diff --git a/0001-If-the-notification-message-length-is-0-ignore-the-m.patch b/0001-If-the-notification-message-length-is-0-ignore-the-m.patch
new file mode 100644
index 00000000..688f4785
--- /dev/null
+++ b/0001-If-the-notification-message-length-is-0-ignore-the-m.patch
@@ -0,0 +1,32 @@
+From ddcd0b726adfd78260ec3d6a446800d85980069e Mon Sep 17 00:00:00 2001
+From: Jorge Niedbalski <jorge.niedbalski@canonical.com>
+Date: Wed, 28 Sep 2016 18:25:50 -0300
+Subject: [PATCH 1/1] If the notification message length is 0, ignore the
+ message (#4237)
+
+Fixes #4234.
+
+Signed-off-by: Jorge Niedbalski <jnr@metaklass.org>
+(cherry picked from commit 531ac2b2349da02acc9c382849758e07eb92b020)
+---
+ src/core/manager.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 229cb31..56ca9cf 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1565,6 +1565,10 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+ 
+                 return -errno;
+         }
++        if (n == 0) {
++                log_debug("Got zero-length notification message. Ignoring.");
++                return 0;
++        }
+ 
+         CMSG_FOREACH(cmsg, &msghdr) {
+                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
+-- 
+2.10.0
+
diff --git a/0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch b/0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
new file mode 100644
index 00000000..99e9c6cb
--- /dev/null
+++ b/0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
@@ -0,0 +1,54 @@
+From 6dac79e09ec1b45f05b3e9a5f1f445859b6eefd2 Mon Sep 17 00:00:00 2001
+From: Franck Bui <fbui@suse.com>
+Date: Fri, 23 Sep 2016 13:33:01 +0200
+Subject: [PATCH 1/1] journal: fix HMAC calculation when appending a data
+ object
+
+Since commit 5996c7c295e073ce21d41305169132c8aa993ad0 (v190 !), the
+calculation of the HMAC is broken because the hash for a data object
+including a field is done in the wrong order: the field object is
+hashed before the data object is.
+
+However during verification, the hash is done in the opposite order as
+objects are scanned sequentially.
+
+(cherry picked from commit 33685a5a3a98c6ded64d0cc25e37d0180ceb0a6a)
+
+[fbui: fixes bsc#1000435]
+---
+ src/journal/journal-file.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
+index a9882cf..a24d97d 100644
+--- a/src/journal/journal-file.c
++++ b/src/journal/journal-file.c
+@@ -1111,6 +1111,12 @@ static int journal_file_append_data(
+         if (r < 0)
+                 return r;
+ 
++#ifdef HAVE_GCRYPT
++        r = journal_file_hmac_put_object(f, OBJECT_DATA, o, p);
++        if (r < 0)
++                return r;
++#endif
++
+         /* The linking might have altered the window, so let's
+          * refresh our pointer */
+         r = journal_file_move_to_object(f, OBJECT_DATA, p, &o);
+@@ -1135,12 +1141,6 @@ static int journal_file_append_data(
+                 fo->field.head_data_offset = le64toh(p);
+         }
+ 
+-#ifdef HAVE_GCRYPT
+-        r = journal_file_hmac_put_object(f, OBJECT_DATA, o, p);
+-        if (r < 0)
+-                return r;
+-#endif
+-
+         if (ret)
+                 *ret = o;
+ 
+-- 
+2.10.0
+
diff --git a/0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch b/0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
new file mode 100644
index 00000000..93e158b2
--- /dev/null
+++ b/0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
@@ -0,0 +1,93 @@
+From 0d0bad044f8f19c472acb69d10861a66d3d267b6 Mon Sep 17 00:00:00 2001
+From: Vito Caputo <vcaputo@gnugeneration.com>
+Date: Tue, 26 Apr 2016 23:29:43 -0700
+Subject: [PATCH 1/1] journal: set STATE_ARCHIVED as part of offlining (#2740)
+
+The only code path which makes a journal durable is via
+journal_file_set_offline().
+
+When we perform a rotate the journal's header->state is being set to
+STATE_ARCHIVED prior to journal_file_set_offline() being called.
+
+In journal_file_set_offline(), we short-circuit the entire offline when
+f->header->state != STATE_ONLINE.
+
+This all results in none of the journal_file_set_offline() fsync() calls
+being reached when rotate archives a journal, so archived journals are
+never explicitly made durable.
+
+What we do now is instead of setting the f->header->state to
+STATE_ARCHIVED directly in journal_file_rotate() prior to
+journal_file_close(), we set an archive flag in f->archive for the
+journal_file_set_offline() machinery to honor by committing
+STATE_ARCHIVED instead of STATE_OFFLINE when set.
+
+Prior to this, rotated journals were never getting fsync() explicitly
+performed on them, since journal_file_set_offline() short-circuited.
+Obviously this is undesirable, and depends entirely on the underlying
+filesystem as to how much durability was achieved when simply closing
+the file.
+
+Note that this problem existed prior to the recent asynchronous fsync
+changes, but those changes do facilitate our performing this durable
+offline on rotate without blocking, regardless of the underlying
+filesystem sync-on-close semantics.
+
+(cherry picked from commit 8eb851711fd166024297c425e9261200c36f489d)
+
+[fbui: context adjustment: the asynchronous journal_file_set_offline()
+       thingie doesn't exist in v228]
+
+[fbui: this also fixes the case when we wanted to append a tag (for
+       FSS verification) when closing the journal. Before this patch,
+       journal_file_append_tag() failed (silently) because re-opening
+       the journal to write the tag was not possible since it was
+       already in "archived" mode.]
+---
+ src/journal/journal-file.c | 10 ++++++++--
+ src/journal/journal-file.h |  1 +
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
+index f9ff954..e7eecad 100644
+--- a/src/journal/journal-file.c
++++ b/src/journal/journal-file.c
+@@ -130,7 +130,7 @@ int journal_file_set_offline(JournalFile *f) {
+         if (mmap_cache_got_sigbus(f->mmap, f->fd))
+                 return -EIO;
+ 
+-        f->header->state = STATE_OFFLINE;
++        f->header->state = f->archive ? STATE_ARCHIVED : STATE_OFFLINE;
+ 
+         if (mmap_cache_got_sigbus(f->mmap, f->fd))
+                 return -EIO;
+@@ -2813,7 +2813,13 @@ int journal_file_rotate(JournalFile **f, bool compress, bool seal) {
+         if (r < 0 && errno != ENOENT)
+                 return -errno;
+ 
+-        old_file->header->state = STATE_ARCHIVED;
++        /* Set as archive so offlining commits w/state=STATE_ARCHIVED.
++         * Previously we would set old_file->header->state to STATE_ARCHIVED directly here,
++         * but journal_file_set_offline() short-circuits when state != STATE_ONLINE, which
++         * would result in the rotated journal never getting fsync() called before closing.
++         * Now we simply queue the archive state by setting an archive bit, leaving the state
++         * as STATE_ONLINE so proper offlining occurs. */
++        old_file->archive = true;
+ 
+         /* Currently, btrfs is not very good with out write patterns
+          * and fragments heavily. Let's defrag our journal files when
+diff --git a/src/journal/journal-file.h b/src/journal/journal-file.h
+index 898d12d..436e5ff 100644
+--- a/src/journal/journal-file.h
++++ b/src/journal/journal-file.h
+@@ -76,6 +76,7 @@ typedef struct JournalFile {
+         bool compress_lz4:1;
+         bool seal:1;
+         bool defrag_on_close:1;
++        bool archive:1;
+ 
+         bool tail_entry_monotonic_valid:1;
+ 
+-- 
+2.10.0
+
diff --git a/0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch b/0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
new file mode 100644
index 00000000..c4dd9e96
--- /dev/null
+++ b/0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
@@ -0,0 +1,36 @@
+From 9f47fe6b6a9aad001e99f1fdea78a0c54ce8ae55 Mon Sep 17 00:00:00 2001
+From: Franck Bui <fbui@suse.com>
+Date: Fri, 23 Sep 2016 12:12:13 +0200
+Subject: [PATCH 1/1] journal: warn when we fail to append a tag to a journal
+
+We shouldn't silently fail when appending the tag to a journal file
+since FSS protection will simply be disabled in this case.
+
+(cherry picked from commit 43cd8794839548a6f332875e8bee8bed2652bf2c)
+---
+ src/journal/journal-file.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
+index e7eecad..a9882cf 100644
+--- a/src/journal/journal-file.c
++++ b/src/journal/journal-file.c
+@@ -145,8 +145,13 @@ JournalFile* journal_file_close(JournalFile *f) {
+ 
+ #ifdef HAVE_GCRYPT
+         /* Write the final tag */
+-        if (f->seal && f->writable)
+-                journal_file_append_tag(f);
++        if (f->seal && f->writable) {
++                int r;
++
++                r = journal_file_append_tag(f);
++                if (r < 0)
++                        log_error_errno(r, "Failed to append tag when closing journal: %m");
++        }
+ #endif
+ 
+         journal_file_set_offline(f);
+-- 
+2.10.0
+
diff --git a/0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch b/0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
new file mode 100644
index 00000000..73ebf147
--- /dev/null
+++ b/0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
@@ -0,0 +1,51 @@
+From c47885438517ac77ee34a30ee3d09e5deb9968f6 Mon Sep 17 00:00:00 2001
+From: Franck Bui <fbui@suse.com>
+Date: Thu, 29 Sep 2016 19:44:34 +0200
+Subject: [PATCH 1/1] pid1: don't return any error in
+ manager_dispatch_notify_fd() (#4240)
+
+If manager_dispatch_notify_fd() fails and returns an error then the handling of
+service notifications will be disabled entirely leading to a compromised system.
+
+For example pid1 won't be able to receive the WATCHDOG messages anymore and
+will kill all services supposed to send such messages.
+(cherry picked from commit 9987750e7a4c62e0eb8473603150596ba7c3a015)
+---
+ src/core/manager.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 56ca9cf..06d78e4 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1560,10 +1560,14 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+ 
+         n = recvmsg(m->notify_fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
+         if (n < 0) {
+-                if (errno == EAGAIN || errno == EINTR)
+-                        return 0;
++                if (!IN_SET(errno, EAGAIN, EINTR))
++                        log_error("Failed to receive notification message: %m");
+ 
+-                return -errno;
++                /* It's not an option to return an error here since it
++                 * would disable the notification handler entirely. Services
++                 * wouldn't be able to send the WATCHDOG message for
++                 * example... */
++                return 0;
+         }
+         if (n == 0) {
+                 log_debug("Got zero-length notification message. Ignoring.");
+@@ -1590,7 +1594,8 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+                 r = fdset_new_array(&fds, fd_array, n_fds);
+                 if (r < 0) {
+                         close_many(fd_array, n_fds);
+-                        return log_oom();
++                        log_oom();
++                        return 0;
+                 }
+         }
+ 
+-- 
+2.10.0
+
diff --git a/0001-pid1-more-informative-error-message-for-ignored-noti.patch b/0001-pid1-more-informative-error-message-for-ignored-noti.patch
new file mode 100644
index 00000000..6773ccd3
--- /dev/null
+++ b/0001-pid1-more-informative-error-message-for-ignored-noti.patch
@@ -0,0 +1,38 @@
+From eb54b43fe31392c9f77505d8f9cd86d1f050b49d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Thu, 29 Sep 2016 16:07:41 +0200
+Subject: [PATCH 1/1] pid1: more informative error message for ignored
+ notifications
+
+It's probably easier to diagnose a bad notification message if the
+contents are printed. But still, do anything only if debugging is on.
+
+(cherry picked from commit a86b76753d7868c2d05f046f601bc7dc89fc2203)
+---
+ src/core/manager.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 58d346e..0d0158a 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1516,8 +1516,14 @@ static void manager_invoke_notify_message(Manager *m, Unit *u, pid_t pid, const
+ 
+         if (UNIT_VTABLE(u)->notify_message)
+                 UNIT_VTABLE(u)->notify_message(u, pid, tags, fds);
+-        else
+-                log_unit_debug(u, "Got notification message for unit. Ignoring.");
++        else if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
++                _cleanup_free_ char *x = NULL, *y = NULL;
++
++                x = cescape(buf);
++                if (x)
++                        y = ellipsize(x, 20, 90);
++                log_unit_debug(u, "Got notification message \"%s\", ignoring.", strnull(y));
++        }
+ }
+ 
+ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
+-- 
+2.10.0
+
diff --git a/0001-pid1-process-zero-length-notification-messages-again.patch b/0001-pid1-process-zero-length-notification-messages-again.patch
new file mode 100644
index 00000000..72e6905f
--- /dev/null
+++ b/0001-pid1-process-zero-length-notification-messages-again.patch
@@ -0,0 +1,82 @@
+From 98c4bab7add94bdfb6cc238376c47a9c73a4fe39 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Thu, 29 Sep 2016 16:06:02 +0200
+Subject: [PATCH 1/1] pid1: process zero-length notification messages again
+
+This undoes 531ac2b234. I acked that patch without looking at the code
+carefully enough. There are two problems:
+- we want to process the fds anyway
+- in principle empty notification messages are valid, and we should
+  process them as usual, including logging using log_unit_debug().
+
+(cherry picked from commit 8523bf7dd514a3a2c6114b7b8fb8f308b4f09fc4)
+
+[fbui: adjust context]
+---
+ src/core/manager.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 06d78e4..58d346e 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1501,13 +1501,12 @@ static unsigned manager_dispatch_dbus_queue(Manager *m) {
+         return n;
+ }
+ 
+-static void manager_invoke_notify_message(Manager *m, Unit *u, pid_t pid, const char *buf, size_t n, FDSet *fds) {
++static void manager_invoke_notify_message(Manager *m, Unit *u, pid_t pid, const char *buf, FDSet *fds) {
+         _cleanup_strv_free_ char **tags = NULL;
+ 
+         assert(m);
+         assert(u);
+         assert(buf);
+-        assert(n > 0);
+ 
+         tags = strv_split(buf, "\n\r");
+         if (!tags) {
+@@ -1569,10 +1568,6 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+                  * example... */
+                 return 0;
+         }
+-        if (n == 0) {
+-                log_debug("Got zero-length notification message. Ignoring.");
+-                return 0;
+-        }
+ 
+         CMSG_FOREACH(cmsg, &msghdr) {
+                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
+@@ -1609,25 +1604,27 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+                 return 0;
+         }
+ 
++        /* The message should be a string. Here we make sure it's NUL-terminated,
++         * but only the part until first NUL will be used anyway. */
+         buf[n] = 0;
+ 
+         /* Notify every unit that might be interested, but try
+          * to avoid notifying the same one multiple times. */
+         u1 = manager_get_unit_by_pid_cgroup(m, ucred->pid);
+         if (u1) {
+-                manager_invoke_notify_message(m, u1, ucred->pid, buf, n, fds);
++                manager_invoke_notify_message(m, u1, ucred->pid, buf, fds);
+                 found = true;
+         }
+ 
+         u2 = hashmap_get(m->watch_pids1, PID_TO_PTR(ucred->pid));
+         if (u2 && u2 != u1) {
+-                manager_invoke_notify_message(m, u2, ucred->pid, buf, n, fds);
++                manager_invoke_notify_message(m, u2, ucred->pid, buf, fds);
+                 found = true;
+         }
+ 
+         u3 = hashmap_get(m->watch_pids2, PID_TO_PTR(ucred->pid));
+         if (u3 && u3 != u2 && u3 != u1) {
+-                manager_invoke_notify_message(m, u3, ucred->pid, buf, n, fds);
++                manager_invoke_notify_message(m, u3, ucred->pid, buf, fds);
+                 found = true;
+         }
+ 
+-- 
+2.10.0
+
diff --git a/0001-rules-block-add-support-for-pmem-devices-3683.patch b/0001-rules-block-add-support-for-pmem-devices-3683.patch
new file mode 100644
index 00000000..2af5f771
--- /dev/null
+++ b/0001-rules-block-add-support-for-pmem-devices-3683.patch
@@ -0,0 +1,51 @@
+From 31ae8c8741ce9595f4053234d6a6b2fb3616fedf Mon Sep 17 00:00:00 2001
+From: bgbhpe <brian.boylston@hpe.com>
+Date: Fri, 8 Jul 2016 11:43:56 -0400
+Subject: [PATCH 1/1] rules: block: add support for pmem devices (#3683)
+
+Persistent memory devices can be exposed as block devices as /dev/pmemN
+and /dev/pmemNs.  pmemN is the raw device and is byte-addressable from
+within the kernel and when mmapped by applications from a DAX-mounted
+file system.  pmemNs has the block translation table (BTT) layered on top,
+offering atomic sector/block access.  Both pmemN and pmemNs are expected
+to contain file systems.
+
+blkid(8) and lsblk(8) seem to correctly report on pmemN and pmemNs.
+systemd v219 will populate /dev/disk/by-uuid/ when, for example, mkfs is
+used on pmem, but systemd v228 does not.
+
+Add pmem to the whitelist.
+(cherry picked from commit f3bc4ccc2edf5ad2a99d6ba2795b9999fe76c3df)
+
+[tblume: fixes bsc#988119]
+---
+ rules/60-block.rules              | 2 +-
+ rules/60-persistent-storage.rules | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/rules/60-block.rules b/rules/60-block.rules
+index c74caca..42c7597 100644
+--- a/rules/60-block.rules
++++ b/rules/60-block.rules
+@@ -8,4 +8,4 @@ ACTION=="add", SUBSYSTEM=="module", KERNEL=="block", ATTR{parameters/events_dfl_
+ ACTION=="change", SUBSYSTEM=="scsi", ENV{DEVTYPE}=="scsi_device", TEST=="block", ATTR{block/*/uevent}="change"
+ 
+ # watch metadata changes, caused by tools closing the device node which was opened for writing
+-ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop*|nvme*|sd*|vd*|xvd*", OPTIONS+="watch"
++ACTION!="remove", SUBSYSTEM=="block", KERNEL=="loop*|nvme*|sd*|vd*|xvd*|pmem*", OPTIONS+="watch"
+diff --git a/rules/60-persistent-storage.rules b/rules/60-persistent-storage.rules
+index ee1fb08f..ef5d205 100644
+--- a/rules/60-persistent-storage.rules
++++ b/rules/60-persistent-storage.rules
+@@ -6,7 +6,7 @@
+ ACTION=="remove", GOTO="persistent_storage_end"
+ 
+ SUBSYSTEM!="block", GOTO="persistent_storage_end"
+-KERNEL!="loop*|mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|nvme*|sd*|sr*|vd*|xvd*|bcache*|cciss*|dasd*|ubd*", GOTO="persistent_storage_end"
++KERNEL!="loop*|mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|nvme*|sd*|sr*|vd*|xvd*|bcache*|cciss*|dasd*|ubd*|pmem*", GOTO="persistent_storage_end"
+ 
+ # ignore partitions that span the entire disk
+ TEST=="whole_disk", GOTO="persistent_storage_end"
+-- 
+2.10.0
+
diff --git a/systemd-mini.changes b/systemd-mini.changes
index 33c5c5bc..e71f989e 100644
--- a/systemd-mini.changes
+++ b/systemd-mini.changes
@@ -1,3 +1,82 @@
+-------------------------------------------------------------------
+Fri Sep 30 06:07:06 UTC 2016 - fbui@suse.com
+
+- Import a better fix from upstream for bsc#1001765
+
+  - Added:
+
+    0001-pid1-more-informative-error-message-for-ignored-noti.patch
+    0001-pid1-process-zero-length-notification-messages-again.patch
+
+  - Updated (no code changes, only patch metadata)
+
+    0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+    0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+
+-------------------------------------------------------------------
+Thu Sep 29 13:05:44 UTC 2016 - fbui@suse.com
+
+- Re add back "udev: don't require nsserv and fillup"
+
+  Did this in the wrong project... it was a complicated day today ;)
+
+-------------------------------------------------------------------
+Thu Sep 29 12:51:38 UTC 2016 - fbui@suse.com
+
+- Added 2 patches to fix bsc#1001765
+
+  0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+  0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+
+-------------------------------------------------------------------
+Thu Sep 29 06:24:01 UTC 2016 - fbui@suse.com
+
+- Revert "udev: don't require nsserv and fillup"
+
+  It's been judged too late for being part of SLE12 final release.
+  Nevertheless it's part of Factory and will be reintroduced after the
+  final release is out (ie through an update).
+
+-------------------------------------------------------------------
+Mon Sep 26 14:23:14 UTC 2016 - fbui@suse.com
+
+- systemd-sysv-convert: make sure that
+  /var/lib/systemd/sysv-convert/database is always initialized (bsc#982211)
+
+  If "--save" command was used and the sysv init script wasn't enabled
+  at all the database file wasn't created at all. This makes the
+  subsequent call to "--apply" fail even though this should not
+  considered as an error.
+
+-------------------------------------------------------------------
+Mon Sep 26 09:09:27 UTC 2016 - fbui@suse.com
+
+- Added patches to fix journal with FSS protection enabled (bsc#1000435)
+
+   0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
+   0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
+   0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
+
+-------------------------------------------------------------------
+Wed Sep 21 11:54:39 UTC 2016 - fbui@suse.com
+
+- udev: don't require nsserv and fillup (bsc#999841)
+
+  udev has no LSB init scripts nor fillup templates anymore.
+
+-------------------------------------------------------------------
+Fri Sep 16 12:38:19 UTC 2016 - fbui@suse.com
+
+- Build require python and python-lxml in order to generate
+  systemd.directives man page (bsc#986952)
+
+-------------------------------------------------------------------
+Fri Sep 16 12:27:02 UTC 2016 - fbui@suse.com
+
+- Add rules: block: add support for pmem devices (#3683) (bsc#988119)
+
+  0001-rules-block-add-support-for-pmem-devices-3683.patch
+
 -------------------------------------------------------------------
 Tue Sep  6 08:14:06 UTC 2016 - tbechtold@suse.com
 
diff --git a/systemd-mini.spec b/systemd-mini.spec
index fcbbf9b6..c1c25587 100644
--- a/systemd-mini.spec
+++ b/systemd-mini.spec
@@ -27,7 +27,6 @@
 %bcond_without  networkd
 %bcond_without  sysvcompat
 %bcond_with     resolved
-%bcond_with     python
 %bcond_with     parentpathid
 %if 0%{?suse_version} > 1315
 %bcond_without  permission
@@ -93,12 +92,12 @@ BuildRequires:  docbook-xsl-stylesheets
 BuildRequires:  libgcrypt-devel
 BuildRequires:  libxslt-tools
 # curl and bzip2 are required for building importd
+BuildRequires:  libapparmor-devel
 BuildRequires:  pkgconfig(bzip2)
 BuildRequires:  pkgconfig(libcurl)
-%if %{with python}
-BuildRequires:  python
-%endif
-BuildRequires:  libapparmor-devel
+# python is only required for generating systemd.directives.xml
+BuildRequires:  python3
+BuildRequires:  python3-lxml
 BuildRequires:  pkgconfig(libcryptsetup) >= 1.6.0
 BuildRequires:  pkgconfig(libmicrohttpd)
 BuildRequires:  pkgconfig(libqrencode)
@@ -264,6 +263,15 @@ Patch528:       0001-core-re-sync-bus-name-list-after-deserializing-durin.patch
 Patch529:       0001-systemctl-pid1-do-not-warn-about-missing-install-inf.patch
 # PATCH-FIX-UPSTREAM -- fixed after 320
 Patch530:       systemd-230-cgroup2-use-new-fstype-for-unified-hierarchy.patch
+# PATCH-FIX-UPSTREAM -- fixed after 231
+Patch531:       0001-rules-block-add-support-for-pmem-devices-3683.patch
+Patch532:       0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
+Patch533:       0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
+Patch534:       0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
+Patch535:       0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+Patch536:       0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+Patch537:       0001-pid1-process-zero-length-notification-messages-again.patch
+Patch538:       0001-pid1-more-informative-error-message-for-ignored-noti.patch
 
 # UDEV PATCHES
 # ============
@@ -394,8 +402,6 @@ License:        GPL-2.0
 Group:          System/Kernel
 Url:            http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html
 PreReq:         /bin/rm
-PreReq:         %insserv_prereq
-PreReq:         %fillup_prereq
 # Avoid bootstrap cycle with sg3_utils
 %if "%{?mini}" == ""
 PreReq:         /usr/bin/sg_inq
@@ -611,6 +617,14 @@ cp %{SOURCE7} m4/
 %patch528 -p1
 %patch529 -p1
 %patch530 -p1
+%patch531 -p1
+%patch532 -p1
+%patch533 -p1
+%patch534 -p1
+%patch535 -p1
+%patch536 -p1
+%patch537 -p1
+%patch538 -p1
 
 # udev patches
 %patch1002 -p1
@@ -683,9 +697,6 @@ export CFLAGS="%{optflags}"
   --disable-importd \
 %else
   --enable-manpages \
-%if %{with python}
-  --with-python \
-%endif
   --with-nss-my-hostname-warning \
 %endif
   --enable-selinux \
@@ -1082,7 +1093,7 @@ if [ "${YAST_IS_RUNNING}" != "instsys" ]; then
 fi
 
 %postun -n udev%{?mini}
-%insserv_cleanup
+
 systemctl daemon-reload || :
 
 if [ "${YAST_IS_RUNNING}" != "instsys" ]; then
diff --git a/systemd-sysv-convert b/systemd-sysv-convert
index 8ba3f211..4d98e4f6 100644
--- a/systemd-sysv-convert
+++ b/systemd-sysv-convert
@@ -118,9 +118,9 @@ case "$1" in
 				find_service $service $runlevel
 				priority=$?
 				if [ $priority -lt 255 ]; then
-					echo "$service	$runlevel	$priority" >> /var/lib/systemd/sysv-convert/database
+					echo "$service	$runlevel	$priority"
 				fi
-			done
+			done >>/var/lib/systemd/sysv-convert/database
 		done
 		;;
 	--show)
@@ -158,11 +158,9 @@ case "$1" in
 			[ -f "/lib/systemd/system/$service.service" ] && service_file="/lib/systemd/system/$service.service" 
 			[ -f "/usr/lib/systemd/system/$service.service" ] && service_file="/usr/lib/systemd/system/$service.service" 
 
-			if [ -z "${results_runlevel[$service]}" ]; then
-				echo No information found about service $service found. >/dev/stderr
-				fail=1
-				continue
-			fi
+			# If $service is not present in the database,
+			# then it simply means that the sysv init
+			# service was not enabled at all.
 			for runlevel in ${results_runlevel[$service]}; do
 				echo ln -sf $service_file /etc/systemd/system/runlevel$runlevel.target.wants/$service.service >/dev/stderr
 				mkdir -p "/etc/systemd/system/runlevel$runlevel.target.wants"
diff --git a/systemd.changes b/systemd.changes
index 33c5c5bc..e71f989e 100644
--- a/systemd.changes
+++ b/systemd.changes
@@ -1,3 +1,82 @@
+-------------------------------------------------------------------
+Fri Sep 30 06:07:06 UTC 2016 - fbui@suse.com
+
+- Import a better fix from upstream for bsc#1001765
+
+  - Added:
+
+    0001-pid1-more-informative-error-message-for-ignored-noti.patch
+    0001-pid1-process-zero-length-notification-messages-again.patch
+
+  - Updated (no code changes, only patch metadata)
+
+    0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+    0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+
+-------------------------------------------------------------------
+Thu Sep 29 13:05:44 UTC 2016 - fbui@suse.com
+
+- Re add back "udev: don't require nsserv and fillup"
+
+  Did this in the wrong project... it was a complicated day today ;)
+
+-------------------------------------------------------------------
+Thu Sep 29 12:51:38 UTC 2016 - fbui@suse.com
+
+- Added 2 patches to fix bsc#1001765
+
+  0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+  0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+
+-------------------------------------------------------------------
+Thu Sep 29 06:24:01 UTC 2016 - fbui@suse.com
+
+- Revert "udev: don't require nsserv and fillup"
+
+  It's been judged too late for being part of SLE12 final release.
+  Nevertheless it's part of Factory and will be reintroduced after the
+  final release is out (ie through an update).
+
+-------------------------------------------------------------------
+Mon Sep 26 14:23:14 UTC 2016 - fbui@suse.com
+
+- systemd-sysv-convert: make sure that
+  /var/lib/systemd/sysv-convert/database is always initialized (bsc#982211)
+
+  If "--save" command was used and the sysv init script wasn't enabled
+  at all the database file wasn't created at all. This makes the
+  subsequent call to "--apply" fail even though this should not
+  considered as an error.
+
+-------------------------------------------------------------------
+Mon Sep 26 09:09:27 UTC 2016 - fbui@suse.com
+
+- Added patches to fix journal with FSS protection enabled (bsc#1000435)
+
+   0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
+   0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
+   0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
+
+-------------------------------------------------------------------
+Wed Sep 21 11:54:39 UTC 2016 - fbui@suse.com
+
+- udev: don't require nsserv and fillup (bsc#999841)
+
+  udev has no LSB init scripts nor fillup templates anymore.
+
+-------------------------------------------------------------------
+Fri Sep 16 12:38:19 UTC 2016 - fbui@suse.com
+
+- Build require python and python-lxml in order to generate
+  systemd.directives man page (bsc#986952)
+
+-------------------------------------------------------------------
+Fri Sep 16 12:27:02 UTC 2016 - fbui@suse.com
+
+- Add rules: block: add support for pmem devices (#3683) (bsc#988119)
+
+  0001-rules-block-add-support-for-pmem-devices-3683.patch
+
 -------------------------------------------------------------------
 Tue Sep  6 08:14:06 UTC 2016 - tbechtold@suse.com
 
diff --git a/systemd.spec b/systemd.spec
index a3d3d79e..ca15920f 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -25,7 +25,6 @@
 %bcond_without  networkd
 %bcond_without  sysvcompat
 %bcond_with     resolved
-%bcond_with     python
 %bcond_with     parentpathid
 %if 0%{?suse_version} > 1315
 %bcond_without  permission
@@ -88,12 +87,12 @@ BuildRequires:  docbook-xsl-stylesheets
 BuildRequires:  libgcrypt-devel
 BuildRequires:  libxslt-tools
 # curl and bzip2 are required for building importd
+BuildRequires:  libapparmor-devel
 BuildRequires:  pkgconfig(bzip2)
 BuildRequires:  pkgconfig(libcurl)
-%if %{with python}
-BuildRequires:  python
-%endif
-BuildRequires:  libapparmor-devel
+# python is only required for generating systemd.directives.xml
+BuildRequires:  python3
+BuildRequires:  python3-lxml
 BuildRequires:  pkgconfig(libcryptsetup) >= 1.6.0
 BuildRequires:  pkgconfig(libmicrohttpd)
 BuildRequires:  pkgconfig(libqrencode)
@@ -259,6 +258,15 @@ Patch528:       0001-core-re-sync-bus-name-list-after-deserializing-durin.patch
 Patch529:       0001-systemctl-pid1-do-not-warn-about-missing-install-inf.patch
 # PATCH-FIX-UPSTREAM -- fixed after 320
 Patch530:       systemd-230-cgroup2-use-new-fstype-for-unified-hierarchy.patch
+# PATCH-FIX-UPSTREAM -- fixed after 231
+Patch531:       0001-rules-block-add-support-for-pmem-devices-3683.patch
+Patch532:       0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
+Patch533:       0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
+Patch534:       0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
+Patch535:       0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+Patch536:       0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+Patch537:       0001-pid1-process-zero-length-notification-messages-again.patch
+Patch538:       0001-pid1-more-informative-error-message-for-ignored-noti.patch
 
 # UDEV PATCHES
 # ============
@@ -389,8 +397,6 @@ License:        GPL-2.0
 Group:          System/Kernel
 Url:            http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html
 PreReq:         /bin/rm
-PreReq:         %insserv_prereq
-PreReq:         %fillup_prereq
 # Avoid bootstrap cycle with sg3_utils
 %if "%{?mini}" == ""
 PreReq:         /usr/bin/sg_inq
@@ -606,6 +612,14 @@ cp %{SOURCE7} m4/
 %patch528 -p1
 %patch529 -p1
 %patch530 -p1
+%patch531 -p1
+%patch532 -p1
+%patch533 -p1
+%patch534 -p1
+%patch535 -p1
+%patch536 -p1
+%patch537 -p1
+%patch538 -p1
 
 # udev patches
 %patch1002 -p1
@@ -678,9 +692,6 @@ export CFLAGS="%{optflags}"
   --disable-importd \
 %else
   --enable-manpages \
-%if %{with python}
-  --with-python \
-%endif
   --with-nss-my-hostname-warning \
 %endif
   --enable-selinux \
@@ -1077,7 +1088,7 @@ if [ "${YAST_IS_RUNNING}" != "instsys" ]; then
 fi
 
 %postun -n udev%{?mini}
-%insserv_cleanup
+
 systemctl daemon-reload || :
 
 if [ "${YAST_IS_RUNNING}" != "instsys" ]; then