>
 
     <para><function>sd_event_source_get_time_clock()</function>
-    retrieves the configured clock of a event source created
+    retrieves the configured clock of an event source created
     previously with <function>sd_event_add_time()</function>. It takes
     the event source object and a pointer to a variable to store the
     clock identifier in.</para>
diff --git a/src/libsystemd/sd_event_wait.xml b/src/libsystemd/sd_event_wait.xml
index f2aea00e98..26327dc688 100644
--- a/src/libsystemd/sd_event_wait.xml
+++ b/src/libsystemd/sd_event_wait.xml
@@ -47,6 +47,7 @@
     <refname>sd_event_prepare</refname>
     <refname>sd_event_dispatch</refname>
     <refname>sd_event_get_state</refname>
+    <refname>sd_event_get_iteration</refname>
     <refname>SD_EVENT_INITIAL</refname>
     <refname>SD_EVENT_PREPARING</refname>
     <refname>SD_EVENT_ARMED</refname>
@@ -93,6 +94,12 @@
         <paramdef>sd_event *<parameter>event</parameter></paramdef>
       </funcprototype>
 
+      <funcprototype>
+        <funcdef>int <function>sd_event_get_iteration</function></funcdef>
+        <paramdef>sd_event *<parameter>event</parameter></paramdef>
+        <paramdef>uint64_t *<parameter>ret</parameter></paramdef>
+      </funcprototype>
+
     </funcsynopsis>
   </refsynopsisdiv>
 
@@ -140,12 +147,15 @@
     determine the state the event loop is currently in. It returns one
     of the states described below.</para>
 
-    <para>All four functions take, as the first argument, the event
-    loop object <parameter>event</parameter> that has been created
-    with <function>sd_event_new()</function>. The timeout for
-    <function>sd_event_wait()</function> is specified in
-    <parameter>usec</parameter> in milliseconds.  <constant>(uint64_t)
-    -1</constant> may be used to specify an infinite timeout.</para>
+    <para><function>sd_event_get_iteration()</function> may be used to determine the current iteration of the event
+    loop. It returns an unsigned 64bit integer containing a counter that increases monotonically with each iteration of
+    the event loop, starting with 0. The counter is increased at the time of the
+    <function>sd_event_prepare()</function> invocation.</para>
+
+    <para>All five functions take, as the first argument, the event loop object <parameter>event</parameter> that has
+    been created with <function>sd_event_new()</function>. The timeout for <function>sd_event_wait()</function> is
+    specified in <parameter>usec</parameter> in microseconds.  <constant>(uint64_t) -1</constant> may be used to
+    specify an infinite timeout.</para>
 </refsect1>
 
   <refsect1>
diff --git a/src/libsystemd/sd_id128_to_string.xml b/src/libsystemd/sd_id128_to_string.xml
index e70c80892e..927d1ad5f2 100644
--- a/src/libsystemd/sd_id128_to_string.xml
+++ b/src/libsystemd/sd_id128_to_string.xml
@@ -74,13 +74,11 @@
     lowercase hexadecimal digits and be terminated by a
     <constant>NUL</constant> byte.</para>
 
-    <para><function>sd_id128_from_string()</function> implements the
-    reverse operation: it takes a 33 character string with 32
-    hexadecimal digits (either lowercase or uppercase, terminated by
-    <constant>NUL</constant>) and parses them back into a 128-bit ID
-    returned in <parameter>ret</parameter>. Alternatively, this call
-    can also parse a 37-character string with a 128-bit ID formatted
-    as RFC UUID.</para>
+    <para><function>sd_id128_from_string()</function> implements the reverse operation: it takes a 33 character string
+    with 32 hexadecimal digits (either lowercase or uppercase, terminated by <constant>NUL</constant>) and parses them
+    back into a 128-bit ID returned in <parameter>ret</parameter>. Alternatively, this call can also parse a
+    37-character string with a 128-bit ID formatted as RFC UUID. If <parameter>ret</parameter> is passed as NULL the
+    function will validate the passed ID string, but not actually return it in parsed form.</para>
 
     <para>For more information about the <literal>sd_id128_t</literal>
     type see
diff --git a/src/libsystemd/sd_journal_get_data.xml b/src/libsystemd/sd_journal_get_data.xml
index 908ee7db16..1321114de0 100644
--- a/src/libsystemd/sd_journal_get_data.xml
+++ b/src/libsystemd/sd_journal_get_data.xml
@@ -151,7 +151,7 @@
     in size — but the library might still return larger data objects.
     That means applications should not rely exclusively on this
     setting to limit the size of the data fields returned, but need to
-    apply a explicit size limit on the returned data as well. This
+    apply an explicit size limit on the returned data as well. This
     threshold defaults to 64K by default. To retrieve the complete
     data fields this threshold should be turned off by setting it to
     0, so that the library always returns the complete data objects.
diff --git a/src/libsystemd/sd_journal_print.xml b/src/libsystemd/sd_journal_print.xml
index 17fdc9c1f2..76542527fc 100644
--- a/src/libsystemd/sd_journal_print.xml
+++ b/src/libsystemd/sd_journal_print.xml
@@ -93,27 +93,21 @@
   <refsect1>
     <title>Description</title>
 
-    <para><function>sd_journal_print()</function> may be used to
-    submit simple, plain text log entries to the system journal. The
-    first argument is a priority value. This is followed by a format
-    string and its parameters, similar to
-    <citerefentry project='man-pages'><refentrytitle>printf</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-    or
+    <para><function>sd_journal_print()</function> may be used to submit simple, plain text log entries to the system
+    journal. The first argument is a priority value. This is followed by a format string and its parameters, similar to
+    <citerefentry project='man-pages'><refentrytitle>printf</refentrytitle><manvolnum>3</manvolnum></citerefentry> or
     <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
-    The priority value is one of
-    <constant>LOG_EMERG</constant>,
-    <constant>LOG_ALERT</constant>,
-    <constant>LOG_CRIT</constant>,
-    <constant>LOG_ERR</constant>,
-    <constant>LOG_WARNING</constant>,
-    <constant>LOG_NOTICE</constant>,
-    <constant>LOG_INFO</constant>,
-    <constant>LOG_DEBUG</constant>, as defined in
-    <filename>syslog.h</filename>, see
-    <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-    for details. It is recommended to use this call to submit log
-    messages in the application locale or system locale and in UTF-8
-    format, but no such restrictions are enforced.</para>
+    The priority value is one of <constant>LOG_EMERG</constant>, <constant>LOG_ALERT</constant>,
+    <constant>LOG_CRIT</constant>, <constant>LOG_ERR</constant>, <constant>LOG_WARNING</constant>,
+    <constant>LOG_NOTICE</constant>, <constant>LOG_INFO</constant>, <constant>LOG_DEBUG</constant>, as defined in
+    <filename>syslog.h</filename>, see <citerefentry
+    project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> for details. It is
+    recommended to use this call to submit log messages in the application locale or system locale and in UTF-8 format,
+    but no such restrictions are enforced. Note that log messages written using this function are generally not
+    expected to end in a new-line character. However, as all trailing whitespace (including spaces, new-lines,
+    tabulators and carriage returns) are automatically stripped from the logged string, it is acceptable to specify one
+    (or more). Empty lines (after trailing whitespace removal) are suppressed. On non-empty lines, leading whitespace
+    (as well as inner whitespace) is left unmodified. </para>
 
     <para><function>sd_journal_printv()</function> is similar to
     <function>sd_journal_print()</function> but takes a variable
@@ -123,35 +117,26 @@
     for more information) instead of the format string. It is
     otherwise equivalent in behavior.</para>
 
-    <para><function>sd_journal_send()</function> may be used to submit
-    structured log entries to the system journal. It takes a series of
-    format strings, each immediately followed by their associated
-    parameters, terminated by <constant>NULL</constant>. The strings
-    passed should be of the format <literal>VARIABLE=value</literal>.
-    The variable name must be in uppercase and consist only of
-    characters, numbers and underscores, and may not begin with an
-    underscore. (All assignments that do not follow this syntax will
-    be ignored.) The value can be of any size and format. It is highly
-    recommended to submit text strings formatted in the UTF-8
-    character encoding only, and submit binary fields only when
-    formatting in UTF-8 strings is not sensible. A number of
-    well-known fields are defined, see
-    <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
-    for details, but additional application defined fields may be
-    used. A variable may be assigned more than one value per
-    entry.</para>
-
-    <para><function>sd_journal_sendv()</function> is similar to
-    <function>sd_journal_send()</function> but takes an array of
-    <varname>struct iovec</varname> (as defined in
-    <filename>uio.h</filename>, see
-    <citerefentry project='man-pages'><refentrytitle>readv</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-    for details) instead of the format string. Each structure should
-    reference one field of the entry to submit. The second argument
-    specifies the number of structures in the array.
-    <function>sd_journal_sendv()</function> is particularly useful to
-    submit binary objects to the journal where that is
-    necessary.</para>
+    <para><function>sd_journal_send()</function> may be used to submit structured log entries to the system journal. It
+    takes a series of format strings, each immediately followed by their associated parameters, terminated by
+    <constant>NULL</constant>. The strings passed should be of the format <literal>VARIABLE=value</literal>.  The
+    variable name must be in uppercase and consist only of characters, numbers and underscores, and may not begin with
+    an underscore. (All assignments that do not follow this syntax will be ignored.) The value can be of any size and
+    format. It is highly recommended to submit text strings formatted in the UTF-8 character encoding only, and submit
+    binary fields only when formatting in UTF-8 strings is not sensible. A number of well-known fields are defined, see
+    <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
+    details, but additional application defined fields may be used. A variable may be assigned more than one value per
+    entry. If this function is used, trailing whitespace is automatically removed from each formatted field.</para>
+
+    <para><function>sd_journal_sendv()</function> is similar to <function>sd_journal_send()</function> but takes an
+    array of <varname>struct iovec</varname> (as defined in <filename>uio.h</filename>, see <citerefentry
+    project='man-pages'><refentrytitle>readv</refentrytitle><manvolnum>3</manvolnum></citerefentry> for details)
+    instead of the format string. Each structure should reference one field of the entry to submit. The second argument
+    specifies the number of structures in the array.  <function>sd_journal_sendv()</function> is particularly useful to
+    submit binary objects to the journal where that is necessary. Note that this function wil not strip trailing
+    whitespace of the passed fields, but passes the specified data along unmodified. This is different from both
+    <function>sd_journal_print()</function> and <function>sd_journal_send()</function> described above, which are based
+    on format strings, and do strip trailing whitespace.</para>
 
     <para><function>sd_journal_perror()</function> is a similar to
     <citerefentry project='die-net'><refentrytitle>perror</refentrytitle><manvolnum>3</manvolnum></citerefentry>
@@ -174,8 +159,8 @@
     <programlisting>sd_journal_print(LOG_INFO, "Hello World, this is PID %lu!", (unsigned long) getpid());
 
 sd_journal_send("MESSAGE=Hello World, this is PID %lu!", (unsigned long) getpid(),
-    "PRIORITY=%i", LOG_INFO,
-    NULL);</programlisting>
+                "PRIORITY=%i", LOG_INFO,
+                NULL);</programlisting>
 
     <para>Note that these calls implicitly add fields for the source
     file, function name and code line where invoked. This is
diff --git a/src/libsystemd/sd_notify.xml b/src/libsystemd/sd_notify.xml
index bd6cfdcd29..025fbec6c1 100644
--- a/src/libsystemd/sd_notify.xml
+++ b/src/libsystemd/sd_notify.xml
@@ -250,6 +250,15 @@
         restrictions, it is ignored.</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>WATCHDOG_USEC=...</term>
+
+        <listitem><para>Reset <varname>watchdog_usec</varname> value during runtime.
+        Notice that this is not available when using <function>sd_event_set_watchdog()</function>
+        or <function>sd_watchdog_enabled()</function>.
+        Example : <literal>WATCHDOG_USEC=20000000</literal></para></listitem>
+      </varlistentry>
+
     </variablelist>
 
     <para>It is recommended to prefix variable names that are not
diff --git a/src/libsystemd/src/Makefile b/src/libsystemd/src/Makefile
index dee853576d..61430ba68d 100644
--- a/src/libsystemd/src/Makefile
+++ b/src/libsystemd/src/Makefile
@@ -92,6 +92,8 @@ _libsystemd_internal_la_SOURCES = \
 	src/libsystemd/sd-netlink/local-addresses.h \
 	src/libsystemd/sd-netlink/local-addresses.c \
 	src/libsystemd/sd-id128/sd-id128.c \
+	src/libsystemd/sd-id128/id128-util.h \
+	src/libsystemd/sd-id128/id128-util.c \
 	src/libsystemd/sd-daemon/sd-daemon.c \
 	src/libsystemd/sd-login/sd-login.c \
 	src/libsystemd/sd-network/sd-network.c \
@@ -110,7 +112,6 @@ _libsystemd_internal_la_SOURCES = \
 	src/libsystemd/sd-resolve/sd-resolve.c
 
 libsystemd_internal_la_LIBADD = \
-	libbasic.la \
 	-lresolv
 
 noinst_LTLIBRARIES += \
diff --git a/src/libsystemd/src/sd-bus/bus-match.c b/src/libsystemd/src/sd-bus/bus-match.c
index 0dc5e45288..185867679e 100644
--- a/src/libsystemd/src/sd-bus/bus-match.c
+++ b/src/libsystemd/src/sd-bus/bus-match.c
@@ -430,6 +430,9 @@ int bus_match_run(
                         r = bus_match_run(bus, c, m);
                         if (r != 0)
                                 return r;
+
+                        if (bus && bus->match_callbacks_modified)
+                                return 0;
                 }
         }
 
diff --git a/src/libsystemd/src/sd-bus/bus-message.c b/src/libsystemd/src/sd-bus/bus-message.c
index a34a4a1619..7fa5e822e0 100644
--- a/src/libsystemd/src/sd-bus/bus-message.c
+++ b/src/libsystemd/src/sd-bus/bus-message.c
@@ -182,7 +182,7 @@ static void *message_extend_fields(sd_bus_message *m, size_t align, size_t sz, b
                 if (!np)
                         goto poison;
         } else {
-                /* Initially, the header is allocated as part of of
+                /* Initially, the header is allocated as part of
                  * the sd_bus_message itself, let's replace it by
                  * dynamic data */
 
@@ -2866,7 +2866,7 @@ static int bus_message_close_header(sd_bus_message *m) {
 
         /* The actual user data is finished now, we just complete the
            variant and struct now (at least on gvariant). Remember
-           this position, so that during parsing we know where to to
+           this position, so that during parsing we know where to
            put the outer container end. */
         m->user_body_size = m->body_size;
 
diff --git a/src/libsystemd/src/sd-bus/bus-socket.c b/src/libsystemd/src/sd-bus/bus-socket.c
index 4d6e21f977..b5fd60cf24 100644
--- a/src/libsystemd/src/sd-bus/bus-socket.c
+++ b/src/libsystemd/src/sd-bus/bus-socket.c
@@ -222,7 +222,7 @@ static int bus_socket_auth_verify_client(sd_bus *b) {
                 peer.bytes[i/2] = ((uint8_t) x << 4 | (uint8_t) y);
         }
 
-        if (!sd_id128_equal(b->server_id, SD_ID128_NULL) &&
+        if (!sd_id128_is_null(b->server_id) &&
             !sd_id128_equal(b->server_id, peer))
                 return -EPERM;
 
diff --git a/src/libsystemd/src/sd-daemon/sd-daemon.c b/src/libsystemd/src/sd-daemon/sd-daemon.c
index 863c47d2ba..e848c16212 100644
--- a/src/libsystemd/src/sd-daemon/sd-daemon.c
+++ b/src/libsystemd/src/sd-daemon/sd-daemon.c
@@ -310,12 +310,12 @@ _public_ int sd_is_socket_inet(int fd, int family, int type, int listening, uint
                         if (l < sizeof(struct sockaddr_in))
                                 return -EINVAL;
 
-                        return htons(port) == sockaddr.in.sin_port;
+                        return htobe16(port) == sockaddr.in.sin_port;
                 } else {
                         if (l < sizeof(struct sockaddr_in6))
                                 return -EINVAL;
 
-                        return htons(port) == sockaddr.in6.sin6_port;
+                        return htobe16(port) == sockaddr.in6.sin6_port;
                 }
         }
 
diff --git a/src/libsystemd/src/sd-device/device-enumerator.c b/src/libsystemd/src/sd-device/device-enumerator.c
index 6378f9c93c..4e0edb6573 100644
--- a/src/libsystemd/src/sd-device/device-enumerator.c
+++ b/src/libsystemd/src/sd-device/device-enumerator.c
@@ -696,17 +696,19 @@ static int enumerator_scan_devices_tag(sd_device_enumerator *enumerator, const c
 static int enumerator_scan_devices_tags(sd_device_enumerator *enumerator) {
         const char *tag;
         Iterator i;
-        int r;
+        int r = 0;
 
         assert(enumerator);
 
         SET_FOREACH(tag, enumerator->match_tag, i) {
-                r = enumerator_scan_devices_tag(enumerator, tag);
-                if (r < 0)
-                        return r;
+                int k;
+
+                k = enumerator_scan_devices_tag(enumerator, tag);
+                if (k < 0)
+                        r = k;
         }
 
-        return 0;
+        return r;
 }
 
 static int parent_add_child(sd_device_enumerator *enumerator, const char *path) {
@@ -838,7 +840,7 @@ static int enumerator_scan_devices_all(sd_device_enumerator *enumerator) {
 
 int device_enumerator_scan_devices(sd_device_enumerator *enumerator) {
         sd_device *device;
-        int r;
+        int r = 0, k;
 
         assert(enumerator);
 
@@ -850,22 +852,22 @@ int device_enumerator_scan_devices(sd_device_enumerator *enumerator) {
                 sd_device_unref(device);
 
         if (!set_isempty(enumerator->match_tag)) {
-                r = enumerator_scan_devices_tags(enumerator);
-                if (r < 0)
-                        return r;
+                k = enumerator_scan_devices_tags(enumerator);
+                if (k < 0)
+                        r = k;
         } else if (enumerator->match_parent) {
-                r = enumerator_scan_devices_children(enumerator);
-                if (r < 0)
-                        return r;
+                k = enumerator_scan_devices_children(enumerator);
+                if (k < 0)
+                        r = k;
         } else {
-                r = enumerator_scan_devices_all(enumerator);
-                if (r < 0)
-                        return r;
+                k = enumerator_scan_devices_all(enumerator);
+                if (k < 0)
+                        r = k;
         }
 
         enumerator->scan_uptodate = true;
 
-        return 0;
+        return r;
 }
 
 _public_ sd_device *sd_device_enumerator_get_device_first(sd_device_enumerator *enumerator) {
diff --git a/src/libsystemd/src/sd-device/device-internal.h b/src/libsystemd/src/sd-device/device-internal.h
index a1a1d3c4e3..04384c66c5 100644
--- a/src/libsystemd/src/sd-device/device-internal.h
+++ b/src/libsystemd/src/sd-device/device-internal.h
@@ -78,6 +78,8 @@ struct sd_device {
 
         char *subsystem;
         bool subsystem_set; /* don't reread subsystem */
+        char *driver_subsystem; /* only set for the 'drivers' subsystem */
+        bool driver_subsystem_set; /* don't reread subsystem */
         char *driver;
         bool driver_set; /* don't reread driver */
 
diff --git a/src/libsystemd/src/sd-device/sd-device.c b/src/libsystemd/src/sd-device/sd-device.c
index b8e6f8580e..79c2c2caeb 100644
--- a/src/libsystemd/src/sd-device/sd-device.c
+++ b/src/libsystemd/src/sd-device/sd-device.c
@@ -75,6 +75,7 @@ _public_ sd_device *sd_device_unref(sd_device *device) {
                 free(device->devtype);
                 free(device->devname);
                 free(device->subsystem);
+                free(device->driver_subsystem);
                 free(device->driver);
                 free(device->id_filename);
                 free(device->properties_strv);
@@ -196,7 +197,7 @@ int device_set_syspath(sd_device *device, const char *_syspath, bool verify) {
                                 return -errno;
                         }
                 } else {
-                        /* everything else just just needs to be a directory */
+                        /* everything else just needs to be a directory */
                         if (!is_dir(syspath, false))
                                 return -ENODEV;
                 }
@@ -258,7 +259,8 @@ _public_ int sd_device_new_from_devnum(sd_device **ret, char type, dev_t devnum)
 }
 
 _public_ int sd_device_new_from_subsystem_sysname(sd_device **ret, const char *subsystem, const char *sysname) {
-        char *syspath;
+        char *name, *syspath;
+        size_t len = 0;
 
         assert_return(ret, -EINVAL);
         assert_return(subsystem, -EINVAL);
@@ -297,33 +299,29 @@ _public_ int sd_device_new_from_subsystem_sysname(sd_device **ret, const char *s
                         syspath = strjoina("/sys/bus/", subsys, "/drivers/", driver);
                         if (access(syspath, F_OK) >= 0)
                                 return sd_device_new_from_syspath(ret, syspath);
-                } else
-                        return -EINVAL;
-        } else {
-                char *name;
-                size_t len = 0;
+                }
+        }
 
-                /* translate sysname back to sysfs filename */
-                name = strdupa(sysname);
-                while (name[len] != '\0') {
-                        if (name[len] == '/')
-                                name[len] = '!';
+        /* translate sysname back to sysfs filename */
+        name = strdupa(sysname);
+        while (name[len] != '\0') {
+                if (name[len] == '/')
+                        name[len] = '!';
 
-                        len++;
-                }
+                len++;
+        }
 
-                syspath = strjoina("/sys/subsystem/", subsystem, "/devices/", name);
-                if (access(syspath, F_OK) >= 0)
-                        return sd_device_new_from_syspath(ret, syspath);
+        syspath = strjoina("/sys/subsystem/", subsystem, "/devices/", name);
+        if (access(syspath, F_OK) >= 0)
+                return sd_device_new_from_syspath(ret, syspath);
 
-                syspath = strjoina("/sys/bus/", subsystem, "/devices/", name);
-                if (access(syspath, F_OK) >= 0)
-                        return sd_device_new_from_syspath(ret, syspath);
+        syspath = strjoina("/sys/bus/", subsystem, "/devices/", name);
+        if (access(syspath, F_OK) >= 0)
+                return sd_device_new_from_syspath(ret, syspath);
 
-                syspath = strjoina("/sys/class/", subsystem, "/", name);
-                if (access(syspath, F_OK) >= 0)
-                        return sd_device_new_from_syspath(ret, syspath);
-        }
+        syspath = strjoina("/sys/class/", subsystem, "/", name);
+        if (access(syspath, F_OK) >= 0)
+                return sd_device_new_from_syspath(ret, syspath);
 
         return -ENODEV;
 }
@@ -533,7 +531,7 @@ int device_read_uevent_file(sd_device *device) {
                 return r;
         }
 
-        for (i = 0; i < uevent_len; i++) {
+        for (i = 0; i < uevent_len; i++)
                 switch (state) {
                 case PRE_KEY:
                         if (!strchr(NEWLINE, uevent[i])) {
@@ -558,10 +556,9 @@ int device_read_uevent_file(sd_device *device) {
                         break;
                 case PRE_VALUE:
                         value = &uevent[i];
-
                         state = VALUE;
 
-                        break;
+                        /* fall through to handle empty property */
                 case VALUE:
                         if (strchr(NEWLINE, uevent[i])) {
                                 uevent[i] = '\0';
@@ -577,7 +574,6 @@ int device_read_uevent_file(sd_device *device) {
                 default:
                         assert_not_reached("invalid state when parsing uevent file");
                 }
-        }
 
         if (major) {
                 r = device_set_devnum(device, major, minor);
@@ -768,21 +764,45 @@ int device_set_subsystem(sd_device *device, const char *_subsystem) {
         return 0;
 }
 
+static int device_set_drivers_subsystem(sd_device *device, const char *_subsystem) {
+        _cleanup_free_ char *subsystem = NULL;
+        int r;
+
+        assert(device);
+        assert(_subsystem);
+        assert(*_subsystem);
+
+        subsystem = strdup(_subsystem);
+        if (!subsystem)
+                return -ENOMEM;
+
+        r = device_set_subsystem(device, "drivers");
+        if (r < 0)
+                return r;
+
+        free(device->driver_subsystem);
+        device->driver_subsystem = subsystem;
+        subsystem = NULL;
+
+        return 0;
+}
+
 _public_ int sd_device_get_subsystem(sd_device *device, const char **ret) {
+        const char *syspath, *drivers = NULL;
+        int r;
+
         assert_return(ret, -EINVAL);
         assert_return(device, -EINVAL);
 
+        r = sd_device_get_syspath(device, &syspath);
+        if (r < 0)
+                return r;
+
         if (!device->subsystem_set) {
                 _cleanup_free_ char *subsystem = NULL;
-                const char *syspath;
                 char *path;
-                int r;
 
                 /* read 'subsystem' link */
-                r = sd_device_get_syspath(device, &syspath);
-                if (r < 0)
-                        return r;
-
                 path = strjoina(syspath, "/subsystem");
                 r = readlink_value(path, &subsystem);
                 if (r >= 0)
@@ -790,16 +810,39 @@ _public_ int sd_device_get_subsystem(sd_device *device, const char **ret) {
                 /* use implicit names */
                 else if (path_startswith(device->devpath, "/module/"))
                         r = device_set_subsystem(device, "module");
-                else if (strstr(device->devpath, "/drivers/"))
-                        r = device_set_subsystem(device, "drivers");
-                else if (path_startswith(device->devpath, "/subsystem/") ||
-                         path_startswith(device->devpath, "/class/") ||
-                         path_startswith(device->devpath, "/bus/"))
+                else if (!(drivers = strstr(syspath, "/drivers/")) &&
+                         (path_startswith(device->devpath, "/subsystem/") ||
+                          path_startswith(device->devpath, "/class/") ||
+                          path_startswith(device->devpath, "/bus/")))
                         r = device_set_subsystem(device, "subsystem");
                 if (r < 0 && r != -ENOENT)
                         return log_debug_errno(r, "sd-device: could not set subsystem for %s: %m", device->devpath);
 
                 device->subsystem_set = true;
+        } else if (!device->driver_subsystem_set)
+                drivers = strstr(syspath, "/drivers/");
+
+        if (!device->driver_subsystem_set) {
+                if (drivers) {
+                        _cleanup_free_ char *subpath = NULL;
+
+                        subpath = strndup(syspath, drivers - syspath);
+                        if (!subpath)
+                                r = -ENOMEM;
+                        else {
+                                const char *subsys;
+
+                                subsys = strrchr(subpath, '/');
+                                if (!subsys)
+                                        r = -EINVAL;
+                                else
+                                        r = device_set_drivers_subsystem(device, subsys + 1);
+                        }
+                        if (r < 0 && r != -ENOENT)
+                                return log_debug_errno(r, "sd-device: could not set subsystem for driver %s: %m", device->devpath);
+                }
+
+                device->driver_subsystem_set = true;
         }
 
         if (!device->subsystem)
@@ -1236,9 +1279,17 @@ int device_get_id_filename(sd_device *device, const char **ret) {
                         if (!subsystem)
                                 return -EINVAL;
 
-                        r = asprintf(&id, "+%s:%s", subsystem, sysname);
-                        if (r < 0)
-                                return -ENOMEM;
+                        if (streq(subsystem, "drivers")) {
+                                /* the 'drivers' pseudo-subsystem is special, and needs the real subsystem
+                                 * encoded as well */
+                                r = asprintf(&id, "+drivers:%s:%s", device->driver_subsystem, sysname);
+                                if (r < 0)
+                                        return -ENOMEM;
+                        } else {
+                                r = asprintf(&id, "+%s:%s", subsystem, sysname);
+                                if (r < 0)
+                                        return -ENOMEM;
+                        }
                 }
 
                 device->id_filename = id;
diff --git a/src/libsystemd/src/sd-event/sd-event.c b/src/libsystemd/src/sd-event/sd-event.c
index daa1f55717..495e97eea2 100644
--- a/src/libsystemd/src/sd-event/sd-event.c
+++ b/src/libsystemd/src/sd-event/sd-event.c
@@ -109,8 +109,8 @@ struct sd_event_source {
         int64_t priority;
         unsigned pending_index;
         unsigned prepare_index;
-        unsigned pending_iteration;
-        unsigned prepare_iteration;
+        uint64_t pending_iteration;
+        uint64_t prepare_iteration;
 
         LIST_FIELDS(sd_event_source, sources);
 
@@ -215,9 +215,8 @@ struct sd_event {
 
         pid_t original_pid;
 
-        unsigned iteration;
-        dual_timestamp timestamp;
-        usec_t timestamp_boottime;
+        uint64_t iteration;
+        triple_timestamp timestamp;
         int state;
 
         bool exit_requested:1;
@@ -1072,16 +1071,16 @@ _public_ int sd_event_add_time(
         assert_return(e->state != SD_EVENT_FINISHED, -ESTALE);
         assert_return(!event_pid_changed(e), -ECHILD);
 
-        if (IN_SET(clock, CLOCK_BOOTTIME, CLOCK_BOOTTIME_ALARM) &&
-            !clock_boottime_supported())
+        if (!clock_supported(clock)) /* Checks whether the kernel supports the clock */
+                return -EOPNOTSUPP;
+
+        type = clock_to_event_source_type(clock); /* checks whether sd-event supports this clock */
+        if (type < 0)
                 return -EOPNOTSUPP;
 
         if (!callback)
                 callback = time_exit_callback;
 
-        type = clock_to_event_source_type(clock);
-        assert_return(type >= 0, -EOPNOTSUPP);
-
         d = event_get_clock_data(e, type);
         assert(d);
 
@@ -2530,9 +2529,7 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) {
                 goto finish;
         }
 
-        dual_timestamp_get(&e->timestamp);
-        if (clock_boottime_supported())
-                e->timestamp_boottime = now(CLOCK_BOOTTIME);
+        triple_timestamp_get(&e->timestamp);
 
         for (i = 0; i < m; i++) {
 
@@ -2573,7 +2570,7 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) {
         if (r < 0)
                 goto finish;
 
-        r = process_timer(e, e->timestamp_boottime, &e->boottime);
+        r = process_timer(e, e->timestamp.boottime, &e->boottime);
         if (r < 0)
                 goto finish;
 
@@ -2585,7 +2582,7 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) {
         if (r < 0)
                 goto finish;
 
-        r = process_timer(e, e->timestamp_boottime, &e->boottime_alarm);
+        r = process_timer(e, e->timestamp.boottime, &e->boottime_alarm);
         if (r < 0)
                 goto finish;
 
@@ -2759,43 +2756,24 @@ _public_ int sd_event_now(sd_event *e, clockid_t clock, uint64_t *usec) {
         assert_return(e, -EINVAL);
         assert_return(usec, -EINVAL);
         assert_return(!event_pid_changed(e), -ECHILD);
-        assert_return(IN_SET(clock,
-                             CLOCK_REALTIME,
-                             CLOCK_REALTIME_ALARM,
-                             CLOCK_MONOTONIC,
-                             CLOCK_BOOTTIME,
-                             CLOCK_BOOTTIME_ALARM), -EOPNOTSUPP);
 
+        if (!TRIPLE_TIMESTAMP_HAS_CLOCK(clock))
+                return -EOPNOTSUPP;
+
+        /* Generate a clean error in case CLOCK_BOOTTIME is not available. Note that don't use clock_supported() here,
+         * for a reason: there are systems where CLOCK_BOOTTIME is supported, but CLOCK_BOOTTIME_ALARM is not, but for
+         * the purpose of getting the time this doesn't matter. */
         if (IN_SET(clock, CLOCK_BOOTTIME, CLOCK_BOOTTIME_ALARM) && !clock_boottime_supported())
                 return -EOPNOTSUPP;
 
-        if (!dual_timestamp_is_set(&e->timestamp)) {
+        if (!triple_timestamp_is_set(&e->timestamp)) {
                 /* Implicitly fall back to now() if we never ran
                  * before and thus have no cached time. */
                 *usec = now(clock);
                 return 1;
         }
 
-        switch (clock) {
-
-        case CLOCK_REALTIME:
-        case CLOCK_REALTIME_ALARM:
-                *usec = e->timestamp.realtime;
-                break;
-
-        case CLOCK_MONOTONIC:
-                *usec = e->timestamp.monotonic;
-                break;
-
-        case CLOCK_BOOTTIME:
-        case CLOCK_BOOTTIME_ALARM:
-                *usec = e->timestamp_boottime;
-                break;
-
-        default:
-                assert_not_reached("Unknown clock?");
-        }
-
+        *usec = triple_timestamp_by_clock(&e->timestamp, clock);
         return 0;
 }
 
@@ -2896,3 +2874,11 @@ _public_ int sd_event_get_watchdog(sd_event *e) {
 
         return e->watchdog;
 }
+
+_public_ int sd_event_get_iteration(sd_event *e, uint64_t *ret) {
+        assert_return(e, -EINVAL);
+        assert_return(!event_pid_changed(e), -ECHILD);
+
+        *ret = e->iteration;
+        return 0;
+}
diff --git a/src/libsystemd/src/sd-id128/id128-util.c b/src/libsystemd/src/sd-id128/id128-util.c
new file mode 100644
index 0000000000..a9c43f9730
--- /dev/null
+++ b/src/libsystemd/src/sd-id128/id128-util.c
@@ -0,0 +1,195 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <fcntl.h>
+#include <unistd.h>
+
+#include "basic/fd-util.h"
+#include "basic/hexdecoct.h"
+#include "basic/io-util.h"
+#include "basic/stdio-util.h"
+
+#include "id128-util.h"
+
+char *id128_to_uuid_string(sd_id128_t id, char s[37]) {
+        unsigned n, k = 0;
+
+        assert(s);
+
+        /* Similar to sd_id128_to_string() but formats the result as UUID instead of plain hex chars */
+
+        for (n = 0; n < 16; n++) {
+
+                if (IN_SET(n, 4, 6, 8, 10))
+                        s[k++] = '-';
+
+                s[k++] = hexchar(id.bytes[n] >> 4);
+                s[k++] = hexchar(id.bytes[n] & 0xF);
+        }
+
+        assert(k == 36);
+
+        s[k] = 0;
+
+        return s;
+}
+
+bool id128_is_valid(const char *s) {
+        size_t i, l;
+
+        assert(s);
+
+        l = strlen(s);
+        if (l == 32) {
+
+                /* Plain formatted 128bit hex string */
+
+                for (i = 0; i < l; i++) {
+                        char c = s[i];
+
+                        if (!(c >= '0' && c <= '9') &&
+                            !(c >= 'a' && c <= 'z') &&
+                            !(c >= 'A' && c <= 'Z'))
+                                return false;
+                }
+
+        } else if (l == 36) {
+
+                /* Formatted UUID */
+
+                for (i = 0; i < l; i++) {
+                        char c = s[i];
+
+                        if ((i == 8 || i == 13 || i == 18 || i == 23)) {
+                                if (c != '-')
+                                        return false;
+                        } else {
+                                if (!(c >= '0' && c <= '9') &&
+                                    !(c >= 'a' && c <= 'z') &&
+                                    !(c >= 'A' && c <= 'Z'))
+                                        return false;
+                        }
+                }
+
+        } else
+                return false;
+
+        return true;
+}
+
+int id128_read_fd(int fd, Id128Format f, sd_id128_t *ret) {
+        char buffer[36 + 2];
+        ssize_t l;
+
+        assert(fd >= 0);
+        assert(f < _ID128_FORMAT_MAX);
+
+        /* Reads an 128bit ID from a file, which may either be in plain format (32 hex digits), or in UUID format, both
+         * optionally followed by a newline and nothing else. ID files should really be newline terminated, but if they
+         * aren't that's OK too, following the rule of "Be conservative in what you send, be liberal in what you
+         * accept". */
+
+        l = loop_read(fd, buffer, sizeof(buffer), false); /* we expect a short read of either 32/33 or 36/37 chars */
+        if (l < 0)
+                return (int) l;
+        if (l == 0) /* empty? */
+                return -ENOMEDIUM;
+
+        switch (l) {
+
+        case 33: /* plain UUID with trailing newline */
+                if (buffer[32] != '\n')
+                        return -EINVAL;
+
+                /* fall through */
+        case 32: /* plain UUID without trailing newline */
+                if (f == ID128_UUID)
+                        return -EINVAL;
+
+                buffer[32] = 0;
+                break;
+
+        case 37: /* RFC UUID with trailing newline */
+                if (buffer[36] != '\n')
+                        return -EINVAL;
+
+                /* fall through */
+        case 36: /* RFC UUID without trailing newline */
+                if (f == ID128_PLAIN)
+                        return -EINVAL;
+
+                buffer[36] = 0;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        return sd_id128_from_string(buffer, ret);
+}
+
+int id128_read(const char *p, Id128Format f, sd_id128_t *ret) {
+        _cleanup_close_ int fd = -1;
+
+        fd = open(p, O_RDONLY|O_CLOEXEC|O_NOCTTY);
+        if (fd < 0)
+                return -errno;
+
+        return id128_read_fd(fd, f, ret);
+}
+
+int id128_write_fd(int fd, Id128Format f, sd_id128_t id, bool do_sync) {
+        char buffer[36 + 2];
+        size_t sz;
+        int r;
+
+        assert(fd >= 0);
+        assert(f < _ID128_FORMAT_MAX);
+
+        if (f != ID128_UUID) {
+                sd_id128_to_string(id, buffer);
+                buffer[32] = '\n';
+                sz = 33;
+        } else {
+                id128_to_uuid_string(id, buffer);
+                buffer[36] = '\n';
+                sz = 37;
+        }
+
+        r = loop_write(fd, buffer, sz, false);
+        if (r < 0)
+                return r;
+
+        if (do_sync) {
+                if (fsync(fd) < 0)
+                        return -errno;
+        }
+
+        return r;
+}
+
+int id128_write(const char *p, Id128Format f, sd_id128_t id, bool do_sync) {
+        _cleanup_close_ int fd = -1;
+
+        fd = open(p, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
+        if (fd < 0)
+                return -errno;
+
+        return id128_write_fd(fd, f, id, do_sync);
+}
diff --git a/src/libsystemd/src/sd-id128/id128-util.h b/src/libsystemd/src/sd-id128/id128-util.h
new file mode 100644
index 0000000000..d45c556746
--- /dev/null
+++ b/src/libsystemd/src/sd-id128/id128-util.h
@@ -0,0 +1,46 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <stdbool.h>
+
+#include <systemd/sd-id128.h>
+
+#include "basic/macro.h"
+
+char *id128_to_uuid_string(sd_id128_t id, char s[37]);
+
+/* Like SD_ID128_FORMAT_STR, but formats as UUID, not in plain format */
+#define ID128_UUID_FORMAT_STR "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x"
+
+bool id128_is_valid(const char *s) _pure_;
+
+typedef enum Id128Format {
+        ID128_ANY,
+        ID128_PLAIN,  /* formatted as 32 hex chars as-is */
+        ID128_UUID,   /* formatted as 36 character uuid string */
+        _ID128_FORMAT_MAX,
+} Id128Format;
+
+int id128_read_fd(int fd, Id128Format f, sd_id128_t *ret);
+int id128_read(const char *p, Id128Format f, sd_id128_t *ret);
+
+int id128_write_fd(int fd, Id128Format f, sd_id128_t id, bool do_sync);
+int id128_write(const char *p, Id128Format f, sd_id128_t id, bool do_sync);
diff --git a/src/libsystemd/src/sd-id128/sd-id128.c b/src/libsystemd/src/sd-id128/sd-id128.c
index 4a227ab6c0..06fbe32f62 100644
--- a/src/libsystemd/src/sd-id128/sd-id128.c
+++ b/src/libsystemd/src/sd-id128/sd-id128.c
@@ -30,6 +30,8 @@
 #include "basic/random-util.h"
 #include "basic/util.h"
 
+#include "id128-util.h"
+
 _public_ char *sd_id128_to_string(sd_id128_t id, char s[SD_ID128_STRING_MAX]) {
         unsigned n;
 
@@ -51,7 +53,6 @@ _public_ int sd_id128_from_string(const char s[], sd_id128_t *ret) {
         bool is_guid = false;
 
         assert_return(s, -EINVAL);
-        assert_return(ret, -EINVAL);
 
         for (n = 0, i = 0; n < 16;) {
                 int a, b;
@@ -89,121 +90,57 @@ _public_ int sd_id128_from_string(const char s[], sd_id128_t *ret) {
         if (s[i] != 0)
                 return -EINVAL;
 
-        *ret = t;
+        if (ret)
+                *ret = t;
         return 0;
 }
 
-static sd_id128_t make_v4_uuid(sd_id128_t id) {
-        /* Stolen from generate_random_uuid() of drivers/char/random.c
-         * in the kernel sources */
-
-        /* Set UUID version to 4 --- truly random generation */
-        id.bytes[6] = (id.bytes[6] & 0x0F) | 0x40;
-
-        /* Set the UUID variant to DCE */
-        id.bytes[8] = (id.bytes[8] & 0x3F) | 0x80;
-
-        return id;
-}
-
 _public_ int sd_id128_get_machine(sd_id128_t *ret) {
-        static thread_local sd_id128_t saved_machine_id;
-        static thread_local bool saved_machine_id_valid = false;
-        _cleanup_close_ int fd = -1;
-        char buf[33];
-        unsigned j;
-        sd_id128_t t;
+        static thread_local sd_id128_t saved_machine_id = {};
         int r;
 
         assert_return(ret, -EINVAL);
 
-        if (saved_machine_id_valid) {
-                *ret = saved_machine_id;
-                return 0;
-        }
-
-        fd = open("/etc/machine-id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
-        if (fd < 0)
-                return -errno;
-
-        r = loop_read_exact(fd, buf, 33, false);
-        if (r < 0)
-                return r;
-        if (buf[32] !='\n')
-                return -EIO;
-
-        for (j = 0; j < 16; j++) {
-                int a, b;
-
-                a = unhexchar(buf[j*2]);
-                b = unhexchar(buf[j*2+1]);
-
-                if (a < 0 || b < 0)
-                        return -EIO;
+        if (sd_id128_is_null(saved_machine_id)) {
+                r = id128_read("/etc/machine-id", ID128_PLAIN, &saved_machine_id);
+                if (r < 0)
+                        return r;
 
-                t.bytes[j] = a << 4 | b;
+                if (sd_id128_is_null(saved_machine_id))
+                        return -EINVAL;
         }
 
-        saved_machine_id = t;
-        saved_machine_id_valid = true;
-
-        *ret = t;
+        *ret = saved_machine_id;
         return 0;
 }
 
 _public_ int sd_id128_get_boot(sd_id128_t *ret) {
-        static thread_local sd_id128_t saved_boot_id;
-        static thread_local bool saved_boot_id_valid = false;
-        _cleanup_close_ int fd = -1;
-        char buf[36];
-        unsigned j;
-        sd_id128_t t;
-        char *p;
+        static thread_local sd_id128_t saved_boot_id = {};
         int r;
 
         assert_return(ret, -EINVAL);
 
-        if (saved_boot_id_valid) {
-                *ret = saved_boot_id;
-                return 0;
+        if (sd_id128_is_null(saved_boot_id)) {
+                r = id128_read("/proc/sys/kernel/random/boot_id", ID128_UUID, &saved_boot_id);
+                if (r < 0)
+                        return r;
         }
 
-        fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
-        if (fd < 0)
-                return -errno;
-
-        r = loop_read_exact(fd, buf, 36, false);
-        if (r < 0)
-                return r;
-
-        for (j = 0, p = buf; j < 16; j++) {
-                int a, b;
-
-                if (p >= buf + 35)
-                        return -EIO;
-
-                if (*p == '-') {
-                        p++;
-                        if (p >= buf + 35)
-                                return -EIO;
-                }
-
-                a = unhexchar(p[0]);
-                b = unhexchar(p[1]);
-
-                if (a < 0 || b < 0)
-                        return -EIO;
+        *ret = saved_boot_id;
+        return 0;
+}
 
-                t.bytes[j] = a << 4 | b;
+static sd_id128_t make_v4_uuid(sd_id128_t id) {
+        /* Stolen from generate_random_uuid() of drivers/char/random.c
+         * in the kernel sources */
 
-                p += 2;
-        }
+        /* Set UUID version to 4 --- truly random generation */
+        id.bytes[6] = (id.bytes[6] & 0x0F) | 0x40;
 
-        saved_boot_id = t;
-        saved_boot_id_valid = true;
+        /* Set the UUID variant to DCE */
+        id.bytes[8] = (id.bytes[8] & 0x3F) | 0x80;
 
-        *ret = t;
-        return 0;
+        return id;
 }
 
 _public_ int sd_id128_randomize(sd_id128_t *ret) {
diff --git a/src/libsystemd/src/sd-journal/journal-send.c b/src/libsystemd/src/sd-journal/journal-send.c
index 7197758289..180311009c 100644
--- a/src/libsystemd/src/sd-journal/journal-send.c
+++ b/src/libsystemd/src/sd-journal/journal-send.c
@@ -107,6 +107,13 @@ _public_ int sd_journal_printv(int priority, const char *format, va_list ap) {
         memcpy(buffer, "MESSAGE=", 8);
         vsnprintf(buffer+8, sizeof(buffer) - 8, format, ap);
 
+        /* Strip trailing whitespace, keep prefix whitespace. */
+        (void) strstrip(buffer);
+
+        /* Suppress empty lines */
+        if (isempty(buffer+8))
+                return 0;
+
         zero(iov);
         IOVEC_SET_STRING(iov[0], buffer);
         IOVEC_SET_STRING(iov[1], p);
@@ -158,6 +165,8 @@ _printf_(1, 0) static int fill_iovec_sprintf(const char *format, va_list ap, int
 
                 VA_FORMAT_ADVANCE(format, ap);
 
+                (void) strstrip(buffer); /* strip trailing whitespace, keep prefixing whitespace */
+
                 IOVEC_SET_STRING(iov[i++], buffer);
 
                 format = va_arg(ap, char *);
@@ -471,6 +480,13 @@ _public_ int sd_journal_printv_with_location(int priority, const char *file, con
         memcpy(buffer, "MESSAGE=", 8);
         vsnprintf(buffer+8, sizeof(buffer) - 8, format, ap);
 
+        /* Strip trailing whitespace, keep prefixing whitespace */
+        (void) strstrip(buffer);
+
+        /* Suppress empty lines */
+        if (isempty(buffer+8))
+                return 0;
+
         /* func is initialized from __func__ which is not a macro, but
          * a static const char[], hence cannot easily be prefixed with
          * CODE_FUNC=, hence let's do it manually here. */
diff --git a/src/libsystemd/src/sd-journal/journal-verify.c b/src/libsystemd/src/sd-journal/journal-verify.c
index f82bdf8518..bb890273b3 100644
--- a/src/libsystemd/src/sd-journal/journal-verify.c
+++ b/src/libsystemd/src/sd-journal/journal-verify.c
@@ -25,6 +25,7 @@
 #include "basic/alloc-util.h"
 #include "basic/fd-util.h"
 #include "basic/fileio.h"
+#include "basic/fs-util.h"
 #include "basic/macro.h"
 #include "basic/terminal-util.h"
 #include "basic/util.h"
@@ -55,7 +56,9 @@ static void draw_progress(uint64_t p, usec_t *last_usec) {
         j = (n * (unsigned) p) / 65535ULL;
         k = n - j;
 
-        fputs("\r\x1B[?25l" ANSI_HIGHLIGHT_GREEN, stdout);
+        fputs("\r", stdout);
+        if (colors_enabled())
+                fputs("\x1B[?25l" ANSI_HIGHLIGHT_GREEN, stdout);
 
         for (i = 0; i < j; i++)
                 fputs("\xe2\x96\x88", stdout);
@@ -67,7 +70,10 @@ static void draw_progress(uint64_t p, usec_t *last_usec) {
 
         printf(" %3"PRIu64"%%", 100U * p / 65535U);
 
-        fputs("\r\x1B[?25h", stdout);
+        fputs("\r", stdout);
+        if (colors_enabled())
+                fputs("\x1B[?25h", stdout);
+
         fflush(stdout);
 }
 
@@ -821,6 +827,8 @@ int journal_file_verify(
         int data_fd = -1, entry_fd = -1, entry_array_fd = -1;
         unsigned i;
         bool found_last = false;
+        _cleanup_free_ char *tmp_dir = NULL;
+
 #ifdef HAVE_GCRYPT
         uint64_t last_tag = 0;
 #endif
@@ -839,19 +847,25 @@ int journal_file_verify(
         } else if (f->seal)
                 return -ENOKEY;
 
-        data_fd = open_tmpfile_unlinkable("/var/tmp", O_RDWR | O_CLOEXEC);
+        r = var_tmp(&tmp_dir);
+        if (r < 0) {
+                log_error_errno(r, "Failed to determine temporary directory: %m");
+                goto fail;
+        }
+
+        data_fd = open_tmpfile_unlinkable(tmp_dir, O_RDWR | O_CLOEXEC);
         if (data_fd < 0) {
                 r = log_error_errno(data_fd, "Failed to create data file: %m");
                 goto fail;
         }
 
-        entry_fd = open_tmpfile_unlinkable("/var/tmp", O_RDWR | O_CLOEXEC);
+        entry_fd = open_tmpfile_unlinkable(tmp_dir, O_RDWR | O_CLOEXEC);
         if (entry_fd < 0) {
                 r = log_error_errno(entry_fd, "Failed to create entry file: %m");
                 goto fail;
         }
 
-        entry_array_fd = open_tmpfile_unlinkable("/var/tmp", O_RDWR | O_CLOEXEC);
+        entry_array_fd = open_tmpfile_unlinkable(tmp_dir, O_RDWR | O_CLOEXEC);
         if (entry_array_fd < 0) {
                 r = log_error_errno(entry_array_fd,
                                     "Failed to create entry array file: %m");
diff --git a/src/libsystemd/src/sd-journal/mmap-cache.c b/src/libsystemd/src/sd-journal/mmap-cache.c
index 7f4aa78308..bda21aed05 100644
--- a/src/libsystemd/src/sd-journal/mmap-cache.c
+++ b/src/libsystemd/src/sd-journal/mmap-cache.c
@@ -482,7 +482,7 @@ static int mmap_try_harder(MMapCache *m, void *addr, int fd, int prot, int flags
                 if (ptr != MAP_FAILED)
                         break;
                 if (errno != ENOMEM)
-                        return -errno;
+                        return negative_errno();
 
                 r = make_room(m);
                 if (r < 0)
@@ -572,7 +572,7 @@ static int add_mmap(
         return 1;
 
 outofmem:
-        munmap(d, wsize);
+        (void) munmap(d, wsize);
         return -ENOMEM;
 }
 
diff --git a/src/libsystemd/src/sd-journal/sd-journal.c b/src/libsystemd/src/sd-journal/sd-journal.c
index 18ca37d58f..1a4b0c6418 100644
--- a/src/libsystemd/src/sd-journal/sd-journal.c
+++ b/src/libsystemd/src/sd-journal/sd-journal.c
@@ -1440,7 +1440,7 @@ static int add_directory(sd_journal *j, const char *prefix, const char *dirname)
         if (j->toplevel_fd < 0)
                 d = opendir(path);
         else
-                /* Open the specified directory relative to the the toplevel fd. Enforce that the path specified is
+                /* Open the specified directory relative to the toplevel fd. Enforce that the path specified is
                  * relative, by dropping the initial slash */
                 d = xopendirat(j->toplevel_fd, skip_slash(path), 0);
         if (!d) {
diff --git a/src/libsystemd/src/sd-login/sd-login.c b/src/libsystemd/src/sd-login/sd-login.c
index 11686bc90d..2698dc5c2b 100644
--- a/src/libsystemd/src/sd-login/sd-login.c
+++ b/src/libsystemd/src/sd-login/sd-login.c
@@ -124,7 +124,7 @@ _public_ int sd_pid_get_cgroup(pid_t pid, char **cgroup) {
 
         /* The internal APIs return the empty string for the root
          * cgroup, let's return the "/" in the public APIs instead, as
-         * that's easier and less ambigious for people to grok. */
+         * that's easier and less ambiguous for people to grok. */
         if (isempty(c)) {
                 free(c);
                 c = strdup("/");
diff --git a/src/libsystemd/src/sd-netlink/netlink-message.c b/src/libsystemd/src/sd-netlink/netlink-message.c
index fd32776a19..352df2f35a 100644
--- a/src/libsystemd/src/sd-netlink/netlink-message.c
+++ b/src/libsystemd/src/sd-netlink/netlink-message.c
@@ -120,7 +120,9 @@ sd_netlink_message *sd_netlink_message_ref(sd_netlink_message *m) {
 }
 
 sd_netlink_message *sd_netlink_message_unref(sd_netlink_message *m) {
-        if (m && REFCNT_DEC(m->n_ref) == 0) {
+        sd_netlink_message *t;
+
+        while (m && REFCNT_DEC(m->n_ref) == 0) {
                 unsigned i;
 
                 free(m->hdr);
@@ -128,9 +130,9 @@ sd_netlink_message *sd_netlink_message_unref(sd_netlink_message *m) {
                 for (i = 0; i <= m->n_containers; i++)
                         free(m->containers[i].attributes);
 
-                sd_netlink_message_unref(m->next);
-
-                free(m);
+                t = m;
+                m = m->next;
+                free(t);
         }
 
         return NULL;
diff --git a/src/libsystemd/src/sd-netlink/netlink-types.c b/src/libsystemd/src/sd-netlink/netlink-types.c
index 3bd7777b88..7aaecd2272 100644
--- a/src/libsystemd/src/sd-netlink/netlink-types.c
+++ b/src/libsystemd/src/sd-netlink/netlink-types.c
@@ -280,6 +280,10 @@ static const NLType rtnl_link_info_data_ip6tnl_types[] = {
         [IFLA_IPTUN_FLOWINFO]            = { .type = NETLINK_TYPE_U32 },
 };
 
+static const NLType rtnl_link_info_data_vrf_types[] = {
+        [IFLA_VRF_TABLE]                 = { .type = NETLINK_TYPE_U32 },
+};
+
 /* these strings must match the .kind entries in the kernel */
 static const char* const nl_union_link_info_data_table[] = {
         [NL_UNION_LINK_INFO_DATA_BOND] = "bond",
@@ -300,6 +304,7 @@ static const char* const nl_union_link_info_data_table[] = {
         [NL_UNION_LINK_INFO_DATA_VTI_TUNNEL] = "vti",
         [NL_UNION_LINK_INFO_DATA_VTI6_TUNNEL] = "vti6",
         [NL_UNION_LINK_INFO_DATA_IP6TNL_TUNNEL] = "ip6tnl",
+        [NL_UNION_LINK_INFO_DATA_VRF] = "vrf",
 };
 
 DEFINE_STRING_TABLE_LOOKUP(nl_union_link_info_data, NLUnionLinkInfoData);
@@ -340,6 +345,9 @@ static const NLTypeSystem rtnl_link_info_data_type_systems[] = {
         [NL_UNION_LINK_INFO_DATA_IP6TNL_TUNNEL] =  { .count = ELEMENTSOF(rtnl_link_info_data_ip6tnl_types),
                                                      .types = rtnl_link_info_data_ip6tnl_types },
 
+        [NL_UNION_LINK_INFO_DATA_VRF] =  { .count = ELEMENTSOF(rtnl_link_info_data_vrf_types),
+                                                     .types = rtnl_link_info_data_vrf_types },
+
 };
 
 static const NLTypeSystemUnion rtnl_link_info_data_type_system_union = {
diff --git a/src/libsystemd/src/sd-netlink/netlink-types.h b/src/libsystemd/src/sd-netlink/netlink-types.h
index 53363cdbfa..56b9cb143f 100644
--- a/src/libsystemd/src/sd-netlink/netlink-types.h
+++ b/src/libsystemd/src/sd-netlink/netlink-types.h
@@ -86,6 +86,7 @@ typedef enum NLUnionLinkInfoData {
         NL_UNION_LINK_INFO_DATA_VTI_TUNNEL,
         NL_UNION_LINK_INFO_DATA_VTI6_TUNNEL,
         NL_UNION_LINK_INFO_DATA_IP6TNL_TUNNEL,
+        NL_UNION_LINK_INFO_DATA_VRF,
         _NL_UNION_LINK_INFO_DATA_MAX,
         _NL_UNION_LINK_INFO_DATA_INVALID = -1
 } NLUnionLinkInfoData;
diff --git a/src/libsystemd/src/sd-netlink/sd-netlink.c b/src/libsystemd/src/sd-netlink/sd-netlink.c
index 1329c56bbd..d78777397e 100644
--- a/src/libsystemd/src/sd-netlink/sd-netlink.c
+++ b/src/libsystemd/src/sd-netlink/sd-netlink.c
@@ -144,7 +144,10 @@ int sd_netlink_open(sd_netlink **ret) {
         return 0;
 }
 
-int sd_netlink_inc_rcvbuf(const sd_netlink *const rtnl, const int size) {
+int sd_netlink_inc_rcvbuf(sd_netlink *rtnl, size_t size) {
+        assert_return(rtnl, -EINVAL);
+        assert_return(!rtnl_pid_changed(rtnl), -ECHILD);
+
         return fd_inc_rcvbuf(rtnl->fd, size);
 }
 
diff --git a/src/libsystemd/src/sd-netlink/sd-netlink.h b/src/libsystemd/src/sd-netlink/sd-netlink.h
index 1df902d30e..7db35e1756 100644
--- a/src/libsystemd/src/sd-netlink/sd-netlink.h
+++ b/src/libsystemd/src/sd-netlink/sd-netlink.h
@@ -43,7 +43,7 @@ typedef int (*sd_netlink_message_handler_t)(sd_netlink *nl, sd_netlink_message *
 int sd_netlink_new_from_netlink(sd_netlink **nl, int fd);
 int sd_netlink_open(sd_netlink **nl);
 int sd_netlink_open_fd(sd_netlink **nl, int fd);
-int sd_netlink_inc_rcvbuf(const sd_netlink *const rtnl, const int size);
+int sd_netlink_inc_rcvbuf(sd_netlink *nl, const size_t size);
 
 sd_netlink *sd_netlink_ref(sd_netlink *nl);
 sd_netlink *sd_netlink_unref(sd_netlink *nl);
diff --git a/src/libsystemd/src/sd-resolve/sd-resolve.c b/src/libsystemd/src/sd-resolve/sd-resolve.c
index d10204cde9..d638a374a1 100644
--- a/src/libsystemd/src/sd-resolve/sd-resolve.c
+++ b/src/libsystemd/src/sd-resolve/sd-resolve.c
@@ -585,9 +585,7 @@ static void resolve_free(sd_resolve *resolve) {
                 (void) pthread_join(resolve->workers[i], NULL);
 
         /* Close all communication channels */
-        for (i = 0; i < _FD_MAX; i++)
-                safe_close(resolve->fds[i]);
-
+        close_many(resolve->fds, _FD_MAX);
         free(resolve);
 }
 
diff --git a/src/libsystemd/src/test.mk b/src/libsystemd/src/test.mk
index 0290b33f6b..24ddf29958 100644
--- a/src/libsystemd/src/test.mk
+++ b/src/libsystemd/src/test.mk
@@ -25,7 +25,7 @@ test_bus_marshal_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-marshal.c
 
 test_bus_marshal_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(GLIB_LIBS) \
 	$(DBUS_LIBS)
 
@@ -38,13 +38,13 @@ test_bus_signature_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-signature.c
 
 test_bus_signature_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_chat_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-chat.c
 
 test_bus_chat_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_cleanup_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-cleanup.c
@@ -54,23 +54,24 @@ test_bus_cleanup_CFLAGS = \
 	$(SECCOMP_CFLAGS)
 
 test_bus_cleanup_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_server_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-server.c
 
 test_bus_server_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_objects_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-objects.c
 
 test_bus_objects_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_error_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-error.c
 
+# Link statically because this test uses BUS_ERROR_MAP_ELF_REGISTER
 test_bus_error_LDADD = \
 	libshared.la
 
@@ -78,7 +79,7 @@ test_bus_gvariant_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-gvariant.c
 
 test_bus_gvariant_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(GLIB_LIBS)
 
 test_bus_gvariant_CFLAGS = \
@@ -89,64 +90,64 @@ test_bus_creds_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-creds.c
 
 test_bus_creds_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_match_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-match.c
 
 test_bus_match_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_kernel_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-kernel.c
 
 test_bus_kernel_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_kernel_bloom_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-kernel-bloom.c
 
 test_bus_kernel_bloom_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_benchmark_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-benchmark.c
 
 test_bus_benchmark_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_zero_copy_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-zero-copy.c
 
 test_bus_zero_copy_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_bus_introspect_SOURCES = \
 	src/libsystemd/sd-bus/test-bus-introspect.c
 
 test_bus_introspect_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_event_SOURCES = \
 	src/libsystemd/sd-event/test-event.c
 
 test_event_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_netlink_SOURCES = \
 	src/libsystemd/sd-netlink/test-netlink.c
 
 test_netlink_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_local_addresses_SOURCES = \
 	src/libsystemd/sd-netlink/test-local-addresses.c
 
 test_local_addresses_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_resolve_SOURCES = \
 	src/libsystemd/sd-resolve/test-resolve.c
 
 test_resolve_LDADD = \
-	libshared.la
+	libsystemd-shared.la
diff --git a/src/libudev/Makefile b/src/libudev/Makefile
index 0ca3d15841..8224a52d8b 100644
--- a/src/libudev/Makefile
+++ b/src/libudev/Makefile
@@ -24,7 +24,7 @@ include $(dir $(lastword $(MAKEFILE_LIST)))/../../config.mk
 include $(topsrcdir)/build-aux/Makefile.head.mk
 
 LIBUDEV_CURRENT=7
-LIBUDEV_REVISION=4
+LIBUDEV_REVISION=5
 LIBUDEV_AGE=6
 
 include_HEADERS += \
@@ -38,7 +38,9 @@ libudev_la_LDFLAGS = \
 	-version-info $(LIBUDEV_CURRENT):$(LIBUDEV_REVISION):$(LIBUDEV_AGE) \
 	-Wl,--version-script=$(srcdir)/libudev.sym
 
-libudev_la_LIBADD += $(libudev-internal.DEPENDS)
+libudev_la_LIBADD = \
+	libsystemd-internal.la \
+	libbasic.la
 
 pkgconfiglib_DATA += \
 	src/libudev/libudev.pc
diff --git a/src/libudev/libudev.xml b/src/libudev/libudev.xml
index 7ef978463c..53b68dcc89 100644
--- a/src/libudev/libudev.xml
+++ b/src/libudev/libudev.xml
@@ -81,7 +81,7 @@
     <para>To introspect a local device on a system, a udev device
     object can be created via
     <citerefentry><refentrytitle>udev_device_new_from_syspath</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-    and friends. The device object allows to query current state,
+    and friends. The device object allows one to query current state,
     read and write attributes and lookup properties of the device in
     question.</para>
 
diff --git a/src/libudev/src/libudev-device.c b/src/libudev/src/libudev-device.c
index 2cb20aa557..a3a0d473a6 100644
--- a/src/libudev/src/libudev-device.c
+++ b/src/libudev/src/libudev-device.c
@@ -621,7 +621,7 @@ _public_ const char *udev_device_get_syspath(struct udev_device *udev_device)
  *
  * Get the kernel device name in /sys.
  *
- * Returns: the name string of the device device
+ * Returns: the name string of the device
  **/
 _public_ const char *udev_device_get_sysname(struct udev_device *udev_device)
 {
diff --git a/src/libudev/src/libudev-monitor.c b/src/libudev/src/libudev-monitor.c
index be8e280336..87ee3d2e1b 100644
--- a/src/libudev/src/libudev-monitor.c
+++ b/src/libudev/src/libudev-monitor.c
@@ -652,9 +652,9 @@ retry:
 
         if (memcmp(buf.raw, "libudev", 8) == 0) {
                 /* udev message needs proper version magic */
-                if (buf.nlh.magic != htonl(UDEV_MONITOR_MAGIC)) {
+                if (buf.nlh.magic != htobe32(UDEV_MONITOR_MAGIC)) {
                         log_debug("unrecognized message signature (%x != %x)",
-                                 buf.nlh.magic, htonl(UDEV_MONITOR_MAGIC));
+                                 buf.nlh.magic, htobe32(UDEV_MONITOR_MAGIC));
                         return NULL;
                 }
                 if (buf.nlh.properties_off+32 > (size_t)buflen) {
@@ -717,7 +717,7 @@ int udev_monitor_send_device(struct udev_monitor *udev_monitor,
         ssize_t blen, count;
         struct udev_monitor_netlink_header nlh = {
                 .prefix = "libudev",
-                .magic = htonl(UDEV_MONITOR_MAGIC),
+                .magic = htobe32(UDEV_MONITOR_MAGIC),
                 .header_size = sizeof nlh,
         };
         struct iovec iov[2] = {
@@ -738,19 +738,19 @@ int udev_monitor_send_device(struct udev_monitor *udev_monitor,
 
         /* fill in versioned header */
         val = udev_device_get_subsystem(udev_device);
-        nlh.filter_subsystem_hash = htonl(util_string_hash32(val));
+        nlh.filter_subsystem_hash = htobe32(util_string_hash32(val));
 
         val = udev_device_get_devtype(udev_device);
         if (val != NULL)
-                nlh.filter_devtype_hash = htonl(util_string_hash32(val));
+                nlh.filter_devtype_hash = htobe32(util_string_hash32(val));
 
         /* add tag bloom filter */
         tag_bloom_bits = 0;
         udev_list_entry_foreach(list_entry, udev_device_get_tags_list_entry(udev_device))
                 tag_bloom_bits |= util_string_bloom64(udev_list_entry_get_name(list_entry));
         if (tag_bloom_bits > 0) {
-                nlh.filter_tag_bloom_hi = htonl(tag_bloom_bits >> 32);
-                nlh.filter_tag_bloom_lo = htonl(tag_bloom_bits & 0xffffffff);
+                nlh.filter_tag_bloom_hi = htobe32(tag_bloom_bits >> 32);
+                nlh.filter_tag_bloom_lo = htobe32(tag_bloom_bits & 0xffffffff);
         }
 
         /* add properties list */
diff --git a/src/libudev/udev_device_get_syspath.xml b/src/libudev/udev_device_get_syspath.xml
index b54749ed56..014f43b21c 100644
--- a/src/libudev/udev_device_get_syspath.xml
+++ b/src/libudev/udev_device_get_syspath.xml
@@ -184,10 +184,10 @@
     to such a parent device. On failure, <constant>NULL</constant>
     is returned.</para>
 
-    <para>On success, <function>udev_device_get_is_initialized()</function>
-    returns either <constant>1</constant> or <constant>0</constant>,
-    depending on whether the passed device is initialized or not. On
-    failure, a negative error code is returned.</para>
+    <para>On success, <function>udev_device_get_is_initialized()</function> returns either <constant>1</constant> or
+    <constant>0</constant>, depending on whether the passed device has already been initialized by udev or not. On
+    failure, a negative error code is returned. Note that devices for which no udev rules are defined are never
+    reported initialized.</para>
   </refsect1>
 
   <refsect1>
diff --git a/src/manpages/os-release.xml b/src/manpages/os-release.xml
index a70ba1aa31..2811f434c5 100644
--- a/src/manpages/os-release.xml
+++ b/src/manpages/os-release.xml
@@ -176,6 +176,22 @@
       </varlistentry>
 
       <varlistentry>
+        <term><varname>VERSION_CODENAME=</varname></term>
+
+        <listitem><para>
+        A lower-case string (no spaces or other characters outside of
+        0–9, a–z, ".", "_" and "-") identifying the operating system
+        release code name, excluding any OS name information or
+        release version, and suitable for processing by scripts or
+        usage in generated filenames. This field is optional and may
+        not be implemented on all systems.
+        Examples:
+        <literal>VERSION_CODENAME=buster</literal>,
+        <literal>VERSION_CODENAME=xenial</literal>
+        </para></listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><varname>VERSION_ID=</varname></term>
 
         <listitem><para>A lower-case string (mostly numeric, no spaces
diff --git a/src/nss-myhostname/Makefile b/src/nss-myhostname/Makefile
index b5f6ff62aa..c98ab37e08 100644
--- a/src/nss-myhostname/Makefile
+++ b/src/nss-myhostname/Makefile
@@ -38,7 +38,8 @@ libnss_myhostname_la_LDFLAGS = \
 	-Wl,--version-script=$(srcdir)/nss-myhostname.sym
 
 libnss_myhostname_la_LIBADD = \
-	libsystemd-internal.la
+	libsystemd-internal.la \
+	libbasic.la
 
 lib_LTLIBRARIES += \
 	libnss_myhostname.la
diff --git a/src/nss-myhostname/nss-myhostname.c b/src/nss-myhostname/nss-myhostname.c
index e31b959584..6983587265 100644
--- a/src/nss-myhostname/nss-myhostname.c
+++ b/src/nss-myhostname/nss-myhostname.c
@@ -38,7 +38,7 @@
  * IPv6 we use ::1 which unfortunately will not translate back to the
  * hostname but instead something like "localhost" or so. */
 
-#define LOCALADDRESS_IPV4 (htonl(0x7F000002))
+#define LOCALADDRESS_IPV4 (htobe32(0x7F000002))
 #define LOCALADDRESS_IPV6 &in6addr_loopback
 
 NSS_GETHOSTBYNAME_PROTOTYPES(myhostname);
@@ -75,7 +75,7 @@ enum nss_status _nss_myhostname_gethostbyname4_r(
                  * is optional */
 
                 canonical = "localhost";
-                local_address_ipv4 = htonl(INADDR_LOOPBACK);
+                local_address_ipv4 = htobe32(INADDR_LOOPBACK);
 
         } else if (is_gateway_hostname(name)) {
 
@@ -96,7 +96,7 @@ enum nss_status _nss_myhostname_gethostbyname4_r(
                         return NSS_STATUS_TRYAGAIN;
                 }
 
-                /* We respond to our local host name, our our hostname suffixed with a single dot. */
+                /* We respond to our local host name, our hostname suffixed with a single dot. */
                 if (!streq(name, hn) && !streq_ptr(startswith(name, hn), ".")) {
                         *errnop = ENOENT;
                         *h_errnop = HOST_NOT_FOUND;
@@ -348,7 +348,7 @@ enum nss_status _nss_myhostname_gethostbyname3_r(
 
         if (is_localhost(name)) {
                 canonical = "localhost";
-                local_address_ipv4 = htonl(INADDR_LOOPBACK);
+                local_address_ipv4 = htobe32(INADDR_LOOPBACK);
 
         } else if (is_gateway_hostname(name)) {
 
@@ -437,9 +437,9 @@ enum nss_status _nss_myhostname_gethostbyaddr2_r(
                 if ((*(uint32_t*) addr) == LOCALADDRESS_IPV4)
                         goto found;
 
-                if ((*(uint32_t*) addr) == htonl(INADDR_LOOPBACK)) {
+                if ((*(uint32_t*) addr) == htobe32(INADDR_LOOPBACK)) {
                         canonical = "localhost";
-                        local_address_ipv4 = htonl(INADDR_LOOPBACK);
+                        local_address_ipv4 = htobe32(INADDR_LOOPBACK);
                         goto found;
                 }
 
diff --git a/src/systemd-ask-password/Makefile b/src/systemd-ask-password/Makefile
index 4a79cd838a..9b23b41513 100644
--- a/src/systemd-ask-password/Makefile
+++ b/src/systemd-ask-password/Makefile
@@ -28,6 +28,6 @@ systemd_ask_password_SOURCES = \
 	src/ask-password/ask-password.c
 
 systemd_ask_password_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-cgls/Makefile b/src/systemd-cgls/Makefile
index 40a7811632..1ef82d8aef 100644
--- a/src/systemd-cgls/Makefile
+++ b/src/systemd-cgls/Makefile
@@ -28,6 +28,6 @@ systemd_cgls_SOURCES = \
 	src/cgls/cgls.c
 
 systemd_cgls_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-cgroups-agent/Makefile b/src/systemd-cgroups-agent/Makefile
index 05ff1f6b49..ae40bb0163 100644
--- a/src/systemd-cgroups-agent/Makefile
+++ b/src/systemd-cgroups-agent/Makefile
@@ -28,6 +28,6 @@ systemd_cgroups_agent_SOURCES = \
 	src/cgroups-agent/cgroups-agent.c
 
 systemd_cgroups_agent_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-cgtop/Makefile b/src/systemd-cgtop/Makefile
index 4980eed15b..abebe7f3d0 100644
--- a/src/systemd-cgtop/Makefile
+++ b/src/systemd-cgtop/Makefile
@@ -28,6 +28,6 @@ systemd_cgtop_SOURCES = \
 	src/cgtop/cgtop.c
 
 systemd_cgtop_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-cgtop/cgtop.c b/src/systemd-cgtop/cgtop.c
index 91cab3f6b1..f23ebf4f57 100644
--- a/src/systemd-cgtop/cgtop.c
+++ b/src/systemd-cgtop/cgtop.c
@@ -72,6 +72,7 @@ static bool arg_batch = false;
 static bool arg_raw = false;
 static usec_t arg_delay = 1*USEC_PER_SEC;
 static char* arg_machine = NULL;
+static char* arg_root = NULL;
 static bool arg_recursive = true;
 
 static enum {
@@ -558,7 +559,7 @@ static void display(Hashmap *a) {
 
         assert(a);
 
-        if (on_tty())
+        if (!terminal_is_dumb())
                 fputs(ANSI_HOME_CLEAR, stdout);
 
         array = alloca(sizeof(Group*) * hashmap_size(a));
@@ -653,7 +654,7 @@ static void display(Hashmap *a) {
 }
 
 static void help(void) {
-        printf("%s [OPTIONS...]\n\n"
+        printf("%s [OPTIONS...] [CGROUP]\n\n"
                "Show top control groups by their resource usage.\n\n"
                "  -h --help           Show this help\n"
                "     --version        Show package version\n"
@@ -835,7 +836,13 @@ static int parse_argv(int argc, char *argv[]) {
                         assert_not_reached("Unhandled option");
                 }
 
-        if (optind < argc) {
+        if (optind == argc-1) {
+                if (arg_machine) {
+                        log_error("Specifying a control group path together with the -M option is not allowed");
+                        return -EINVAL;
+                }
+                arg_root = argv[optind];
+        } else if (optind < argc) {
                 log_error("Too many arguments.");
                 return -EINVAL;
         }
@@ -864,6 +871,17 @@ static int get_cgroup_root(char **ret) {
         const char *m;
         int r;
 
+        if (arg_root) {
+                char *aux;
+
+                aux = strdup(arg_root);
+                if (!aux)
+                        return log_oom();
+
+                *ret = aux;
+                return 0;
+        }
+
         if (!arg_machine) {
                 r = cg_get_root_path(ret);
                 if (r < 0)
diff --git a/src/systemd-cgtop/systemd-cgtop.xml b/src/systemd-cgtop/systemd-cgtop.xml
index c76f646984..be13631239 100644
--- a/src/systemd-cgtop/systemd-cgtop.xml
+++ b/src/systemd-cgtop/systemd-cgtop.xml
@@ -52,6 +52,7 @@
     <cmdsynopsis>
       <command>systemd-cgtop</command>
       <arg choice="opt" rep="repeat">OPTIONS</arg>
+      <arg choice="opt">GROUP</arg>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -62,7 +63,9 @@
     groups of the local Linux control group hierarchy, ordered by
     their CPU, memory, or disk I/O load. The display is refreshed in
     regular intervals (by default every 1s), similar in style to
-    <citerefentry project='man-pages'><refentrytitle>top</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
+    <citerefentry project='man-pages'><refentrytitle>top</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+    If a control group path is specified, shows only the services of
+    the specified control group.</para>
 
     <para>If <command>systemd-cgtop</command> is not connected to a
     tty, no column headers are printed and the default is to only run
@@ -252,7 +255,8 @@
 
         <listitem><para>Limit control groups shown to the part
         corresponding to the container
-        <replaceable>MACHINE</replaceable>.</para></listitem>
+        <replaceable>MACHINE</replaceable>.
+        This option may not be used when a control group path is specified.</para></listitem>
       </varlistentry>
 
       <xi:include href="standard-options.xml" xpointer="help" />
diff --git a/src/systemd-cryptsetup/Makefile b/src/systemd-cryptsetup/Makefile
index 981bd89c85..346eab772a 100644
--- a/src/systemd-cryptsetup/Makefile
+++ b/src/systemd-cryptsetup/Makefile
@@ -42,14 +42,14 @@ systemd_cryptsetup_CFLAGS = \
 	$(LIBCRYPTSETUP_CFLAGS)
 
 systemd_cryptsetup_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(LIBCRYPTSETUP_LIBS)
 
 systemd_cryptsetup_generator_SOURCES = \
 	src/cryptsetup/cryptsetup-generator.c
 
 systemd_cryptsetup_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 SYSINIT_TARGET_WANTS += \
 	cryptsetup.target
diff --git a/src/systemd-cryptsetup/crypttab.xml b/src/systemd-cryptsetup/crypttab.xml
index 1de834a045..4b8d4aa3d6 100644
--- a/src/systemd-cryptsetup/crypttab.xml
+++ b/src/systemd-cryptsetup/crypttab.xml
@@ -93,7 +93,7 @@
     field is not present or the password is set to
     <literal>none</literal> or <literal>-</literal>, the password has
     to be manually entered during system boot. Otherwise, the field is
-    interpreted as a absolute path to a file containing the encryption
+    interpreted as an absolute path to a file containing the encryption
     password. For swap encryption, <filename>/dev/urandom</filename>
     or the hardware device <filename>/dev/hw_random</filename> can be
     used as the password file; using <filename>/dev/random</filename>
diff --git a/src/systemd-dbus1-generator/Makefile b/src/systemd-dbus1-generator/Makefile
deleted file mode 100644
index 8a4193621a..0000000000
--- a/src/systemd-dbus1-generator/Makefile
+++ /dev/null
@@ -1,53 +0,0 @@
-#  -*- Mode: makefile; indent-tabs-mode: t -*-
-#
-#  This file is part of systemd.
-#
-#  Copyright 2010-2012 Lennart Poettering
-#  Copyright 2010-2012 Kay Sievers
-#  Copyright 2013 Zbigniew Jędrzejewski-Szmek
-#  Copyright 2013 David Strauss
-#  Copyright 2016 Luke Shumaker
-#
-#  systemd is free software; you can redistribute it and/or modify it
-#  under the terms of the GNU Lesser General Public License as published by
-#  the Free Software Foundation; either version 2.1 of the License, or
-#  (at your option) any later version.
-#
-#  systemd is distributed in the hope that it will be useful, but
-#  WITHOUT ANY WARRANTY; without even the implied warranty of
-#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-#  Lesser General Public License for more details.
-#
-#  You should have received a copy of the GNU Lesser General Public License
-#  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-include $(dir $(lastword $(MAKEFILE_LIST)))/../../config.mk
-include $(topsrcdir)/build-aux/Makefile.head.mk
-
-systemgenerator_PROGRAMS +=  \
-	systemd-dbus1-generator
-
-systemd_dbus1_generator_SOURCES = \
-	src/dbus1-generator/dbus1-generator.c
-
-systemd_dbus1_generator_LDADD = \
-	libshared.la
-
-dbus1-generator-install-hook:
-	$(AM_V_at)$(MKDIR_P) $(DESTDIR)$(usergeneratordir)
-	$(AM_V_RM)rm -f $(DESTDIR)$(usergeneratordir)/systemd-dbus1-generator
-	$(AM_V_LN)$(LN_S) --relative -f $(DESTDIR)$(systemgeneratordir)/systemd-dbus1-generator $(DESTDIR)$(usergeneratordir)/systemd-dbus1-generator
-
-dbus1-generator-uninstall-hook:
-	rm -f $(DESTDIR)$(usergeneratordir)/systemd-dbus1-generator
-
-# TODO
-_dist_xinitrc_SCRIPTS = \
-	xorg/50-systemd-user.sh
-
-INSTALL_EXEC_HOOKS += dbus1-generator-install-hook
-UNINSTALL_EXEC_HOOKS += dbus1-generator-uninstall-hook
-
-sd.CPPFLAGS += -DSYSTEM_DATA_UNIT_PATH=\"$(systemunitdir)\"
-sd.CPPFLAGS += -DUSER_DATA_UNIT_PATH=\"$(userunitdir)\"
-
-include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-dbus1-generator/dbus1-generator.c b/src/systemd-dbus1-generator/dbus1-generator.c
deleted file mode 100644
index 762a374fe4..0000000000
--- a/src/systemd-dbus1-generator/dbus1-generator.c
+++ /dev/null
@@ -1,331 +0,0 @@
-/***
-  This file is part of systemd.
-
-  Copyright 2013 Lennart Poettering
-
-  systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU Lesser General Public License as published by
-  the Free Software Foundation; either version 2.1 of the License, or
-  (at your option) any later version.
-
-  systemd is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  Lesser General Public License for more details.
-
-  You should have received a copy of the GNU Lesser General Public License
-  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-#include "basic/alloc-util.h"
-#include "basic/cgroup-util.h"
-#include "basic/dirent-util.h"
-#include "basic/fd-util.h"
-#include "basic/fileio.h"
-#include "basic/mkdir.h"
-#include "basic/special.h"
-#include "basic/unit-name.h"
-#include "basic/util.h"
-#include "sd-bus/bus-internal.h"
-#include "shared/bus-util.h"
-#include "shared/conf-parser.h"
-
-static const char *arg_dest_late = "/tmp", *arg_dest = "/tmp";
-
-static int create_dbus_files(
-                const char *path,
-                const char *name,
-                const char *service,
-                const char *exec,
-                const char *user,
-                const char *type) {
-
-        _cleanup_free_ char *b = NULL, *s = NULL, *lnk = NULL;
-        _cleanup_fclose_ FILE *f = NULL;
-        int r;
-
-        assert(path);
-        assert(name);
-        assert(service || exec);
-
-        if (!service) {
-                _cleanup_free_ char *a = NULL;
-
-                s = strjoin("dbus-", name, ".service", NULL);
-                if (!s)
-                        return log_oom();
-
-                a = strjoin(arg_dest_late, "/", s, NULL);
-                if (!a)
-                        return log_oom();
-
-                f = fopen(a, "wxe");
-                if (!f)
-                        return log_error_errno(errno, "Failed to create %s: %m", a);
-
-                fprintf(f,
-                        "# Automatically generated by systemd-dbus1-generator\n\n"
-                        "[Unit]\n"
-                        "SourcePath=%s\n"
-                        "Description=DBUS1: %s\n"
-                        "Documentation=man:systemd-dbus1-generator(8)\n\n"
-                        "[Service]\n"
-                        "ExecStart=%s\n"
-                        "Type=dbus\n"
-                        "BusName=%s\n",
-                        path,
-                        name,
-                        exec,
-                        name);
-
-                if (user)
-                        fprintf(f, "User=%s\n", user);
-
-
-                if (type) {
-                        fprintf(f, "Environment=DBUS_STARTER_BUS_TYPE=%s\n", type);
-
-                        if (streq(type, "system"))
-                                fprintf(f, "Environment=DBUS_STARTER_ADDRESS=" DEFAULT_SYSTEM_BUS_ADDRESS "\n");
-                        else if (streq(type, "session")) {
-                                char *run;
-
-                                run = getenv("XDG_RUNTIME_DIR");
-                                if (!run) {
-                                        log_error("XDG_RUNTIME_DIR not set.");
-                                        return -EINVAL;
-                                }
-
-                                fprintf(f, "Environment=DBUS_STARTER_ADDRESS="KERNEL_USER_BUS_ADDRESS_FMT ";" UNIX_USER_BUS_ADDRESS_FMT "\n",
-                                        getuid(), run);
-                        }
-                }
-
-                r = fflush_and_check(f);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to write %s: %m", a);
-
-                f = safe_fclose(f);
-
-                service = s;
-        }
-
-        b = strjoin(arg_dest_late, "/", name, ".busname", NULL);
-        if (!b)
-                return log_oom();
-
-        f = fopen(b, "wxe");
-        if (!f)
-                return log_error_errno(errno, "Failed to create %s: %m", b);
-
-        fprintf(f,
-                "# Automatically generated by systemd-dbus1-generator\n\n"
-                "[Unit]\n"
-                "SourcePath=%s\n"
-                "Description=DBUS1: %s\n"
-                "Documentation=man:systemd-dbus1-generator(8)\n\n"
-                "[BusName]\n"
-                "Name=%s\n"
-                "Service=%s\n"
-                "AllowWorld=talk\n",
-                path,
-                name,
-                name,
-                service);
-
-        r = fflush_and_check(f);
-        if (r < 0)
-                return log_error_errno(r, "Failed to write %s: %m", b);
-
-        lnk = strjoin(arg_dest_late, "/" SPECIAL_BUSNAMES_TARGET ".wants/", name, ".busname", NULL);
-        if (!lnk)
-                return log_oom();
-
-        mkdir_parents_label(lnk, 0755);
-        if (symlink(b, lnk))
-                return log_error_errno(errno, "Failed to create symlink %s: %m", lnk);
-
-        return 0;
-}
-
-static int add_dbus(const char *path, const char *fname, const char *type) {
-        _cleanup_free_ char *name = NULL, *exec = NULL, *user = NULL, *service = NULL;
-
-        const ConfigTableItem table[] = {
-                { "D-BUS Service", "Name", config_parse_string, 0, &name },
-                { "D-BUS Service", "Exec", config_parse_string, 0, &exec },
-                { "D-BUS Service", "User", config_parse_string, 0, &user },
-                { "D-BUS Service", "SystemdService", config_parse_string, 0, &service },
-                { },
-        };
-
-        char *p;
-        int r;
-
-        assert(path);
-        assert(fname);
-
-        p = strjoina(path, "/", fname);
-        r = config_parse(NULL, p, NULL,
-                         "D-BUS Service\0",
-                         config_item_table_lookup, table,
-                         true, false, true, NULL);
-        if (r < 0)
-                return r;
-
-        if (!name) {
-                log_warning("Activation file %s lacks name setting, ignoring.", p);
-                return 0;
-        }
-
-        if (!service_name_is_valid(name)) {
-                log_warning("Bus service name %s is not valid, ignoring.", name);
-                return 0;
-        }
-
-        if (streq(name, "org.freedesktop.systemd1")) {
-                log_debug("Skipping %s, identified as systemd.", p);
-                return 0;
-        }
-
-        if (service) {
-                if (!unit_name_is_valid(service, UNIT_NAME_PLAIN|UNIT_NAME_INSTANCE)) {
-                        log_warning("Unit name %s is not valid, ignoring.", service);
-                        return 0;
-                }
-                if (!endswith(service, ".service")) {
-                        log_warning("Bus names can only activate services, ignoring %s.", p);
-                        return 0;
-                }
-        } else {
-                if (streq(exec, "/bin/false") || !exec) {
-                        log_warning("Neither service name nor binary path specified, ignoring %s.", p);
-                        return 0;
-                }
-
-                if (exec[0] != '/') {
-                        log_warning("Exec= in %s does not start with an absolute path, ignoring.", p);
-                        return 0;
-                }
-        }
-
-        return create_dbus_files(p, name, service, exec, user, type);
-}
-
-static int parse_dbus_fragments(const char *path, const char *type) {
-        _cleanup_closedir_ DIR *d = NULL;
-        struct dirent *de;
-        int r;
-
-        assert(path);
-        assert(type);
-
-        d = opendir(path);
-        if (!d) {
-                if (errno == -ENOENT)
-                        return 0;
-
-                return log_error_errno(errno, "Failed to enumerate D-Bus activated services: %m");
-        }
-
-        r = 0;
-        FOREACH_DIRENT(de, d, goto fail) {
-                int q;
-
-                if (!endswith(de->d_name, ".service"))
-                        continue;
-
-                q = add_dbus(path, de->d_name, type);
-                if (q < 0)
-                        r = q;
-        }
-
-        return r;
-
-fail:
-        return log_error_errno(errno, "Failed to read D-Bus services directory: %m");
-}
-
-static int link_busnames_target(const char *units) {
-        const char *f, *t;
-
-        f = strjoina(units, "/" SPECIAL_BUSNAMES_TARGET);
-        t = strjoina(arg_dest, "/" SPECIAL_BASIC_TARGET ".wants/" SPECIAL_BUSNAMES_TARGET);
-
-        mkdir_parents_label(t, 0755);
-        if (symlink(f, t) < 0)
-                return log_error_errno(errno, "Failed to create symlink %s: %m", t);
-
-        return 0;
-}
-
-static int link_compatibility(const char *units) {
-        const char *f, *t;
-
-        f = strjoina(units, "/systemd-bus-proxyd.socket");
-        t = strjoina(arg_dest, "/" SPECIAL_DBUS_SOCKET);
-        mkdir_parents_label(t, 0755);
-        if (symlink(f, t) < 0)
-                return log_error_errno(errno, "Failed to create symlink %s: %m", t);
-
-        f = strjoina(units, "/systemd-bus-proxyd.socket");
-        t = strjoina(arg_dest, "/" SPECIAL_SOCKETS_TARGET ".wants/systemd-bus-proxyd.socket");
-        mkdir_parents_label(t, 0755);
-        if (symlink(f, t) < 0)
-                return log_error_errno(errno, "Failed to create symlink %s: %m", t);
-
-        t = strjoina(arg_dest, "/" SPECIAL_DBUS_SERVICE);
-        if (symlink("/dev/null", t) < 0)
-                return log_error_errno(errno, "Failed to mask %s: %m", t);
-
-        return 0;
-}
-
-int main(int argc, char *argv[]) {
-        const char *path, *type, *units;
-        int r, q;
-
-        if (argc > 1 && argc != 4) {
-                log_error("This program takes three or no arguments.");
-                return EXIT_FAILURE;
-        }
-
-        if (argc > 1) {
-                arg_dest = argv[1];
-                arg_dest_late = argv[3];
-        }
-
-        log_set_target(LOG_TARGET_SAFE);
-        log_parse_environment();
-        log_open();
-
-        umask(0022);
-
-        if (!is_kdbus_available())
-                return 0;
-
-        r = cg_pid_get_owner_uid(0, NULL);
-        if (r >= 0) {
-                path = "/usr/share/dbus-1/services";
-                type = "session";
-                units = USER_DATA_UNIT_PATH;
-        } else if (r == -ENXIO) {
-                path = "/usr/share/dbus-1/system-services";
-                type = "system";
-                units = SYSTEM_DATA_UNIT_PATH;
-        } else
-                return log_error_errno(r, "Failed to determine whether we are running as user or system instance: %m");
-
-        r = parse_dbus_fragments(path, type);
-
-        /* FIXME: One day this should just be pulled in statically from basic.target */
-        q = link_busnames_target(units);
-        if (q < 0)
-                r = q;
-
-        q = link_compatibility(units);
-        if (q < 0)
-                r = q;
-
-        return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
-}
diff --git a/src/systemd-debug-generator/Makefile b/src/systemd-debug-generator/Makefile
index d07c97f2ef..a326353121 100644
--- a/src/systemd-debug-generator/Makefile
+++ b/src/systemd-debug-generator/Makefile
@@ -29,7 +29,7 @@ systemd_debug_generator_SOURCES = \
 	src/debug-generator/debug-generator.c
 
 systemd_debug_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 sd.CPPFLAGS += -DSYSTEM_DATA_UNIT_PATH=\"$(systemunitdir)\"
 
diff --git a/src/systemd-getty-generator/Makefile b/src/systemd-getty-generator/Makefile
index 9ca689c035..4f90ae05ed 100644
--- a/src/systemd-getty-generator/Makefile
+++ b/src/systemd-getty-generator/Makefile
@@ -28,7 +28,7 @@ systemd_getty_generator_SOURCES = \
 	src/getty-generator/getty-generator.c
 
 systemd_getty_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 sd.CPPFLAGS += -DSYSTEM_DATA_UNIT_PATH=\"$(systemunitdir)\"
 
diff --git a/src/systemd-gpt-auto-generator/Makefile b/src/systemd-gpt-auto-generator/Makefile
index ef832ad737..4e88a88977 100644
--- a/src/systemd-gpt-auto-generator/Makefile
+++ b/src/systemd-gpt-auto-generator/Makefile
@@ -32,7 +32,7 @@ systemd_gpt_auto_generator_SOURCES = \
 	src/basic/blkid-util.h
 
 systemd_gpt_auto_generator_LDADD = \
-	libshared.la \
+	libsystemd-shared.la \
 	$(BLKID_LIBS)
 
 systemd_gpt_auto_generator_CFLAGS = \
diff --git a/src/systemd-gpt-auto-generator/gpt-auto-generator.c b/src/systemd-gpt-auto-generator/gpt-auto-generator.c
index 4edcd42239..fe598da6e1 100644
--- a/src/systemd-gpt-auto-generator/gpt-auto-generator.c
+++ b/src/systemd-gpt-auto-generator/gpt-auto-generator.c
@@ -489,10 +489,8 @@ static int add_boot(const char *what) {
                 return 0;
         }
 
-        if (r < 0) {
-                log_error_errno(r, "Failed to read ESP partition UUID: %m");
-                return r;
-        }
+        if (r < 0)
+                return log_error_errno(r, "Failed to read ESP partition UUID: %m");
 
         errno = 0;
         b = blkid_new_probe_from_filename(what);
diff --git a/src/systemd-initctl/Makefile b/src/systemd-initctl/Makefile
index bd19b4a090..18d66993b7 100644
--- a/src/systemd-initctl/Makefile
+++ b/src/systemd-initctl/Makefile
@@ -28,6 +28,6 @@ systemd_initctl_SOURCES = \
 	src/initctl/initctl.c
 
 systemd_initctl_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-machine-id-setup/Makefile b/src/systemd-machine-id-setup/Makefile
index 8f210b3cdf..4cbba418ff 100644
--- a/src/systemd-machine-id-setup/Makefile
+++ b/src/systemd-machine-id-setup/Makefile
@@ -30,7 +30,7 @@ systemd_machine_id_setup_SOURCES = \
 	src/core/machine-id-setup.h
 
 systemd_machine_id_setup_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 SYSINIT_TARGET_WANTS += \
 	systemd-machine-id-commit.service
diff --git a/src/systemd-machine-id-setup/machine-id-setup-main.c b/src/systemd-machine-id-setup/machine-id-setup-main.c
index 009bb5c5c0..9cc90b6efd 100644
--- a/src/systemd-machine-id-setup/machine-id-setup-main.c
+++ b/src/systemd-machine-id-setup/machine-id-setup-main.c
@@ -30,6 +30,7 @@
 
 static char *arg_root = NULL;
 static bool arg_commit = false;
+static bool arg_print = false;
 
 static void help(void) {
         printf("%s [OPTIONS...]\n\n"
@@ -38,6 +39,7 @@ static void help(void) {
                "     --version          Show package version\n"
                "     --root=ROOT        Filesystem root\n"
                "     --commit           Commit transient ID\n"
+               "     --print            Print used machine ID\n"
                , program_invocation_short_name);
 }
 
@@ -47,6 +49,7 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_VERSION = 0x100,
                 ARG_ROOT,
                 ARG_COMMIT,
+                ARG_PRINT,
         };
 
         static const struct option options[] = {
@@ -54,6 +57,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "version",   no_argument,       NULL, ARG_VERSION   },
                 { "root",      required_argument, NULL, ARG_ROOT      },
                 { "commit",    no_argument,       NULL, ARG_COMMIT    },
+                { "print",     no_argument,       NULL, ARG_PRINT     },
                 {}
         };
 
@@ -83,6 +87,10 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_commit = true;
                         break;
 
+                case ARG_PRINT:
+                        arg_print = true;
+                        break;
+
                 case '?':
                         return -EINVAL;
 
@@ -99,6 +107,8 @@ static int parse_argv(int argc, char *argv[]) {
 }
 
 int main(int argc, char *argv[]) {
+        char buf[SD_ID128_STRING_MAX];
+        sd_id128_t id;
         int r;
 
         log_parse_environment();
@@ -108,10 +118,24 @@ int main(int argc, char *argv[]) {
         if (r <= 0)
                 goto finish;
 
-        if (arg_commit)
+        if (arg_commit) {
                 r = machine_id_commit(arg_root);
-        else
-                r = machine_id_setup(arg_root, SD_ID128_NULL);
+                if (r < 0)
+                        goto finish;
+
+                r = sd_id128_get_machine(&id);
+                if (r < 0) {
+                        log_error_errno(r, "Failed to read machine ID back: %m");
+                        goto finish;
+                }
+        } else {
+                r = machine_id_setup(arg_root, SD_ID128_NULL, &id);
+                if (r < 0)
+                        goto finish;
+        }
+
+        if (arg_print)
+                puts(sd_id128_to_string(id, buf));
 
 finish:
         free(arg_root);
diff --git a/src/systemd-machine-id-setup/systemd-machine-id-setup.xml b/src/systemd-machine-id-setup/systemd-machine-id-setup.xml
index bfcd74f436..749987a937 100644
--- a/src/systemd-machine-id-setup/systemd-machine-id-setup.xml
+++ b/src/systemd-machine-id-setup/systemd-machine-id-setup.xml
@@ -151,6 +151,12 @@
         early boot service.</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--print</option></term>
+
+        <listitem><para>Print the machine ID generated or commited after the operation is complete.</para></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
     </variablelist>
diff --git a/src/systemd-nspawn/Makefile b/src/systemd-nspawn/Makefile
index 2fe9bcc143..0c008808d8 100644
--- a/src/systemd-nspawn/Makefile
+++ b/src/systemd-nspawn/Makefile
@@ -36,6 +36,8 @@ systemd_nspawn_SOURCES = \
 	src/nspawn/nspawn-expose-ports.h \
 	src/nspawn/nspawn-cgroup.c \
 	src/nspawn/nspawn-cgroup.h \
+	src/nspawn/nspawn-seccomp.c \
+	src/nspawn/nspawn-seccomp.h \
 	src/nspawn/nspawn-register.c \
 	src/nspawn/nspawn-register.h \
 	src/nspawn/nspawn-setuid.c \
@@ -47,9 +49,7 @@ systemd_nspawn_SOURCES = \
 	src/core/mount-setup.c \
 	src/core/mount-setup.h \
 	src/core/loopback-setup.c \
-	src/core/loopback-setup.h \
-	src/core/machine-id-setup.c \
-	src/core/machine-id-setup.h
+	src/core/loopback-setup.h
 
 nodist_systemd_nspawn_SOURCES = \
 	src/nspawn/nspawn-gperf.c
@@ -59,12 +59,17 @@ gperf_gperf_sources += \
 
 systemd_nspawn_CFLAGS = \
 	$(AM_CFLAGS) \
+	$(ACL_CFLAGS) \
 	$(BLKID_CFLAGS) \
-	$(SECCOMP_CFLAGS)
+	$(SECCOMP_CFLAGS) \
+	$(SELINUX_CFLAGS)
 
 systemd_nspawn_LDADD = \
-	libshared.la \
-	$(BLKID_LIBS)
+	libsystemd-shared.la \
+	$(ACL_LIBS) \
+	$(BLKID_LIBS) \
+	$(SECCOMP_LIBS) \
+	$(SELINUX_LIBS)
 
 ifneq ($(HAVE_LIBIPTC),)
 systemd_nspawn_LDADD += \
@@ -76,8 +81,13 @@ test_patch_uid_SOURCES = \
 	src/nspawn/nspawn-patch-uid.h \
 	src/nspawn/test-patch-uid.c
 
+test_patch_uid_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(ACL_CFLAGS)
+
 test_patch_uid_LDADD = \
-	libshared.la
+	libsystemd-shared.la \
+	$(ACL_LIBS)
 
 manual_tests += \
 	test-patch-uid
diff --git a/src/systemd-nspawn/nspawn-cgroup.c b/src/systemd-nspawn/nspawn-cgroup.c
index d0e2de2345..9fa46fadbd 100644
--- a/src/systemd-nspawn/nspawn-cgroup.c
+++ b/src/systemd-nspawn/nspawn-cgroup.c
@@ -124,7 +124,7 @@ int create_subcgroup(pid_t pid, bool unified_requested) {
         int unified, r;
         CGroupMask supported;
 
-        /* In the unified hierarchy inner nodes may only only contain
+        /* In the unified hierarchy inner nodes may only contain
          * subgroups, but not processes. Hence, if we running in the
          * unified hierarchy and the container does the same, and we
          * did not create a scope unit for the container move us and
diff --git a/src/systemd-nspawn/nspawn-gperf.gperf b/src/systemd-nspawn/nspawn-gperf.gperf
index dd3c1b3b88..332063e19b 100644
--- a/src/systemd-nspawn/nspawn-gperf.gperf
+++ b/src/systemd-nspawn/nspawn-gperf.gperf
@@ -29,6 +29,7 @@ Exec.Personality,             config_parse_personality,   0, offsetof(Settings,
 Exec.MachineID,               config_parse_id128,         0, offsetof(Settings, machine_id)
 Exec.WorkingDirectory,        config_parse_path,          0, offsetof(Settings, working_directory)
 Exec.PrivateUsers,            config_parse_private_users, 0, 0
+Exec.NotifyReady,             config_parse_bool,          0, offsetof(Settings, notify_ready)
 Files.ReadOnly,               config_parse_tristate,      0, offsetof(Settings, read_only)
 Files.Volatile,               config_parse_volatile_mode, 0, offsetof(Settings, volatile_mode)
 Files.Bind,                   config_parse_bind,          0, 0
diff --git a/src/systemd-nspawn/nspawn-mount.c b/src/systemd-nspawn/nspawn-mount.c
index d8ca696f21..ea1d591415 100644
--- a/src/systemd-nspawn/nspawn-mount.c
+++ b/src/systemd-nspawn/nspawn-mount.c
@@ -299,18 +299,19 @@ int mount_all(const char *dest,
         } MountPoint;
 
         static const MountPoint mount_table[] = {
-                { "proc",      "/proc",          "proc",   NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,                              true,  true, false  },
-                { "/proc/sys", "/proc/sys",      NULL,     NULL,        MS_BIND,                                                   true,  true, false  },   /* Bind mount first */
-                { NULL,        "/proc/sys",      NULL,     NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, true,  true, false  },   /* Then, make it r/o */
-                { "tmpfs",     "/sys",           "tmpfs",  "mode=755",  MS_NOSUID|MS_NOEXEC|MS_NODEV,                              true,  false, true },
-                { "sysfs",     "/sys",           "sysfs",  NULL,        MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,                    true,  false, false },
-                { "tmpfs",     "/dev",           "tmpfs",  "mode=755",  MS_NOSUID|MS_STRICTATIME,                                  true,  false, false },
-                { "tmpfs",     "/dev/shm",       "tmpfs",  "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,                         true,  false, false },
-                { "tmpfs",     "/run",           "tmpfs",  "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,                         true,  false, false },
-                { "tmpfs",     "/tmp",           "tmpfs",  "mode=1777", MS_STRICTATIME,                                            true,  false, false },
+                { "proc",            "/proc",           "proc",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,                              true,  true,  false },
+                { "/proc/sys",       "/proc/sys",       NULL,    NULL,        MS_BIND,                                                   true,  true,  false },   /* Bind mount first ...*/
+                { "/proc/sys/net",   "/proc/sys/net",   NULL,    NULL,        MS_BIND,                                                   true,  true,  true  },   /* (except for this) */
+                { NULL,              "/proc/sys",       NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, true,  true,  false },   /* ... then, make it r/o */
+                { "tmpfs",           "/sys",            "tmpfs", "mode=755",  MS_NOSUID|MS_NOEXEC|MS_NODEV,                              true,  false, true  },
+                { "sysfs",           "/sys",            "sysfs", NULL,        MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,                    true,  false, false },
+                { "tmpfs",           "/dev",            "tmpfs", "mode=755",  MS_NOSUID|MS_STRICTATIME,                                  true,  false, false },
+                { "tmpfs",           "/dev/shm",        "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,                         true,  false, false },
+                { "tmpfs",           "/run",            "tmpfs", "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,                         true,  false, false },
+                { "tmpfs",           "/tmp",            "tmpfs", "mode=1777", MS_STRICTATIME,                                            true,  false, false },
 #ifdef HAVE_SELINUX
-                { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL,     MS_BIND,                                                   false, false, false },  /* Bind mount first */
-                { NULL,              "/sys/fs/selinux", NULL, NULL,     MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, false, false, false },  /* Then, make it r/o */
+                { "/sys/fs/selinux", "/sys/fs/selinux", NULL,     NULL,       MS_BIND,                                                   false, false, false },  /* Bind mount first */
+                { NULL,              "/sys/fs/selinux", NULL,     NULL,       MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, false, false, false },  /* Then, make it r/o */
 #endif
         };
 
@@ -344,7 +345,7 @@ int mount_all(const char *dest,
                         if (mount_table[k].fatal)
                                 return log_error_errno(r, "Failed to create directory %s: %m", where);
 
-                        log_warning_errno(r, "Failed to create directory %s: %m", where);
+                        log_debug_errno(r, "Failed to create directory %s: %m", where);
                         continue;
                 }
 
diff --git a/src/systemd-nspawn/nspawn-network.c b/src/systemd-nspawn/nspawn-network.c
index 1ae0a52f03..b188491000 100644
--- a/src/systemd-nspawn/nspawn-network.c
+++ b/src/systemd-nspawn/nspawn-network.c
@@ -351,7 +351,7 @@ int setup_bridge(const char *veth_name, const char *bridge_name, bool create) {
 
         if (create) {
                 /* We take a system-wide lock here, so that we can safely check whether there's still a member in the
-                 * bridge before removing it, without risking interferance from other nspawn instances. */
+                 * bridge before removing it, without risking interference from other nspawn instances. */
 
                 r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
                 if (r < 0)
diff --git a/src/systemd-nspawn/nspawn-patch-uid.c b/src/systemd-nspawn/nspawn-patch-uid.c
index 28d2801c69..dc703165ff 100644
--- a/src/systemd-nspawn/nspawn-patch-uid.c
+++ b/src/systemd-nspawn/nspawn-patch-uid.c
@@ -265,9 +265,12 @@ static int patch_fd(int fd, const char *name, const struct stat *st, uid_t shift
                         return -errno;
 
                 /* The Linux kernel alters the mode in some cases of chown(). Let's undo this. */
-                if (name && !S_ISLNK(st->st_mode))
-                        r = fchmodat(fd, name, st->st_mode, 0);
-                else
+                if (name) {
+                        if (!S_ISLNK(st->st_mode))
+                                r = fchmodat(fd, name, st->st_mode, 0);
+                        else /* AT_SYMLINK_NOFOLLOW is not available for fchmodat() */
+                                r = 0;
+                } else
                         r = fchmod(fd, st->st_mode);
                 if (r < 0)
                         return -errno;
@@ -282,7 +285,13 @@ static int patch_fd(int fd, const char *name, const struct stat *st, uid_t shift
         return r > 0 || changed;
 }
 
-static int is_procfs_sysfs_or_suchlike(int fd) {
+/*
+ * Check if the filesystem is fully compatible with user namespaces or
+ * UID/GID patching. Some filesystems in this list can be fully mounted inside
+ * user namespaces, however their inodes may relate to host resources or only
+ * valid in the global user namespace, therefore no patching should be applied.
+ */
+static int is_fs_fully_userns_compatible(int fd) {
         struct statfs sfs;
 
         assert(fd >= 0);
@@ -302,6 +311,9 @@ static int is_procfs_sysfs_or_suchlike(int fd) {
                F_TYPE_EQUAL(sfs.f_type, PSTOREFS_MAGIC) ||
                F_TYPE_EQUAL(sfs.f_type, SELINUX_MAGIC) ||
                F_TYPE_EQUAL(sfs.f_type, SMACK_MAGIC) ||
+               F_TYPE_EQUAL(sfs.f_type, SECURITYFS_MAGIC) ||
+               F_TYPE_EQUAL(sfs.f_type, BPF_FS_MAGIC) ||
+               F_TYPE_EQUAL(sfs.f_type, TRACEFS_MAGIC) ||
                F_TYPE_EQUAL(sfs.f_type, SYSFS_MAGIC);
 }
 
@@ -313,8 +325,8 @@ static int recurse_fd(int fd, bool donate_fd, const struct stat *st, uid_t shift
 
         /* We generally want to permit crossing of mount boundaries when patching the UIDs/GIDs. However, we
          * probably shouldn't do this for /proc and /sys if that is already mounted into place. Hence, let's
-         * stop the recursion when we hit a procfs or sysfs file system. */
-        r = is_procfs_sysfs_or_suchlike(fd);
+         * stop the recursion when we hit procfs, sysfs or some other special file systems. */
+        r = is_fs_fully_userns_compatible(fd);
         if (r < 0)
                 goto finish;
         if (r > 0) {
diff --git a/src/systemd-nspawn/nspawn-register.c b/src/systemd-nspawn/nspawn-register.c
index 3f174b6f24..12e29153f9 100644
--- a/src/systemd-nspawn/nspawn-register.c
+++ b/src/systemd-nspawn/nspawn-register.c
@@ -105,7 +105,7 @@ int register_machine(
                                 return bus_log_create_error(r);
                 }
 
-                r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
+                r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "closed");
                 if (r < 0)
                         return bus_log_create_error(r);
 
@@ -113,26 +113,19 @@ int register_machine(
                  * systemd-nspawn@.service, to keep the device
                  * policies in sync regardless if we are run with or
                  * without the --keep-unit switch. */
-                r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
+                r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 2,
                                           /* Allow the container to
                                            * access and create the API
                                            * device nodes, so that
                                            * PrivateDevices= in the
                                            * container can work
                                            * fine */
-                                          "/dev/null", "rwm",
-                                          "/dev/zero", "rwm",
-                                          "/dev/full", "rwm",
-                                          "/dev/random", "rwm",
-                                          "/dev/urandom", "rwm",
-                                          "/dev/tty", "rwm",
                                           "/dev/net/tun", "rwm",
                                           /* Allow the container
                                            * access to ptys. However,
                                            * do not permit the
                                            * container to ever create
                                            * these device nodes. */
-                                          "/dev/pts/ptmx", "rw",
                                           "char-pts", "rw");
                 if (r < 0)
                         return bus_log_create_error(r);
diff --git a/src/systemd-nspawn/nspawn-seccomp.c b/src/systemd-nspawn/nspawn-seccomp.c
new file mode 100644
index 0000000000..3efdf16a80
--- /dev/null
+++ b/src/systemd-nspawn/nspawn-seccomp.c
@@ -0,0 +1,198 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <errno.h>
+#include <sys/capability.h>
+#include <sys/types.h>
+
+#include <linux/netlink.h>
+
+#ifdef HAVE_SECCOMP
+#include <seccomp.h>
+#endif
+
+#include "basic/log.h"
+
+#ifdef HAVE_SECCOMP
+#include "shared/seccomp-util.h"
+#endif
+
+#include "nspawn-seccomp.h"
+
+#ifdef HAVE_SECCOMP
+
+static int seccomp_add_default_syscall_filter(scmp_filter_ctx ctx,
+                                              uint64_t cap_list_retain) {
+        unsigned i;
+        int r;
+        static const struct {
+                uint64_t capability;
+                int syscall_num;
+        } blacklist[] = {
+                { 0,              SCMP_SYS(_sysctl)             }, /* obsolete syscall */
+                { 0,              SCMP_SYS(add_key)             }, /* keyring is not namespaced */
+                { 0,              SCMP_SYS(afs_syscall)         }, /* obsolete syscall */
+                { 0,              SCMP_SYS(bdflush)             },
+#ifdef __NR_bpf
+                { 0,              SCMP_SYS(bpf)                 },
+#endif
+                { 0,              SCMP_SYS(break)               }, /* obsolete syscall */
+                { 0,              SCMP_SYS(create_module)       }, /* obsolete syscall */
+                { 0,              SCMP_SYS(ftime)               }, /* obsolete syscall */
+                { 0,              SCMP_SYS(get_kernel_syms)     }, /* obsolete syscall */
+                { 0,              SCMP_SYS(getpmsg)             }, /* obsolete syscall */
+                { 0,              SCMP_SYS(gtty)                }, /* obsolete syscall */
+#ifdef __NR_kexec_file_load
+                { 0,              SCMP_SYS(kexec_file_load)     },
+#endif
+                { 0,              SCMP_SYS(kexec_load)          },
+                { 0,              SCMP_SYS(keyctl)              }, /* keyring is not namespaced */
+                { 0,              SCMP_SYS(lock)                }, /* obsolete syscall */
+                { 0,              SCMP_SYS(lookup_dcookie)      },
+                { 0,              SCMP_SYS(mpx)                 }, /* obsolete syscall */
+                { 0,              SCMP_SYS(nfsservctl)          }, /* obsolete syscall */
+                { 0,              SCMP_SYS(open_by_handle_at)   },
+                { 0,              SCMP_SYS(perf_event_open)     },
+                { 0,              SCMP_SYS(prof)                }, /* obsolete syscall */
+                { 0,              SCMP_SYS(profil)              }, /* obsolete syscall */
+                { 0,              SCMP_SYS(putpmsg)             }, /* obsolete syscall */
+                { 0,              SCMP_SYS(query_module)        }, /* obsolete syscall */
+                { 0,              SCMP_SYS(quotactl)            },
+                { 0,              SCMP_SYS(request_key)         }, /* keyring is not namespaced */
+                { 0,              SCMP_SYS(security)            }, /* obsolete syscall */
+                { 0,              SCMP_SYS(sgetmask)            }, /* obsolete syscall */
+                { 0,              SCMP_SYS(ssetmask)            }, /* obsolete syscall */
+                { 0,              SCMP_SYS(stty)                }, /* obsolete syscall */
+                { 0,              SCMP_SYS(swapoff)             },
+                { 0,              SCMP_SYS(swapon)              },
+                { 0,              SCMP_SYS(sysfs)               }, /* obsolete syscall */
+                { 0,              SCMP_SYS(tuxcall)             }, /* obsolete syscall */
+                { 0,              SCMP_SYS(ulimit)              }, /* obsolete syscall */
+                { 0,              SCMP_SYS(uselib)              }, /* obsolete syscall */
+                { 0,              SCMP_SYS(ustat)               }, /* obsolete syscall */
+                { 0,              SCMP_SYS(vserver)             }, /* obsolete syscall */
+                { CAP_SYSLOG,     SCMP_SYS(syslog)              },
+                { CAP_SYS_MODULE, SCMP_SYS(delete_module)       },
+                { CAP_SYS_MODULE, SCMP_SYS(finit_module)        },
+                { CAP_SYS_MODULE, SCMP_SYS(init_module)         },
+                { CAP_SYS_PACCT,  SCMP_SYS(acct)                },
+                { CAP_SYS_PTRACE, SCMP_SYS(process_vm_readv)    },
+                { CAP_SYS_PTRACE, SCMP_SYS(process_vm_writev)   },
+                { CAP_SYS_PTRACE, SCMP_SYS(ptrace)              },
+                { CAP_SYS_RAWIO,  SCMP_SYS(ioperm)              },
+                { CAP_SYS_RAWIO,  SCMP_SYS(iopl)                },
+                { CAP_SYS_RAWIO,  SCMP_SYS(pciconfig_iobase)    },
+                { CAP_SYS_RAWIO,  SCMP_SYS(pciconfig_read)      },
+                { CAP_SYS_RAWIO,  SCMP_SYS(pciconfig_write)     },
+#ifdef __NR_s390_pci_mmio_read
+                { CAP_SYS_RAWIO,  SCMP_SYS(s390_pci_mmio_read)  },
+#endif
+#ifdef __NR_s390_pci_mmio_write
+                { CAP_SYS_RAWIO,  SCMP_SYS(s390_pci_mmio_write) },
+#endif
+                { CAP_SYS_TIME,   SCMP_SYS(adjtimex)            },
+                { CAP_SYS_TIME,   SCMP_SYS(clock_adjtime)       },
+                { CAP_SYS_TIME,   SCMP_SYS(clock_settime)       },
+                { CAP_SYS_TIME,   SCMP_SYS(settimeofday)        },
+                { CAP_SYS_TIME,   SCMP_SYS(stime)               },
+        };
+
+        for (i = 0; i < ELEMENTSOF(blacklist); i++) {
+                if (blacklist[i].capability != 0 && (cap_list_retain & (1ULL << blacklist[i].capability)))
+                        continue;
+
+                r = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), blacklist[i].syscall_num, 0);
+                if (r == -EFAULT)
+                        continue; /* unknown syscall */
+                if (r < 0)
+                        return log_error_errno(r, "Failed to block syscall: %m");
+        }
+
+        return 0;
+}
+
+int setup_seccomp(uint64_t cap_list_retain) {
+        scmp_filter_ctx seccomp;
+        int r;
+
+        seccomp = seccomp_init(SCMP_ACT_ALLOW);
+        if (!seccomp)
+                return log_oom();
+
+        r = seccomp_add_secondary_archs(seccomp);
+        if (r < 0) {
+                log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
+                goto finish;
+        }
+
+        r = seccomp_add_default_syscall_filter(seccomp, cap_list_retain);
+        if (r < 0)
+                goto finish;
+
+        /*
+           Audit is broken in containers, much of the userspace audit
+           hookup will fail if running inside a container. We don't
+           care and just turn off creation of audit sockets.
+
+           This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
+           with EAFNOSUPPORT which audit userspace uses as indication
+           that audit is disabled in the kernel.
+         */
+
+        r = seccomp_rule_add(
+                        seccomp,
+                        SCMP_ACT_ERRNO(EAFNOSUPPORT),
+                        SCMP_SYS(socket),
+                        2,
+                        SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
+                        SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
+        if (r < 0) {
+                log_error_errno(r, "Failed to add audit seccomp rule: %m");
+                goto finish;
+        }
+
+        r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+        if (r < 0) {
+                log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
+                goto finish;
+        }
+
+        r = seccomp_load(seccomp);
+        if (r == -EINVAL) {
+                log_debug_errno(r, "Kernel is probably not configured with CONFIG_SECCOMP. Disabling seccomp audit filter: %m");
+                r = 0;
+                goto finish;
+        }
+        if (r < 0) {
+                log_error_errno(r, "Failed to install seccomp audit filter: %m");
+                goto finish;
+        }
+
+finish:
+        seccomp_release(seccomp);
+        return r;
+}
+
+#else
+
+int setup_seccomp(uint64_t cap_list_retain) {
+        return 0;
+}
+
+#endif
diff --git a/src/systemd-nspawn/nspawn-seccomp.h b/src/systemd-nspawn/nspawn-seccomp.h
new file mode 100644
index 0000000000..5bde16faf9
--- /dev/null
+++ b/src/systemd-nspawn/nspawn-seccomp.h
@@ -0,0 +1,24 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2016 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <sys/types.h>
+
+int setup_seccomp(uint64_t cap_list_retain);
diff --git a/src/systemd-nspawn/nspawn-settings.h b/src/systemd-nspawn/nspawn-settings.h
index 95e70d5fa4..8a88647df2 100644
--- a/src/systemd-nspawn/nspawn-settings.h
+++ b/src/systemd-nspawn/nspawn-settings.h
@@ -57,7 +57,8 @@ typedef enum SettingsMask {
         SETTING_CUSTOM_MOUNTS     = 1 << 11,
         SETTING_WORKING_DIRECTORY = 1 << 12,
         SETTING_USERNS            = 1 << 13,
-        _SETTINGS_MASK_ALL        = (1 << 14) -1
+        SETTING_NOTIFY_READY      = 1 << 14,
+        _SETTINGS_MASK_ALL        = (1 << 15) -1
 } SettingsMask;
 
 typedef struct Settings {
@@ -74,6 +75,7 @@ typedef struct Settings {
         char *working_directory;
         UserNamespaceMode userns_mode;
         uid_t uid_shift, uid_range;
+        bool notify_ready;
 
         /* [Image] */
         int read_only;
diff --git a/src/systemd-nspawn/nspawn-setuid.c b/src/systemd-nspawn/nspawn-setuid.c
index 38ca9e2e24..360781c24c 100644
--- a/src/systemd-nspawn/nspawn-setuid.c
+++ b/src/systemd-nspawn/nspawn-setuid.c
@@ -125,14 +125,12 @@ int change_uid_gid(const char *user, char **_home) {
         fd = -1;
 
         if (!fgets(line, sizeof(line), f)) {
-
                 if (!ferror(f)) {
                         log_error("Failed to resolve user %s.", user);
                         return -ESRCH;
                 }
 
-                log_error_errno(errno, "Failed to read from getent: %m");
-                return -errno;
+                return log_error_errno(errno, "Failed to read from getent: %m");
         }
 
         truncate_nl(line);
@@ -215,8 +213,7 @@ int change_uid_gid(const char *user, char **_home) {
                         return -ESRCH;
                 }
 
-                log_error_errno(errno, "Failed to read from getent: %m");
-                return -errno;
+                return log_error_errno(errno, "Failed to read from getent: %m");
         }
 
         truncate_nl(line);
diff --git a/src/systemd-nspawn/nspawn.c b/src/systemd-nspawn/nspawn.c
index 5537a526f0..fb25ec7afa 100644
--- a/src/systemd-nspawn/nspawn.c
+++ b/src/systemd-nspawn/nspawn.c
@@ -27,9 +27,6 @@
 #include <sched.h>
 
 #include <linux/loop.h>
-#ifdef HAVE_SECCOMP
-#include <seccomp.h>
-#endif
 #ifdef HAVE_SELINUX
 #include <selinux/selinux.h>
 #endif
@@ -57,7 +54,6 @@
 #include "basic/copy.h"
 #include "basic/env-util.h"
 #include "basic/fd-util.h"
-#include "basic/fdset.h"
 #include "basic/fileio.h"
 #include "basic/formats-util.h"
 #include "basic/fs-util.h"
@@ -71,45 +67,39 @@
 #include "basic/path-util.h"
 #include "basic/process-util.h"
 #include "basic/random-util.h"
+#include "basic/raw-clone.h"
 #include "basic/rm-rf.h"
 #include "shared/base-filesystem.h"
 #include "shared/dev-setup.h"
+#include "shared/fdset.h"
 #include "shared/gpt.h"
 #include "shared/machine-image.h"
 #include "shared/ptyfwd.h"
+#include "shared/udev-util.h"
 
 #include "loopback-setup.h"
-#include "machine-id-setup.h"
 #include "nspawn-cgroup.h"
 #include "nspawn-expose-ports.h"
 #include "nspawn-mount.h"
 #include "nspawn-network.h"
 #include "nspawn-patch-uid.h"
 #include "nspawn-register.h"
+#include "nspawn-seccomp.h"
 #include "nspawn-settings.h"
 #include "nspawn-setuid.h"
 #include "nspawn-stub-pid1.h"
-#ifdef HAVE_SECCOMP
-#include "shared/seccomp-util.h"
-#endif
-#include "basic/selinux-util.h"
-#include "basic/signal-util.h"
-#include "basic/socket-util.h"
-#include "basic/stat-util.h"
-#include "basic/stdio-util.h"
-#include "basic/string-util.h"
-#include "basic/strv.h"
-#include "basic/terminal-util.h"
-#include "basic/umask-util.h"
-#include "basic/user-util.h"
-#include "basic/util.h"
-#include "shared/udev-util.h"
 
 /* Note that devpts's gid= parameter parses GIDs as signed values, hence we stay away from the upper half of the 32bit
- * UID range here */
+ * UID range here. We leave a bit of room at the lower end and a lot of room at the upper end, so that other subsystems
+ * may have their own allocation ranges too. */
 #define UID_SHIFT_PICK_MIN ((uid_t) UINT32_C(0x00080000))
 #define UID_SHIFT_PICK_MAX ((uid_t) UINT32_C(0x6FFF0000))
 
+/* nspawn is listening on the socket at the path in the constant nspawn_notify_socket_path
+ * nspawn_notify_socket_path is relative to the container
+ * the init process in the container pid can send messages to nspawn following the sd_notify(3) protocol */
+#define NSPAWN_NOTIFY_SOCKET_PATH "/run/systemd/nspawn/notify"
+
 typedef enum ContainerStatus {
         CONTAINER_TERMINATED,
         CONTAINER_REBOOTED
@@ -137,7 +127,9 @@ static StartMode arg_start_mode = START_PID1;
 static bool arg_ephemeral = false;
 static LinkJournal arg_link_journal = LINK_AUTO;
 static bool arg_link_journal_try = false;
-static uint64_t arg_retain =
+static uint64_t arg_caps_retain =
+        (1ULL << CAP_AUDIT_CONTROL) |
+        (1ULL << CAP_AUDIT_WRITE) |
         (1ULL << CAP_CHOWN) |
         (1ULL << CAP_DAC_OVERRIDE) |
         (1ULL << CAP_DAC_READ_SEARCH) |
@@ -147,23 +139,21 @@ static uint64_t arg_retain =
         (1ULL << CAP_KILL) |
         (1ULL << CAP_LEASE) |
         (1ULL << CAP_LINUX_IMMUTABLE) |
+        (1ULL << CAP_MKNOD) |
         (1ULL << CAP_NET_BIND_SERVICE) |
         (1ULL << CAP_NET_BROADCAST) |
         (1ULL << CAP_NET_RAW) |
-        (1ULL << CAP_SETGID) |
         (1ULL << CAP_SETFCAP) |
+        (1ULL << CAP_SETGID) |
         (1ULL << CAP_SETPCAP) |
         (1ULL << CAP_SETUID) |
         (1ULL << CAP_SYS_ADMIN) |
+        (1ULL << CAP_SYS_BOOT) |
         (1ULL << CAP_SYS_CHROOT) |
         (1ULL << CAP_SYS_NICE) |
         (1ULL << CAP_SYS_PTRACE) |
-        (1ULL << CAP_SYS_TTY_CONFIG) |
         (1ULL << CAP_SYS_RESOURCE) |
-        (1ULL << CAP_SYS_BOOT) |
-        (1ULL << CAP_AUDIT_WRITE) |
-        (1ULL << CAP_AUDIT_CONTROL) |
-        (1ULL << CAP_MKNOD);
+        (1ULL << CAP_SYS_TTY_CONFIG);
 static CustomMount *arg_custom_mounts = NULL;
 static unsigned arg_n_custom_mounts = 0;
 static char **arg_setenv = NULL;
@@ -192,6 +182,7 @@ static SettingsMask arg_settings_mask = 0;
 static int arg_settings_trusted = -1;
 static char **arg_parameters = NULL;
 static const char *arg_container_service_name = "systemd-nspawn";
+static bool arg_notify_ready = false;
 
 static void help(void) {
         printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
@@ -272,10 +263,11 @@ static void help(void) {
                "                            the service unit nspawn is running in\n"
                "     --volatile[=MODE]      Run the system in volatile mode\n"
                "     --settings=BOOLEAN     Load additional settings from .nspawn file\n"
+               "     --notify-ready=BOOLEAN Receive notifications from the container's init process,\n"
+               "                            accepted values: yes and no\n"
                , program_invocation_short_name);
 }
 
-
 static int custom_mounts_prepare(void) {
         unsigned i;
         int r;
@@ -372,6 +364,7 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_SETTINGS,
                 ARG_CHDIR,
                 ARG_PRIVATE_USERS_CHOWN,
+                ARG_NOTIFY_READY,
         };
 
         static const struct option options[] = {
@@ -420,6 +413,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "kill-signal",           required_argument, NULL, ARG_KILL_SIGNAL       },
                 { "settings",              required_argument, NULL, ARG_SETTINGS          },
                 { "chdir",                 required_argument, NULL, ARG_CHDIR             },
+                { "notify-ready",          required_argument, NULL, ARG_NOTIFY_READY      },
                 {}
         };
 
@@ -589,9 +583,12 @@ static int parse_argv(int argc, char *argv[]) {
 
                 case ARG_UUID:
                         r = sd_id128_from_string(optarg, &arg_uuid);
-                        if (r < 0) {
-                                log_error("Invalid UUID: %s", optarg);
-                                return r;
+                        if (r < 0)
+                                return log_error_errno(r, "Invalid UUID: %s", optarg);
+
+                        if (sd_id128_is_null(arg_uuid)) {
+                                log_error("Machine UUID may not be all zeroes.");
+                                return -EINVAL;
                         }
 
                         arg_settings_mask |= SETTING_MACHINE_ID;
@@ -992,6 +989,16 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_settings_mask |= SETTING_WORKING_DIRECTORY;
                         break;
 
+                case ARG_NOTIFY_READY:
+                        r = parse_boolean(optarg);
+                        if (r < 0) {
+                                log_error("%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
+                                return -EINVAL;
+                        }
+                        arg_notify_ready = r;
+                        arg_settings_mask |= SETTING_NOTIFY_READY;
+                        break;
+
                 case '?':
                         return -EINVAL;
 
@@ -1076,7 +1083,7 @@ static int parse_argv(int argc, char *argv[]) {
         if (mask_all_settings)
                 arg_settings_mask = _SETTINGS_MASK_ALL;
 
-        arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
+        arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
 
         r = detect_unified_cgroup_hierarchy();
         if (r < 0)
@@ -1251,20 +1258,9 @@ static int setup_resolv_conf(const char *dest) {
         return 0;
 }
 
-static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
-        assert(s);
-
-        snprintf(s, 37,
-                 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-                 SD_ID128_FORMAT_VAL(id));
-
-        return s;
-}
-
 static int setup_boot_id(const char *dest) {
+        sd_id128_t rnd = SD_ID128_NULL;
         const char *from, *to;
-        sd_id128_t rnd = {};
-        char as_uuid[37];
         int r;
 
         if (arg_share_system)
@@ -1280,18 +1276,16 @@ static int setup_boot_id(const char *dest) {
         if (r < 0)
                 return log_error_errno(r, "Failed to generate random boot id: %m");
 
-        id128_format_as_uuid(rnd, as_uuid);
-
-        r = write_string_file(from, as_uuid, WRITE_STRING_FILE_CREATE);
+        r = id128_write(from, ID128_UUID, rnd, false);
         if (r < 0)
                 return log_error_errno(r, "Failed to write boot id: %m");
 
         if (mount(from, to, NULL, MS_BIND, NULL) < 0)
                 r = log_error_errno(errno, "Failed to bind mount boot id: %m");
         else if (mount(NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL) < 0)
-                log_warning_errno(errno, "Failed to make boot id read-only: %m");
+                log_warning_errno(errno, "Failed to make boot id read-only, ignoring: %m");
 
-        unlink(from);
+        (void) unlink(from);
         return r;
 }
 
@@ -1633,7 +1627,7 @@ static int setup_journal(const char *directory) {
 }
 
 static int drop_capabilities(void) {
-        return capability_bounding_set_drop(arg_retain, false);
+        return capability_bounding_set_drop(arg_caps_retain, false);
 }
 
 static int reset_audit_loginuid(void) {
@@ -1668,99 +1662,6 @@ static int reset_audit_loginuid(void) {
         return 0;
 }
 
-static int setup_seccomp(void) {
-
-#ifdef HAVE_SECCOMP
-        static const struct {
-                uint64_t capability;
-                int syscall_num;
-        } blacklist[] = {
-                { CAP_SYS_RAWIO,  SCMP_SYS(iopl)              },
-                { CAP_SYS_RAWIO,  SCMP_SYS(ioperm)            },
-                { CAP_SYS_BOOT,   SCMP_SYS(kexec_load)        },
-                { CAP_SYS_ADMIN,  SCMP_SYS(swapon)            },
-                { CAP_SYS_ADMIN,  SCMP_SYS(swapoff)           },
-                { CAP_SYS_ADMIN,  SCMP_SYS(open_by_handle_at) },
-                { CAP_SYS_MODULE, SCMP_SYS(init_module)       },
-                { CAP_SYS_MODULE, SCMP_SYS(finit_module)      },
-                { CAP_SYS_MODULE, SCMP_SYS(delete_module)     },
-                { CAP_SYSLOG,     SCMP_SYS(syslog)            },
-        };
-
-        scmp_filter_ctx seccomp;
-        unsigned i;
-        int r;
-
-        seccomp = seccomp_init(SCMP_ACT_ALLOW);
-        if (!seccomp)
-                return log_oom();
-
-        r = seccomp_add_secondary_archs(seccomp);
-        if (r < 0) {
-                log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
-                goto finish;
-        }
-
-        for (i = 0; i < ELEMENTSOF(blacklist); i++) {
-                if (arg_retain & (1ULL << blacklist[i].capability))
-                        continue;
-
-                r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i].syscall_num, 0);
-                if (r == -EFAULT)
-                        continue; /* unknown syscall */
-                if (r < 0) {
-                        log_error_errno(r, "Failed to block syscall: %m");
-                        goto finish;
-                }
-        }
-
-        /*
-           Audit is broken in containers, much of the userspace audit
-           hookup will fail if running inside a container. We don't
-           care and just turn off creation of audit sockets.
-
-           This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
-           with EAFNOSUPPORT which audit userspace uses as indication
-           that audit is disabled in the kernel.
-         */
-
-        r = seccomp_rule_add(
-                        seccomp,
-                        SCMP_ACT_ERRNO(EAFNOSUPPORT),
-                        SCMP_SYS(socket),
-                        2,
-                        SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
-                        SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
-        if (r < 0) {
-                log_error_errno(r, "Failed to add audit seccomp rule: %m");
-                goto finish;
-        }
-
-        r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
-        if (r < 0) {
-                log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
-                goto finish;
-        }
-
-        r = seccomp_load(seccomp);
-        if (r == -EINVAL) {
-                log_debug_errno(r, "Kernel is probably not configured with CONFIG_SECCOMP. Disabling seccomp audit filter: %m");
-                r = 0;
-                goto finish;
-        }
-        if (r < 0) {
-                log_error_errno(r, "Failed to install seccomp audit filter: %m");
-                goto finish;
-        }
-
-finish:
-        seccomp_release(seccomp);
-        return r;
-#else
-        return 0;
-#endif
-
-}
 
 static int setup_propagate(const char *root) {
         const char *p, *q;
@@ -2310,33 +2211,37 @@ static int mount_device(const char *what, const char *where, const char *directo
 }
 
 static int setup_machine_id(const char *directory) {
+        const char *etc_machine_id;
+        sd_id128_t id;
         int r;
-        const char *etc_machine_id, *t;
-        _cleanup_free_ char *s = NULL;
 
-        etc_machine_id = prefix_roota(directory, "/etc/machine-id");
+        /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
+         * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
+         * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
+         * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
+         * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
+         * container behaves nicely). */
 
-        r = read_one_line_file(etc_machine_id, &s);
-        if (r < 0)
-                return log_error_errno(r, "Failed to read machine ID from %s: %m", etc_machine_id);
+        etc_machine_id = prefix_roota(directory, "/etc/machine-id");
 
-        t = strstrip(s);
+        r = id128_read(etc_machine_id, ID128_PLAIN, &id);
+        if (r < 0) {
+                if (!IN_SET(r, -ENOENT, -ENOMEDIUM)) /* If the file is missing or empty, we don't mind */
+                        return log_error_errno(r, "Failed to read machine ID from container image: %m");
 
-        if (!isempty(t)) {
-                r = sd_id128_from_string(t, &arg_uuid);
-                if (r < 0)
-                        return log_error_errno(r, "Failed to parse machine ID from %s: %m", etc_machine_id);
-        } else {
                 if (sd_id128_is_null(arg_uuid)) {
                         r = sd_id128_randomize(&arg_uuid);
                         if (r < 0)
-                                return log_error_errno(r, "Failed to generate random machine ID: %m");
+                                return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
+                }
+        } else {
+                if (sd_id128_is_null(id)) {
+                        log_error("Machine ID in container image is zero, refusing.");
+                        return -EINVAL;
                 }
-        }
 
-        r = machine_id_setup(directory, arg_uuid);
-        if (r < 0)
-                return log_error_errno(r, "Failed to setup machine ID: %m");
+                arg_uuid = id;
+        }
 
         return 0;
 }
@@ -2447,10 +2352,9 @@ static int wait_for_container(pid_t pid, ContainerStatus *container) {
         switch (status.si_code) {
 
         case CLD_EXITED:
-                if (status.si_status == 0) {
+                if (status.si_status == 0)
                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
-
-                } else
+                else
                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
 
                 *container = CONTAINER_TERMINATED;
@@ -2458,13 +2362,11 @@ static int wait_for_container(pid_t pid, ContainerStatus *container) {
 
         case CLD_KILLED:
                 if (status.si_status == SIGINT) {
-
                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
                         *container = CONTAINER_TERMINATED;
                         return 0;
 
                 } else if (status.si_status == SIGHUP) {
-
                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
                         *container = CONTAINER_REBOOTED;
                         return 0;
@@ -2480,8 +2382,6 @@ static int wait_for_container(pid_t pid, ContainerStatus *container) {
                 log_error("Container %s failed due to unknown reason.", arg_machine);
                 return -EIO;
         }
-
-        return r;
 }
 
 static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
@@ -2632,6 +2532,7 @@ static int inner_child(
                 NULL, /* container_uuid */
                 NULL, /* LISTEN_FDS */
                 NULL, /* LISTEN_PID */
+                NULL, /* NOTIFY_SOCKET */
                 NULL
         };
 
@@ -2725,7 +2626,7 @@ static int inner_child(
 
 #ifdef HAVE_SELINUX
         if (arg_selinux_context)
-                if (setexeccon((security_context_t) arg_selinux_context) < 0)
+                if (setexeccon(arg_selinux_context) < 0)
                         return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
 #endif
 
@@ -2745,9 +2646,9 @@ static int inner_child(
             (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0))
                 return log_oom();
 
-        assert(!sd_id128_equal(arg_uuid, SD_ID128_NULL));
+        assert(!sd_id128_is_null(arg_uuid));
 
-        if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0)
+        if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_to_uuid_string(arg_uuid, as_uuid)) < 0)
                 return log_oom();
 
         if (fdset_size(fds) > 0) {
@@ -2759,6 +2660,8 @@ static int inner_child(
                     (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0))
                         return log_oom();
         }
+        if (asprintf((char **)(envp + n_env++), "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
+                return log_oom();
 
         env_use = strv_env_merge(2, envp, arg_setenv);
         if (!env_use)
@@ -2828,6 +2731,37 @@ static int inner_child(
         return log_error_errno(r, "execv() failed: %m");
 }
 
+static int setup_sd_notify_child(void) {
+        static const int one = 1;
+        int fd = -1;
+        union sockaddr_union sa = {
+                .sa.sa_family = AF_UNIX,
+        };
+        int r;
+
+        fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
+        if (fd < 0)
+                return log_error_errno(errno, "Failed to allocate notification socket: %m");
+
+        (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
+        (void) unlink(NSPAWN_NOTIFY_SOCKET_PATH);
+
+        strncpy(sa.un.sun_path, NSPAWN_NOTIFY_SOCKET_PATH, sizeof(sa.un.sun_path)-1);
+        r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
+        if (r < 0) {
+                safe_close(fd);
+                return log_error_errno(errno, "bind(%s) failed: %m", sa.un.sun_path);
+        }
+
+        r = setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one));
+        if (r < 0) {
+                safe_close(fd);
+                return log_error_errno(errno, "SO_PASSCRED failed: %m");
+        }
+
+        return fd;
+}
+
 static int outer_child(
                 Barrier *barrier,
                 const char *directory,
@@ -2839,6 +2773,7 @@ static int outer_child(
                 bool secondary,
                 int pid_socket,
                 int uuid_socket,
+                int notify_socket,
                 int kmsg_socket,
                 int rtnl_socket,
                 int uid_shift_socket,
@@ -2847,12 +2782,14 @@ static int outer_child(
         pid_t pid;
         ssize_t l;
         int r;
+        _cleanup_close_ int fd = -1;
 
         assert(barrier);
         assert(directory);
         assert(console);
         assert(pid_socket >= 0);
         assert(uuid_socket >= 0);
+        assert(notify_socket >= 0);
         assert(kmsg_socket >= 0);
 
         cg_unified_flush();
@@ -2920,7 +2857,7 @@ static int outer_child(
                         if (l < 0)
                                 return log_error_errno(errno, "Failed to recv UID shift: %m");
                         if (l != sizeof(arg_uid_shift)) {
-                                log_error("Short read while recieving UID shift.");
+                                log_error("Short read while receiving UID shift.");
                                 return -EIO;
                         }
                 }
@@ -2994,7 +2931,7 @@ static int outer_child(
         if (r < 0)
                 return r;
 
-        r = setup_seccomp();
+        r = setup_seccomp(arg_caps_retain);
         if (r < 0)
                 return r;
 
@@ -3039,16 +2976,20 @@ static int outer_child(
         if (r < 0)
                 return log_error_errno(r, "Failed to move root directory: %m");
 
+        fd = setup_sd_notify_child();
+        if (fd < 0)
+                return fd;
+
         pid = raw_clone(SIGCHLD|CLONE_NEWNS|
                         (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS) |
                         (arg_private_network ? CLONE_NEWNET : 0) |
-                        (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0),
-                        NULL);
+                        (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
         if (pid < 0)
                 return log_error_errno(errno, "Failed to fork inner child: %m");
         if (pid == 0) {
                 pid_socket = safe_close(pid_socket);
                 uuid_socket = safe_close(uuid_socket);
+                notify_socket = safe_close(notify_socket);
                 uid_shift_socket = safe_close(uid_shift_socket);
 
                 /* The inner child has all namespaces that are
@@ -3078,8 +3019,13 @@ static int outer_child(
                 return -EIO;
         }
 
+        l = send_one_fd(notify_socket, fd, 0);
+        if (l < 0)
+                return log_error_errno(errno, "Failed to send notify fd: %m");
+
         pid_socket = safe_close(pid_socket);
         uuid_socket = safe_close(uuid_socket);
+        notify_socket = safe_close(notify_socket);
         kmsg_socket = safe_close(kmsg_socket);
         rtnl_socket = safe_close(rtnl_socket);
 
@@ -3162,6 +3108,95 @@ static int setup_uid_map(pid_t pid) {
         return 0;
 }
 
+static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
+        char buf[NOTIFY_BUFFER_MAX+1];
+        char *p = NULL;
+        struct iovec iovec = {
+                .iov_base = buf,
+                .iov_len = sizeof(buf)-1,
+        };
+        union {
+                struct cmsghdr cmsghdr;
+                uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
+                            CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)];
+        } control = {};
+        struct msghdr msghdr = {
+                .msg_iov = &iovec,
+                .msg_iovlen = 1,
+                .msg_control = &control,
+                .msg_controllen = sizeof(control),
+        };
+        struct cmsghdr *cmsg;
+        struct ucred *ucred = NULL;
+        ssize_t n;
+        pid_t inner_child_pid;
+        _cleanup_strv_free_ char **tags = NULL;
+
+        assert(userdata);
+
+        inner_child_pid = PTR_TO_PID(userdata);
+
+        if (revents != EPOLLIN) {
+                log_warning("Got unexpected poll event for notify fd.");
+                return 0;
+        }
+
+        n = recvmsg(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
+        if (n < 0) {
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
+                return log_warning_errno(errno, "Couldn't read notification socket: %m");
+        }
+        cmsg_close_all(&msghdr);
+
+        CMSG_FOREACH(cmsg, &msghdr) {
+                if (cmsg->cmsg_level == SOL_SOCKET &&
+                           cmsg->cmsg_type == SCM_CREDENTIALS &&
+                           cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
+
+                        ucred = (struct ucred*) CMSG_DATA(cmsg);
+                }
+        }
+
+        if (!ucred || ucred->pid != inner_child_pid) {
+                log_warning("Received notify message without valid credentials. Ignoring.");
+                return 0;
+        }
+
+        if ((size_t) n >= sizeof(buf)) {
+                log_warning("Received notify message exceeded maximum size. Ignoring.");
+                return 0;
+        }
+
+        buf[n] = 0;
+        tags = strv_split(buf, "\n\r");
+        if (!tags)
+                return log_oom();
+
+        if (strv_find(tags, "READY=1"))
+                sd_notifyf(false, "READY=1\n");
+
+        p = strv_find_startswith(tags, "STATUS=");
+        if (p)
+                sd_notifyf(false, "STATUS=Container running: %s", p);
+
+        return 0;
+}
+
+static int setup_sd_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid) {
+        int r;
+        sd_event_source *notify_event_source;
+
+        r = sd_event_add_io(event, &notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
+        if (r < 0)
+                return log_error_errno(r, "Failed to allocate notify event source: %m");
+
+        (void) sd_event_source_set_description(notify_event_source, "nspawn-notify");
+
+        return 0;
+}
+
 static int load_settings(void) {
         _cleanup_(settings_freep) Settings *settings = NULL;
         _cleanup_fclose_ FILE *f = NULL;
@@ -3278,9 +3313,9 @@ static int load_settings(void) {
                         if (settings->capability != 0)
                                 log_warning("Ignoring Capability= setting, file %s is not trusted.", p);
                 } else
-                        arg_retain |= plus;
+                        arg_caps_retain |= plus;
 
-                arg_retain &= ~settings->drop_capability;
+                arg_caps_retain &= ~settings->drop_capability;
         }
 
         if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
@@ -3390,6 +3425,9 @@ static int load_settings(void) {
                 }
         }
 
+        if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0)
+                arg_notify_ready = settings->notify_ready;
+
         return 0;
 }
 
@@ -3504,7 +3542,7 @@ int main(int argc, char *argv[]) {
                         }
                         if (r < 0) {
                                 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
-                                return r;
+                                goto finish;
                         }
 
                         if (arg_template) {
@@ -3640,7 +3678,9 @@ int main(int argc, char *argv[]) {
                         rtnl_socket_pair[2] = { -1, -1 },
                         pid_socket_pair[2] = { -1, -1 },
                         uuid_socket_pair[2] = { -1, -1 },
+                        notify_socket_pair[2] = { -1, -1 },
                         uid_shift_socket_pair[2] = { -1, -1 };
+                _cleanup_close_ int notify_socket= -1;
                 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
                 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
                 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
@@ -3691,6 +3731,11 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
+                if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, notify_socket_pair) < 0) {
+                        r = log_error_errno(errno, "Failed to create notify socket pair: %m");
+                        goto finish;
+                }
+
                 if (arg_userns_mode != USER_NAMESPACE_NO)
                         if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0) {
                                 r = log_error_errno(errno, "Failed to create uid shift socket pair: %m");
@@ -3712,7 +3757,7 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
-                pid = raw_clone(SIGCHLD|CLONE_NEWNS, NULL);
+                pid = raw_clone(SIGCHLD|CLONE_NEWNS);
                 if (pid < 0) {
                         if (errno == EINVAL)
                                 r = log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
@@ -3732,6 +3777,7 @@ int main(int argc, char *argv[]) {
                         rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
                         pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
                         uuid_socket_pair[0] = safe_close(uuid_socket_pair[0]);
+                        notify_socket_pair[0] = safe_close(notify_socket_pair[0]);
                         uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
 
                         (void) reset_all_signal_handlers();
@@ -3747,6 +3793,7 @@ int main(int argc, char *argv[]) {
                                         secondary,
                                         pid_socket_pair[1],
                                         uuid_socket_pair[1],
+                                        notify_socket_pair[1],
                                         kmsg_socket_pair[1],
                                         rtnl_socket_pair[1],
                                         uid_shift_socket_pair[1],
@@ -3765,6 +3812,7 @@ int main(int argc, char *argv[]) {
                 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
                 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
                 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
+                notify_socket_pair[1] = safe_close(notify_socket_pair[1]);
                 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
 
                 if (arg_userns_mode != USER_NAMESPACE_NO) {
@@ -3838,6 +3886,13 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
+                /* We also retrieve the socket used for notifications generated by outer child */
+                notify_socket = receive_one_fd(notify_socket_pair[0], 0);
+                if (notify_socket < 0) {
+                        r = log_error_errno(errno, "Failed to receive notification socket from the outer child: %m");
+                        goto finish;
+                }
+
                 log_debug("Init process invoked as PID " PID_FMT, pid);
 
                 if (arg_userns_mode != USER_NAMESPACE_NO) {
@@ -3952,6 +4007,16 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
+                r = sd_event_new(&event);
+                if (r < 0) {
+                        log_error_errno(r, "Failed to get default event source: %m");
+                        goto finish;
+                }
+
+                r = setup_sd_notify_parent(event, notify_socket, PID_TO_PTR(pid));
+                if (r < 0)
+                        goto finish;
+
                 /* Let the child know that we are ready and wait that the child is completely ready now. */
                 if (!barrier_place_and_sync(&barrier)) { /* #4 */
                         log_error("Child died too early.");
@@ -3964,15 +4029,10 @@ int main(int argc, char *argv[]) {
                 etc_passwd_lock = safe_close(etc_passwd_lock);
 
                 sd_notifyf(false,
-                           "READY=1\n"
                            "STATUS=Container running.\n"
                            "X_NSPAWN_LEADER_PID=" PID_FMT, pid);
-
-                r = sd_event_new(&event);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to get default event source: %m");
-                        goto finish;
-                }
+                if (!arg_notify_ready)
+                        sd_notify(false, "READY=1\n");
 
                 if (arg_kill_signal > 0) {
                         /* Try to kill the init system on SIGINT or SIGTERM */
diff --git a/src/systemd-nspawn/systemd-nspawn.completion.bash b/src/systemd-nspawn/systemd-nspawn.completion.bash
index 0cf249d8ce..ea4a5e1f43 100644
--- a/src/systemd-nspawn/systemd-nspawn.completion.bash
+++ b/src/systemd-nspawn/systemd-nspawn.completion.bash
@@ -60,7 +60,8 @@ _systemd_nspawn() {
                       [ARG]='-D --directory -u --user --uuid --capability --drop-capability --link-journal --bind --bind-ro -M --machine
                              -S --slice --setenv -Z --selinux-context -L --selinux-apifs-context --register --network-interface --network-bridge
                              --personality -i --image --tmpfs --volatile
-                             --network-macvlan --kill-signal --template'
+                             --network-macvlan --kill-signal --template
+                             --notify-ready'
         )
 
         _init_completion || return
@@ -139,6 +140,10 @@ _systemd_nspawn() {
                                 _signals
                                 return
                         ;;
+                        --notify-ready)
+                                comps='yes no'
+                                return
+                        ;;
                 esac
                 COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
                 return 0
diff --git a/src/systemd-nspawn/systemd-nspawn.completion.zsh b/src/systemd-nspawn/systemd-nspawn.completion.zsh
index 3e0f667909..77b2e7cd7c 100644
--- a/src/systemd-nspawn/systemd-nspawn.completion.zsh
+++ b/src/systemd-nspawn/systemd-nspawn.completion.zsh
@@ -46,4 +46,5 @@ _arguments \
     '--keep-unit[Instead of creating a transient scope unit to run the container in, simply register the service or scope unit systemd-nspawn has been invoked in with systemd-machined(8).]' \
     '--personality=[Control the architecture ("personality") reported by uname(2) in the container.]:architecture:(x86 x86-64)' \
     '--volatile=[Run the system in volatile mode.]:volatile:(no yes state)' \
+    "--notify-ready=[Control when the ready notification is sent]:options:(yes no)" \
     '*:: : _normal'
diff --git a/src/systemd-nspawn/systemd-nspawn.tmpfiles b/src/systemd-nspawn/systemd-nspawn.tmpfiles
index 9fa3878d6b..78bd1c670e 100644
--- a/src/systemd-nspawn/systemd-nspawn.tmpfiles
+++ b/src/systemd-nspawn/systemd-nspawn.tmpfiles
@@ -10,7 +10,7 @@
 Q /var/lib/machines 0700 - - -
 
 # Remove old temporary snapshots, but only at boot. Ideally we'd have
-# "self-destroying" btrfs snapshots that go away if the last last
+# "self-destroying" btrfs snapshots that go away if the last
 # reference to it does. To mimic a scheme like this at least remove
 # the old snapshots on fresh boots, where we know they cannot be
 # referenced anymore. Note that we actually remove all temporary files
diff --git a/src/systemd-nspawn/systemd-nspawn.xml b/src/systemd-nspawn/systemd-nspawn.xml
index 476cc2932f..69d2f6ff7d 100644
--- a/src/systemd-nspawn/systemd-nspawn.xml
+++ b/src/systemd-nspawn/systemd-nspawn.xml
@@ -67,69 +67,80 @@
   <refsect1>
     <title>Description</title>
 
-    <para><command>systemd-nspawn</command> may be used to run a
-    command or OS in a light-weight namespace container. In many ways
-    it is similar to
-    <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-    but more powerful since it fully virtualizes the file system
-    hierarchy, as well as the process tree, the various IPC subsystems
-    and the host and domain name.</para>
-
-    <para><command>systemd-nspawn</command> limits access to various
-    kernel interfaces in the container to read-only, such as
-    <filename>/sys</filename>, <filename>/proc/sys</filename> or
-    <filename>/sys/fs/selinux</filename>. Network interfaces and the
-    system clock may not be changed from within the container. Device
-    nodes may not be created. The host system cannot be rebooted and
-    kernel modules may not be loaded from within the container.</para>
-
-    <para>Note that even though these security precautions are taken
-    <command>systemd-nspawn</command> is not suitable for fully secure
-    container setups. Many of the security features may be
-    circumvented and are hence primarily useful to avoid accidental
-    changes to the host system from the container.</para>
-
-    <para>In contrast to
-    <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
-    may be used to boot full Linux-based operating systems in a
+    <para><command>systemd-nspawn</command> may be used to run a command or OS in a light-weight namespace
+    container. In many ways it is similar to <citerefentry
+    project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>, but more powerful
+    since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and
+    the host and domain name.</para>
+
+    <para><command>systemd-nspawn</command> may be invoked on any directory tree containing an operating system tree,
+    using the <option>--directory=</option> command line option. By using the <option>--machine=</option> option an OS
+    tree is automatically searched for in a couple of locations, most importantly in
+    <filename>/var/lib/machines</filename>, the suggested directory to place container images installed on the
+    system.</para>
+
+    <para>In contrast to <citerefentry
+    project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
+    may be used to boot full Linux-based operating systems in a container.</para>
+
+    <para><command>systemd-nspawn</command> limits access to various kernel interfaces in the container to read-only,
+    such as <filename>/sys</filename>, <filename>/proc/sys</filename> or <filename>/sys/fs/selinux</filename>. The
+    host's network interfaces and the system clock may not be changed from within the container. Device nodes may not
+    be created. The host system cannot be rebooted and kernel modules may not be loaded from within the
     container.</para>
 
-    <para>Use a tool like
-    <citerefentry project='mankier'><refentrytitle>dnf</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry project='die-net'><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    or
-    <citerefentry project='archlinux'><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-    to set up an OS directory tree suitable as file system hierarchy
-    for <command>systemd-nspawn</command> containers.</para>
-
-    <para>Note that <command>systemd-nspawn</command> will mount file
-    systems private to the container to <filename>/dev</filename>,
-    <filename>/run</filename> and similar. These will not be visible
-    outside of the container, and their contents will be lost when the
-    container exits.</para>
-
-    <para>Note that running two <command>systemd-nspawn</command>
-    containers from the same directory tree will not make processes in
-    them see each other. The PID namespace separation of the two
-    containers is complete and the containers will share very few
-    runtime objects except for the underlying file system. Use
-    <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
-    <command>login</command> command to request an additional login
-    prompt in a running container.</para>
-
-    <para><command>systemd-nspawn</command> implements the
-    <ulink
-    url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
-    Interface</ulink> specification.</para>
-
-    <para>As a safety check <command>systemd-nspawn</command> will
-    verify the existence of <filename>/usr/lib/os-release</filename>
-    or <filename>/etc/os-release</filename> in the container tree
-    before starting the container (see
-    <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
-    It might be necessary to add this file to the container tree
-    manually if the OS of the container is too old to contain this
+    <para>Use a tool like <citerefentry
+    project='mankier'><refentrytitle>dnf</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry
+    project='die-net'><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>, or
+    <citerefentry project='archlinux'><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry> to
+    set up an OS directory tree suitable as file system hierarchy for <command>systemd-nspawn</command> containers. See
+    the Examples section below for details on suitable invocation of these commands.</para>
+
+    <para>As a safety check <command>systemd-nspawn</command> will verify the existence of
+    <filename>/usr/lib/os-release</filename> or <filename>/etc/os-release</filename> in the container tree before
+    starting the container (see
+    <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>).  It might be
+    necessary to add this file to the container tree manually if the OS of the container is too old to contain this
     file out-of-the-box.</para>
+
+    <para><command>systemd-nspawn</command> may be invoked directly from the interactive command line or run as system
+    service in the background. In this mode each container instance runs as its own service instance; a default
+    template unit file <filename>systemd-nspawn@.service</filename> is provided to make this easy, taking the container
+    name as instance identifier. Note that different default options apply when <command>systemd-nspawn</command> is
+    invoked by the template unit file than interactively on the command line. Most importantly the template unit file
+    makes use of the <option>--boot</option> which is not the default in case <command>systemd-nspawn</command> is
+    invoked from the interactive command line. Further differences with the defaults are documented along with the
+    various supported options below.</para>
+
+    <para>The <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry> tool may
+    be used to execute a number of operations on containers. In particular it provides easy-to-use commands to run
+    containers as system services using the <filename>systemd-nspawn@.service</filename> template unit
+    file.</para>
+
+    <para>Along with each container a settings file with the <filename>.nspawn</filename> suffix may exist, containing
+    additional settings to apply when running the container. See
+    <citerefentry><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
+    details. Settings files override the default options used by the <filename>systemd-nspawn@.service</filename>
+    template unit file, making it usually unnecessary to alter this template file directly.</para>
+
+    <para>Note that <command>systemd-nspawn</command> will mount file systems private to the container to
+    <filename>/dev</filename>, <filename>/run</filename> and similar. These will not be visible outside of the
+    container, and their contents will be lost when the container exits.</para>
+
+    <para>Note that running two <command>systemd-nspawn</command> containers from the same directory tree will not make
+    processes in them see each other. The PID namespace separation of the two containers is complete and the containers
+    will share very few runtime objects except for the underlying file system. Use
+    <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
+    <command>login</command> or <command>shell</command> commands to request an additional login session in a running
+    container.</para>
+
+    <para><command>systemd-nspawn</command> implements the <ulink
+    url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container Interface</ulink>
+    specification.</para>
+
+    <para>While running, containers invoked with <command>systemd-nspawn</command> are registered with the
+    <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry> service that
+    keeps track of running containers, and provides programming interfaces to interact with them.</para>
   </refsect1>
 
   <refsect1>
@@ -139,7 +150,7 @@
     are used as arguments for the init binary. Otherwise,
     <replaceable>COMMAND</replaceable> specifies the program to launch
     in the container, and the remaining arguments are used as
-    arguments for this program. If <option>-b</option> is not used and
+    arguments for this program. If <option>--boot</option> is not used and
     no arguments are specified, a shell is launched in the
     container.</para>
 
@@ -310,6 +321,9 @@
             </tbody>
           </tgroup>
         </table>
+
+        <para>Note that <option>--boot</option> is the default mode of operation if the
+        <filename>systemd-nspawn@.service</filename> template unit file is used.</para>
         </listitem>
       </varlistentry>
 
@@ -446,7 +460,10 @@
 
         <listitem><para>If the kernel supports the user namespaces feature, equivalent to
         <option>--private-users=pick</option>, otherwise equivalent to
-        <option>--private-users=no</option>.</para></listitem>
+        <option>--private-users=no</option>.</para>
+
+        <para>Note that <option>-U</option> is the default if the <filename>systemd-nspawn@.service</filename> template unit
+        file is used.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -540,6 +557,9 @@
         assignment via DHCP. In case <filename>systemd-networkd</filename> is running on both the host and inside the
         container, automatic IP communication from the container to the host is thus available, with further
         connectivity to the external network.</para>
+
+        <para>Note that <option>--network-veth</option> is the default if the
+        <filename>systemd-nspawn@.service</filename> template unit file is used.</para>
         </listitem>
       </varlistentry>
 
@@ -705,7 +725,10 @@
         Effectively, booting a container once with
         <literal>guest</literal> or <literal>host</literal> will link
         the journal persistently if further on the default of
-        <literal>auto</literal> is used.</para></listitem>
+        <literal>auto</literal> is used.</para>
+
+        <para>Note that <option>--link-journal=try-guest</option> is the default if the
+        <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -910,8 +933,8 @@
         <literal>tmpfs</literal> instance, and
         <filename>/usr</filename> from the OS tree is mounted into it
         in read-only mode (the system thus starts up with read-only OS
-        resources, but pristine state and configuration, any changes
-        to the either are lost on shutdown). When the mode parameter
+        image, but pristine state and configuration, any changes
+        are lost on shutdown). When the mode parameter
         is specified as <option>state</option>, the OS tree is
         mounted read-only, but <filename>/var</filename> is mounted as
         a <literal>tmpfs</literal> instance into it (the system thus
@@ -980,6 +1003,19 @@
         effect.</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--notify-ready=</option></term>
+
+        <listitem><para>Configures support for notifications from the container's init process.
+        <option>--notify-ready=</option> takes a boolean (<option>no</option> and  <option>yes</option>).
+        With option <option>no</option> systemd-nspawn notifies systemd
+        with a <literal>READY=1</literal> message when the init process is created.
+        With option <option>yes</option> systemd-nspawn waits for the
+        <literal>READY=1</literal> message from the init process in the container
+        before sending its own to systemd. For more details about notifications
+        see <citerefentry><refentrytitle>sd_notify</refentrytitle><manvolnum>3</manvolnum></citerefentry>).</para></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
     </variablelist>
diff --git a/src/systemd-nspawn/systemd-nspawn@.service.in b/src/systemd-nspawn/systemd-nspawn@.service.in
index ea28941507..c8141639b6 100644
--- a/src/systemd-nspawn/systemd-nspawn@.service.in
+++ b/src/systemd-nspawn/systemd-nspawn@.service.in
@@ -20,20 +20,13 @@ RestartForceExitStatus=133
 SuccessExitStatus=133
 Slice=machine.slice
 Delegate=yes
-TasksMax=8192
+TasksMax=16384
 
 # Enforce a strict device policy, similar to the one nspawn configures
 # when it allocates its own scope unit. Make sure to keep these
 # policies in sync if you change them!
-DevicePolicy=strict
-DeviceAllow=/dev/null rwm
-DeviceAllow=/dev/zero rwm
-DeviceAllow=/dev/full rwm
-DeviceAllow=/dev/random rwm
-DeviceAllow=/dev/urandom rwm
-DeviceAllow=/dev/tty rwm
+DevicePolicy=closed
 DeviceAllow=/dev/net/tun rwm
-DeviceAllow=/dev/pts/ptmx rw
 DeviceAllow=char-pts rw
 
 # nspawn itself needs access to /dev/loop-control and /dev/loop, to
diff --git a/src/systemd-rc-local-generator/Makefile b/src/systemd-rc-local-generator/Makefile
index 2e9b3e7a64..0e17ae7d94 100644
--- a/src/systemd-rc-local-generator/Makefile
+++ b/src/systemd-rc-local-generator/Makefile
@@ -27,6 +27,6 @@ systemd_rc_local_generator_SOURCES = \
 	src/rc-local-generator/rc-local-generator.c
 
 systemd_rc_local_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-remount-fs/Makefile b/src/systemd-remount-fs/Makefile
index a0dcf27135..1f9df2b99a 100644
--- a/src/systemd-remount-fs/Makefile
+++ b/src/systemd-remount-fs/Makefile
@@ -30,7 +30,7 @@ systemd_remount_fs_SOURCES = \
 	src/core/mount-setup.h
 
 systemd_remount_fs_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 sd.CPPFLAGS += -DMOUNT_PATH=\"$(MOUNT_PATH)\"
 sd.CPPFLAGS += -DUMOUNT_PATH=\"$(UMOUNT_PATH)\"
diff --git a/src/systemd-reply-password/Makefile b/src/systemd-reply-password/Makefile
index b5c4698fd8..18514df027 100644
--- a/src/systemd-reply-password/Makefile
+++ b/src/systemd-reply-password/Makefile
@@ -28,6 +28,6 @@ systemd_reply_password_SOURCES = \
 	src/reply-password/reply-password.c
 
 systemd_reply_password_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-socket-proxyd/Makefile b/src/systemd-socket-proxyd/Makefile
index e3d354bd30..31261392f1 100644
--- a/src/systemd-socket-proxyd/Makefile
+++ b/src/systemd-socket-proxyd/Makefile
@@ -29,6 +29,6 @@ systemd_socket_proxyd_SOURCES = \
 	src/socket-proxy/socket-proxyd.c
 
 systemd_socket_proxyd_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-stdio-bridge/Makefile b/src/systemd-stdio-bridge/Makefile
index 8aeb20b41a..096d94b90a 100644
--- a/src/systemd-stdio-bridge/Makefile
+++ b/src/systemd-stdio-bridge/Makefile
@@ -28,6 +28,6 @@ systemd_stdio_bridge_SOURCES = \
 	src/stdio-bridge/stdio-bridge.c
 
 systemd_stdio_bridge_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-system-update-generator/Makefile b/src/systemd-system-update-generator/Makefile
index 2fa9008ff6..45504681b5 100644
--- a/src/systemd-system-update-generator/Makefile
+++ b/src/systemd-system-update-generator/Makefile
@@ -28,7 +28,7 @@ systemd_system_update_generator_SOURCES = \
 	src/system-update-generator/system-update-generator.c
 
 systemd_system_update_generator_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 sd.CPPFLAGS += -DSYSTEM_DATA_UNIT_PATH=\"$(systemunitdir)\"
 
diff --git a/src/systemd-system-update-generator/systemd-system-update-generator.xml b/src/systemd-system-update-generator/systemd-system-update-generator.xml
index e7fc95c742..833ed79646 100644
--- a/src/systemd-system-update-generator/systemd-system-update-generator.xml
+++ b/src/systemd-system-update-generator/systemd-system-update-generator.xml
@@ -54,11 +54,10 @@
 
     <para><filename>systemd-system-update-generator</filename> is a
     generator that automatically redirects the boot process to
-    <filename>system-update.target</filename> if
+    <filename>system-update.target</filename>, if
     <filename>/system-update</filename> exists. This is required to
-    implement the logic explained in the <ulink
-    url="http://freedesktop.org/wiki/Software/systemd/SystemUpdates">System
-    Updates Specification</ulink>.
+    implement the logic explained in the
+    <citerefentry><refentrytitle>systemd.offline-updates</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
     </para>
 
     <para><filename>systemd-system-update-generator</filename> implements
diff --git a/src/systemd-timesyncd/Makefile b/src/systemd-timesyncd/Makefile
index 511c86ba82..1230be959d 100644
--- a/src/systemd-timesyncd/Makefile
+++ b/src/systemd-timesyncd/Makefile
@@ -38,7 +38,8 @@ nodist_systemd_timesyncd_SOURCES = \
 
 systemd_timesyncd_LDADD = \
 	libsystemd-network.la \
-	libshared.la
+	libsystemd-shared.la \
+	-lm
 
 rootlibexec_PROGRAMS += \
 	systemd-timesyncd
diff --git a/src/systemd-timesyncd/systemd-timesyncd.service.in b/src/systemd-timesyncd/systemd-timesyncd.service.in
index a856dad709..df1e339196 100644
--- a/src/systemd-timesyncd/systemd-timesyncd.service.in
+++ b/src/systemd-timesyncd/systemd-timesyncd.service.in
@@ -28,6 +28,8 @@ PrivateDevices=yes
 ProtectSystem=full
 ProtectHome=yes
 WatchdogSec=3min
+MemoryDenyWriteExecute=yes
+SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
 
 [Install]
 WantedBy=sysinit.target
diff --git a/src/systemd-tty-ask-password-agent/Makefile b/src/systemd-tty-ask-password-agent/Makefile
index b5119b5066..3091527a7f 100644
--- a/src/systemd-tty-ask-password-agent/Makefile
+++ b/src/systemd-tty-ask-password-agent/Makefile
@@ -28,6 +28,6 @@ systemd_tty_ask_password_agent_SOURCES = \
 	src/tty-ask-password-agent/tty-ask-password-agent.c
 
 systemd_tty_ask_password_agent_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/systemd-tty-ask-password-agent/tty-ask-password-agent.c b/src/systemd-tty-ask-password-agent/tty-ask-password-agent.c
index 0db27e27cd..713f2025a4 100644
--- a/src/systemd-tty-ask-password-agent/tty-ask-password-agent.c
+++ b/src/systemd-tty-ask-password-agent/tty-ask-password-agent.c
@@ -2,6 +2,7 @@
   This file is part of systemd.
 
   Copyright 2010 Lennart Poettering
+  Copyright 2015 Werner Fink
 
   systemd is free software; you can redistribute it and/or modify it
   under the terms of the GNU Lesser General Public License as published by
@@ -21,20 +22,27 @@
 #include <fcntl.h>
 #include <getopt.h>
 #include <poll.h>
+#include <signal.h>
 #include <stdbool.h>
 #include <stddef.h>
 #include <string.h>
 #include <sys/inotify.h>
+#include <sys/prctl.h>
 #include <sys/signalfd.h>
 #include <sys/socket.h>
 #include <sys/un.h>
+#include <sys/wait.h>
 #include <unistd.h>
 
 #include "basic/alloc-util.h"
 #include "basic/def.h"
 #include "basic/dirent-util.h"
+#include "basic/exit-status.h"
 #include "basic/fd-util.h"
+#include "basic/fileio.h"
+#include "basic/hashmap.h"
 #include "basic/io-util.h"
+#include "basic/macro.h"
 #include "basic/mkdir.h"
 #include "basic/path-util.h"
 #include "basic/process-util.h"
@@ -57,6 +65,7 @@ static enum {
 
 static bool arg_plymouth = false;
 static bool arg_console = false;
+static const char *arg_device = NULL;
 
 static int ask_password_plymouth(
                 const char *message,
@@ -354,7 +363,9 @@ static int parse_password(const char *filename, char **wall) {
                         int tty_fd = -1;
 
                         if (arg_console) {
-                                tty_fd = acquire_terminal("/dev/console", false, false, false, USEC_INFINITY);
+                                const char *con = arg_device ? arg_device : "/dev/console";
+
+                                tty_fd = acquire_terminal(con, false, false, false, USEC_INFINITY);
                                 if (tty_fd < 0)
                                         return log_error_errno(tty_fd, "Failed to acquire /dev/console: %m");
 
@@ -586,14 +597,14 @@ static int parse_argv(int argc, char *argv[]) {
         };
 
         static const struct option options[] = {
-                { "help",     no_argument, NULL, 'h'          },
-                { "version",  no_argument, NULL, ARG_VERSION  },
-                { "list",     no_argument, NULL, ARG_LIST     },
-                { "query",    no_argument, NULL, ARG_QUERY    },
-                { "watch",    no_argument, NULL, ARG_WATCH    },
-                { "wall",     no_argument, NULL, ARG_WALL     },
-                { "plymouth", no_argument, NULL, ARG_PLYMOUTH },
-                { "console",  no_argument, NULL, ARG_CONSOLE  },
+                { "help",     no_argument,       NULL, 'h'          },
+                { "version",  no_argument,       NULL, ARG_VERSION  },
+                { "list",     no_argument,       NULL, ARG_LIST     },
+                { "query",    no_argument,       NULL, ARG_QUERY    },
+                { "watch",    no_argument,       NULL, ARG_WATCH    },
+                { "wall",     no_argument,       NULL, ARG_WALL     },
+                { "plymouth", no_argument,       NULL, ARG_PLYMOUTH },
+                { "console",  optional_argument, NULL, ARG_CONSOLE  },
                 {}
         };
 
@@ -635,6 +646,15 @@ static int parse_argv(int argc, char *argv[]) {
 
                 case ARG_CONSOLE:
                         arg_console = true;
+                        if (optarg) {
+
+                                if (isempty(optarg)) {
+                                        log_error("Empty console device path is not allowed.");
+                                        return -EINVAL;
+                                }
+
+                                arg_device = optarg;
+                        }
                         break;
 
                 case '?':
@@ -649,9 +669,171 @@ static int parse_argv(int argc, char *argv[]) {
                 return -EINVAL;
         }
 
+        if (arg_plymouth || arg_console) {
+
+                if (!IN_SET(arg_action, ACTION_QUERY, ACTION_WATCH)) {
+                        log_error("Options --query and --watch conflict.");
+                        return -EINVAL;
+                }
+
+                if (arg_plymouth && arg_console) {
+                        log_error("Options --plymouth and --console conflict.");
+                        return -EINVAL;
+                }
+        }
+
         return 1;
 }
 
+/*
+ * To be able to ask on all terminal devices of /dev/console
+ * the devices are collected. If more than one device is found,
+ * then on each of the terminals a inquiring task is forked.
+ * Every task has its own session and its own controlling terminal.
+ * If one of the tasks does handle a password, the remaining tasks
+ * will be terminated.
+ */
+static int ask_on_this_console(const char *tty, pid_t *pid, int argc, char *argv[]) {
+        struct sigaction sig = {
+                .sa_handler = nop_signal_handler,
+                .sa_flags = SA_NOCLDSTOP | SA_RESTART,
+        };
+
+        assert_se(sigprocmask_many(SIG_UNBLOCK, NULL, SIGHUP, SIGCHLD, -1) >= 0);
+
+        assert_se(sigemptyset(&sig.sa_mask) >= 0);
+        assert_se(sigaction(SIGCHLD, &sig, NULL) >= 0);
+
+        sig.sa_handler = SIG_DFL;
+        assert_se(sigaction(SIGHUP, &sig, NULL) >= 0);
+
+        *pid = fork();
+        if (*pid < 0)
+                return log_error_errno(errno, "Failed to fork process: %m");
+
+        if (*pid == 0) {
+                int ac;
+
+                assert_se(prctl(PR_SET_PDEATHSIG, SIGHUP) >= 0);
+
+                reset_signal_mask();
+                reset_all_signal_handlers();
+
+                for (ac = 0; ac < argc; ac++) {
+                        if (streq(argv[ac], "--console")) {
+                                argv[ac] = strjoina("--console=", tty, NULL);
+                                break;
+                        }
+                }
+
+                assert(ac < argc);
+
+                execv(SYSTEMD_TTY_ASK_PASSWORD_AGENT_BINARY_PATH, argv);
+                _exit(EXIT_FAILURE);
+        }
+        return 0;
+}
+
+static void terminate_agents(Set *pids) {
+        struct timespec ts;
+        siginfo_t status = {};
+        sigset_t set;
+        Iterator i;
+        void *p;
+        int r, signum;
+
+        /*
+         * Request termination of the remaining processes as those
+         * are not required anymore.
+         */
+        SET_FOREACH(p, pids, i)
+                (void) kill(PTR_TO_PID(p), SIGTERM);
+
+        /*
+         * Collect the processes which have go away.
+         */
+        assert_se(sigemptyset(&set) >= 0);
+        assert_se(sigaddset(&set, SIGCHLD) >= 0);
+        timespec_store(&ts, 50 * USEC_PER_MSEC);
+
+        while (!set_isempty(pids)) {
+
+                zero(status);
+                r = waitid(P_ALL, 0, &status, WEXITED|WNOHANG);
+                if (r < 0 && errno == EINTR)
+                        continue;
+
+                if (r == 0 && status.si_pid > 0) {
+                        set_remove(pids, PID_TO_PTR(status.si_pid));
+                        continue;
+                }
+
+                signum = sigtimedwait(&set, NULL, &ts);
+                if (signum < 0) {
+                        if (errno != EAGAIN)
+                                log_error_errno(errno, "sigtimedwait() failed: %m");
+                        break;
+                }
+                assert(signum == SIGCHLD);
+        }
+
+        /*
+         * Kill hanging processes.
+         */
+        SET_FOREACH(p, pids, i) {
+                log_warning("Failed to terminate child %d, killing it", PTR_TO_PID(p));
+                (void) kill(PTR_TO_PID(p), SIGKILL);
+        }
+}
+
+static int ask_on_consoles(int argc, char *argv[]) {
+        _cleanup_set_free_ Set *pids = NULL;
+        _cleanup_strv_free_ char **consoles = NULL;
+        siginfo_t status = {};
+        char **tty;
+        pid_t pid;
+        int r;
+
+        r = get_kernel_consoles(&consoles);
+        if (r < 0)
+                return log_error_errno(r, "Failed to determine devices of /dev/console: %m");
+
+        pids = set_new(NULL);
+        if (!pids)
+                return log_oom();
+
+        /* Start an agent on each console. */
+        STRV_FOREACH(tty, consoles) {
+                r = ask_on_this_console(*tty, &pid, argc, argv);
+                if (r < 0)
+                        return r;
+
+                if (set_put(pids, PID_TO_PTR(pid)) < 0)
+                        return log_oom();
+        }
+
+        /* Wait for an agent to exit. */
+        for (;;) {
+                zero(status);
+
+                if (waitid(P_ALL, 0, &status, WEXITED) < 0) {
+                        if (errno == EINTR)
+                                continue;
+
+                        return log_error_errno(errno, "waitid() failed: %m");
+                }
+
+                set_remove(pids, PID_TO_PTR(status.si_pid));
+                break;
+        }
+
+        if (!is_clean_exit(status.si_code, status.si_status, NULL))
+                log_error("Password agent failed with: %d", status.si_status);
+
+        terminate_agents(pids);
+        return 0;
+}
+
 int main(int argc, char *argv[]) {
         int r;
 
@@ -665,15 +847,28 @@ int main(int argc, char *argv[]) {
         if (r <= 0)
                 goto finish;
 
-        if (arg_console) {
-                (void) setsid();
-                (void) release_terminal();
-        }
+        if (arg_console && !arg_device)
+                /*
+                 * Spawn for each console device a separate process.
+                 */
+                r = ask_on_consoles(argc, argv);
+        else {
+
+                if (arg_device) {
+                        /*
+                         * Later on, a controlling terminal will be acquired,
+                         * therefore the current process has to become a session
+                         * leader and should not have a controlling terminal already.
+                         */
+                        (void) setsid();
+                        (void) release_terminal();
+                }
 
-        if (IN_SET(arg_action, ACTION_WATCH, ACTION_WALL))
-                r = watch_passwords();
-        else
-                r = show_passwords();
+                if (IN_SET(arg_action, ACTION_WATCH, ACTION_WALL))
+                        r = watch_passwords();
+                else
+                        r = show_passwords();
+        }
 
 finish:
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
diff --git a/src/test/Makefile b/src/test/Makefile
index f416b4aadf..7c50a983ea 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -27,7 +27,7 @@ test_id128_SOURCES = \
 	src/test/test-id128.c
 
 test_id128_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 tests += \
 	test-id128
diff --git a/src/test/test-calendarspec.c b/src/test/test-calendarspec.c
index afa9b4e362..c7cbf99cf0 100644
--- a/src/test/test-calendarspec.c
+++ b/src/test/test-calendarspec.c
@@ -91,12 +91,15 @@ static void test_next(const char *input, const char *new_tz, usec_t after, usec_
 int main(int argc, char* argv[]) {
         CalendarSpec *c;
 
-        test_one("Sat,Thu,Mon-Wed,Sat-Sun", "Mon-Thu,Sat,Sun *-*-* 00:00:00");
+        test_one("Sat,Thu,Mon-Wed,Sat-Sun", "Mon..Thu,Sat,Sun *-*-* 00:00:00");
+        test_one("Sat,Thu,Mon..Wed,Sat..Sun", "Mon..Thu,Sat,Sun *-*-* 00:00:00");
         test_one("Mon,Sun 12-*-* 2,1:23", "Mon,Sun 2012-*-* 01,02:23:00");
         test_one("Wed *-1", "Wed *-*-01 00:00:00");
         test_one("Wed-Wed,Wed *-1", "Wed *-*-01 00:00:00");
+        test_one("Wed..Wed,Wed *-1", "Wed *-*-01 00:00:00");
         test_one("Wed, 17:48", "Wed *-*-* 17:48:00");
-        test_one("Wed-Sat,Tue 12-10-15 1:2:3", "Tue-Sat 2012-10-15 01:02:03");
+        test_one("Wed-Sat,Tue 12-10-15 1:2:3", "Tue..Sat 2012-10-15 01:02:03");
+        test_one("Wed..Sat,Tue 12-10-15 1:2:3", "Tue..Sat 2012-10-15 01:02:03");
         test_one("*-*-7 0:0:0", "*-*-07 00:00:00");
         test_one("10-15", "*-10-15 00:00:00");
         test_one("monday *-12-* 17:00", "Mon *-12-* 17:00:00");
@@ -124,6 +127,10 @@ int main(int argc, char* argv[]) {
         test_one("2016-03-27 03:17:00.4200005", "2016-03-27 03:17:00.420001");
         test_one("2016-03-27 03:17:00/0.42", "2016-03-27 03:17:00/0.420000");
         test_one("2016-03-27 03:17:00/0.42", "2016-03-27 03:17:00/0.420000");
+        test_one("9..11,13:00,30", "*-*-* 09,10,11,13:00,30:00");
+        test_one("1..3-1..3 1..3:1..3", "*-01,02,03-01,02,03 01,02,03:01,02,03:00");
+        test_one("00:00:1.125..2.125", "*-*-* 00:00:01.125000,02.125000");
+        test_one("00:00:1.0..3.8", "*-*-* 00:00:01,02,03");
 
         test_next("2016-03-27 03:17:00", "", 12345, 1459048620000000);
         test_next("2016-03-27 03:17:00", "CET", 12345, 1459041420000000);
@@ -146,6 +153,7 @@ int main(int argc, char* argv[]) {
         assert_se(calendar_spec_from_string("2000-03-05.23 00:00:00", &c) < 0);
         assert_se(calendar_spec_from_string("2000-03-05 00:00.1:00", &c) < 0);
         assert_se(calendar_spec_from_string("00:00:00/0.00000001", &c) < 0);
+        assert_se(calendar_spec_from_string("00:00:00.0..00.9", &c) < 0);
 
         return 0;
 }
diff --git a/src/test/test-cgroup.c b/src/test/test-cgroup.c
index 970b9a5f13..c969185337 100644
--- a/src/test/test-cgroup.c
+++ b/src/test/test-cgroup.c
@@ -60,16 +60,16 @@ int main(int argc, char*argv[]) {
         assert_se(cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-a") > 0);
         assert_se(cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b") == 0);
 
-        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-a", 0, false, false, false, NULL) == 0);
-        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b", 0, false, false, false, NULL) > 0);
+        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-a", 0, 0, NULL, NULL, NULL) == 0);
+        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b", 0, 0, NULL, NULL, NULL) > 0);
 
-        assert_se(cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b", SYSTEMD_CGROUP_CONTROLLER, "/test-a", false, false) > 0);
+        assert_se(cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b", SYSTEMD_CGROUP_CONTROLLER, "/test-a", 0) > 0);
 
         assert_se(cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-a") == 0);
         assert_se(cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b") > 0);
 
-        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-a", 0, false, false, false, NULL) > 0);
-        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b", 0, false, false, false, NULL) == 0);
+        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-a", 0, 0, NULL, NULL, NULL) > 0);
+        assert_se(cg_kill_recursive(SYSTEMD_CGROUP_CONTROLLER, "/test-b", 0, 0, NULL, NULL, NULL) == 0);
 
         cg_trim(SYSTEMD_CGROUP_CONTROLLER, "/", false);
 
diff --git a/src/test/test-condition.c b/src/test/test-condition.c
index 00a86dedda..9d27a66a95 100644
--- a/src/test/test-condition.c
+++ b/src/test/test-condition.c
@@ -159,15 +159,15 @@ static void test_condition_test_architecture(void) {
         assert_se(sa);
 
         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, false);
-        assert_se(condition_test(condition));
+        assert_se(condition_test(condition) > 0);
         condition_free(condition);
 
         condition = condition_new(CONDITION_ARCHITECTURE, "garbage value", false, false);
-        assert_se(condition_test(condition) < 0);
+        assert_se(condition_test(condition) == 0);
         condition_free(condition);
 
         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, true);
-        assert_se(!condition_test(condition));
+        assert_se(condition_test(condition) == 0);
         condition_free(condition);
 }
 
diff --git a/src/test/test-fdset.c b/src/test/test-fdset.c
index 9ad122f628..71b155ae8d 100644
--- a/src/test/test-fdset.c
+++ b/src/test/test-fdset.c
@@ -21,10 +21,10 @@
 #include <unistd.h>
 
 #include "basic/fd-util.h"
-#include "basic/fdset.h"
 #include "basic/fileio.h"
 #include "basic/macro.h"
 #include "basic/util.h"
+#include "shared/fdset.h"
 
 static void test_fdset_new_fill(void) {
         int fd = -1;
diff --git a/src/test/test-fs-util.c b/src/test/test-fs-util.c
index 7002eb841a..30b521c297 100644
--- a/src/test/test-fs-util.c
+++ b/src/test/test-fs-util.c
@@ -82,10 +82,56 @@ static void test_get_files_in_directory(void) {
         assert_se(get_files_in_directory(".", NULL) >= 0);
 }
 
+static void test_var_tmp(void) {
+        char *tmp_dir = NULL;
+        char *tmpdir_backup = NULL;
+        const char *default_var_tmp = NULL;
+        const char *var_name;
+        bool do_overwrite = true;
+
+        default_var_tmp = "/var/tmp";
+        var_name = "TMPDIR";
+
+        if (getenv(var_name) != NULL) {
+                tmpdir_backup = strdup(getenv(var_name));
+                assert_se(tmpdir_backup != NULL);
+        }
+
+        unsetenv(var_name);
+
+        var_tmp(&tmp_dir);
+        assert_se(!strcmp(tmp_dir, default_var_tmp));
+
+        free(tmp_dir);
+
+        setenv(var_name, "/tmp", do_overwrite);
+        assert_se(!strcmp(getenv(var_name), "/tmp"));
+
+        var_tmp(&tmp_dir);
+        assert_se(!strcmp(tmp_dir, "/tmp"));
+
+        free(tmp_dir);
+
+        setenv(var_name, "/88_does_not_exist_88", do_overwrite);
+        assert_se(!strcmp(getenv(var_name), "/88_does_not_exist_88"));
+
+        var_tmp(&tmp_dir);
+        assert_se(!strcmp(tmp_dir, default_var_tmp));
+
+        free(tmp_dir);
+
+        if (tmpdir_backup != NULL)  {
+                setenv(var_name, tmpdir_backup, do_overwrite);
+                assert_se(!strcmp(getenv(var_name), tmpdir_backup));
+                free(tmpdir_backup);
+        }
+}
+
 int main(int argc, char *argv[]) {
         test_unlink_noerrno();
         test_readlink_and_make_absolute();
         test_get_files_in_directory();
+        test_var_tmp();
 
         return 0;
 }
diff --git a/src/test/test-id128.c b/src/test/test-id128.c
index aa41068530..c9240cf40d 100644
--- a/src/test/test-id128.c
+++ b/src/test/test-id128.c
@@ -23,9 +23,12 @@
 #include <systemd/sd-id128.h>
 
 #include "basic/alloc-util.h"
+#include "basic/fd-util.h"
+#include "basic/fileio.h"
 #include "basic/macro.h"
 #include "basic/string-util.h"
 #include "basic/util.h"
+#include "sd-id128/id128-util.h"
 
 #define ID128_WALDI SD_ID128_MAKE(01, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 10)
 #define STR_WALDI "0102030405060708090a0b0c0d0e0f10"
@@ -33,8 +36,9 @@
 
 int main(int argc, char *argv[]) {
         sd_id128_t id, id2;
-        char t[33];
+        char t[33], q[37];
         _cleanup_free_ char *b = NULL;
+        _cleanup_close_ int fd = -1;
 
         assert_se(sd_id128_randomize(&id) == 0);
         printf("random: %s\n", sd_id128_to_string(id, t));
@@ -57,6 +61,17 @@ int main(int argc, char *argv[]) {
         printf("waldi2: %s\n", b);
         assert_se(streq(t, b));
 
+        printf("waldi3: %s\n", id128_to_uuid_string(ID128_WALDI, q));
+        assert_se(streq(q, UUID_WALDI));
+
+        b = mfree(b);
+        assert_se(asprintf(&b, ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(ID128_WALDI)) == 36);
+        printf("waldi4: %s\n", b);
+        assert_se(streq(q, b));
+
+        assert_se(sd_id128_from_string(STR_WALDI, &id) >= 0);
+        assert_se(sd_id128_equal(id, ID128_WALDI));
+
         assert_se(sd_id128_from_string(UUID_WALDI, &id) >= 0);
         assert_se(sd_id128_equal(id, ID128_WALDI));
 
@@ -74,5 +89,69 @@ int main(int argc, char *argv[]) {
         assert_se(!id128_is_valid("01020304-0506-0708-090a0b0c0d0e0f10"));
         assert_se(!id128_is_valid("010203040506-0708-090a-0b0c0d0e0f10"));
 
+        fd = open_tmpfile_unlinkable(NULL, O_RDWR|O_CLOEXEC);
+        assert_se(fd >= 0);
+
+        /* First, write as UUID */
+        assert_se(sd_id128_randomize(&id) >= 0);
+        assert_se(id128_write_fd(fd, ID128_UUID, id, false) >= 0);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_PLAIN, &id2) == -EINVAL);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_UUID, &id2) >= 0);
+        assert_se(sd_id128_equal(id, id2));
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_ANY, &id2) >= 0);
+        assert_se(sd_id128_equal(id, id2));
+
+        /* Second, write as plain */
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(ftruncate(fd, 0) >= 0);
+
+        assert_se(sd_id128_randomize(&id) >= 0);
+        assert_se(id128_write_fd(fd, ID128_PLAIN, id, false) >= 0);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_UUID, &id2) == -EINVAL);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_PLAIN, &id2) >= 0);
+        assert_se(sd_id128_equal(id, id2));
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_ANY, &id2) >= 0);
+        assert_se(sd_id128_equal(id, id2));
+
+        /* Third, write plain without trailing newline */
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(ftruncate(fd, 0) >= 0);
+
+        assert_se(sd_id128_randomize(&id) >= 0);
+        assert_se(write(fd, sd_id128_to_string(id, t), 32) == 32);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_UUID, &id2) == -EINVAL);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_PLAIN, &id2) >= 0);
+        assert_se(sd_id128_equal(id, id2));
+
+        /* Third, write UUID without trailing newline */
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(ftruncate(fd, 0) >= 0);
+
+        assert_se(sd_id128_randomize(&id) >= 0);
+        assert_se(write(fd, id128_to_uuid_string(id, t), 36) == 36);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_PLAIN, &id2) == -EINVAL);
+
+        assert_se(lseek(fd, 0, SEEK_SET) == 0);
+        assert_se(id128_read_fd(fd, ID128_UUID, &id2) >= 0);
+        assert_se(sd_id128_equal(id, id2));
+
         return 0;
 }
diff --git a/src/test/test-install-root.c b/src/test/test-install-root.c
index c0d696dcdc..9a0a48131c 100644
--- a/src/test/test-install-root.c
+++ b/src/test/test-install-root.c
@@ -301,7 +301,12 @@ static void test_linked_units(const char *root) {
         unit_file_changes_free(changes, n_changes);
         changes = NULL; n_changes = 0;
 
-        assert_se(unit_file_enable(UNIT_FILE_SYSTEM, false, root, STRV_MAKE("linked3.service"), false, &changes, &n_changes) == -ELOOP);
+        assert_se(unit_file_enable(UNIT_FILE_SYSTEM, false, root, STRV_MAKE("linked3.service"), false, &changes, &n_changes) >= 0);
+        assert_se(n_changes == 1);
+        assert_se(changes[0].type == UNIT_FILE_SYMLINK);
+        assert_se(startswith(changes[0].path, root));
+        assert_se(endswith(changes[0].path, "linked3.service"));
+        assert_se(streq(changes[0].source, "/opt/linked3.service"));
         unit_file_changes_free(changes, n_changes);
         changes = NULL; n_changes = 0;
 }
diff --git a/src/test/test-nss.c b/src/test/test-nss.c
index 876e978d22..5be5c409d5 100644
--- a/src/test/test-nss.c
+++ b/src/test/test-nss.c
@@ -400,8 +400,8 @@ int main(int argc, char **argv) {
         _cleanup_free_ char *dir = NULL, *hostname = NULL;
         const char *module;
 
-        const uint32_t local_address_ipv4 = htonl(0x7F000001);
-        const uint32_t local_address_ipv4_2 = htonl(0x7F000002);
+        const uint32_t local_address_ipv4 = htobe32(0x7F000001);
+        const uint32_t local_address_ipv4_2 = htobe32(0x7F000002);
         _cleanup_free_ struct local_address *addresses = NULL;
         int n_addresses;
 
diff --git a/src/test/test-parse-util.c b/src/test/test-parse-util.c
index 423bf8a78c..1e90800a33 100644
--- a/src/test/test-parse-util.c
+++ b/src/test/test-parse-util.c
@@ -475,6 +475,24 @@ static void test_safe_atod(void) {
         assert_se(*e == ',');
 }
 
+static void test_parse_percent(void) {
+        assert_se(parse_percent("") == -EINVAL);
+        assert_se(parse_percent("foo") == -EINVAL);
+        assert_se(parse_percent("0") == -EINVAL);
+        assert_se(parse_percent("50") == -EINVAL);
+        assert_se(parse_percent("100") == -EINVAL);
+        assert_se(parse_percent("-1") == -EINVAL);
+        assert_se(parse_percent("0%") == 0);
+        assert_se(parse_percent("55%") == 55);
+        assert_se(parse_percent("100%") == 100);
+        assert_se(parse_percent("-7%") == -ERANGE);
+        assert_se(parse_percent("107%") == -ERANGE);
+        assert_se(parse_percent("%") == -EINVAL);
+        assert_se(parse_percent("%%") == -EINVAL);
+        assert_se(parse_percent("%1") == -EINVAL);
+        assert_se(parse_percent("1%%") == -EINVAL);
+}
+
 int main(int argc, char *argv[]) {
         log_parse_environment();
         log_open();
@@ -488,6 +506,7 @@ int main(int argc, char *argv[]) {
         test_safe_atou16();
         test_safe_atoi16();
         test_safe_atod();
+        test_parse_percent();
 
         return 0;
 }
diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
index 8dbac28d7b..aa1ed1ec81 100644
--- a/src/test/test-path-util.c
+++ b/src/test/test-path-util.c
@@ -114,7 +114,7 @@ static void test_find_binary(const char *self) {
 
         assert_se(find_binary(self, &p) == 0);
         puts(p);
-        assert_se(endswith(p, "/test-path-util"));
+        assert_se(endswith(p, "/lt-test-path-util"));
         assert_se(path_is_absolute(p));
         free(p);
 
diff --git a/src/test/test-proc-cmdline.c b/src/test/test-proc-cmdline.c
index e85c6bbf7d..35e6541150 100644
--- a/src/test/test-proc-cmdline.c
+++ b/src/test/test-proc-cmdline.c
@@ -23,6 +23,7 @@
 #include "basic/proc-cmdline.h"
 #include "basic/special.h"
 #include "basic/string-util.h"
+#include "basic/util.h"
 
 static int parse_item(const char *key, const char *value) {
         assert_se(key);
@@ -36,9 +37,19 @@ static void test_parse_proc_cmdline(void) {
 }
 
 static void test_runlevel_to_target(void) {
+        in_initrd_force(false);
         assert_se(streq_ptr(runlevel_to_target(NULL), NULL));
         assert_se(streq_ptr(runlevel_to_target("unknown-runlevel"), NULL));
+        assert_se(streq_ptr(runlevel_to_target("rd.unknown-runlevel"), NULL));
         assert_se(streq_ptr(runlevel_to_target("3"), SPECIAL_MULTI_USER_TARGET));
+        assert_se(streq_ptr(runlevel_to_target("rd.rescue"), NULL));
+
+        in_initrd_force(true);
+        assert_se(streq_ptr(runlevel_to_target(NULL), NULL));
+        assert_se(streq_ptr(runlevel_to_target("unknown-runlevel"), NULL));
+        assert_se(streq_ptr(runlevel_to_target("rd.unknown-runlevel"), NULL));
+        assert_se(streq_ptr(runlevel_to_target("3"), NULL));
+        assert_se(streq_ptr(runlevel_to_target("rd.rescue"), SPECIAL_RESCUE_TARGET));
 }
 
 int main(void) {
diff --git a/src/test/test-process-util.c b/src/test/test-process-util.c
index 6a0a5b46c2..65dc6a9140 100644
--- a/src/test/test-process-util.c
+++ b/src/test/test-process-util.c
@@ -18,82 +18,87 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include <sched.h>
+#include <sys/mount.h>
 #include <sys/personality.h>
+#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
+#ifdef HAVE_VALGRIND_VALGRIND_H
+#include <valgrind/valgrind.h>
+#endif
 
 #include "basic/alloc-util.h"
 #include "basic/architecture.h"
+#include "basic/fd-util.h"
 #include "basic/log.h"
 #include "basic/macro.h"
+#include "basic/parse-util.h"
 #include "basic/process-util.h"
+#include "basic/stdio-util.h"
 #include "basic/string-util.h"
 #include "basic/terminal-util.h"
 #include "basic/util.h"
 #include "basic/virt.h"
 
-static void test_get_process_comm(void) {
+static void test_get_process_comm(pid_t pid) {
         struct stat st;
-        _cleanup_free_ char *a = NULL, *c = NULL, *d = NULL, *f = NULL, *i = NULL, *cwd = NULL, *root = NULL;
+        _cleanup_free_ char *a = NULL, *c = NULL, *d = NULL, *f = NULL, *i = NULL;
         _cleanup_free_ char *env = NULL;
+        char path[strlen("/proc//comm") + DECIMAL_STR_MAX(pid_t)];
         pid_t e;
         uid_t u;
         gid_t g;
         dev_t h;
         int r;
-        pid_t me;
-
-        if (stat("/proc/1/comm", &st) == 0) {
-                assert_se(get_process_comm(1, &a) >= 0);
-                log_info("pid1 comm: '%s'", a);
-        } else
-                log_warning("/proc/1/comm does not exist.");
 
-        assert_se(get_process_cmdline(1, 0, true, &c) >= 0);
-        log_info("pid1 cmdline: '%s'", c);
+        xsprintf(path, "/proc/"PID_FMT"/comm", pid);
 
-        assert_se(get_process_cmdline(1, 8, false, &d) >= 0);
-        log_info("pid1 cmdline truncated: '%s'", d);
+        if (stat(path, &st) == 0) {
+                assert_se(get_process_comm(pid, &a) >= 0);
+                log_info("PID"PID_FMT" comm: '%s'", pid, a);
+        } else
+                log_warning("%s not exist.", path);
 
-        assert_se(get_process_ppid(1, &e) >= 0);
-        log_info("pid1 ppid: "PID_FMT, e);
-        assert_se(e == 0);
+        assert_se(get_process_cmdline(pid, 0, true, &c) >= 0);
+        log_info("PID"PID_FMT" cmdline: '%s'", pid, c);
 
-        assert_se(is_kernel_thread(1) == 0);
+        assert_se(get_process_cmdline(pid, 8, false, &d) >= 0);
+        log_info("PID"PID_FMT" cmdline truncated to 8: '%s'", pid, d);
 
-        r = get_process_exe(1, &f);
-        assert_se(r >= 0 || r == -EACCES);
-        log_info("pid1 exe: '%s'", strna(f));
+        free(d);
+        assert_se(get_process_cmdline(pid, 1, false, &d) >= 0);
+        log_info("PID"PID_FMT" cmdline truncated to 1: '%s'", pid, d);
 
-        assert_se(get_process_uid(1, &u) == 0);
-        log_info("pid1 uid: "UID_FMT, u);
-        assert_se(u == 0);
+        assert_se(get_process_ppid(pid, &e) >= 0);
+        log_info("PID"PID_FMT" PPID: "PID_FMT, pid, e);
+        assert_se(pid == 1 ? e == 0 : e > 0);
 
-        assert_se(get_process_gid(1, &g) == 0);
-        log_info("pid1 gid: "GID_FMT, g);
-        assert_se(g == 0);
+        assert_se(is_kernel_thread(pid) == 0 || pid != 1);
 
-        me = getpid();
-
-        r = get_process_cwd(me, &cwd);
+        r = get_process_exe(pid, &f);
         assert_se(r >= 0 || r == -EACCES);
-        log_info("pid1 cwd: '%s'", cwd);
+        log_info("PID"PID_FMT" exe: '%s'", pid, strna(f));
 
-        r = get_process_root(me, &root);
-        assert_se(r >= 0 || r == -EACCES);
-        log_info("pid1 root: '%s'", root);
+        assert_se(get_process_uid(pid, &u) == 0);
+        log_info("PID"PID_FMT" UID: "UID_FMT, pid, u);
+        assert_se(u == 0 || pid != 1);
 
-        r = get_process_environ(me, &env);
+        assert_se(get_process_gid(pid, &g) == 0);
+        log_info("PID"PID_FMT" GID: "GID_FMT, pid, g);
+        assert_se(g == 0 || pid != 1);
+
+        r = get_process_environ(pid, &env);
         assert_se(r >= 0 || r == -EACCES);
-        log_info("self strlen(environ): '%zu'", strlen(env));
+        log_info("PID"PID_FMT" strlen(environ): %zi", pid, env ? (ssize_t)strlen(env) : (ssize_t)-errno);
 
         if (!detect_container())
-                assert_se(get_ctty_devnr(1, &h) == -ENXIO);
+                assert_se(get_ctty_devnr(pid, &h) == -ENXIO || pid != 1);
 
-        getenv_for_pid(1, "PATH", &i);
-        log_info("pid1 $PATH: '%s'", strna(i));
+        getenv_for_pid(pid, "PATH", &i);
+        log_info("PID"PID_FMT" $PATH: '%s'", pid, strna(i));
 }
 
 static void test_pid_is_unwaited(void) {
@@ -153,14 +158,213 @@ static void test_personality(void) {
 #endif
 }
 
+static void test_get_process_cmdline_harder(void) {
+        char path[] = "/tmp/test-cmdlineXXXXXX";
+        _cleanup_close_ int fd = -1;
+        _cleanup_free_ char *line = NULL;
+        pid_t pid;
+
+        if (geteuid() != 0)
+                return;
+
+#ifdef HAVE_VALGRIND_VALGRIND_H
+        /* valgrind patches open(/proc//cmdline)
+         * so, test_get_process_cmdline_harder fails always
+         * See https://github.com/systemd/systemd/pull/3555#issuecomment-226564908 */
+        if (RUNNING_ON_VALGRIND)
+                return;
+#endif
+
+        pid = fork();
+        if (pid > 0) {
+                siginfo_t si;
+
+                (void) wait_for_terminate(pid, &si);
+
+                assert_se(si.si_code == CLD_EXITED);
+                assert_se(si.si_status == 0);
+
+                return;
+        }
+
+        assert_se(pid == 0);
+        assert_se(unshare(CLONE_NEWNS) >= 0);
+
+        fd = mkostemp(path, O_CLOEXEC);
+        assert_se(fd >= 0);
+        assert_se(mount(path, "/proc/self/cmdline", "bind", MS_BIND, NULL) >= 0);
+        assert_se(unlink(path) >= 0);
+
+        assert_se(prctl(PR_SET_NAME, "testa") >= 0);
+
+        assert_se(get_process_cmdline(getpid(), 0, false, &line) == -ENOENT);
+
+        assert_se(get_process_cmdline(getpid(), 0, true, &line) >= 0);
+        assert_se(streq(line, "[testa]"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 1, true, &line) >= 0);
+        assert_se(streq(line, ""));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 2, true, &line) >= 0);
+        assert_se(streq(line, "["));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 3, true, &line) >= 0);
+        assert_se(streq(line, "[."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 4, true, &line) >= 0);
+        assert_se(streq(line, "[.."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 5, true, &line) >= 0);
+        assert_se(streq(line, "[..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 6, true, &line) >= 0);
+        assert_se(streq(line, "[...]"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 7, true, &line) >= 0);
+        assert_se(streq(line, "[t...]"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 8, true, &line) >= 0);
+        assert_se(streq(line, "[testa]"));
+        line = mfree(line);
+
+        assert_se(write(fd, "\0\0\0\0\0\0\0\0\0", 10) == 10);
+
+        assert_se(get_process_cmdline(getpid(), 0, false, &line) == -ENOENT);
+
+        assert_se(get_process_cmdline(getpid(), 0, true, &line) >= 0);
+        assert_se(streq(line, "[testa]"));
+        line = mfree(line);
+
+        assert_se(write(fd, "foo\0bar\0\0\0\0\0", 10) == 10);
+
+        assert_se(get_process_cmdline(getpid(), 0, false, &line) >= 0);
+        assert_se(streq(line, "foo bar"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 0, true, &line) >= 0);
+        assert_se(streq(line, "foo bar"));
+        line = mfree(line);
+
+        assert_se(write(fd, "quux", 4) == 4);
+        assert_se(get_process_cmdline(getpid(), 0, false, &line) >= 0);
+        assert_se(streq(line, "foo bar quux"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 0, true, &line) >= 0);
+        assert_se(streq(line, "foo bar quux"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 1, true, &line) >= 0);
+        assert_se(streq(line, ""));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 2, true, &line) >= 0);
+        assert_se(streq(line, "."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 3, true, &line) >= 0);
+        assert_se(streq(line, ".."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 4, true, &line) >= 0);
+        assert_se(streq(line, "..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 5, true, &line) >= 0);
+        assert_se(streq(line, "f..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 6, true, &line) >= 0);
+        assert_se(streq(line, "fo..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 7, true, &line) >= 0);
+        assert_se(streq(line, "foo..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 8, true, &line) >= 0);
+        assert_se(streq(line, "foo..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 9, true, &line) >= 0);
+        assert_se(streq(line, "foo b..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 10, true, &line) >= 0);
+        assert_se(streq(line, "foo ba..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 11, true, &line) >= 0);
+        assert_se(streq(line, "foo bar..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 12, true, &line) >= 0);
+        assert_se(streq(line, "foo bar..."));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 13, true, &line) >= 0);
+        assert_se(streq(line, "foo bar quux"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 14, true, &line) >= 0);
+        assert_se(streq(line, "foo bar quux"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 1000, true, &line) >= 0);
+        assert_se(streq(line, "foo bar quux"));
+        line = mfree(line);
+
+        assert_se(ftruncate(fd, 0) >= 0);
+        assert_se(prctl(PR_SET_NAME, "aaaa bbbb cccc") >= 0);
+
+        assert_se(get_process_cmdline(getpid(), 0, false, &line) == -ENOENT);
+
+        assert_se(get_process_cmdline(getpid(), 0, true, &line) >= 0);
+        assert_se(streq(line, "[aaaa bbbb cccc]"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 10, true, &line) >= 0);
+        assert_se(streq(line, "[aaaa...]"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 11, true, &line) >= 0);
+        assert_se(streq(line, "[aaaa...]"));
+        line = mfree(line);
+
+        assert_se(get_process_cmdline(getpid(), 12, true, &line) >= 0);
+        assert_se(streq(line, "[aaaa b...]"));
+        line = mfree(line);
+
+        safe_close(fd);
+        _exit(0);
+}
+
 int main(int argc, char *argv[]) {
         log_parse_environment();
         log_open();
 
-        test_get_process_comm();
+        if (argc > 1) {
+                pid_t pid = 0;
+
+                (void) parse_pid(argv[1], &pid);
+                test_get_process_comm(pid);
+        } else {
+                test_get_process_comm(1);
+                test_get_process_comm(getpid());
+        }
+
         test_pid_is_unwaited();
         test_pid_is_alive();
         test_personality();
+        test_get_process_cmdline_harder();
 
         return 0;
 }
diff --git a/src/test/test-socket-util.c b/src/test/test-socket-util.c
index c7b5384ab8..44786ee262 100644
--- a/src/test/test-socket-util.c
+++ b/src/test/test-socket-util.c
@@ -286,6 +286,55 @@ static void test_in_addr_to_string(void) {
         test_in_addr_to_string_one(AF_INET6, "fe80::");
 }
 
+static void test_in_addr_ifindex_to_string_one(int f, const char *a, int ifindex, const char *b) {
+        _cleanup_free_ char *r = NULL;
+        union in_addr_union ua, uuaa;
+        int ff, ifindex2;
+
+        assert_se(in_addr_from_string(f, a, &ua) >= 0);
+        assert_se(in_addr_ifindex_to_string(f, &ua, ifindex, &r) >= 0);
+        printf("test_in_addr_ifindex_to_string_one: %s == %s\n", b, r);
+        assert_se(streq(b, r));
+
+        assert_se(in_addr_ifindex_from_string_auto(b, &ff, &uuaa, &ifindex2) >= 0);
+        assert_se(ff == f);
+        assert_se(in_addr_equal(f, &ua, &uuaa));
+        assert_se(ifindex2 == ifindex || ifindex2 == 0);
+}
+
+static void test_in_addr_ifindex_to_string(void) {
+        test_in_addr_ifindex_to_string_one(AF_INET, "192.168.0.1", 7, "192.168.0.1");
+        test_in_addr_ifindex_to_string_one(AF_INET, "10.11.12.13", 9, "10.11.12.13");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", 10, "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "::1", 11, "::1");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "fe80::", 12, "fe80::%12");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "fe80::", 0, "fe80::");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "fe80::14", 12, "fe80::14%12");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "fe80::15", -7, "fe80::15");
+        test_in_addr_ifindex_to_string_one(AF_INET6, "fe80::16", LOOPBACK_IFINDEX, "fe80::16%1");
+}
+
+static void test_in_addr_ifindex_from_string_auto(void) {
+        int family, ifindex;
+        union in_addr_union ua;
+
+        /* Most in_addr_ifindex_from_string_auto() invocations have already been tested above, but let's test some more */
+
+        assert_se(in_addr_ifindex_from_string_auto("fe80::17", &family, &ua, &ifindex) >= 0);
+        assert_se(family == AF_INET6);
+        assert_se(ifindex == 0);
+
+        assert_se(in_addr_ifindex_from_string_auto("fe80::18%19", &family, &ua, &ifindex) >= 0);
+        assert_se(family == AF_INET6);
+        assert_se(ifindex == 19);
+
+        assert_se(in_addr_ifindex_from_string_auto("fe80::18%lo", &family, &ua, &ifindex) >= 0);
+        assert_se(family == AF_INET6);
+        assert_se(ifindex == LOOPBACK_IFINDEX);
+
+        assert_se(in_addr_ifindex_from_string_auto("fe80::19%thisinterfacecantexist", &family, &ua, &ifindex) == -ENODEV);
+}
+
 static void *connect_thread(void *arg) {
         union sockaddr_union *sa = arg;
         _cleanup_close_ int fd = -1;
@@ -304,7 +353,7 @@ static void test_nameinfo_pretty(void) {
         union sockaddr_union s = {
                 .in.sin_family = AF_INET,
                 .in.sin_port = 0,
-                .in.sin_addr.s_addr = htonl(INADDR_ANY),
+                .in.sin_addr.s_addr = htobe32(INADDR_ANY),
         };
         int r;
 
@@ -342,17 +391,17 @@ static void test_sockaddr_equal(void) {
         union sockaddr_union a = {
                 .in.sin_family = AF_INET,
                 .in.sin_port = 0,
-                .in.sin_addr.s_addr = htonl(INADDR_ANY),
+                .in.sin_addr.s_addr = htobe32(INADDR_ANY),
         };
         union sockaddr_union b = {
                 .in.sin_family = AF_INET,
                 .in.sin_port = 0,
-                .in.sin_addr.s_addr = htonl(INADDR_ANY),
+                .in.sin_addr.s_addr = htobe32(INADDR_ANY),
         };
         union sockaddr_union c = {
                 .in.sin_family = AF_INET,
                 .in.sin_port = 0,
-                .in.sin_addr.s_addr = htonl(1234),
+                .in.sin_addr.s_addr = htobe32(1234),
         };
         union sockaddr_union d = {
                 .in6.sin6_family = AF_INET6,
@@ -398,6 +447,8 @@ int main(int argc, char *argv[]) {
         test_in_addr_prefix_intersect();
         test_in_addr_prefix_next();
         test_in_addr_to_string();
+        test_in_addr_ifindex_to_string();
+        test_in_addr_ifindex_from_string_auto();
 
         test_nameinfo_pretty();
 
diff --git a/src/test/test-strv.c b/src/test/test-strv.c
index 3ecca8cfee..0ad23ef3bb 100644
--- a/src/test/test-strv.c
+++ b/src/test/test-strv.c
@@ -647,7 +647,9 @@ static void test_strv_extend_n(void) {
 static void test_strv_make_nulstr_one(char **l) {
         _cleanup_free_ char *b = NULL, *c = NULL;
         _cleanup_strv_free_ char **q = NULL;
+        const char *s = NULL;
         size_t n, m;
+        unsigned i = 0;
 
         assert_se(strv_make_nulstr(l, &b, &n) >= 0);
         assert_se(q = strv_parse_nulstr(b, n));
@@ -656,6 +658,10 @@ static void test_strv_make_nulstr_one(char **l) {
         assert_se(strv_make_nulstr(q, &c, &m) >= 0);
         assert_se(m == n);
         assert_se(memcmp(b, c, m) == 0);
+
+        NULSTR_FOREACH(s, b)
+                assert_se(streq(s, l[i++]));
+        assert_se(i == strv_length(l));
 }
 
 static void test_strv_make_nulstr(void) {
@@ -685,6 +691,16 @@ static void test_foreach_string(void) {
                 assert_se(streq(x, "zzz"));
 }
 
+static void test_strv_fnmatch(void) {
+        _cleanup_strv_free_ char **v = NULL;
+
+        assert_se(!strv_fnmatch(STRV_MAKE_EMPTY, "a", 0));
+
+        v = strv_new("*\\*", NULL);
+        assert_se(!strv_fnmatch(v, "\\", 0));
+        assert_se(strv_fnmatch(v, "\\", FNM_NOESCAPE));
+}
+
 int main(int argc, char *argv[]) {
         test_specifier_printf();
         test_strv_foreach();
@@ -750,6 +766,7 @@ int main(int argc, char *argv[]) {
         test_strv_make_nulstr();
 
         test_foreach_string();
+        test_strv_fnmatch();
 
         return 0;
 }
diff --git a/src/test/test-unaligned.c b/src/test/test-unaligned.c
index 82151638d2..0568211e0c 100644
--- a/src/test/test-unaligned.c
+++ b/src/test/test-unaligned.c
@@ -159,7 +159,31 @@ static void test_le(void) {
         assert_se(memcmp(&scratch[7], &data[7], sizeof(uint64_t)) == 0);
 }
 
+static void test_ne(void) {
+        uint16_t x = 4711;
+        uint32_t y = 123456;
+        uint64_t z = 9876543210;
+
+        /* Note that we don't bother actually testing alignment issues in this function, after all the _ne() functions
+         * are just aliases for the _le() or _be() implementations, which we test extensively above. Hence, in this
+         * function, just ensure that they map to the right version on the local architecture. */
+
+        assert_se(unaligned_read_ne16(&x) == 4711);
+        assert_se(unaligned_read_ne32(&y) == 123456);
+        assert_se(unaligned_read_ne64(&z) == 9876543210);
+
+        unaligned_write_ne16(&x, 1);
+        unaligned_write_ne32(&y, 2);
+        unaligned_write_ne64(&z, 3);
+
+        assert_se(x == 1);
+        assert_se(y == 2);
+        assert_se(z == 3);
+}
+
 int main(int argc, const char *argv[]) {
         test_be();
         test_le();
+        test_ne();
+        return 0;
 }
diff --git a/src/test/test-util.c b/src/test/test-util.c
index 13f6b2f953..c0ac362c9d 100644
--- a/src/test/test-util.c
+++ b/src/test/test-util.c
@@ -26,6 +26,8 @@
 #include "basic/def.h"
 #include "basic/fileio.h"
 #include "basic/fs-util.h"
+#include "basic/parse-util.h"
+#include "basic/raw-clone.h"
 #include "basic/rm-rf.h"
 #include "basic/string-util.h"
 #include "basic/util.h"
@@ -244,7 +246,7 @@ static void test_raw_clone(void) {
         log_info("before clone: getpid()→"PID_FMT, parent);
         assert_se(raw_getpid() == parent);
 
-        pid = raw_clone(0, NULL);
+        pid = raw_clone(0);
         assert_se(pid >= 0);
 
         pid2 = raw_getpid();
@@ -262,6 +264,89 @@ static void test_raw_clone(void) {
         }
 }
 
+static void test_physical_memory(void) {
+        uint64_t p;
+        char buf[FORMAT_BYTES_MAX];
+
+        p = physical_memory();
+        assert_se(p > 0);
+        assert_se(p < UINT64_MAX);
+        assert_se(p % page_size() == 0);
+
+        log_info("Memory: %s (%" PRIu64 ")", format_bytes(buf, sizeof(buf), p), p);
+}
+
+static void test_physical_memory_scale(void) {
+        uint64_t p;
+
+        p = physical_memory();
+
+        assert_se(physical_memory_scale(0, 100) == 0);
+        assert_se(physical_memory_scale(100, 100) == p);
+
+        log_info("Memory original: %" PRIu64, physical_memory());
+        log_info("Memory scaled by 50%%: %" PRIu64, physical_memory_scale(50, 100));
+        log_info("Memory divided by 2: %" PRIu64, physical_memory() / 2);
+        log_info("Page size: %zu", page_size());
+
+        /* There might be an uneven number of pages, hence permit these calculations to be half a page off... */
+        assert_se(page_size()/2 + physical_memory_scale(50, 100) - p/2 <= page_size());
+        assert_se(physical_memory_scale(200, 100) == p*2);
+
+        assert_se(physical_memory_scale(0, 1) == 0);
+        assert_se(physical_memory_scale(1, 1) == p);
+        assert_se(physical_memory_scale(2, 1) == p*2);
+
+        assert_se(physical_memory_scale(0, 2) == 0);
+
+        assert_se(page_size()/2 + physical_memory_scale(1, 2) - p/2 <= page_size());
+        assert_se(physical_memory_scale(2, 2) == p);
+        assert_se(physical_memory_scale(4, 2) == p*2);
+
+        assert_se(physical_memory_scale(0, UINT32_MAX) == 0);
+        assert_se(physical_memory_scale(UINT32_MAX, UINT32_MAX) == p);
+
+        /* overflow */
+        assert_se(physical_memory_scale(UINT64_MAX/4, UINT64_MAX) == UINT64_MAX);
+}
+
+static void test_system_tasks_max(void) {
+        uint64_t t;
+
+        t = system_tasks_max();
+        assert_se(t > 0);
+        assert_se(t < UINT64_MAX);
+
+        log_info("Max tasks: %" PRIu64, t);
+}
+
+static void test_system_tasks_max_scale(void) {
+        uint64_t t;
+
+        t = system_tasks_max();
+
+        assert_se(system_tasks_max_scale(0, 100) == 0);
+        assert_se(system_tasks_max_scale(100, 100) == t);
+
+        assert_se(system_tasks_max_scale(0, 1) == 0);
+        assert_se(system_tasks_max_scale(1, 1) == t);
+        assert_se(system_tasks_max_scale(2, 1) == 2*t);
+
+        assert_se(system_tasks_max_scale(0, 2) == 0);
+        assert_se(system_tasks_max_scale(1, 2) == t/2);
+        assert_se(system_tasks_max_scale(2, 2) == t);
+        assert_se(system_tasks_max_scale(3, 2) == (3*t)/2);
+        assert_se(system_tasks_max_scale(4, 2) == t*2);
+
+        assert_se(system_tasks_max_scale(0, UINT32_MAX) == 0);
+        assert_se(system_tasks_max_scale((UINT32_MAX-1)/2, UINT32_MAX-1) == t/2);
+        assert_se(system_tasks_max_scale(UINT32_MAX, UINT32_MAX) == t);
+
+        /* overflow */
+
+        assert_se(system_tasks_max_scale(UINT64_MAX/4, UINT64_MAX) == UINT64_MAX);
+}
+
 int main(int argc, char *argv[]) {
         log_parse_environment();
         log_open();
@@ -276,6 +361,10 @@ int main(int argc, char *argv[]) {
         test_log2i();
         test_execute_directory();
         test_raw_clone();
+        test_physical_memory();
+        test_physical_memory_scale();
+        test_system_tasks_max();
+        test_system_tasks_max_scale();
 
         return 0;
 }
author	Luke Shumaker <lukeshu@sbcglobal.net>	2016-09-14 18:33:57 -0400
committer	Luke Shumaker <lukeshu@sbcglobal.net>	2016-09-14 18:33:57 -0400
commit	3c72c8d3ee67388336aca58c5afa3fb93a9c24c0 (patch)
tree	d072df7fee0f5906fad88c08398b2fe887cbc064 /src
parent	e51613a3291342c6006edda8783755fb8994fd75 (diff)
parent	6ba6ca19507add38549e07058c57489a8cd98cd1 (diff)