diff --git a/.clevis.metadata b/.clevis.metadata
index cf38ada..8d0a0c5 100644
--- a/.clevis.metadata
+++ b/.clevis.metadata
@@ -1 +1 @@
-905a3b7a326dfc8e84a0b09d3246bea3d048fa78 SOURCES/clevis-20.tar.xz
+14f8ca6f130651b468c73568e236522839c104a7 SOURCES/clevis-21.tar.xz
diff --git a/.gitignore b/.gitignore
index 35c36d7..76ba17b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/clevis-20.tar.xz
+SOURCES/clevis-21.tar.xz
diff --git a/SOURCES/0001-Include-miscellaneous-sast-fixes-clevis-luks-udisk-2.patch b/SOURCES/0001-Include-miscellaneous-sast-fixes-clevis-luks-udisk-2.patch
deleted file mode 100644
index 263166d..0000000
--- a/SOURCES/0001-Include-miscellaneous-sast-fixes-clevis-luks-udisk-2.patch
+++ /dev/null
@@ -1,56 +0,0 @@
---- clevis-20.old/src/luks/udisks2/clevis-luks-udisks2.c	2024-03-08 09:35:37.000000000 +0100
-+++ clevis-20/src/luks/udisks2/clevis-luks-udisks2.c	2024-05-21 10:04:15.301469592 +0200
-@@ -264,8 +264,10 @@
- 
- error:
-     g_list_free_full(ctx.lst, g_free);
--    g_main_loop_unref(ctx.loop);
--    g_object_unref(ctx.clt);
-+    if (ctx.loop) 
-+        g_main_loop_unref(ctx.loop);
-+    if (ctx.clt) 
-+        g_object_unref(ctx.clt);
-     close(sock);
-     return exit_status;
- }
-@@ -299,12 +301,12 @@
-     safeclose(&pair[0]);
- }
- 
--static ssize_t
--recover_key(const pkt_t *jwe, char *out, size_t max, uid_t uid, gid_t gid)
-+static uint32_t
-+recover_key(const pkt_t *jwe, char *out, int32_t max, uid_t uid, gid_t gid)
- {
-     int push[2] = { -1, -1 };
-     int pull[2] = { -1, -1 };
--    ssize_t bytes = 0;
-+    int32_t bytes = 0;
-     pid_t chld = 0;
- 
-     if (pipe(push) != 0)
-@@ -379,12 +381,18 @@
-     }
- 
-     bytes = 0;
--    for (ssize_t block = 1; block > 0; bytes += block) {
--        block = read(pull[PIPE_RD], &out[bytes], max - bytes);
--        if (block < 0) {
--            kill(chld, SIGTERM);
--            goto error;
--        }
-+    ssize_t block = 0;
-+    while (max > 0 && max > bytes) {
-+       do {
-+           block = read(pull[PIPE_RD], &out[bytes], max - bytes);
-+       } while (block < 0 && errno == EINTR);
-+       if (block < 0 || block < INT32_MIN || block > INT32_MAX) {
-+           kill(chld, SIGTERM);
-+           goto error;
-+       }
-+       if (block == 0)
-+           break;
-+       bytes += block;
-     }
- 
-     safeclose(&pull[PIPE_RD]);
diff --git a/SOURCES/0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch b/SOURCES/0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch
new file mode 100644
index 0000000..a80fe03
--- /dev/null
+++ b/SOURCES/0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch
@@ -0,0 +1,288 @@
+From 691b4136d6077ed7b079a38459b6844dbc584776 Mon Sep 17 00:00:00 2001
+From: Sergio Arroutbi <sarroutb@redhat.com>
+Date: Mon, 30 Sep 2024 11:27:57 +0200
+Subject: [PATCH] PKCS#11 pin: fix dracut for unconfigured device
+
+Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com>
+---
+ .../clevis-pin-pkcs11/module-setup.sh.in      |  2 +-
+ src/luks/systemd/clevis-luks-pkcs11-askpin.in | 72 +++++--------------
+ .../clevis-pkcs11-afunix-socket-unlock.c      |  9 ++-
+ src/pins/pkcs11/clevis-pkcs11-common          | 52 +++++++++++++-
+ 4 files changed, 74 insertions(+), 61 deletions(-)
+
+diff --git a/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in b/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in
+index 39d06a0..a7a6d6b 100755
+--- a/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in
++++ b/src/luks/dracut/clevis-pin-pkcs11/module-setup.sh.in
+@@ -23,7 +23,7 @@ depends() {
+ }
+ 
+ install() {
+-    inst_hook initqueue 60 "${moddir}/clevis-pkcs11-prehook.sh"
++    inst_hook pre-trigger 60 "${moddir}/clevis-pkcs11-prehook.sh"
+     inst_hook initqueue/settled 60 "${moddir}/clevis-pkcs11-hook.sh"
+     inst_hook initqueue/online 60 "${moddir}/clevis-pkcs11-hook.sh"
+ 
+diff --git a/src/luks/systemd/clevis-luks-pkcs11-askpin.in b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
+index 8f4092f..b860efa 100755
+--- a/src/luks/systemd/clevis-luks-pkcs11-askpin.in
++++ b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
+@@ -52,6 +52,7 @@ get_pkcs11_error() {
+     return 0
+ }
+ 
++
+ if command -v pcscd; then
+     echo "clevis-pkcs11: starting pcscd if not available ..."
+     PCSCD_PID=$(ps auxf | grep "[p]cscd")
+@@ -72,51 +73,6 @@ if [ "${dracut_mode}" != true ]; then
+     pkcs11-tool -L
+ fi
+ 
+-if ! pkcs11_device=$(pkcs11-tool -L 2>/dev/null | grep "Slot" | head -1 | \
+-	                 awk -F ":" '{print $2}' | sed -e 's@^ *@@g'); then
+-    echo "No PKCS11 device detected (without module option) / pkcs11-tool error"
+-    exit 1
+-fi
+-
+-if ! pkcs11-tool -O 2>/dev/null 1>/dev/null; then
+-    pkcs11_device=""
+-    echo "No objects in PKCS11 device detected"
+-fi
+-
+-while [ -z "${pkcs11_device}" ]; do
+-    if [ "${dracut_mode}" != true ]; then
+-        module_paths=$(clevis_get_module_path_from_pkcs11_config "/etc/crypttab")
+-        if [ -n "${module_paths}" ]; then
+-            modules=$(echo ${module_paths} | tr ";" "\n")
+-            for module in $modules; do
+-                pkcs11_device=$(pkcs11-tool -L --module ${module} | grep "Slot" \
+-                                | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
+-                if [ -n "${pkcs11_device}" ]; then
+-                    break;
+-                fi
+-            done
+-        fi
+-    fi
+-    if [ -z "${pkcs11_device}" ]; then
+-        if [ "${retry_mode}" == true ]; then
+-            option=$(systemd-ask-password --echo "Detected no PKCS#11 device, retry PKCS#11 detection? [yY/nN]")
+-            if [ "${option}" == "N" ] || [ "${option}" == "n" ] ; then
+-                echo "Won't continue PKCS11 device detection"
+-                exit 0
+-            fi
+-            pkcs11_device=$(pkcs11-tool -L | grep "Slot" \
+-                                | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
+-            if ! pkcs11-tool -O 2>/dev/null; then
+-                pkcs11_device=""
+-                echo "No objects in PKCS11 device detected"
+-            fi
+-        else
+-            exit 0
+-        fi
+-    fi
+-done
+-echo "Detected PKCS11 device:${pkcs11_device}"
+-
+ devices_array=()
+ # Let's analyze all entries from /etc/crypttab that contain clevis-pkcs11.sock entries
+ while read -r line;
+@@ -126,6 +82,8 @@ do
+         next_device=0
+         errors=0
+         msg=""
++        # Store passphrases to send to control socket
++        systemd_device=$(echo "${line}" | awk '{print $1}')
+         while [ ${next_device} -ne 1 ]; do
+             uuid=$(echo "${line}" | awk '{print $2}')
+             if ! mapped_device=$(clevis_map_device "${uuid}"); then
+@@ -141,15 +99,23 @@ do
+             fi
+             # If no PKCS#11 configuration, advance to next device
+             if ! clevis luks list -d "${mapped_device}" | grep pkcs11 >/dev/null 2>&1; then
+-                echo "Device:${mapped_device} does not contain PKCS#11 configuration"
++                echo "Device:${mapped_device} does not contain PKCS#11 configuration" >&2
++                # Send a wrong passphrase
++                echo -n "${systemd_device},NOPASSWORDFOR${systemd_device}" | socat UNIX-CONNECT:/run/systemd/clevis-pkcs11.control.sock -
+                 next_device=1
+                 continue
+             fi
++            if ! pkcs11_device=$(clevis_detect_pkcs11_device "${dracut_mode}" "${retry_mode}"); then
++                echo "No PKCS11 device detected" >&2
++                exit 0
++            else
++                echo "Detected PKCS11 device:${pkcs11_device}" >&2
++            fi
+             # Get configuration PKCS#11 URI
+             uri=$(clevis luks list -d "${mapped_device}" | awk -F '"uri":' '{print $2}' | awk -F '"' '{print $2}' | awk -F '"' '{print $1}')
+             slot_opt=""
+             if ! slot=$(clevis_get_pkcs11_final_slot_from_uri "${uri}"); then
+-                echo "Could not find slot for uri:${uri}"
++                echo "Could not find slot for uri:${uri}" >&2
+             else
+                 slot_opt="--slot-index ${slot}"
+             fi
+@@ -159,8 +125,9 @@ do
+                 module_opt="--module ${module}"
+             fi
+             echo "Device:${mapped_device}, slot_opt:${slot_opt}, module_opt:${module_opt}"
+-            if ! pkcs11-tool -O ${module_opt} ${slot_opt}; then
+-                echo "No objects on slot:${slot}, module_opt:${module_opt}"
++            if ! pkcs11-tool -O ${module_opt} ${slot_opt} 2>/dev/null 1>/dev/null; then
++                echo "No objects on slot:${slot}, module_opt:${module_opt}" >&2
++                echo -n "${systemd_device},NOPASSWORDFOR${systemd_device}" | socat UNIX-CONNECT:/run/systemd/clevis-pkcs11.control.sock -
+                 next_device=1
+                 continue
+             fi
+@@ -175,22 +142,21 @@ do
+             # Get key from PKCS11 pin here and feed AF_UNIX socket program
+             echo "${pin}" > /run/systemd/clevis-pkcs11.pin
+             if ! passphrase=$(clevis_luks_unlock_device "${mapped_device}") || [ -z "${passphrase}" ]; then
+-                echo "Could not unlock device:${mapped_device}"
++                echo "Could not unlock device:${mapped_device}" >&2
+                 msg="$(get_pkcs11_error)"
+                 ((errors++))
+                 if [ ${errors} -eq ${too_many_errors} ]; then
+-                    echo "Too many errors !!!" 1>&2
++                    echo "Too many errors !!!" >&2
+                     next_device=1
+                 fi
+                 continue
+             fi
+             next_device=1
+-            echo "Device:${mapped_device} unlocked successfully by clevis"
++            echo "Device:${mapped_device} unlocked successfully by clevis" >&2
+             if [ "${dracut_mode}" == true ]; then
+                 echo "${mapped_device}" >> /run/systemd/clevis-pkcs11-dracut.devices
+             fi
+             # Store passphrases to send to control socket
+-            systemd_device=$(echo "${line}" | awk '{print $1}')
+             devices_array+=("${systemd_device},${passphrase}")
+         done
+     fi
+diff --git a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
+index a6ecc63..24bad83 100644
+--- a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
++++ b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
+@@ -146,7 +146,6 @@ static void* control_thread(void *targ) {
+         }
+         char* t = control_msg;
+         int is_device = 1;
+-        fprintf(logfile, "Received control message:[%s]\n", t);
+         while((t = strtok(t, ","))) {
+             if (is_device) {
+                 fprintf(logfile, "Adding device:%s\n", t);
+@@ -185,7 +184,7 @@ static void dump_wide_version(void) {
+ 
+ static void int_handler(int s) {
+     if(logfile) {
+-        fprintf(logfile, "Closing, signal:[%d]\n", s);
++        fprintf(logfile, "Closing, received signal:[%d]\n", s);
+         fclose(logfile);
+     }
+     exit(EXIT_FAILURE);
+@@ -222,6 +221,7 @@ int main(int argc, char* argv[]) {
+             break;
+         case 'f':
+             strncpy(sock_file, optarg, MAX_PATH - 1);
++            unlink(sock_file);
+             break;
+         case 'k':
+             strncpy(key, optarg, MAX_KEY - 1);
+@@ -275,7 +275,6 @@ int main(int argc, char* argv[]) {
+     memset(&sock_addr, 0, sizeof(sock_addr));
+     sock_addr.sun_family = AF_UNIX;
+     strncpy(sock_addr.sun_path, sock_file, sizeof(sock_addr.sun_path)-1);
+-    unlink(sock_file);
+     s = socket(AF_UNIX, SOCK_STREAM, 0);
+     if (s == -1) {
+         perror("socket");
+@@ -346,8 +345,8 @@ int main(int argc, char* argv[]) {
+                     perror("key entry send error");
+                     goto efailure;
+                 }
+-                fprintf(logfile, "Sending:[%s] to device:[%s]\n",
+-                        entry_key, unlocking_device);
++                fprintf(logfile, "Sending passphrase to device:[%s]\n",
++                        unlocking_device);
+             } else {
+                 fprintf(logfile, "Device not found: [%s]\n", unlocking_device);
+             }
+diff --git a/src/pins/pkcs11/clevis-pkcs11-common b/src/pins/pkcs11/clevis-pkcs11-common
+index 4c0629c..571a2be 100755
+--- a/src/pins/pkcs11/clevis-pkcs11-common
++++ b/src/pins/pkcs11/clevis-pkcs11-common
+@@ -27,6 +27,56 @@ serial_devices_array=""
+ URI_EXPECTED_FORMAT="pkcs11:"
+ DEFAULT_CRYPTTAB_FILE="/etc/crypttab"
+ 
++clevis_detect_pkcs11_device() {
++    dracut_mode="${1:false}"
++    retry_mode="${2:false}"
++    if ! pkcs11_device=$(pkcs11-tool -L 2>/dev/null | grep "Slot" | head -1 | \
++                         awk -F ":" '{print $2}' | sed -e 's@^ *@@g'); then
++        echo ""
++        return 1
++    fi
++
++    if ! pkcs11-tool -O 2>/dev/null 1>/dev/null; then
++        pkcs11_device=""
++        echo "No objects in PKCS11 device detected" >&2
++    fi
++
++    while [ -z "${pkcs11_device}" ]; do
++        if [ "${dracut_mode}" != true ]; then
++            module_paths=$(clevis_get_module_path_from_pkcs11_config "/etc/crypttab")
++            if [ -n "${module_paths}" ]; then
++                modules=$(echo ${module_paths} | tr ";" "\n")
++                for module in $modules; do
++                    pkcs11_device=$(pkcs11-tool -L --module ${module} | grep "Slot" \
++                                    | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
++                    if [ -n "${pkcs11_device}" ]; then
++                        break;
++                    fi
++                done
++            fi
++        fi
++        if [ -z "${pkcs11_device}" ]; then
++            if [ "${retry_mode}" == true ]; then
++                option=$(systemd-ask-password --echo "Detected no PKCS#11 device, retry PKCS#11 detection? [yY/nN]")
++                if [ "${option}" == "N" ] || [ "${option}" == "n" ] ; then
++                    echo ""
++		    # Straight Forward Mode
++                    return 0
++                fi
++                pkcs11_device=$(pkcs11-tool -L | grep "Slot" \
++                                    | head -1 | awk -F ":" '{print $2}' | sed -e 's@^ *@@g')
++                if ! pkcs11-tool -O 2>/dev/null 1>/dev/null; then
++                    pkcs11_device=""
++                    echo "No objects in PKCS11 device detected" >&2
++                fi
++            else
++		echo "${pkcs11_device}"
++                return 0
++            fi
++        fi
++    done
++}
++
+ clevis_parse_devices_array() {
+     INPUT_ARRAY=$(pkcs11-tool -L | grep Slot)
+     counter=0
+@@ -64,12 +114,10 @@ clevis_get_module_path_from_pkcs11_config() {
+     while read -r line; do
+         uuid=$(echo "${line}" | awk '{print $2}')
+         if ! mapped_device=$(clevis_map_device "${uuid}"); then
+-            echo "Could not check mapped device for UID:${uuid}"
+             continue
+         fi
+         # If no PKCS#11 configuration, advance to next device
+         if ! clevis luks list -d "${mapped_device}" | grep pkcs11 >/dev/null 2>&1; then
+-            echo "Device:${mapped_device} does not contain PKCS#11 configuration"
+             continue
+         fi
+         # Get configuration PKCS#11 URI
+-- 
+2.46.2
+
diff --git a/SOURCES/0002-Fix-potential-race-condition.patch b/SOURCES/0002-Fix-potential-race-condition.patch
new file mode 100644
index 0000000..029ea36
--- /dev/null
+++ b/SOURCES/0002-Fix-potential-race-condition.patch
@@ -0,0 +1,49 @@
+From 5feea5da42b98302006f2c82ab9c22d43779e0c8 Mon Sep 17 00:00:00 2001
+From: Sergio Arroutbi <sarroutb@redhat.com>
+Date: Fri, 27 Sep 2024 12:12:48 +0200
+Subject: [PATCH] Fix potential race condition
+
+Guard the modification of "entry_counter" and the read
+used to decide whether to modify "entry_counter" with the
+same set of locks
+
+Resolves: #478
+
+Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com>
+---
+ src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
+index a6ecc63..b1e2004 100644
+--- a/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
++++ b/src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c
+@@ -70,21 +70,23 @@ get_control_socket_name(const char* file_sock, char* control_sock, uint32_t cont
+ }
+ 
+ static void insert_device(const char* dev) {
++    pthread_mutex_lock(&mutex);
+     if(MAX_ENTRIES == entry_counter) {
++        pthread_mutex_unlock(&mutex);
+         perror("No more entries accepted\n");
+         return;
+     }
+-    pthread_mutex_lock(&mutex);
+     strncpy(keys[entry_counter].dev, dev, MAX_DEVICE);
+     pthread_mutex_unlock(&mutex);
+ }
+ 
+ static void insert_key(const char* key) {
++    pthread_mutex_lock(&mutex);
+     if(MAX_ENTRIES == entry_counter) {
++        pthread_mutex_unlock(&mutex);
+         perror("No more entries accepted\n");
+         return;
+     }
+-    pthread_mutex_lock(&mutex);
+     strncpy(keys[entry_counter++].key, key, MAX_KEY);
+     pthread_mutex_unlock(&mutex);
+ }
+-- 
+2.46.2
+
diff --git a/SOURCES/0003-Fix-to-start-pcscd-appropriately.patch b/SOURCES/0003-Fix-to-start-pcscd-appropriately.patch
new file mode 100644
index 0000000..19cd4be
--- /dev/null
+++ b/SOURCES/0003-Fix-to-start-pcscd-appropriately.patch
@@ -0,0 +1,106 @@
+diff --git a/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh b/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh
+index 01a3062..9922bbc 100755
+--- a/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh
++++ b/src/luks/dracut/clevis-pin-pkcs11/clevis-pkcs11-hook.sh
+@@ -16,9 +16,11 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ #
++. /usr/bin/clevis-pkcs11-common
++
+ if [ ! -f /run/systemd/clevis-pkcs11.run ] && [ -d /run/systemd ];
+ then
+-  pcscd --disable-polkit
+-  echo "" > /run/systemd/clevis-pkcs11.run
+-  /usr/libexec/clevis-luks-pkcs11-askpin -d -r
++    clevis_start_pcscd_server
++    echo "" > /run/systemd/clevis-pkcs11.run
++    /usr/libexec/clevis-luks-pkcs11-askpin -d -r
+ fi
+diff --git a/src/luks/systemd/clevis-luks-pkcs11-askpin.in b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
+index b860efa..468ca3c 100755
+--- a/src/luks/systemd/clevis-luks-pkcs11-askpin.in
++++ b/src/luks/systemd/clevis-luks-pkcs11-askpin.in
+@@ -52,22 +52,7 @@ get_pkcs11_error() {
+     return 0
+ }
+ 
+-
+-if command -v pcscd; then
+-    echo "clevis-pkcs11: starting pcscd if not available ..."
+-    PCSCD_PID=$(ps auxf | grep "[p]cscd")
+-    echo -e "clevis-pkcs11: pcscd running?:[${PCSCD_PID}]\n"
+-    if ! ps auxf | grep "[p]cscd";
+-    then
+-        if pcscd pcscd --help | grep disable-polkit 1>/dev/null 2>/dev/null; then
+-            echo "clevis-pkcs11: starting pcscd with --disable-polkit option ..."
+-            pcscd --disable-polkit
+-        else
+-            echo "clevis-pkcs11: starting pcscd ..."
+-            pcscd
+-        fi
+-    fi
+-fi
++clevis_start_pcscd_server
+ 
+ if [ "${dracut_mode}" != true ]; then
+     pkcs11-tool -L
+diff --git a/src/pins/pkcs11/clevis-pkcs11-common b/src/pins/pkcs11/clevis-pkcs11-common
+index 571a2be..b6328f5 100755
+--- a/src/pins/pkcs11/clevis-pkcs11-common
++++ b/src/pins/pkcs11/clevis-pkcs11-common
+@@ -27,6 +27,25 @@ serial_devices_array=""
+ URI_EXPECTED_FORMAT="pkcs11:"
+ DEFAULT_CRYPTTAB_FILE="/etc/crypttab"
+ 
++
++clevis_start_pcscd_server() {
++    if command -v pcscd; then
++        echo "clevis-pkcs11: starting pcscd if not available ..."
++        PCSCD_PID=$(ps auxf | grep "[p]cscd")
++        echo -e "clevis-pkcs11: pcscd running?:[${PCSCD_PID}]\n"
++        if ! ps auxf | grep "[p]cscd";
++        then
++            if pcscd --help | grep disable-polkit 1>/dev/null 2>/dev/null; then
++                echo "clevis-pkcs11: starting pcscd with --disable-polkit option ..."
++                pcscd --disable-polkit
++            else
++                echo "clevis-pkcs11: starting pcscd ..."
++                pcscd
++            fi
++        fi
++    fi
++}
++
+ clevis_detect_pkcs11_device() {
+     dracut_mode="${1:false}"
+     retry_mode="${2:false}"
+diff --git a/src/pins/pkcs11/tests/pin-pkcs11 b/src/pins/pkcs11/tests/pin-pkcs11
+index 94e1548..c876ca4 100755
+--- a/src/pins/pkcs11/tests/pin-pkcs11
++++ b/src/pins/pkcs11/tests/pin-pkcs11
+@@ -20,6 +20,7 @@
+ . pkcs11-common-tests
+ . tests-common-functions
+ . clevis-luks-common-functions
++. clevis-pkcs11-common
+ 
+ on_exit() {
+     exit_status=$?
+@@ -150,5 +151,16 @@ then
+ (${WRONGCFG})"
+ fi
+ 
++if command -v ps && command -v killall; then
++    if ! clevis_start_pcscd_server;
++    then
++        error "${TEST}: Could not start pcscd server"
++    fi
++    if ! killall -9 pcscd;
++    then
++        error "${TEST}: Could not kill pcscd server"
++    fi
++fi
++
+ softhsm_lib_cleanup
+ test "$?" == 0
diff --git a/SOURCES/0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch b/SOURCES/0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch
new file mode 100644
index 0000000..5b0df2b
--- /dev/null
+++ b/SOURCES/0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch
@@ -0,0 +1,65 @@
+--- clevis-21.old/src/pins/tpm2/clevis-encrypt-tpm2	2024-09-24 10:27:06.000000000 +0200
++++ clevis-21/src/pins/tpm2/clevis-encrypt-tpm2	2024-11-05 15:54:16.209993587 +0100
+@@ -58,7 +58,7 @@
+     echo
+     echo "  key: <string>   Algorithm type for the generated key (default: ecc)"
+     echo
+-    echo "  pcr_bank: <string>   PCR algorithm bank to use for policy (default: sha1)"
++    echo "  pcr_bank: <string>   PCR algorithm bank to use for policy (default: first supported by TPM)"
+     echo
+     echo "  pcr_ids: <string>   PCR list used for policy. If not present, no policy is used"
+     echo
+@@ -130,7 +130,15 @@
+ 
+ key="$(jose fmt -j- -Og key -u- <<< "$cfg")" || key="ecc"
+ 
+-pcr_bank="$(jose fmt -j- -Og pcr_bank -u- <<< "$cfg")" || pcr_bank="sha1"
++pcr_bank="$(jose fmt -j- -Og pcr_bank -u- <<< "$cfg")" || {
++    if ! pcr_bank=$(tpm2_getcap pcrs |
++            awk '/^[[:space:]]*-[[:space:]]*([^:]+):[[:space:]]*\[[[:space:]]*[^][:space:]]/ \
++                     {found=1; split($0, m, /[-:[:space:]]+/); print m[2]; exit}
++                 END {exit !found}'); then
++        echo "Unable to find non-empty PCR algorithm bank, please check output of tpm2_getcap pcrs" >&2
++        exit 1
++    fi
++}
+ 
+ # Trim the spaces from the config, so that we will not have issues parsing
+ # the PCR IDs.
+--- clevis-21.old/src/pins/tpm2/clevis-encrypt-tpm2.1.adoc	2024-09-24 10:27:06.000000000 +0200
++++ clevis-21/src/pins/tpm2/clevis-encrypt-tpm2.1.adoc	2024-11-05 15:54:16.209993587 +0100
+@@ -91,13 +91,17 @@
+   - *symcipher*
+ 
+ * *pcr_bank*  (string) :
+-  PCR algorithm bank to use for policy (default: sha1)
++  PCR algorithm bank to use for policy (default: first supported by TPM)
+ 
+-  It must be one of the following:
++  Examples of PCR algorithm banks, support depends on TPM chip:
+ 
+   - *sha1*
+   - *sha256*
+ 
++  For the full list of algorithms supported by the TPM chip check output of
++  `tpm2_getcap pcrs` and use the algorithm which shows non-empty list of PCR
++  numbers.
++
+ * *pcr_ids*  (string) :
+   Comma separated list of PCR used for policy. If not present, no policy is used
+ 
+--- clevis-21.old/src/pins/tpm2/pin-tpm2	2024-09-24 10:27:06.000000000 +0200
++++ clevis-21/src/pins/tpm2/pin-tpm2	2024-11-05 15:54:16.209993587 +0100
+@@ -142,8 +142,10 @@
+ # arrays and check if we get the expected pcr_ids.
+ 
+ # Let's first make sure this would be a valid configuration.
+-_default_pcr_bank="sha1"
+-if validate_pcrs "${_default_pcr_bank}" "4,16"; then
++_default_pcr_bank=$(tpm2_getcap pcrs |
++    awk '/^[[:space:]]*-[[:space:]]*([^:]+):[[:space:]]*\[[[:space:]]*[^][:space:]]/ \
++             {split($0, m, /[-:[:space:]]+/); print m[2]; exit}')
++if [ -n "$_default_pcr_bank" ] && validate_pcrs "${_default_pcr_bank}" "4,16"; then
+     test_pcr_ids "${orig}" '{"pcr_ids": "16"}' "16" || exit 1
+     test_pcr_ids "${orig}" '{"pcr_ids": ["16"]}' "16"  || exit 1
+     test_pcr_ids "${orig}" '{"pcr_ids": "4,  16"}' "4,16" || exit 1
diff --git a/SOURCES/0005-Include-tpm2_getcap-as-dracut-required-binary.patch b/SOURCES/0005-Include-tpm2_getcap-as-dracut-required-binary.patch
new file mode 100644
index 0000000..69d248b
--- /dev/null
+++ b/SOURCES/0005-Include-tpm2_getcap-as-dracut-required-binary.patch
@@ -0,0 +1,36 @@
+From fc371d25a72806109e9a5c0205d67ba2232a6f17 Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 20 Nov 2024 18:45:56 +0100
+Subject: [PATCH] Include tpm2_getcap as dracut required binary
+
+---
+ src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in b/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in
+index 5ff0640..723df7a 100755
+--- a/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in
++++ b/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in
+@@ -19,7 +19,8 @@
+ #
+ 
+ check() {
+-    require_binaries clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext tpm2_load tpm2_unseal || return 1
++    require_binaries clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext \
++        tpm2_load tpm2_unseal tpm2_pcrread tpm2_getcap || return 1
+     require_any_binary tpm2_pcrread tpm2_pcrlist || return 1
+     return 0
+ }
+@@ -30,7 +31,8 @@ depends() {
+ }
+ 
+ install() {
+-    inst_multiple clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext tpm2_load tpm2_unseal
++    inst_multiple clevis-decrypt-tpm2 tpm2_createprimary tpm2_flushcontext \
++        tpm2_load tpm2_unseal tpm2_getcap
+     inst_multiple -o tpm2_pcrread tpm2_pcrlist
+     inst_libdir_file "libtss2-tcti-device.so*"
+ }
+-- 
+2.47.0
+
diff --git a/SPECS/clevis.spec b/SPECS/clevis.spec
index ce5cf68..14654d6 100644
--- a/SPECS/clevis.spec
+++ b/SPECS/clevis.spec
@@ -1,14 +1,18 @@
 Name:           clevis
-Version:        20
-Release:        200%{?dist}
+Version:        21
+Release:        208%{?dist}
 Summary:        Automated decryption framework
 
 License:        GPLv3+
 URL:            https://github.com/latchset/%{name}
 Source0:        https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz
 Source1:        clevis.sysusers
-Patch1:         0001-Include-miscellaneous-sast-fixes-clevis-luks-udisk-2.patch
 
+Patch0:         0001-PKCS-11-pin-fix-dracut-for-unconfigured-device.patch
+Patch1:         0002-Fix-potential-race-condition.patch
+Patch2:         0003-Fix-to-start-pcscd-appropriately.patch
+Patch3:         0004-tpm2-use-first-pcr-algorithm-bank-supported-by.patch
+Patch4:         0005-Include-tpm2_getcap-as-dracut-required-binary.patch
 
 BuildRequires:  git-core
 BuildRequires:  gcc
@@ -16,6 +20,8 @@ BuildRequires:  meson
 BuildRequires:  asciidoc
 BuildRequires:  ninja-build
 BuildRequires:  bash-completion
+BuildRequires:  pcsc-lite
+BuildRequires:  opensc
 
 BuildRequires:  libjose-devel >= 8
 BuildRequires:  libluksmeta-devel >= 8
@@ -103,6 +109,20 @@ Requires:       %{name}-luks%{?_isa} = %{version}-%{release}
 Automatically unlocks LUKS block devices in desktop environments that
 use UDisks2 or storaged (like GNOME).
 
+%package pin-pkcs11
+Summary:        PKCS#11 for clevis
+Requires:       %{name}-systemd%{?_isa} = %{version}-%{release}
+Requires:       %{name}-luks%{?_isa} = %{version}-%{release}
+Requires:       %{name}-dracut%{?_isa} = %{version}-%{release}
+Requires:       pcsc-lite
+Requires:       opensc
+Requires:       socat
+Requires:       openssl
+
+
+%description pin-pkcs11
+Automatically unlocks LUKS block devices through a PKCS#11 device.
+
 %prep
 %autosetup -S git
 
@@ -183,11 +203,58 @@ systemctl preset %{name}-luks-askpass.path >/dev/null 2>&1 || :
 %{_prefix}/lib/dracut/modules.d/60%{name}-pin-tang/module-setup.sh
 %{_prefix}/lib/dracut/modules.d/60%{name}-pin-tpm2/module-setup.sh
 
+%files pin-pkcs11
+%{_libexecdir}/%{name}-luks-pkcs11-askpass
+%{_libexecdir}/%{name}-luks-pkcs11-askpin
+%{_bindir}/%{name}-decrypt-pkcs11
+%{_bindir}/%{name}-encrypt-pkcs11
+%{_bindir}/%{name}-pkcs11-afunix-socket-unlock
+%{_bindir}/%{name}-pkcs11-common
+%{_unitdir}/%{name}-luks-pkcs11-askpass.service
+%{_unitdir}/%{name}-luks-pkcs11-askpass.socket
+%{_mandir}/man1/%{name}-encrypt-pkcs11.1*
+%{_prefix}/lib/dracut/modules.d/60%{name}-pin-pkcs11/module-setup.sh
+%{_prefix}/lib/dracut/modules.d/60%{name}-pin-pkcs11/%{name}-pkcs11-hook.sh
+%{_prefix}/lib/dracut/modules.d/60%{name}-pin-pkcs11/%{name}-pkcs11-prehook.sh
+
 %files udisks2
 %{_sysconfdir}/xdg/autostart/%{name}-luks-udisks2.desktop
 %attr(4755, root, root) %{_libexecdir}/%{name}-luks-udisks2
 
 %changelog
+
+* Thu Jan 9 2025 Sergio Arroutbi <sarroutb@redhat.com> - 21-208
+- Include socat, openssl as PKCS#11 pin requirements
+  Resolves: #RHEL-72982
+
+* Fri Nov 22 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-207
+- Include tpm2_getcap as dracut required binary
+  Resolves: #RHEL-68638
+
+* Tue Nov 5 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-206
+- TPM2: use first PCR algorithm bank supported by TPM as default
+  Resolves: #RHEL-65468
+
+* Thu Oct 31 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-205
+- Groom clevis.spec
+  Resolves: #RHEL-65458
+
+* Fri Oct 11 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-204
+- Split PKCS#11 files into clevis-pin-pkcs11 package
+  Resolves: #RHEL-61941
+
+* Mon Oct 7 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-203
+- Fix to start pcscd appropriately
+  Resolves: #RHEL-61612
+
+* Tue Oct 01 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-202
+- Fix dracut startup issue
+  Resolves: #RHEL-61184
+
+* Thu Sep 26 2024 Sergio Arroutbi <sarroutb@redhat.com> - 21-201
+- Rebase to clevis-21
+  Resolves: #RHEL-60257
+
 * Tue May 21 2024 Sergio Arroutbi <sarroutb@redhat.com> - 20-200
 - Rebase to clevis-20
   Resolves: #RHEL-29282