Merging upstream version 102.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

107 files changed, 919 insertions, 1060 deletions

diff --git a/modules.d/00systemd/module-setup.sh b/modules.d/00systemd/module-setup.sh
index 9a13a1d..d173c99 100755
--- a/modules.d/00systemd/module-setup.sh
+++ b/modules.d/00systemd/module-setup.sh
@@ -23,8 +23,6 @@ installkernel() {
 
 # called by dracut
 install() {
-    local _mods
-
     if [[ $prefix == /run/* ]]; then
         dfatal 'systemd does not work with a prefix, which contains "/run"!!'
         exit 1
@@ -38,10 +36,6 @@ install() {
         "$systemdutildir"/systemd-shutdown \
         "$systemdutildir"/systemd-reply-password \
         "$systemdutildir"/systemd-fsck \
-        "$systemdutildir"/systemd-udevd \
-        "$systemdutildir"/systemd-journald \
-        "$systemdutildir"/systemd-sysctl \
-        "$systemdutildir"/systemd-modules-load \
         "$systemdutildir"/systemd-vconsole-setup \
         "$systemdutildir"/systemd-volatile-root \
         "$systemdutildir"/systemd-sysroot-fstab-check \
@@ -80,111 +74,35 @@ install() {
         "$systemdsystemunitdir"/paths.target \
         "$systemdsystemunitdir"/umount.target \
         "$systemdsystemunitdir"/sys-kernel-config.mount \
-        "$systemdsystemunitdir"/modprobe@.service \
-        "$systemdsystemunitdir"/kmod-static-nodes.service \
-        "$systemdsystemunitdir"/systemd-tmpfiles-setup.service \
-        "$systemdsystemunitdir"/systemd-tmpfiles-setup-dev.service \
-        "$systemdsystemunitdir"/systemd-tmpfiles-setup-dev-early.service \
-        "$systemdsystemunitdir"/systemd-ask-password-console.path \
-        "$systemdsystemunitdir"/systemd-udevd-control.socket \
-        "$systemdsystemunitdir"/systemd-udevd-kernel.socket \
-        "$systemdsystemunitdir"/systemd-ask-password-plymouth.path \
-        "$systemdsystemunitdir"/systemd-journald.socket \
-        "$systemdsystemunitdir"/systemd-journald-audit.socket \
-        "$systemdsystemunitdir"/systemd-ask-password-console.service \
-        "$systemdsystemunitdir"/systemd-modules-load.service \
         "$systemdsystemunitdir"/systemd-halt.service \
         "$systemdsystemunitdir"/systemd-poweroff.service \
         "$systemdsystemunitdir"/systemd-reboot.service \
         "$systemdsystemunitdir"/systemd-kexec.service \
         "$systemdsystemunitdir"/systemd-fsck@.service \
-        "$systemdsystemunitdir"/systemd-udevd.service \
-        "$systemdsystemunitdir"/systemd-udev-trigger.service \
-        "$systemdsystemunitdir"/systemd-udev-settle.service \
-        "$systemdsystemunitdir"/systemd-ask-password-plymouth.service \
-        "$systemdsystemunitdir"/systemd-journald.service \
         "$systemdsystemunitdir"/systemd-vconsole-setup.service \
         "$systemdsystemunitdir"/systemd-volatile-root.service \
-        "$systemdsystemunitdir"/systemd-sysctl.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-modules-load.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-ask-password-console.path \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-journald.service \
-        "$systemdsystemunitdir"/sockets.target.wants/systemd-udevd-control.socket \
-        "$systemdsystemunitdir"/sockets.target.wants/systemd-udevd-kernel.socket \
-        "$systemdsystemunitdir"/sockets.target.wants/systemd-journald.socket \
-        "$systemdsystemunitdir"/sockets.target.wants/systemd-journald-audit.socket \
-        "$systemdsystemunitdir"/sockets.target.wants/systemd-journald-dev-log.socket \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-udevd.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-udev-trigger.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/kmod-static-nodes.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-tmpfiles-setup.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-tmpfiles-setup-dev.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-tmpfiles-setup-dev-early.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-sysctl.service \
         "$systemdsystemunitdir"/ctrl-alt-del.target \
-        "$systemdsystemunitdir"/reboot.target \
-        "$systemdsystemunitdir"/systemd-reboot.service \
         "$systemdsystemunitdir"/syslog.socket \
         "$systemdsystemunitdir"/slices.target \
         "$systemdsystemunitdir"/system.slice \
         "$systemdsystemunitdir"/-.slice \
-        "$tmpfilesdir"/systemd.conf \
-        journalctl systemctl \
+        systemctl \
         echo swapoff \
-        kmod insmod rmmod modprobe modinfo depmod lsmod \
         mount umount reboot poweroff \
         systemd-run systemd-escape \
-        systemd-cgls systemd-tmpfiles \
-        systemd-ask-password systemd-tty-ask-password-agent \
-        /etc/udev/udev.hwdb
-
-    inst_multiple -o \
-        /usr/lib/modules-load.d/*.conf \
-        /usr/lib/sysctl.d/*.conf
-
-    modules_load_get() {
-        local _line i
-        for i in "$dracutsysrootdir$1"/*.conf; do
-            [[ -f $i ]] || continue
-            while read -r _line || [ -n "$_line" ]; do
-                case $_line in
-                    \#*) ;;
-
-                    \;*) ;;
-
-                    *)
-                        echo "$_line"
-                        ;;
-                esac
-            done < "$i"
-        done
-    }
-
-    mapfile -t _mods < <(modules_load_get /usr/lib/modules-load.d)
-    [[ ${#_mods[@]} -gt 0 ]] && hostonly='' instmods "${_mods[@]}"
+        systemd-cgls
 
     if [[ $hostonly ]]; then
         inst_multiple -H -o \
-            /etc/systemd/journald.conf \
-            /etc/systemd/journald.conf.d/*.conf \
             /etc/systemd/system.conf \
             /etc/systemd/system.conf.d/*.conf \
-            "$systemdsystemconfdir"/modprobe@.service \
-            "$systemdsystemconfdir/modprobe@.service.d/*.conf" \
             /etc/hosts \
             /etc/hostname \
             /etc/nsswitch.conf \
             /etc/machine-id \
             /etc/machine-info \
             /etc/vconsole.conf \
-            /etc/locale.conf \
-            /etc/modules-load.d/*.conf \
-            /etc/sysctl.d/*.conf \
-            /etc/sysctl.conf \
-            /etc/udev/udev.conf
-
-        mapfile -t _mods < <(modules_load_get /etc/modules-load.d)
-        [[ ${#_mods[@]} -gt 0 ]] && hostonly='' instmods "${_mods[@]}"
+            /etc/locale.conf
     fi
 
     if ! [[ -e "$initdir/etc/machine-id" ]]; then
@@ -192,17 +110,14 @@ install() {
         chmod 444 "$initdir/etc/machine-id"
     fi
 
-    # install adm user/group for journald
     inst_multiple nologin
     {
-        grep '^systemd-journal:' "$dracutsysrootdir"/etc/passwd 2> /dev/null
         grep '^adm:' "$dracutsysrootdir"/etc/passwd 2> /dev/null
         # we don't use systemd-networkd, but the user is in systemd.conf tmpfiles snippet
         grep '^systemd-network:' "$dracutsysrootdir"/etc/passwd 2> /dev/null
     } >> "$initdir/etc/passwd"
 
     {
-        grep '^systemd-journal:' "$dracutsysrootdir"/etc/group 2> /dev/null
         grep '^wheel:' "$dracutsysrootdir"/etc/group 2> /dev/null
         grep '^adm:' "$dracutsysrootdir"/etc/group 2> /dev/null
         grep '^utmp:' "$dracutsysrootdir"/etc/group 2> /dev/null
@@ -241,27 +156,19 @@ EOF
 
     for i in \
         emergency.target \
-        rescue.target \
-        systemd-ask-password-console.service \
-        systemd-ask-password-plymouth.service; do
+        rescue.target; do
         [[ -f "$systemdsystemunitdir"/$i ]] || continue
         $SYSTEMCTL -q --root "$initdir" add-wants "$i" systemd-vconsole-setup.service
     done
 
     mkdir -p "$initdir/etc/systemd"
-    # We must use a volatile journal, and we don't want rate-limiting
-    {
-        echo "[Journal]"
-        echo "Storage=volatile"
-        echo "RateLimitInterval=0"
-        echo "RateLimitBurst=0"
-    } >> "$initdir/etc/systemd/journald.conf"
 
     $SYSTEMCTL -q --root "$initdir" set-default multi-user.target
 
     # Install library file(s)
     _arch=${DRACUT_ARCH:-$(uname -m)}
     inst_libdir_file \
+        {"tls/$_arch/",tls/,"$_arch/",}"libgcrypt.so*" \
+        {"tls/$_arch/",tls/,"$_arch/",}"libkmod.so*" \
         {"tls/$_arch/",tls/,"$_arch/",}"libnss_*"
-
 }
diff --git a/modules.d/01fips/fips-boot.sh b/modules.d/01fips/fips-boot.sh
index 34760e0..d703a10 100755
--- a/modules.d/01fips/fips-boot.sh
+++ b/modules.d/01fips/fips-boot.sh
@@ -3,7 +3,7 @@
 type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
 
 if ! fipsmode=$(getarg fips) || [ "$fipsmode" = "0" ]; then
-    rm -f -- /etc/modprobe.d/fips.conf > /dev/null 2>&1
+    :
 elif [ -z "$fipsmode" ]; then
     die "FIPS mode have to be enabled by 'fips=1' not just 'fips'"
 elif getarg boot= > /dev/null; then
diff --git a/modules.d/01fips/fips-load-crypto.sh b/modules.d/01fips/fips-load-crypto.sh
index 6ef42b9..d1d90c8 100755
--- a/modules.d/01fips/fips-load-crypto.sh
+++ b/modules.d/01fips/fips-load-crypto.sh
@@ -3,7 +3,7 @@
 type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
 
 if ! fipsmode=$(getarg fips) || [ "$fipsmode" = "0" ]; then
-    rm -f -- /etc/modprobe.d/fips.conf > /dev/null 2>&1
+    :
 elif [ -z "$fipsmode" ]; then
     die "FIPS mode have to be enabled by 'fips=1' not just 'fips'"
 else
diff --git a/modules.d/01fips/fips-noboot.sh b/modules.d/01fips/fips-noboot.sh
index 963a034..319da90 100755
--- a/modules.d/01fips/fips-noboot.sh
+++ b/modules.d/01fips/fips-noboot.sh
@@ -3,7 +3,7 @@
 type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
 
 if ! fipsmode=$(getarg fips) || [ "$fipsmode" = "0" ]; then
-    rm -f -- /etc/modprobe.d/fips.conf > /dev/null 2>&1
+    :
 elif [ -z "$fipsmode" ]; then
     die "FIPS mode have to be enabled by 'fips=1' not just 'fips'"
 elif ! [ -f /tmp/fipsdone ]; then
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index 2e7b7cb..c81c2a6 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -97,7 +97,6 @@ fips_load_crypto() {
     read -d '' -r FIPSMODULES < /etc/fipsmodules
 
     fips_info "Loading and integrity checking all crypto modules"
-    mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak
     for _module in $FIPSMODULES; do
         if [ "$_module" != "tcrypt" ]; then
             if ! nonfatal_modprobe "${_module}" 2> /tmp/fips.modprobe_err; then
@@ -113,7 +112,10 @@ fips_load_crypto() {
             fi
         fi
     done
-    mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf
+    if [ -f /etc/fips.conf ]; then
+        mkdir -p /run/modprobe.d
+        cp /etc/fips.conf /run/modprobe.d/fips.conf
+    fi
 
     fips_info "Self testing crypto algorithms"
     modprobe tcrypt || return 1
diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index 0e47c84..83fcd56 100755
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -39,13 +39,10 @@ installkernel() {
         _fipsmodules+="aead cryptomgr tcrypt crypto_user "
     fi
 
-    # shellcheck disable=SC2174
-    mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
-
     for _mod in $_fipsmodules; do
         if hostonly='' instmods -c -s "$_mod"; then
             echo "$_mod" >> "${initdir}/etc/fipsmodules"
-            echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
+            echo "blacklist $_mod" >> "${initdir}/etc/fips.conf"
         fi
     done
 
@@ -70,16 +67,4 @@ install() {
     inst_multiple sha512hmac rmmod insmod mount uname umount grep sed cut find sort
 
     inst_simple /etc/system-fips
-    [ -c "${initdir}"/dev/random ] || mknod "${initdir}"/dev/random c 1 8 \
-        || {
-            dfatal "Cannot create /dev/random"
-            dfatal "To create an initramfs with fips support, dracut has to run as root"
-            return 1
-        }
-    [ -c "${initdir}"/dev/urandom ] || mknod "${initdir}"/dev/urandom c 1 9 \
-        || {
-            dfatal "Cannot create /dev/urandom"
-            dfatal "To create an initramfs with fips support, dracut has to run as root"
-            return 1
-        }
 }
diff --git a/modules.d/01systemd-ask-password/module-setup.sh b/modules.d/01systemd-ask-password/module-setup.sh
index 6e78075..866eb3a 100755
--- a/modules.d/01systemd-ask-password/module-setup.sh
+++ b/modules.d/01systemd-ask-password/module-setup.sh
@@ -19,6 +19,19 @@ check() {
 # Module dependency requirements.
 depends() {
 
+    if [[ $hostonly ]]; then
+        # A password cannot be entered if there is no graphical output during boot,
+        # as is the case in aarch64, where efifb does not work with qemu-system-aarch64:
+        # - virtio-gpu-pci does not expose a linear framebuffer
+        # - virtio-vga is not supported
+        # - ramfb is not enough
+        # Therefore, depend on the drm module if virtio_gpu is loaded on the system.
+        if [[ ${DRACUT_ARCH:-$(uname -m)} == arm* || ${DRACUT_ARCH:-$(uname -m)} == aarch64 ]] \
+            && grep -r -q "virtio:d00000010v" /sys/bus/virtio/devices/*/modalias 2> /dev/null; then
+            echo drm
+        fi
+    fi
+
     # Return 0 to include the dependent module(s) in the initramfs.
     return 0
 
@@ -35,6 +48,10 @@ install() {
         systemd-ask-password \
         systemd-tty-ask-password-agent
 
+    if [ -e "$systemdsystemunitdir"/systemd-vconsole-setup.service ]; then
+        $SYSTEMCTL -q --root "$initdir" add-wants systemd-ask-password-console.service systemd-vconsole-setup.service
+    fi
+
     # Enable the systemd type service unit for systemd-ask-password.
     $SYSTEMCTL -q --root "$initdir" enable systemd-ask-password-console.service
 
@@ -44,6 +61,10 @@ install() {
             "$systemdsystemunitdir"/systemd-ask-password-plymouth.path \
             "$systemdsystemunitdir"/systemd-ask-password-plymouth.service
 
+        if [ -e "$systemdsystemunitdir"/systemd-vconsole-setup.service ]; then
+            $SYSTEMCTL -q --root "$initdir" add-wants systemd-ask-password-plymouth.service systemd-vconsole-setup.service
+        fi
+
         $SYSTEMCTL -q --root "$initdir" enable systemd-ask-password-plymouth.service
     fi
 
diff --git a/modules.d/01systemd-bsod/module-setup.sh b/modules.d/01systemd-bsod/module-setup.sh
new file mode 100755
index 0000000..91b28d7
--- /dev/null
+++ b/modules.d/01systemd-bsod/module-setup.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# This file is part of dracut.
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# Prerequisite check(s) for module.
+check() {
+    # If the binary(s) requirements are not fulfilled the module can't be installed
+    require_binaries "$systemdutildir"/systemd-bsod || return 1
+
+    # Return 255 to only include the module, if another module requires it.
+    return 255
+}
+
+# Module dependency requirements.
+depends() {
+    # This module has external dependency on other module(s).
+    echo systemd-journald
+    # Return 0 to include the dependent module(s) in the initramfs.
+    return 0
+}
+
+# Install the required file(s) for the module in the initramfs.
+install() {
+    inst_multiple \
+        "$systemdsystemunitdir"/systemd-bsod.service \
+        "$systemdsystemunitdir"/initrd.target.wants/systemd-bsod.service \
+        "$systemdutildir"/systemd-bsod
+
+    inst_libdir_file "libqrencode.so*"
+}
diff --git a/modules.d/01systemd-coredump/module-setup.sh b/modules.d/01systemd-coredump/module-setup.sh
index 69ec966..47666b6 100755
--- a/modules.d/01systemd-coredump/module-setup.sh
+++ b/modules.d/01systemd-coredump/module-setup.sh
@@ -40,6 +40,13 @@ install() {
         "$sysusers"/systemd-coredump.conf \
         coredumpctl
 
+    # Install library file(s)
+    _arch=${DRACUT_ARCH:-$(uname -m)}
+    inst_libdir_file \
+        {"tls/$_arch/",tls/,"$_arch/",}"liblz4.so.*" \
+        {"tls/$_arch/",tls/,"$_arch/",}"liblzma.so.*" \
+        {"tls/$_arch/",tls/,"$_arch/",}"libzstd.so.*"
+
     # Install the hosts local user configurations if enabled.
     if [[ $hostonly ]]; then
         inst_multiple -H -o \
diff --git a/modules.d/01systemd-initrd/module-setup.sh b/modules.d/01systemd-initrd/module-setup.sh
index f65041f..957e7be 100755
--- a/modules.d/01systemd-initrd/module-setup.sh
+++ b/modules.d/01systemd-initrd/module-setup.sh
@@ -4,12 +4,13 @@
 check() {
     [[ $mount_needs ]] && return 1
 
-    return 0
+    # Return 255 to only include the module, if another module requires it.
+    return 255
 }
 
 # called by dracut
 depends() {
-    echo "systemd"
+    echo systemd-udevd systemd-journald systemd-tmpfiles
 }
 
 installkernel() {
diff --git a/modules.d/01systemd-journald/module-setup.sh b/modules.d/01systemd-journald/module-setup.sh
index 3cf2a1a..e0944d2 100755
--- a/modules.d/01systemd-journald/module-setup.sh
+++ b/modules.d/01systemd-journald/module-setup.sh
@@ -20,7 +20,7 @@ check() {
 depends() {
 
     # This module has external dependency on other module(s).
-    echo systemd-sysusers
+    echo systemd systemd-sysusers
     # Return 0 to include the dependent module(s) in the initramfs.
     return 0
 
@@ -53,9 +53,10 @@ install() {
     # Install library file(s)
     _arch=${DRACUT_ARCH:-$(uname -m)}
     inst_libdir_file \
+        {"tls/$_arch/",tls/,"$_arch/",}"libgcrypt.so*" \
         {"tls/$_arch/",tls/,"$_arch/",}"liblz4.so.*" \
-        {"tls/$_arch/",tls/,"$_arch/",}"libzstd.so.*" \
-        {"tls/$_arch/",tls/,"$_arch/",}"liblzma.so.*"
+        {"tls/$_arch/",tls/,"$_arch/",}"liblzma.so.*" \
+        {"tls/$_arch/",tls/,"$_arch/",}"libzstd.so.*"
 
     # Install the hosts local user configurations if enabled.
     if [[ $hostonly ]]; then
diff --git a/modules.d/01systemd-ldconfig/module-setup.sh b/modules.d/01systemd-ldconfig/module-setup.sh
index 3a5842a..4e65d89 100755
--- a/modules.d/01systemd-ldconfig/module-setup.sh
+++ b/modules.d/01systemd-ldconfig/module-setup.sh
@@ -33,7 +33,8 @@ install() {
         "$systemdsystemunitdir"/ldconfig.service \
         "$systemdsystemunitdir/ldconfig.service.d/*.conf" \
         "$systemdsystemunitdir"/sysinit.target.wants/ldconfig.service \
-        ldconfig
+        ldconfig \
+        ldconfig.real
 
     # Install required libraries.
     _arch=${DRACUT_ARCH:-$(uname -m)}
diff --git a/modules.d/01systemd-modules-load/module-setup.sh b/modules.d/01systemd-modules-load/module-setup.sh
index f9adfea..34778f8 100755
--- a/modules.d/01systemd-modules-load/module-setup.sh
+++ b/modules.d/01systemd-modules-load/module-setup.sh
@@ -21,14 +21,56 @@ depends() {
 
 }
 
+# Install kernel module(s).
+installkernel() {
+    local _mods
+
+    modules_load_get() {
+        local _line _i
+        for _i in "$dracutsysrootdir$1"/*.conf; do
+            [[ -f $_i ]] || continue
+            while read -r _line || [ -n "$_line" ]; do
+                case $_line in
+                    \#*) ;;
+
+                    \;*) ;;
+
+                    *)
+                        echo "$_line"
+                        ;;
+                esac
+            done < "$_i"
+        done
+    }
+
+    mapfile -t _mods < <(modules_load_get "$modulesload")
+    if [[ ${#_mods[@]} -gt 0 ]]; then
+        hostonly='' instmods "${_mods[@]}"
+    fi
+
+    if [[ $hostonly ]]; then
+        mapfile -t _mods < <(modules_load_get "$modulesloadconfdir")
+        if [[ ${#_mods[@]} -gt 0 ]]; then
+            hostonly='' instmods "${_mods[@]}"
+        fi
+    fi
+
+    return 0
+}
+
 # Install the required file(s) and directories for the module in the initramfs.
 install() {
 
     inst_multiple -o \
+        /usr/lib/modules-load.d/*.conf \
         "$modulesload/*.conf" \
         "$systemdutildir"/systemd-modules-load \
         "$systemdsystemunitdir"/systemd-modules-load.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-modules-load.service
+        "$systemdsystemunitdir"/modprobe@.service \
+        "$systemdsystemunitdir"/kmod-static-nodes.service \
+        "$systemdsystemunitdir"/sysinit.target.wants/systemd-modules-load.service \
+        "$systemdsystemunitdir"/sysinit.target.wants/kmod-static-nodes.service \
+        kmod insmod rmmod modprobe modinfo depmod lsmod
 
     # Enable systemd type unit(s)
     $SYSTEMCTL -q --root "$initdir" enable systemd-modules-load.service
@@ -36,7 +78,10 @@ install() {
     # Install the hosts local user configurations if enabled.
     if [[ $hostonly ]]; then
         inst_multiple -H -o \
+            /etc/modules-load.d/*.conf \
             "$modulesloadconfdir/*.conf" \
+            "$systemdsystemconfdir"/modprobe@.service \
+            "$systemdsystemconfdir/modprobe@.service.d/*.conf" \
             "$systemdsystemconfdir"/systemd-modules-load.service \
             "$systemdsystemconfdir/systemd-modules-load.service.d/*.conf"
     fi
diff --git a/modules.d/01systemd-networkd/module-setup.sh b/modules.d/01systemd-networkd/module-setup.sh
index 7bbf83c..3658882 100755
--- a/modules.d/01systemd-networkd/module-setup.sh
+++ b/modules.d/01systemd-networkd/module-setup.sh
@@ -7,7 +7,7 @@ check() {
     [[ $mount_needs ]] && return 1
 
     # If the binary(s) requirements are not fulfilled the module can't be installed
-    require_binaries ip networkctl \
+    require_binaries ip \
         "$systemdutildir"/systemd-networkd \
         "$systemdutildir"/systemd-network-generator \
         "$systemdutildir"/systemd-networkd-wait-online \
@@ -22,7 +22,7 @@ check() {
 depends() {
 
     # This module has external dependency on other module(s).
-    echo dbus kernel-network-modules systemd-sysusers
+    echo kernel-network-modules systemd-sysusers
     # Return 0 to include the dependent module(s) in the initramfs.
     return 0
 
@@ -47,6 +47,7 @@ install() {
         "$systemdnetwork"/80-container-vz.network \
         "$systemdnetwork"/80-vm-vt.network \
         "$systemdnetwork"/80-wifi-adhoc.network \
+        "$systemdnetwork"/98-default-mac-none.link \
         "$systemdnetwork"/99-default.link \
         "$systemdsystemunitdir"/systemd-networkd.service \
         "$systemdsystemunitdir"/systemd-networkd.socket \
@@ -55,7 +56,7 @@ install() {
         "$systemdsystemunitdir"/systemd-networkd-wait-online@.service \
         "$systemdsystemunitdir"/systemd-network-generator.service \
         "$sysusers"/systemd-network.conf \
-        networkctl ip
+        ip
 
     # Enable systemd type units
     for i in \
diff --git a/modules.d/01systemd-pcrphase/module-setup.sh b/modules.d/01systemd-pcrphase/module-setup.sh
index fa960a4..eb85207 100755
--- a/modules.d/01systemd-pcrphase/module-setup.sh
+++ b/modules.d/01systemd-pcrphase/module-setup.sh
@@ -6,10 +6,13 @@
 check() {
 
     # If the binary(s) requirements are not fulfilled the module can't be installed.
-    require_binaries "$systemdutildir"/systemd-pcrphase || return 1
+    # systemd-255 renamed the binary, check for old and new location.
+    if ! require_binaries "$systemdutildir"/systemd-pcrphase \
+        && ! require_binaries "$systemdutildir"/systemd-pcrextend; then
+        return 1
+    fi
 
-    # Return 255 to only include the module, if another module requires it.
-    return 255
+    return 0
 
 }
 
@@ -28,6 +31,7 @@ install() {
 
     inst_multiple -o \
         "$systemdutildir"/systemd-pcrphase \
+        "$systemdutildir"/systemd-pcrextend \
         "$systemdsystemunitdir"/systemd-pcrphase-initrd.service \
         "$systemdsystemunitdir/systemd-pcrphase-initrd.service.d/*.conf" \
         "$systemdsystemunitdir"/initrd.target.wants/systemd-pcrphase-initrd.service
diff --git a/modules.d/01systemd-sysctl/module-setup.sh b/modules.d/01systemd-sysctl/module-setup.sh
index d0eb779..64f93f9 100755
--- a/modules.d/01systemd-sysctl/module-setup.sh
+++ b/modules.d/01systemd-sysctl/module-setup.sh
@@ -10,7 +10,6 @@ check() {
 
     # Return 255 to only include the module, if another module requires it.
     return 255
-
 }
 
 # Module dependency requirements.
@@ -20,13 +19,13 @@ depends() {
     echo systemd-modules-load
     # Return 0 to include the dependent module(s) in the initramfs.
     return 0
-
 }
 
 # Install the required file(s) for the module in the initramfs.
 install() {
 
     inst_multiple -o \
+        /usr/lib/sysctl.d/*.conf \
         "$sysctld/*.conf" \
         "$systemdsystemunitdir"/systemd-sysctl.service \
         "$systemdsystemunitdir"/sysinit.target.wants/systemd-sysctl.service \
@@ -36,6 +35,7 @@ install() {
     if [[ $hostonly ]]; then
         inst_multiple -H -o \
             /etc/sysctl.conf \
+            /etc/sysctl.d/*.conf \
             "$sysctlconfdir/*.conf" \
             "$systemdsystemconfdir"/systemd-sysctl.service \
             "$systemdsystemconfdir/systemd-sysctl.service.d/*.conf"
@@ -43,5 +43,4 @@ install() {
 
     # Enable the systemd type service unit for sysctl.
     $SYSTEMCTL -q --root "$initdir" enable systemd-sysctl.service
-
 }
diff --git a/modules.d/01systemd-sysext/module-setup.sh b/modules.d/01systemd-sysext/module-setup.sh
index b95a480..381e339 100755
--- a/modules.d/01systemd-sysext/module-setup.sh
+++ b/modules.d/01systemd-sysext/module-setup.sh
@@ -26,20 +26,34 @@ depends() {
 # Install the required file(s) and directories for the module in the initramfs.
 install() {
 
+    # It's intended to work only with raw binary disk images contained in
+    # regular files, but not with directory trees.
+
     inst_multiple -o \
-        "/usr/lib/extensions/*" \
+        "/usr/lib/confexts/*.raw" \
+        "/var/lib/confexts/*.raw" \
+        "/var/lib/extensions/*.raw" \
+        "/etc/extension-release.d/extension-release.*" \
         "/usr/lib/extension-release.d/extension-release.*" \
+        "$systemdsystemunitdir"/systemd-confext.service \
+        "$systemdsystemunitdir/systemd-confext.service.d/*.conf" \
         "$systemdsystemunitdir"/systemd-sysext.service \
         "$systemdsystemunitdir/systemd-sysext.service.d/*.conf" \
-        systemd-sysext
+        systemd-confext systemd-sysext
 
     # Enable systemd type unit(s)
-    $SYSTEMCTL -q --root "$initdir" enable systemd-sysext.service
+    for i in \
+        systemd-confext.service \
+        systemd-sysext.service; do
+        $SYSTEMCTL -q --root "$initdir" enable "$i"
+    done
 
     # Install the hosts local user configurations if enabled.
     if [[ $hostonly ]]; then
         inst_multiple -H -o \
-            "/etc/extensions/*" \
+            "/etc/extensions/*.raw" \
+            "$systemdsystemconfdir"/systemd-confext.service \
+            "$systemdsystemconfdir/systemd-confext.service.d/*.conf" \
             "$systemdsystemconfdir"/systemd-sysext.service \
             "$systemdsystemconfdir/systemd-sysext.service.d/*.conf"
     fi
diff --git a/modules.d/01systemd-udevd/module-setup.sh b/modules.d/01systemd-udevd/module-setup.sh
index ce5d2a3..168167f 100755
--- a/modules.d/01systemd-udevd/module-setup.sh
+++ b/modules.d/01systemd-udevd/module-setup.sh
@@ -20,7 +20,7 @@ check() {
 depends() {
 
     # This module has external dependency on other module(s).
-    echo systemd
+    echo udev-rules systemd systemd-sysctl
     # Return 0 to include the dependent module(s) in the initramfs.
     return 0
 
@@ -30,20 +30,14 @@ depends() {
 install() {
 
     inst_multiple -o \
+        /etc/udev/udev.hwdb \
         "$udevdir"/hwdb.bin \
-        "$udevdir"/udev.conf \
-        "$udevdir"/ata_id \
-        "$udevdir"/cdrom_id \
         "$udevdir"/dmi_memory_id \
         "$udevdir"/fido_id \
         "$udevdir"/mtd_probe \
         "$udevdir"/mtp-probe \
-        "$udevdir"/scsi_id \
         "$udevdir"/v4l_id \
-        "$udevrulesdir"/50-udev-default.rules \
         "$udevrulesdir"/60-autosuspend.rules \
-        "$udevrulesdir"/60-block.rules \
-        "$udevrulesdir"/60-cdrom_id.rules \
         "$udevrulesdir"/60-drm.rules \
         "$udevrulesdir"/60-evdev.rules \
         "$udevrulesdir"/60-fido-id.rules \
@@ -51,20 +45,15 @@ install() {
         "$udevrulesdir"/60-persistent-alsa.rules \
         "$udevrulesdir"/60-persistent-input.rules \
         "$udevrulesdir"/60-persistent-storage-tape.rules \
-        "$udevrulesdir"/60-persistent-storage.rules \
         "$udevrulesdir"/60-persistent-v4l.rules \
         "$udevrulesdir"/60-sensor.rules \
         "$udevrulesdir"/60-serial.rules \
-        "$udevrulesdir"/64-btrfs.rules \
         "$udevrulesdir"/70-joystick.rules \
         "$udevrulesdir"/70-memory.rules \
         "$udevrulesdir"/70-mouse.rules \
         "$udevrulesdir"/70-touchpad.rules \
-        "$udevrulesdir"/75-net-description.rules \
         "$udevrulesdir"/75-probe_mtd.rules \
         "$udevrulesdir"/78-sound-card.rules \
-        "$udevrulesdir"/80-drivers.rules \
-        "$udevrulesdir"/80-net-setup-link.rules \
         "$udevrulesdir"/81-net-dhcp.rules \
         "$udevrulesdir"/99-systemd.rules \
         "$systemdutildir"/systemd-udevd \
@@ -79,14 +68,12 @@ install() {
         "$systemdsystemunitdir"/sockets.target.wants/systemd-udevd-control.socket \
         "$systemdsystemunitdir"/sockets.target.wants/systemd-udevd-kernel.socket \
         "$systemdsystemunitdir"/sysinit.target.wants/systemd-udevd.service \
-        "$systemdsystemunitdir"/sysinit.target.wants/systemd-udev-trigger.service \
-        udevadm
+        "$systemdsystemunitdir"/sysinit.target.wants/systemd-udev-trigger.service
 
     # Install the hosts local user configurations if enabled.
     if [[ $hostonly ]]; then
         inst_multiple -H -o \
             "$udevconfdir"/hwdb.bin \
-            "$udevconfdir"/udev.conf \
             "$udevrulesconfdir/*.rules" \
             "$systemdutilconfdir"/hwdb/hwdb.bin \
             "$systemdsystemconfdir"/systemd-udevd.service \
diff --git a/modules.d/02caps/module-setup.sh b/modules.d/02caps/module-setup.sh
index 18073e2..9119caf 100755
--- a/modules.d/02caps/module-setup.sh
+++ b/modules.d/02caps/module-setup.sh
@@ -2,7 +2,7 @@
 
 # called by dracut
 check() {
-    require_binaries capsh
+    require_binaries capsh || return 1
     return 255
 }
 
diff --git a/modules.d/10i18n/console_init.sh b/modules.d/10i18n/console_init.sh
index 3ca0ac1..7349817 100755
--- a/modules.d/10i18n/console_init.sh
+++ b/modules.d/10i18n/console_init.sh
@@ -49,7 +49,7 @@ set_font() {
     setfont "${FONT-${DEFAULT_FONT}}" \
         -C "${1}" \
         ${FONT_MAP:+-m "${FONT_MAP}"} \
-        ${FONT_UNIMAP:+-u "${FONT_UNIMAP}"}
+        ${FONT_UNIMAP:+-u "${FONT_UNIMAP}"} 2> /dev/null
 }
 
 dev_close() {
diff --git a/modules.d/10i18n/module-setup.sh b/modules.d/10i18n/module-setup.sh
index ac45611..960c41d 100755
--- a/modules.d/10i18n/module-setup.sh
+++ b/modules.d/10i18n/module-setup.sh
@@ -38,13 +38,13 @@ install() {
         local CMD
         local FN
 
-        if [[ -f $dracutsysrootdir$1 ]]; then
+        if [[ -f $1 ]]; then
             MAPS=("$1")
         else
             MAPNAME=${1%.map*}
 
             mapfile -t -d '' MAPS < <(
-                find "${dracutsysrootdir}${kbddir}"/keymaps/ -type f \( -name "${MAPNAME}" -o -name "${MAPNAME}.map*" \) -print0
+                find "${dracutsysrootdir}${kbddir}"/keymaps/ -type f,l \( -name "${MAPNAME}" -o -name "${MAPNAME}.map*" \) -print0
             )
         fi
 
@@ -160,6 +160,7 @@ install() {
 
     install_local_i18n() {
         local map
+        local maplink
 
         # shellcheck disable=SC2086
         eval "$(gather_vars ${i18n_vars})"
@@ -216,7 +217,19 @@ install() {
         done
 
         for keymap in "${!KEYMAPS[@]}"; do
-            inst_opt_decompress "${keymap}"
+            if [[ -L ${keymap} ]]; then
+                maplink=$(readlink -f "${keymap}")
+                # skip symlinked directories
+                [[ -d ${maplink} ]] && continue
+
+                inst_opt_decompress "${maplink}"
+                # create new symlink to decompressed keymap
+                maplink=${maplink%.gz}
+                keymap=${keymap%.gz}
+                ln -srn "${initdir}${maplink#"$dracutsysrootdir"}" "${initdir}${keymap#"$dracutsysrootdir"}"
+            else
+                inst_opt_decompress "${keymap}"
+            fi
         done
 
         inst_opt_decompress "${kbddir}"/consolefonts/"${DEFAULT_FONT}".*
diff --git a/modules.d/35connman/cm-lib.sh b/modules.d/35connman/cm-lib.sh
index 69c4fa2..69901f3 100755
--- a/modules.d/35connman/cm-lib.sh
+++ b/modules.d/35connman/cm-lib.sh
@@ -4,7 +4,6 @@ type getcmdline > /dev/null 2>&1 || . /lib/dracut-lib.sh
 
 cm_generate_connections() {
     if getargbool 0 rd.neednet; then
-        mkdir -p "$hookdir"/initqueue/finished
         echo '[ -f /tmp/cm.done ]' > "$hookdir"/initqueue/finished/cm.sh
         mkdir -p /run/connman/initrd
         : > /run/connman/initrd/neednet # activate ConnMan services
diff --git a/modules.d/35connman/module-setup.sh b/modules.d/35connman/module-setup.sh
index 6502d30..5a3b0e1 100755
--- a/modules.d/35connman/module-setup.sh
+++ b/modules.d/35connman/module-setup.sh
@@ -10,7 +10,7 @@ check() {
 
 # called by dracut
 depends() {
-    echo dbus systemd bash
+    echo dbus systemd bash net-lib kernel-network-modules
     return 0
 }
 
@@ -25,7 +25,6 @@ install() {
     # in an emergency shell.
     inst_multiple ip sed grep
 
-    inst_script "$moddir/netroot.sh" "/sbin/netroot"
     inst connmand
     inst connmanctl
     inst connmand-wait-online
diff --git a/modules.d/35network-legacy/module-setup.sh b/modules.d/35network-legacy/module-setup.sh
index 868ea8f..42257eb 100755
--- a/modules.d/35network-legacy/module-setup.sh
+++ b/modules.d/35network-legacy/module-setup.sh
@@ -10,6 +10,7 @@ check() {
 
 # called by dracut
 depends() {
+    echo net-lib kernel-network-modules
     return 0
 }
 
@@ -23,9 +24,11 @@ installkernel() {
 install() {
     local _arch
 
-    #Adding default link
+    # Adding default link and (if exists) 98-default-mac-none.link
     if dracut_module_included "systemd"; then
-        inst_multiple -o "${systemdnetwork}/99-default.link"
+        inst_multiple -o \
+            "${systemdnetwork}/99-default.link" \
+            "${systemdnetwork}/98-default-mac-none.link"
         [[ $hostonly ]] && inst_multiple -H -o "${systemdnetworkconfdir}/*.link"
     fi
 
diff --git a/modules.d/35network-manager/module-setup.sh b/modules.d/35network-manager/module-setup.sh
index d9a244a..67144f3 100755
--- a/modules.d/35network-manager/module-setup.sh
+++ b/modules.d/35network-manager/module-setup.sh
@@ -10,7 +10,7 @@ check() {
 
 # called by dracut
 depends() {
-    echo dbus bash
+    echo dbus bash net-lib kernel-network-modules
     return 0
 }
 
@@ -51,8 +51,10 @@ install() {
         inst_simple "$moddir"/nm-initrd.service "$systemdsystemunitdir"/nm-initrd.service
         inst_simple "$moddir"/nm-wait-online-initrd.service "$systemdsystemunitdir"/nm-wait-online-initrd.service
 
-        # Adding default link
-        inst_multiple -o "${systemdnetwork}/99-default.link"
+        # Adding default link and (if exists) 98-default-mac-none.link
+        inst_multiple -o \
+            "${systemdnetwork}/99-default.link" \
+            "${systemdnetwork}/98-default-mac-none.link"
         [[ $hostonly ]] && inst_multiple -H -o "${systemdnetworkconfdir}/*.link"
 
         $SYSTEMCTL -q --root "$initdir" enable nm-initrd.service
@@ -70,7 +72,9 @@ install() {
     elif ! [[ -e "$initdir/etc/machine-id" ]]; then
         # The internal DHCP client silently fails if we
         # have no machine-id
-        systemd-machine-id-setup --root="$initdir"
+        local UUID
+        UUID=$(< /proc/sys/kernel/random/uuid)
+        echo "${UUID//-/}" > "$initdir/etc/machine-id"
     fi
 
     # We don't install the ifcfg files from the host automatically.
diff --git a/modules.d/35network-manager/nm-lib.sh b/modules.d/35network-manager/nm-lib.sh
index 32a288d..f0941de 100755
--- a/modules.d/35network-manager/nm-lib.sh
+++ b/modules.d/35network-manager/nm-lib.sh
@@ -20,7 +20,6 @@ nm_generate_connections() {
             /etc/NetworkManager/system-connections/* \
             /etc/sysconfig/network-scripts/ifcfg-*; do
             [ -f "$i" ] || continue
-            mkdir -p "$hookdir"/initqueue/finished
             echo '[ -f /tmp/nm.done ]' > "$hookdir"/initqueue/finished/nm.sh
             mkdir -p /run/NetworkManager/initrd
             : > /run/NetworkManager/initrd/neednet # activate NM services
diff --git a/modules.d/40network/module-setup.sh b/modules.d/40network/module-setup.sh
index 4c77ff3..970c252 100755
--- a/modules.d/40network/module-setup.sh
+++ b/modules.d/40network/module-setup.sh
@@ -27,22 +27,6 @@ depends() {
             network_handler="network-legacy"
         fi
     fi
-    echo "kernel-network-modules $network_handler"
+    echo "net-lib kernel-network-modules $network_handler"
     return 0
 }
-
-# called by dracut
-installkernel() {
-    return 0
-}
-
-# called by dracut
-install() {
-    inst_script "$moddir/netroot.sh" "/sbin/netroot"
-    inst_simple "$moddir/net-lib.sh" "/lib/net-lib.sh"
-    inst_hook pre-udev 50 "$moddir/ifname-genrules.sh"
-    inst_hook cmdline 91 "$moddir/dhcp-root.sh"
-    inst_multiple ip sed awk grep pgrep tr
-    inst_multiple -o arping arping2
-    dracut_need_initqueue
-}
diff --git a/modules.d/40network/netroot.sh b/modules.d/40network/netroot.sh
deleted file mode 100755
index 8f97774..0000000
--- a/modules.d/40network/netroot.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/bin/sh
-
-PATH=/usr/sbin:/usr/bin:/sbin:/bin
-command -v getarg > /dev/null || . /lib/dracut-lib.sh
-command -v setup_net > /dev/null || . /lib/net-lib.sh
-
-# Huh? Empty $1?
-[ -z "$1" ] && exit 1
-
-# [ ! -z $2 ] means this is for manually bringing up network
-# instead of real netroot; If It's called without $2, then there's
-# no sense in doing something if no (net)root info is available
-# or root is already there
-[ -d "$NEWROOT"/proc ] && exit 0
-
-if [ -z "$netroot" ]; then
-    netroot=$(getarg netroot=)
-fi
-
-[ -z "$netroot" ] && exit 1
-
-# Set or override primary interface
-netif=$1
-[ -e "/tmp/net.bootdev" ] && read -r netif < /tmp/net.bootdev
-
-case "$netif" in
-    ??:??:??:??:??:??) # MAC address
-        for i in /sys/class/net/*/address; do
-            read -r mac < "$i"
-            if [ "$mac" = "$netif" ]; then
-                i=${i%/address}
-                netif=${i##*/}
-                break
-            fi
-        done ;;
-esac
-
-# Figure out the handler for root=dhcp by recalling all netroot cmdline
-# handlers when this is not called from manually network bringing up.
-if [ -z "$2" ]; then
-    if getarg "root=dhcp" || getarg "netroot=dhcp" || getarg "root=dhcp6" || getarg "netroot=dhcp6"; then
-        # Load dhcp options
-        # shellcheck disable=SC1090
-        [ -e /tmp/dhclient."$netif".dhcpopts ] && . /tmp/dhclient."$netif".dhcpopts
-
-        # If we have a specific bootdev with no dhcpoptions or empty root-path,
-        # we die. Otherwise we just warn
-        if [ -z "$new_root_path" ]; then
-            [ -n "$BOOTDEV" ] && die "No dhcp root-path received for '$BOOTDEV'"
-            warn "No dhcp root-path received for '$netif' trying other interfaces if available"
-            exit 1
-        fi
-
-        rm -f -- "$hookdir"/initqueue/finished/dhcp.sh
-
-        # Set netroot to new_root_path, so cmdline parsers don't call
-        netroot=$new_root_path
-
-        # FIXME!
-        unset rootok
-        for f in "$hookdir"/cmdline/90*.sh; do
-            # shellcheck disable=SC1090
-            [ -f "$f" ] && . "$f"
-        done
-    else
-        rootok="1"
-    fi
-
-    # Check: do we really know how to handle (net)root?
-    if [ -z "$root" ]; then
-        root=$(getarg root=)
-    fi
-    [ -z "$root" ] && die "No or empty root= argument"
-    [ -z "$rootok" ] && die "Don't know how to handle 'root=$root'"
-
-    handler=${netroot%%:*}
-    handler=${handler%%4}
-    handler=$(command -v "${handler}"root)
-    if [ -z "$netroot" ] || [ ! -e "$handler" ]; then
-        die "No handler for netroot type '$netroot'"
-    fi
-fi
-
-# Source netroot hooks before we start the handler
-source_hook netroot "$netif"
-
-# Run the handler; don't store the root, it may change from device to device
-# XXX other variables to export?
-[ -n "$handler" ] && "$handler" "$netif" "$netroot" "$NEWROOT"
-save_netinfo "$netif"
-
-exit 0
diff --git a/modules.d/45ifcfg/module-setup.sh b/modules.d/45ifcfg/module-setup.sh
index b0d4418..cf731be 100755
--- a/modules.d/45ifcfg/module-setup.sh
+++ b/modules.d/45ifcfg/module-setup.sh
@@ -1,8 +1,11 @@
 #!/bin/bash
 
+# This module is deprecated. Modern replacements are NetworkManager keyfiles and
+# systemd network files. It must now be explicitly opted in by the user to be
+# added to the initrd.
+
 # called by dracut
 check() {
-    [[ -d $dracutsysrootdir/etc/sysconfig/network-scripts ]] && return 0
     return 255
 }
 
diff --git a/modules.d/45ifcfg/write-ifcfg.sh b/modules.d/45ifcfg/write-ifcfg.sh
index 5550cce..a7804b5 100755
--- a/modules.d/45ifcfg/write-ifcfg.sh
+++ b/modules.d/45ifcfg/write-ifcfg.sh
@@ -10,68 +10,21 @@ mkdir -m 0755 -p /tmp/ifcfg/
 # shellcheck disable=SC2174
 mkdir -m 0755 -p /tmp/ifcfg-leases/
 
-get_config_line_by_subchannel() {
-    local CHANNELS
-    local line
-
-    CHANNELS="$1"
-    while read -r line || [ -n "$line" ]; do
-        if strstr "$line" "$CHANNELS"; then
-            echo "$line"
-            return 0
-        fi
-    done < /etc/ccw.conf
-    return 1
-}
-
 print_s390() {
     local _netif
     local SUBCHANNELS
-    local OPTIONS
-    local NETTYPE
-    local CONFIG_LINE
     local i
-    local channel
-    local OLD_IFS
 
     _netif="$1"
     # if we find ccw channel, then use those, instead of
     # of the MAC
-    SUBCHANNELS=$({
-        for i in /sys/class/net/"$_netif"/device/cdev[0-9]*; do
-            [ -e "$i" ] || continue
-            channel=$(readlink -f "$i")
-            printf '%s' "${channel##*/},"
-        done
-    })
+    # [iface_get_subchannels() from /lib/net-lib.sh sourced at top of this file]
+    SUBCHANNELS=$(iface_get_subchannels "$_netif")
     [ -n "$SUBCHANNELS" ] || return 1
 
     SUBCHANNELS=${SUBCHANNELS%,}
     echo "SUBCHANNELS=\"${SUBCHANNELS}\""
 
-    CONFIG_LINE=$(get_config_line_by_subchannel "$SUBCHANNELS")
-    # shellcheck disable=SC2181
-    [ $? -ne 0 -o -z "$CONFIG_LINE" ] && return 0
-
-    OLD_IFS=$IFS
-    IFS=","
-    # shellcheck disable=SC2086
-    set -- $CONFIG_LINE
-    IFS=$OLD_IFS
-    NETTYPE=$1
-    shift
-    SUBCHANNELS="$1"
-    OPTIONS=""
-    shift
-    while [ $# -gt 0 ]; do
-        case $1 in
-            *=*) OPTIONS="$OPTIONS $1" ;;
-        esac
-        shift
-    done
-    OPTIONS=${OPTIONS## }
-    echo "NETTYPE=\"${NETTYPE}\""
-    echo "OPTIONS=\"${OPTIONS}\""
     return 0
 }
 
diff --git a/modules.d/40network/dhcp-root.sh b/modules.d/45net-lib/dhcp-root.sh
index 3f11221..3f11221 100755
--- a/modules.d/40network/dhcp-root.sh
+++ b/modules.d/45net-lib/dhcp-root.sh
diff --git a/modules.d/40network/ifname-genrules.sh b/modules.d/45net-lib/ifname-genrules.sh
index b9b95c4..b9b95c4 100755
--- a/modules.d/40network/ifname-genrules.sh
+++ b/modules.d/45net-lib/ifname-genrules.sh
diff --git a/modules.d/45net-lib/module-setup.sh b/modules.d/45net-lib/module-setup.sh
new file mode 100755
index 0000000..8053aa6
--- /dev/null
+++ b/modules.d/45net-lib/module-setup.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+check() {
+    return 255
+}
+
+depends() {
+    echo base
+    return 0
+}
+
+install() {
+    inst_script "$moddir/netroot.sh" "/sbin/netroot"
+    inst_simple "$moddir/net-lib.sh" "/lib/net-lib.sh"
+    inst_hook pre-udev 50 "$moddir/ifname-genrules.sh"
+    inst_hook cmdline 91 "$moddir/dhcp-root.sh"
+    inst_multiple ip sed awk grep pgrep tr
+    inst_multiple -o arping arping2
+    dracut_need_initqueue
+}
diff --git a/modules.d/40network/net-lib.sh b/modules.d/45net-lib/net-lib.sh
index 9d88e0d..9d88e0d 100755
--- a/modules.d/40network/net-lib.sh
+++ b/modules.d/45net-lib/net-lib.sh
diff --git a/modules.d/35connman/netroot.sh b/modules.d/45net-lib/netroot.sh
index 8f97774..8f97774 100755
--- a/modules.d/35connman/netroot.sh
+++ b/modules.d/45net-lib/netroot.sh
diff --git a/modules.d/50drm/module-setup.sh b/modules.d/50drm/module-setup.sh
index 1fb3867..43a99e8 100755
--- a/modules.d/50drm/module-setup.sh
+++ b/modules.d/50drm/module-setup.sh
@@ -29,18 +29,22 @@ installkernel() {
     # as we could e.g. be in the installer; nokmsboot boot parameter will disable
     # loading of the driver if needed
     if [[ $hostonly ]]; then
+        local -a _mods
         local i modlink modname
 
         for i in /sys/bus/{pci/devices,platform/devices,virtio/devices,soc/devices/soc?,vmbus/devices}/*/modalias; do
             [[ -e $i ]] || continue
             [[ -n $(< "$i") ]] || continue
-            # shellcheck disable=SC2046
-            if hostonly="" dracut_instmods --silent -s "drm_crtc_init|drm_dev_register|drm_encoder_init" -S "iw_handler_get_spy" $(< "$i"); then
-                if strstr "$(modinfo -F filename $(< "$i") 2> /dev/null)" radeon.ko; then
+            mapfile -t -O "${#_mods[@]}" _mods < "$i"
+        done
+        if ((${#_mods[@]})); then
+            # shellcheck disable=SC2068
+            if hostonly="" dracut_instmods --silent -o -s "drm_crtc_init|drm_dev_register|drm_encoder_init" -S "iw_handler_get_spy" ${_mods[@]}; then
+                if strstr "$(modinfo -F filename "${_mods[@]}" 2> /dev/null)" radeon.ko; then
                     hostonly='' instmods amdkfd
                 fi
             fi
-        done
+        fi
         # if there is a privacy screen then its driver must be loaded before the
         # kms driver will bind, otherwise its probe() will return -EPROBE_DEFER
         # note privacy screens always register, even with e.g. nokmsboot
diff --git a/modules.d/50plymouth/module-setup.sh b/modules.d/50plymouth/module-setup.sh
index cc6629b..ba2fbc5 100755
--- a/modules.d/50plymouth/module-setup.sh
+++ b/modules.d/50plymouth/module-setup.sh
@@ -20,7 +20,9 @@ check() {
     [[ "$mount_needs" ]] && return 1
     [[ $(pkglib_dir) ]] || return 1
 
-    require_binaries plymouthd plymouth plymouth-set-default-theme
+    require_binaries plymouthd plymouth plymouth-set-default-theme || return 1
+
+    return 0
 }
 
 # called by dracut
diff --git a/modules.d/80cms/cms-write-ifcfg.sh b/modules.d/80cms/cms-write-ifcfg.sh
index ecfd53e..9126309 100755
--- a/modules.d/80cms/cms-write-ifcfg.sh
+++ b/modules.d/80cms/cms-write-ifcfg.sh
@@ -81,21 +81,8 @@ EOF
     fi
     # colons in SEARCHDNS already replaced with spaces above for /etc/resolv.conf
     [[ $SEARCHDNS ]] && echo "DOMAIN=\"$SEARCHDNS\"" >> "$IFCFGFILE"
-    [[ $NETTYPE ]] && echo "NETTYPE=$NETTYPE" >> "$IFCFGFILE"
     [[ $PEERID ]] && echo "PEERID=$PEERID" >> "$IFCFGFILE"
-    [[ $PORTNAME ]] && echo "PORTNAME=$PORTNAME" >> "$IFCFGFILE"
-    [[ $CTCPROT ]] && echo "CTCPROT=$CTCPROT" >> "$IFCFGFILE"
     [[ $MACADDR ]] && echo "MACADDR=$MACADDR" >> "$IFCFGFILE"
-    optstr=""
-    for option in LAYER2 PORTNO; do
-        [ -z "${!option}" ] && continue
-        [ -n "$optstr" ] && optstr=${optstr}" "
-        optstr=${optstr}$(echo ${option} | sed 'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/')"="${!option}
-    done
-    # write single quotes since network.py removes double quotes but we need quotes
-    echo "OPTIONS='$optstr'" >> "$IFCFGFILE"
-    unset option
-    unset optstr
     unset DNS1
     unset DNS2
     echo "files /etc/sysconfig/network-scripts" >> /run/initramfs/rwtab
diff --git a/modules.d/80cms/cmssetup.sh b/modules.d/80cms/cmssetup.sh
index 68e4563..5e5b926 100755
--- a/modules.d/80cms/cmssetup.sh
+++ b/modules.d/80cms/cmssetup.sh
@@ -1,35 +1,18 @@
 #!/bin/bash
 
 type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
-
-function sysecho() {
-    file="$1"
-    shift
-    local i=1
-    while [ $i -le 10 ]; do
-        if [ ! -f "$file" ]; then
-            sleep 1
-            i=$((i + 1))
-        else
-            break
-        fi
-    done
-    local status
-    read -r status < "$file"
-    if [[ $status != "$*" ]]; then
-        [ -f "$file" ] && echo "$*" > "$file"
-    fi
-}
+type zdev_parse_dasd_list > /dev/null 2>&1 || . /lib/s390-tools/zdev-from-dasd_mod.dasd
 
 function dasd_settle() {
-    local dasd_status=/sys/bus/ccw/devices/$1/status
+    local dasd_status
+    dasd_status=$(lszdev dasd "$1" --columns ATTRPATH:status --no-headings --active)
     if [ ! -f "$dasd_status" ]; then
         return 1
     fi
     local i=1
     while [ $i -le 60 ]; do
         local status
-        read -r status < "$dasd_status"
+        status=$(lszdev dasd "$1" --columns ATTR:status --no-headings --active)
         case $status in
             online | unformatted)
                 return 0
@@ -43,77 +26,23 @@ function dasd_settle() {
     return 1
 }
 
-function dasd_settle_all() {
-    for dasdccw in $(while read -r line || [ -n "$line" ]; do echo "${line%%(*}"; done < /proc/dasd/devices); do
-        if ! dasd_settle "$dasdccw"; then
-            echo $"Could not access DASD $dasdccw in time"
-            return 1
-        fi
-    done
-    return 0
-}
-
-# prints a canonocalized device bus ID for a given devno of any format
-function canonicalize_devno() {
-    case ${#1} in
-        3) echo "0.0.0${1}" ;;
-        4) echo "0.0.${1}" ;;
-        *) echo "${1}" ;;
-    esac
-    return 0
-}
-
 # read file from CMS and write it to /tmp
 function readcmsfile() { # $1=dasdport $2=filename
     local dev
-    local numcpus
     local devname
     local ret=0
     if [ $# -ne 2 ]; then return; fi
-    # precondition: udevd created dasda block device node
-    if ! dasd_cio_free -d "$1"; then
-        echo $"DASD $1 could not be cleared from device blacklist"
-        return 1
-    fi
-
-    modprobe dasd_mod dasd="$CMSDASD"
-    modprobe dasd_eckd_mod
-    udevadm settle
-
-    # precondition: dasd_eckd_mod driver incl. dependencies loaded,
-    #               dasd_mod must be loaded without setting any DASD online
-    dev=$(canonicalize_devno "$1")
-    numcpus=$(
-        while read -r line || [ -n "$line" ]; do
-            if strstr "$line" "# processors"; then
-                echo "${line##*:}"
-                break
-            fi
-        done < /proc/cpuinfo
-    )
+    # precondition: udevd created block device node
 
-    if [ "${numcpus}" -eq 1 ]; then
-        echo 1 > /sys/bus/ccw/devices/"$dev"/online
-    else
-        if ! sysecho /sys/bus/ccw/devices/"$dev"/online 1; then
-            echo $"DASD $dev could not be set online"
-            return 1
-        fi
-        udevadm settle
-        if ! dasd_settle "$dev"; then
-            echo $"Could not access DASD $dev in time"
-            return 1
-        fi
+    dev="$1"
+    chzdev --enable --active --yes --quiet --no-root-update --force dasd "$dev" || return 1
+    if ! dasd_settle "$dev"; then
+        echo $"Could not access DASD $dev in time"
+        return 1
     fi
 
-    udevadm settle
-
-    devname=$(
-        cd /sys/bus/ccw/devices/"$dev"/block || exit
-        set -- *
-        [ -b /dev/"$1" ] && echo "$1"
-    )
-    devname=${devname:-dasda}
+    devname=$(lszdev dasd "$dev" --columns NAMES --no-headings --active)
+    [[ -n $devname ]] || return 1
 
     [[ -d /mnt ]] || mkdir -p /mnt
     if cmsfs-fuse --to=UTF-8 -a /dev/"$devname" /mnt; then
@@ -125,20 +54,22 @@ function readcmsfile() { # $1=dasdport $2=filename
         ret=1
     fi
 
-    if ! sysecho /sys/bus/ccw/devices/"$dev"/online 0; then
-        echo $"DASD $dev could not be set offline again"
-        #return 1
-    fi
-    udevadm settle
+    chzdev --disable --active --yes --quiet --no-root-update --force dasd "$dev"
 
     # unbind all dasds to unload the dasd modules for a clean start
     (
         cd /sys/bus/ccw/drivers/dasd-eckd || exit
-        for i in *.*; do echo "$i" > unbind; done
+        for i in *.*; do echo "$i" > unbind 2> /dev/null; done
+    )
+    (
+        cd /sys/bus/ccw/drivers/dasd-fba || exit
+        for i in *.*; do echo "$i" > unbind 2> /dev/null; done
     )
     udevadm settle
     modprobe -r dasd_eckd_mod
     udevadm settle
+    modprobe -r dasd_fba_mod
+    udevadm settle
     modprobe -r dasd_diag_mod
     udevadm settle
     modprobe -r dasd_mod
@@ -151,13 +82,19 @@ processcmsfile() {
     SUBCHANNELS="$(echo "$SUBCHANNELS" | sed 'y/ABCDEF/abcdef/')"
 
     if [[ $NETTYPE ]]; then
-        (
-            echo -n "$NETTYPE","$SUBCHANNELS"
-            [[ $PORTNAME ]] && echo -n ",portname=$PORTNAME"
-            [[ $LAYER2 ]] && echo -n ",layer2=$LAYER2"
-            [[ $NETTYPE == "ctc" ]] && [[ $CTCPROT ]] && echo -n ",protocol=$CTCPROT"
-            echo
-        ) >> /etc/ccw.conf
+        _cms_attrs=""
+        if [[ $PORTNAME ]]; then
+            if [[ $NETTYPE == lcs ]]; then
+                _cms_attrs="$_cms_attrs portno=$PORTNAME"
+            else
+                _cms_attrs="$_cms_attrs portname=$PORTNAME"
+            fi
+        fi
+        [[ $LAYER2 ]] && _cms_attrs="$_cms_attrs layer2=$LAYER2"
+        [[ $CTCPROT ]] && _cms_attrs="$_cms_attrs protocol=$CTCPROT"
+        # shellcheck disable=SC2086
+        chzdev --enable --persistent --yes --no-root-update --force \
+            "$NETTYPE" "$SUBCHANNELS" $_cms_attrs 2>&1 | vinfo
 
         OLDIFS=$IFS
         IFS=,
@@ -178,16 +115,13 @@ processcmsfile() {
         [[ -f /etc/udev/rules.d/90-net.rules ]] \
             || printf 'SUBSYSTEM=="net", ACTION=="online", RUN+="/sbin/initqueue --onetime --env netif=$name source_hook initqueue/online"\n' >> /etc/udev/rules.d/99-cms.rules
         udevadm control --reload
-        znet_cio_free
     fi
 
     if [[ $DASD ]] && [[ $DASD != "none" ]]; then
-        echo "$DASD" | normalize_dasd_arg > /etc/dasd.conf
-        echo "options dasd_mod dasd=$DASD" > /etc/modprobe.d/dasd_mod.conf
-        dasd_cio_free
+        echo "$DASD" | zdev_parse_dasd_list globals 2>&1 | vinfo
+        echo "$DASD" | zdev_parse_dasd_list ranges 2>&1 | vinfo
     fi
 
-    unset _do_zfcp
     for i in ${!FCP_*}; do
         echo "${!i}" | while read -r port rest || [ -n "$port" ]; do
             case $port in
@@ -200,12 +134,24 @@ processcmsfile() {
                     port="0.0.$port"
                     ;;
             esac
-            echo "$port" "$rest" >> /etc/zfcp.conf
+            # shellcheck disable=SC2086
+            set -- $rest
+            SAVED_IFS="$IFS"
+            IFS=":"
+            # Intentionally do not dynamically activate now, but only generate udev
+            # rules, which activate the device later during udev coldplug.
+            if [[ -z $rest ]]; then
+                chzdev --enable --persistent \
+                    --no-settle --yes --quiet --no-root-update --force \
+                    zfcp-host "$port" 2>&1 | vinfo
+            else
+                chzdev --enable --persistent \
+                    --no-settle --yes --quiet --no-root-update --force \
+                    zfcp-lun "$port:$*" 2>&1 | vinfo
+            fi
+            IFS="$SAVED_IFS"
         done
-        _do_zfcp=1
     done
-    [[ $_do_zfcp ]] && zfcp_cio_free
-    unset _do_zfcp
 }
 
 [[ $CMSDASD ]] || CMSDASD=$(getarg "CMSDASD=")
diff --git a/modules.d/80cms/module-setup.sh b/modules.d/80cms/module-setup.sh
index 2b280e0..5b33cd1 100755
--- a/modules.d/80cms/module-setup.sh
+++ b/modules.d/80cms/module-setup.sh
@@ -4,6 +4,7 @@
 check() {
     arch=${DRACUT_ARCH:-$(uname -m)}
     [ "$arch" = "s390" -o "$arch" = "s390x" ] || return 1
+    require_binaries chzdev lszdev || return 1
     return 255
 }
 
@@ -11,13 +12,13 @@ check() {
 depends() {
     arch=${DRACUT_ARCH:-$(uname -m)}
     [ "$arch" = "s390" -o "$arch" = "s390x" ] || return 1
-    echo znet zfcp dasd dasd_mod bash
+    echo znet bash
     return 0
 }
 
 # called by dracut
 installkernel() {
-    instmods zfcp
+    instmods zfcp dasd_mod dasd_eckd_mod dasd_fba_mod dasd_diag_mod
 }
 
 # called by dracut
@@ -27,8 +28,8 @@ install() {
     inst_script "$moddir/cmsifup.sh" /sbin/cmsifup
     # shellcheck disable=SC2046
     inst_multiple /etc/cmsfs-fuse/filetypes.conf /etc/udev/rules.d/99-fuse.rules /etc/fuse.conf \
-        cmsfs-fuse fusermount bash insmod rmmod cat normalize_dasd_arg sed \
-        $(rpm -ql s390utils-base) awk getopt
+        cmsfs-fuse fusermount bash insmod rmmod cat /lib/s390-tools/zdev-from-dasd_mod.dasd sed \
+        awk getopt chzdev lszdev
 
     inst_libdir_file "gconv/*"
     #inst /usr/lib/locale/locale-archive
diff --git a/modules.d/80test-makeroot/module-setup.sh b/modules.d/80test-makeroot/module-setup.sh
index eb6fb74..f311e4a 100755
--- a/modules.d/80test-makeroot/module-setup.sh
+++ b/modules.d/80test-makeroot/module-setup.sh
@@ -14,6 +14,13 @@ installkernel() {
 }
 
 install() {
-    inst_multiple poweroff cp umount sync dd
+    # do not compress, do not strip
+    export compress="cat"
+    export do_strip="no"
+    export do_hardlink="no"
+    export early_microcode="no"
+    export hostonly_cmdline="no"
+
+    inst_multiple poweroff cp umount sync dd mkfs.ext4
     inst_hook initqueue/finished 01 "$moddir/finished-false.sh"
 }
diff --git a/modules.d/80test-root/module-setup.sh b/modules.d/80test-root/module-setup.sh
index 24605c5..64d618f 100755
--- a/modules.d/80test-root/module-setup.sh
+++ b/modules.d/80test-root/module-setup.sh
@@ -6,10 +6,17 @@ check() {
 }
 
 depends() {
-    echo "debug"
+    echo debug
 }
 
 install() {
+    # do not compress, do not strip
+    export compress="cat"
+    export do_strip="no"
+    export do_hardlink="no"
+    export early_microcode="no"
+    export hostonly_cmdline="no"
+
     inst_simple /etc/os-release
 
     inst_multiple mkdir ln dd stty mount poweroff umount setsid sync
@@ -23,5 +30,10 @@ install() {
     ln -s dracut-util "${initdir}/usr/bin/dracut-getarg"
     ln -s dracut-util "${initdir}/usr/bin/dracut-getargs"
 
+    inst_script "${dracutbasedir}/modules.d/99base/dracut-lib.sh" "/lib/dracut-lib.sh"
+    inst_script "${dracutbasedir}/modules.d/99base/dracut-dev-lib.sh" "/lib/dracut-dev-lib.sh"
+
+    inst_script "$moddir/test-init.sh" "/sbin/init"
+
     inst_multiple -o plymouth
 }
diff --git a/modules.d/80test-root/test-init.sh b/modules.d/80test-root/test-init.sh
new file mode 100755
index 0000000..bd6e485
--- /dev/null
+++ b/modules.d/80test-root/test-init.sh
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+[ -e /proc/self/mounts ] \
+    || (mkdir -p /proc && mount -t proc -o nosuid,noexec,nodev proc /proc)
+
+grep -q '^sysfs /sys sysfs' /proc/self/mounts \
+    || (mkdir -p /sys && mount -t sysfs -o nosuid,noexec,nodev sysfs /sys)
+
+grep -q '^devtmpfs /dev devtmpfs' /proc/self/mounts \
+    || (mkdir -p /dev && mount -t devtmpfs -o mode=755,noexec,nosuid,strictatime devtmpfs /dev)
+
+grep -q '^tmpfs /run tmpfs' /proc/self/mounts \
+    || (mkdir -p /run && mount -t tmpfs -o mode=755,noexec,nosuid,strictatime tmpfs /run)
+
+: > /dev/watchdog
+
+exec > /dev/console 2>&1
+
+if [ -s /failed ]; then
+    echo "**************************FAILED**************************"
+    cat /failed
+    echo "**************************FAILED**************************"
+else
+    echo "dracut-root-block-success" | dd oflag=direct,dsync status=none of=/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_marker
+    echo "All OK"
+fi
+
+export TERM=linux
+export PS1='initramfs-test:\w\$ '
+[ -f /etc/mtab ] || ln -sfn /proc/mounts /etc/mtab
+[ -f /etc/fstab ] || ln -sfn /proc/mounts /etc/fstab
+stty sane
+echo "made it to the rootfs!"
+
+. /lib/dracut-lib.sh
+
+if getargbool 0 rd.shell; then
+    strstr "$(setsid --help)" "control" && CTTY="-c"
+    # shellcheck disable=SC2086
+    setsid $CTTY sh -i
+fi
+
+echo "Powering down."
+mount -n -o remount,ro /
+if [ -d /run/initramfs/etc ]; then
+    echo " rd.debug=0 " >> /run/initramfs/etc/cmdline
+fi
+poweroff -f
diff --git a/modules.d/80test/hard-off.sh b/modules.d/80test/hard-off.sh
index 01acb19..cf44fb0 100755
--- a/modules.d/80test/hard-off.sh
+++ b/modules.d/80test/hard-off.sh
@@ -1,3 +1,3 @@
 #!/bin/sh
 getargbool 0 rd.shell || poweroff -f
-getargbool 0 failme && poweroff -f
+! getargbool 0 rd.break && getargbool 0 failme && poweroff -f
diff --git a/modules.d/80test/module-setup.sh b/modules.d/80test/module-setup.sh
index 96041a9..7560e05 100755
--- a/modules.d/80test/module-setup.sh
+++ b/modules.d/80test/module-setup.sh
@@ -6,10 +6,29 @@ check() {
 }
 
 depends() {
-    echo "debug"
+    echo "base debug qemu watchdog"
+}
+
+installkernel() {
+    instmods \
+        ata_piix \
+        ext4 \
+        i6300esb \
+        ide-gd_mod \
+        piix \
+        sd_mod \
+        virtio_pci \
+        virtio_scsi
 }
 
 install() {
+    # do not compress, do not strip
+    export compress="cat"
+    export do_strip="no"
+    export do_hardlink="no"
+    export early_microcode="no"
+    export hostonly_cmdline="no"
+
     inst poweroff
     inst_hook shutdown-emergency 000 "$moddir/hard-off.sh"
     inst_hook emergency 000 "$moddir/hard-off.sh"
diff --git a/modules.d/90crypt/module-setup.sh b/modules.d/90crypt/module-setup.sh
index d5ac45b..8d24825 100755
--- a/modules.d/90crypt/module-setup.sh
+++ b/modules.d/90crypt/module-setup.sh
@@ -18,21 +18,7 @@ check() {
 
 # called by dracut
 depends() {
-    local deps
-    deps="dm rootfs-block"
-    if [[ $hostonly && -f "$dracutsysrootdir"/etc/crypttab ]]; then
-        if grep -q -e "fido2-device=" -e "fido2-cid=" "$dracutsysrootdir"/etc/crypttab; then
-            deps+=" fido2"
-        fi
-        if grep -q "pkcs11-uri" "$dracutsysrootdir"/etc/crypttab; then
-            deps+=" pkcs11"
-        fi
-        if grep -q "tpm2-device=" "$dracutsysrootdir"/etc/crypttab; then
-            deps+=" tpm2-tss"
-        fi
-    fi
-    echo "$deps"
-    return 0
+    echo dm rootfs-block
 }
 
 # called by dracut
@@ -160,22 +146,6 @@ install() {
     inst_simple "$moddir/crypt-lib.sh" "/lib/dracut-crypt-lib.sh"
     inst_script "$moddir/crypt-run-generator.sh" "/sbin/crypt-run-generator"
 
-    if dracut_module_included "systemd"; then
-        # the cryptsetup targets are already pulled in by 00systemd, but not
-        # the enablement symlinks
-        inst_multiple -o \
-            "$tmpfilesdir"/cryptsetup.conf \
-            "$systemdutildir"/system-generators/systemd-cryptsetup-generator \
-            "$systemdutildir"/systemd-cryptsetup \
-            "$systemdsystemunitdir"/systemd-ask-password-console.path \
-            "$systemdsystemunitdir"/systemd-ask-password-console.service \
-            "$systemdsystemunitdir"/cryptsetup.target \
-            "$systemdsystemunitdir"/sysinit.target.wants/cryptsetup.target \
-            "$systemdsystemunitdir"/remote-cryptsetup.target \
-            "$systemdsystemunitdir"/initrd-root-device.target.wants/remote-cryptsetup.target \
-            systemd-ask-password systemd-tty-ask-password-agent
-    fi
-
     # Install required libraries.
     _arch=${DRACUT_ARCH:-$(uname -m)}
     inst_libdir_file \
diff --git a/modules.d/90crypt/parse-crypt.sh b/modules.d/90crypt/parse-crypt.sh
index e46e347..39fc6d2 100755
--- a/modules.d/90crypt/parse-crypt.sh
+++ b/modules.d/90crypt/parse-crypt.sh
@@ -174,7 +174,7 @@ else
                 } >> "$hookdir/emergency/90-crypt.sh"
             fi
         done
-    elif getargbool 0 rd.auto; then
+    elif getargbool 1 rd.auto; then
         if [ -z "$DRACUT_SYSTEMD" ]; then
             {
                 printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", RUN+="%s ' "$(command -v initqueue)"
diff --git a/modules.d/90dm/dm-shutdown.sh b/modules.d/90dm/dm-shutdown.sh
index bd7134a..93b62bb 100755
--- a/modules.d/90dm/dm-shutdown.sh
+++ b/modules.d/90dm/dm-shutdown.sh
@@ -2,26 +2,40 @@
 
 _remove_dm() {
     local dev="$1"
+    local final="$2"
     local s
     local devname
 
     for s in /sys/block/"${dev}"/holders/dm-*; do
         [ -e "${s}" ] || continue
-        _remove_dm "${s##*/}"
+        _remove_dm "${s##*/}" "$final" || return $?
     done
-    # multipath devices might have MD devices on top,
-    # which are removed after this script. So do not
-    # remove those to avoid spurious errors
+
+    read -r devname < /sys/block/"${dev}"/dm/name
     case $(cat /sys/block/"${dev}"/dm/uuid) in
         mpath-*)
+            # multipath devices might have MD devices on top,
+            # which are removed after this script. So do not
+            # remove those to avoid spurious errors
             return 0
             ;;
-        *)
-            read -r devname < /sys/block/"${dev}"/dm/name
-            dmsetup -v --noudevsync remove "$devname" || return $?
+        CRYPT-*)
+            if command -v systemd-cryptsetup > /dev/null; then
+                DM_DISABLE_UDEV=true SYSTEMD_LOG_LEVEL=debug systemd-cryptsetup detach "$devname" && return 0
+            elif command -v cryptsetup > /dev/null; then
+                DM_DISABLE_UDEV=true cryptsetup close --debug "$devname" && return 0
+            else
+                dmsetup -v --noudevsync remove "$devname"
+                return $?
+            fi
+
+            # try using plain dmsetup if we're on the final attempt.
+            [ -z "$final" ] && return 1
             ;;
     esac
-    return 0
+
+    dmsetup -v --noudevsync remove "$devname"
+    return $?
 }
 
 _do_dm_shutdown() {
@@ -33,9 +47,9 @@ _do_dm_shutdown() {
     for dev in /sys/block/dm-*; do
         [ -e "${dev}" ] || continue
         if [ "x$final" != "x" ]; then
-            _remove_dm "${dev##*/}" || ret=$?
+            _remove_dm "${dev##*/}" "$final" || ret=$?
         else
-            _remove_dm "${dev##*/}" > /dev/null 2>&1 || ret=$?
+            _remove_dm "${dev##*/}" "$final" > /dev/null 2>&1 || ret=$?
         fi
     done
     if [ "x$final" != "x" ]; then
diff --git a/modules.d/90dmsquash-live/dmsquash-live-root.sh b/modules.d/90dmsquash-live/dmsquash-live-root.sh
index e808339..4518852 100755
--- a/modules.d/90dmsquash-live/dmsquash-live-root.sh
+++ b/modules.d/90dmsquash-live/dmsquash-live-root.sh
@@ -59,27 +59,34 @@ get_check_dev() {
     echo "$_udevinfo" | grep "DEVNAME=" | sed 's/DEVNAME=//'
 }
 
-# Find the right device to run check on
-check_dev=$(get_check_dev "$livedev")
-# CD/DVD media check
-[ -b "$check_dev" ] && fs=$(det_fs "$check_dev")
-if [ "$fs" = "iso9660" -o "$fs" = "udf" ]; then
-    check="yes"
-fi
-getarg rd.live.check -d check || check=""
-if [ -n "$check" ]; then
-    type plymouth > /dev/null 2>&1 && plymouth --hide-splash
-    if [ -n "$DRACUT_SYSTEMD" ]; then
-        p=$(dev_unit_name "$check_dev")
-        systemctl start checkisomd5@"${p}".service
-    else
-        checkisomd5 --verbose "$check_dev"
+# Check ISO checksum only if we have a path to a block device (or just its name
+# without '/dev'). In other words, in this context, we perform the check only
+# if the given $livedev is not a filesystem file image.
+if [ ! -f "$livedev" ]; then
+    # Find the right device to run check on
+    check_dev=$(get_check_dev "$livedev")
+    # CD/DVD media check
+    [ -b "$check_dev" ] && fs=$(det_fs "$check_dev")
+    if [ "$fs" = "iso9660" -o "$fs" = "udf" ]; then
+        check="yes"
     fi
-    if [ $? -eq 1 ]; then
-        die "CD check failed!"
-        exit 1
+    getarg rd.live.check -d check || check=""
+    if [ -n "$check" ]; then
+        type plymouth > /dev/null 2>&1 && plymouth --hide-splash
+        if [ -n "$DRACUT_SYSTEMD" ]; then
+            p=$(dev_unit_name "$check_dev")
+            systemctl start checkisomd5@"${p}".service
+        else
+            checkisomd5 --verbose "$check_dev"
+        fi
+        if [ $? -eq 1 ]; then
+            warn "Media check failed! We do not recommend using this medium. System will halt in 12 hours"
+            sleep 43200
+            die "Media check failed!"
+            exit 1
+        fi
+        type plymouth > /dev/null 2>&1 && plymouth --show-splash
     fi
-    type plymouth > /dev/null 2>&1 && plymouth --show-splash
 fi
 
 ln -s "$livedev" /run/initramfs/livedev
@@ -109,7 +116,7 @@ if [ -f "$livedev" ]; then
         auto) die "cannot mount live image (unknown filesystem type)" ;;
         *) FSIMG=$livedev ;;
     esac
-    [ -e /sys/fs/"$fstype" ] || modprobe "$fstype"
+    load_fstype "$fstype"
 else
     livedev_fstype=$(det_fs "$livedev")
     if [ "$livedev_fstype" = "squashfs" ]; then
@@ -143,6 +150,8 @@ do_live_overlay() {
 
     if [ -z "$pathspec" -o "$pathspec" = "auto" ]; then
         pathspec="/${live_dir}/overlay-$l-$u"
+    elif ! str_starts "$pathspec" "/"; then
+        pathspec=/"${pathspec}"
     fi
     devspec=${overlay%%:*}
 
@@ -296,7 +305,7 @@ do_live_overlay() {
         dmsetup message /dev/mapper/live-overlay-pool 0 "create_thin 0"
 
         # Create a snapshot of the base image
-        echo 0 "$sz" thin /dev/mapper/live-overlay-pool 0 "$base" | dmsetup create live-rw
+        echo 0 "$thin_data_sz" thin /dev/mapper/live-overlay-pool 0 "$base" | dmsetup create live-rw
     elif [ -z "$overlayfs" ]; then
         echo 0 "$sz" snapshot "$base" "$over" PO 8 | dmsetup create live-rw
     fi
diff --git a/modules.d/90kernel-modules/module-setup.sh b/modules.d/90kernel-modules/module-setup.sh
index e217512..ec60f39 100755
--- a/modules.d/90kernel-modules/module-setup.sh
+++ b/modules.d/90kernel-modules/module-setup.sh
@@ -55,10 +55,10 @@ installkernel() {
             "=drivers/watchdog"
 
         instmods \
-            yenta_socket spi_pxa2xx_platform \
-            atkbd i8042 firewire-ohci pcmcia hv-vmbus \
+            yenta_socket intel_lpss_pci spi_pxa2xx_platform \
+            atkbd i8042 firewire-ohci hv-vmbus \
             virtio virtio_ring virtio_pci pci_hyperv \
-            "=drivers/pcmcia"
+            surface_aggregator_registry psmouse
 
         if [[ ${DRACUT_ARCH:-$(uname -m)} == arm* || ${DRACUT_ARCH:-$(uname -m)} == aarch64 || ${DRACUT_ARCH:-$(uname -m)} == riscv* ]]; then
             # arm/aarch64 specific modules
@@ -87,6 +87,7 @@ installkernel() {
                 "=drivers/rtc" \
                 "=drivers/soc" \
                 "=drivers/spi" \
+                "=drivers/spmi" \
                 "=drivers/usb/chipidea" \
                 "=drivers/usb/dwc2" \
                 "=drivers/usb/dwc3" \
@@ -95,7 +96,8 @@ installkernel() {
                 "=drivers/usb/misc" \
                 "=drivers/usb/musb" \
                 "=drivers/usb/phy" \
-                "=drivers/scsi/hisi_sas"
+                "=drivers/scsi/hisi_sas" \
+                "=net/qrtr"
         fi
 
         awk -F: '/^\// {print $1}' "$srcmods/modules.dep" 2> /dev/null | instmods
diff --git a/modules.d/90kernel-modules/parse-kernel.sh b/modules.d/90kernel-modules/parse-kernel.sh
index d14f912..218a3e0 100755
--- a/modules.d/90kernel-modules/parse-kernel.sh
+++ b/modules.d/90kernel-modules/parse-kernel.sh
@@ -1,11 +1,7 @@
 #!/bin/sh
 
-_modprobe_d=/etc/modprobe.d
-if [ -d /usr/lib/modprobe.d ]; then
-    _modprobe_d=/usr/lib/modprobe.d
-elif [ -d /lib/modprobe.d ]; then
-    _modprobe_d=/lib/modprobe.d
-elif [ ! -d $_modprobe_d ]; then
+_modprobe_d=/run/modprobe.d
+if [ ! -d $_modprobe_d ]; then
     mkdir -p $_modprobe_d
 fi
 
@@ -18,8 +14,6 @@ for i in $(getargs rd.driver.pre -d rdloaddriver=); do
     )
 done
 
-[ -d /etc/modprobe.d ] || mkdir -p /etc/modprobe.d
-
 for i in $(getargs rd.driver.blacklist -d rdblacklist=); do
     (
         IFS=,
diff --git a/modules.d/90livenet/livenetroot.sh b/modules.d/90livenet/livenetroot.sh
index 66dd41b..34f91ff 100755
--- a/modules.d/90livenet/livenetroot.sh
+++ b/modules.d/90livenet/livenetroot.sh
@@ -17,10 +17,21 @@ liveurl="${netroot#livenet:}"
 info "fetching $liveurl"
 
 if getargbool 0 'rd.writable.fsimg'; then
+    imgheader=$(curl -sIL "$liveurl")
 
-    imgsize=$(($(curl -sIL "$liveurl" | sed -n 's/Content-Length: *\([[:digit:]]*\).*/\1/p') / (1024 * 1024)))
-
-    check_live_ram $imgsize
+    # shellcheck disable=SC2181
+    ret=$?
+    if [ $ret != 0 ]; then
+        warn "failed to get live image header: error $ret"
+    else
+        imgheaderlen=$(echo "$imgheader" | sed -n 's/[cC]ontent-[lL]ength: *\([[:digit:]]*\).*/\1/p')
+        if [ -z "$imgheaderlen" ]; then
+            warn "failed to get 'Content-Length' header from live image"
+        else
+            imgsize=$((imgheaderlen / (1024 * 1024)))
+            check_live_ram $imgsize
+        fi
+    fi
 fi
 
 imgfile=
@@ -30,8 +41,9 @@ while [ "$i" -le "$RETRIES" ]; do
     imgfile=$(fetch_url "$liveurl")
 
     # shellcheck disable=SC2181
-    if [ $? != 0 ]; then
-        warn "failed to download live image: error $?"
+    ret=$?
+    if [ $ret != 0 ]; then
+        warn "failed to download live image: error $ret"
         imgfile=
     fi
 
diff --git a/modules.d/90multipath/module-setup.sh b/modules.d/90multipath/module-setup.sh
index 9c3e629..782a880 100755
--- a/modules.d/90multipath/module-setup.sh
+++ b/modules.d/90multipath/module-setup.sh
@@ -126,7 +126,7 @@ install() {
     inst_libdir_file "libmultipath*" "multipath/*"
     inst_libdir_file 'libgcc_s.so*'
 
-    if [[ $hostonly_cmdline ]]; then
+    if [[ $hostonly_cmdline == "yes" ]]; then
         local _conf
         _conf=$(cmdline)
         [[ $_conf ]] && echo "$_conf" >> "${initdir}/etc/cmdline.d/90multipath.conf"
diff --git a/modules.d/90multipath/multipathd-configure.service b/modules.d/90multipath/multipathd-configure.service
index a2baec7..dba5a68 100644
--- a/modules.d/90multipath/multipathd-configure.service
+++ b/modules.d/90multipath/multipathd-configure.service
@@ -1,8 +1,8 @@
 [Unit]
 Description=Device-Mapper Multipath Default Configuration
-Before=iscsi.service iscsid.service lvm2-activation-early.service
-Wants=systemd-udev-trigger.service systemd-udev-settle.service local-fs-pre.target
-After=systemd-udev-trigger.service systemd-udev-settle.service
+Before=lvm2-activation-early.service
+Wants=local-fs-pre.target
+After=systemd-journald.socket
 Before=local-fs-pre.target multipathd.service
 DefaultDependencies=no
 Conflicts=shutdown.target
diff --git a/modules.d/90numlock/module-setup.sh b/modules.d/90numlock/module-setup.sh
new file mode 100755
index 0000000..c4cd2dd
--- /dev/null
+++ b/modules.d/90numlock/module-setup.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+# This file is part of dracut.
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# Prerequisite check(s) for module.
+check() {
+
+    # If the binary(s) requirements are not fulfilled the module can't be installed.
+    require_binaries setleds || return 1
+
+    # Return 255 to only include the module, if another module requires it.
+    return 255
+}
+
+# Module dependency requirements.
+depends() {
+    # This module has external dependency on other module(s).
+    echo base
+    # Return 0 to include the dependent module(s) in the initramfs.
+    return 0
+}
+
+# Install the required file(s) and directories for the module in the initramfs.
+install() {
+    inst_multiple \
+        setleds
+
+    inst_hook initqueue/settled 90 "$moddir/numlock.sh"
+}
diff --git a/modules.d/90numlock/numlock.sh b/modules.d/90numlock/numlock.sh
new file mode 100755
index 0000000..48aa39d
--- /dev/null
+++ b/modules.d/90numlock/numlock.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+i=1
+# 6 is the default value of the NAutoVTs option of the systemd login manager
+while [ "${i}" -le 6 ]; do
+    setleds -D +num < /dev/tty"${i}"
+    i=$((i + 1))
+done
diff --git a/modules.d/90overlayfs/module-setup.sh b/modules.d/90overlayfs/module-setup.sh
index 893e2dc..dae2009 100755
--- a/modules.d/90overlayfs/module-setup.sh
+++ b/modules.d/90overlayfs/module-setup.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 check() {
-    [[ $hostonly ]] && return 1
+    require_kernel_modules overlay || return 1
     return 255
 }
 
@@ -10,10 +10,11 @@ depends() {
 }
 
 installkernel() {
-    instmods overlay
+    hostonly="" instmods overlay
 }
 
 install() {
-    inst_hook mount 01 "$moddir/mount-overlayfs.sh"
     inst_hook pre-mount 01 "$moddir/prepare-overlayfs.sh"
+    inst_hook mount 01 "$moddir/mount-overlayfs.sh"     # overlay on top of block device
+    inst_hook pre-pivot 10 "$moddir/mount-overlayfs.sh" # overlay on top of network device (e.g. nfs)
 }
diff --git a/modules.d/90pcmcia/module-setup.sh b/modules.d/90pcmcia/module-setup.sh
new file mode 100755
index 0000000..b11e8f1
--- /dev/null
+++ b/modules.d/90pcmcia/module-setup.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+# called by dracut
+check() {
+    return 0
+}
+
+# called by dracut
+depends() {
+    echo udev-rules
+    return 0
+}
+
+# called by dracut
+installkernel() {
+    instmods pcmcia \
+        "=drivers/pcmcia"
+}
+
+# called by dracut
+install() {
+    inst_rules 60-pcmcia.rules
+
+    inst_multiple -o \
+        "${udevdir}"/pcmcia-socket-startup \
+        "${udevdir}"/pcmcia-check-broken-cis
+
+    # Install the hosts local user configurations if enabled.
+    if [[ $hostonly ]]; then
+        inst_multiple -H -o \
+            /etc/pcmcia/config.opts
+    fi
+}
diff --git a/modules.d/90systemd-cryptsetup/module-setup.sh b/modules.d/90systemd-cryptsetup/module-setup.sh
new file mode 100755
index 0000000..da37bde
--- /dev/null
+++ b/modules.d/90systemd-cryptsetup/module-setup.sh
@@ -0,0 +1,120 @@
+#!/bin/bash
+
+# called by dracut
+check() {
+    local fs
+    # if cryptsetup is not installed, then we cannot support encrypted devices.
+    require_any_binary "$systemdutildir"/systemd-cryptsetup || return 1
+
+    [[ $hostonly ]] || [[ $mount_needs ]] && {
+        for fs in "${host_fs_types[@]}"; do
+            [[ $fs == "crypto_LUKS" ]] && return 0
+        done
+        return 255
+    }
+
+    return 0
+}
+
+# called by dracut
+depends() {
+    local deps
+    deps="dm rootfs-block crypt systemd-ask-password"
+    if [[ $hostonly && -f "$dracutsysrootdir"/etc/crypttab ]]; then
+        if grep -q -e "fido2-device=" -e "fido2-cid=" "$dracutsysrootdir"/etc/crypttab; then
+            deps+=" fido2"
+        fi
+        if grep -q "pkcs11-uri" "$dracutsysrootdir"/etc/crypttab; then
+            deps+=" pkcs11"
+        fi
+        if grep -q "tpm2-device=" "$dracutsysrootdir"/etc/crypttab; then
+            deps+=" tpm2-tss"
+        fi
+    elif [[ ! $hostonly ]]; then
+        for module in fido2 pkcs11 tpm2-tss; do
+            module_check $module > /dev/null 2>&1
+            if [[ $? == 255 ]]; then
+                deps+=" $module"
+            fi
+        done
+    fi
+    echo "$deps"
+    return 0
+}
+
+# called by dracut
+install() {
+    # the cryptsetup targets are already pulled in by 00systemd, but not
+    # the enablement symlinks
+    inst_multiple -o \
+        "$tmpfilesdir"/cryptsetup.conf \
+        "$systemdutildir"/system-generators/systemd-cryptsetup-generator \
+        "$systemdutildir"/systemd-cryptsetup \
+        "$systemdsystemunitdir"/cryptsetup.target \
+        "$systemdsystemunitdir"/sysinit.target.wants/cryptsetup.target \
+        "$systemdsystemunitdir"/remote-cryptsetup.target \
+        "$systemdsystemunitdir"/initrd-root-device.target.wants/remote-cryptsetup.target
+
+    if [[ $hostonly ]] && [[ -f $initdir/etc/crypttab ]]; then
+        # for each entry in /etc/crypttab check if the key file is backed by a socket unit and if so,
+        # include it along with its corresponding service unit.
+        while read -r _mapper _dev _luksfile _luksoptions || [[ -n $_mapper ]]; do
+            # ignore paths followed by a device specification
+            if [[ $_luksfile == *":"* ]]; then
+                return
+            fi
+
+            # if no explicit path is provided, try to include units for auto-discoverable keys
+            if [[ -z $_luksfile ]] || [[ $_luksfile == "-" ]] || [[ $_luksfile == "none" ]]; then
+                _luksfile="/run/cryptsetup-keys.d/$_mapper.key"
+            fi
+
+            find "$systemdsystemunitdir" "$systemdsystemconfdir" -type f -name "*.socket" | while read -r socket_unit; do
+                # systemd-cryptsetup utility only supports SOCK_STREAM (ListenStream) sockets, so we ignore
+                # other types like SOCK_DGRAM (ListenDatagram), SOCK_SEQPACKET (ListenSequentialPacket), etc.
+                if ! grep -E -q "^ListenStream\s*=\s*$_luksfile$" "$socket_unit"; then
+                    continue
+                fi
+
+                service_name=$(grep -E "^Service\s*=\s*" "$socket_unit" | cut -d= -f2)
+
+                if [ -z "$service_name" ]; then
+                    # if no explicit Service= is defined, construct the service name based on the socket unit's name
+                    if grep -P -q "^Accept\s*=\s*(?i)(1|yes|y|true|t|on)$" "$socket_unit"; then
+                        # if Accept is truthy, assemble a service template
+                        service_name=$(basename "$socket_unit" .socket)"@.service"
+                    else
+                        # otherwise, just replace .socket with .service
+                        service_name=$(basename "$socket_unit" .socket)".service"
+                    fi
+                fi
+
+                # this assumes the service file is in the same directory as the socket file,
+                # which is a common configuration but not guaranteed.
+                if ! inst_multiple -H "${socket_unit%/*}/$service_name" "$socket_unit"; then
+                    continue
+                fi
+
+                # sanity check - all units which use default dependencies will depend on sysinit.target,
+                # which itself depends on cryptsetup.target. This could lead to either:
+                #   a) systemd-cryptsetup falling back to a passphrase prompt due to a missing socket file
+                #   b) a deadlock caused by a circular dependency (service unit -> sysinit.target -> cryptsetup.target -> service unit)
+                if ! grep -P -q "^DefaultDependencies\s*=\s*(?i)(0|no|n|false|f|off)" "$socket_unit"; then
+                    dwarning "crypt: $socket_unit: default dependencies are not disabled," \
+                        "the socket file may not exist by the time systemd-cryptsetup gets executed"
+                fi
+
+                if ! grep -P -q "^DefaultDependencies\s*=\s*(?i)(0|no|n|false|f|off)" "${socket_unit%/*}/$service_name"; then
+                    dwarning "crypt: ${socket_unit%/*}/$service_name: default dependencies are not disabled," \
+                        "the service unit may encounter a deadlock due to a circular dependency"
+                fi
+
+                socket_unit_basename=$(basename "$socket_unit")
+                inst_multiple -H -o \
+                    "$systemdsystemunitdir"/sockets.target.wants/"$socket_unit_basename" \
+                    "$systemdsystemconfdir"/sockets.target.wants/"$socket_unit_basename"
+                break
+            done
+        done < "$initdir"/etc/crypttab
+    fi
+}
diff --git a/modules.d/91crypt-gpg/crypt-gpg-lib.sh b/modules.d/91crypt-gpg/crypt-gpg-lib.sh
index 538419f..59fb4d3 100755
--- a/modules.d/91crypt-gpg/crypt-gpg-lib.sh
+++ b/modules.d/91crypt-gpg/crypt-gpg-lib.sh
@@ -41,13 +41,13 @@ gpg_decrypt() {
         echo "allow-loopback-pinentry" >> "$gpghome/gpg-agent.conf"
         GNUPGHOME="$gpghome" gpg-agent --quiet --daemon
         GNUPGHOME="$gpghome" gpg --quiet --no-tty --import < /root/crypt-public-key.gpg
+        GNUPGHOME="$gpghome" gpg-connect-agent 1> /dev/null learn /bye
         local smartcardSerialNumber
         smartcardSerialNumber="$(GNUPGHOME=$gpghome gpg --no-tty --card-status \
             | sed -n -r -e 's|Serial number.*: ([0-9]*)|\1|p' | tr -d '\n')"
         if [ -n "${smartcardSerialNumber}" ]; then
             inputPrompt="PIN (OpenPGP card ${smartcardSerialNumber})"
         fi
-        GNUPGHOME="$gpghome" gpg-connect-agent 1> /dev/null learn /bye
         opts="$opts --pinentry-mode=loopback"
         cmd="GNUPGHOME=$gpghome gpg --card-status --no-tty > /dev/null 2>&1; gpg $opts --decrypt $mntp/$keypath"
     else
diff --git a/modules.d/91crypt-gpg/module-setup.sh b/modules.d/91crypt-gpg/module-setup.sh
index 501869a..523cfce 100755
--- a/modules.d/91crypt-gpg/module-setup.sh
+++ b/modules.d/91crypt-gpg/module-setup.sh
@@ -3,7 +3,7 @@
 # GPG support is optional
 # called by dracut
 check() {
-    require_binaries gpg tr || return 1
+    require_binaries gpg tr stty || return 1
 
     if sc_requested; then
         if ! sc_supported; then
@@ -23,7 +23,7 @@ depends() {
 
 # called by dracut
 install() {
-    inst_multiple gpg tr
+    inst_multiple gpg tr stty
     inst "$moddir/crypt-gpg-lib.sh" "/lib/dracut-crypt-gpg-lib.sh"
 
     if sc_requested; then
diff --git a/modules.d/91pcsc/module-setup.sh b/modules.d/91pcsc/module-setup.sh
index 6f8b2c8..26b463d 100755
--- a/modules.d/91pcsc/module-setup.sh
+++ b/modules.d/91pcsc/module-setup.sh
@@ -29,7 +29,8 @@ install() {
     inst_simple "$moddir/pcscd.socket" "${systemdsystemunitdir}"/pcscd.socket
 
     inst_multiple -o \
-        pcscd
+        pcscd \
+        /usr/share/p11-kit/modules/opensc.module
 
     # Enable systemd type unit(s)
     for i in \
diff --git a/modules.d/91pcsc/pcscd.service b/modules.d/91pcsc/pcscd.service
index 639decd..7d4e0a2 100644
--- a/modules.d/91pcsc/pcscd.service
+++ b/modules.d/91pcsc/pcscd.service
@@ -5,7 +5,7 @@ Documentation=man:pcscd(8)
 Requires=pcscd.socket
 
 [Service]
-ExecStart=/usr/sbin/pcscd --foreground --auto-exit
+ExecStart=/usr/sbin/pcscd --foreground --auto-exit --disable-polkit
 ExecReload=/usr/sbin/pcscd --hotplug
 
 [Install]
diff --git a/modules.d/91tpm2-tss/module-setup.sh b/modules.d/91tpm2-tss/module-setup.sh
index e145c41..4106e3e 100755
--- a/modules.d/91tpm2-tss/module-setup.sh
+++ b/modules.d/91tpm2-tss/module-setup.sh
@@ -35,6 +35,8 @@ install() {
         "$sysusers"/tpm2-tss.conf \
         "$tmpfilesdir"/tpm2-tss-fapi.conf \
         "$udevrulesdir"/60-tpm-udev.rules \
+        "$systemdutildir"/system-generators/systemd-tpm2-generator \
+        "$systemdsystemunitdir/tpm2.target" \
         tpm2_pcrread tpm2_pcrextend tpm2_createprimary tpm2_createpolicy \
         tpm2_create tpm2_load tpm2_unseal tpm2
 
diff --git a/modules.d/95dasd/module-setup.sh b/modules.d/95dasd/module-setup.sh
index 180da14..825f95d 100755
--- a/modules.d/95dasd/module-setup.sh
+++ b/modules.d/95dasd/module-setup.sh
@@ -4,20 +4,18 @@
 check() {
     local _arch=${DRACUT_ARCH:-$(uname -m)}
     [ "$_arch" = "s390" -o "$_arch" = "s390x" ] || return 1
-    require_binaries normalize_dasd_arg || return 1
+    require_binaries dasdconf.sh || return 1
     return 0
 }
 
 # called by dracut
 depends() {
-    echo "dasd_mod"
     return 0
 }
 
 # called by dracut
 install() {
-    inst_hook cmdline 30 "$moddir/parse-dasd.sh"
-    inst_multiple dasdinfo dasdconf.sh normalize_dasd_arg
+    inst_multiple dasdconf.sh
     conf=/etc/dasd.conf
     if [[ $hostonly && -f $conf ]]; then
         inst -H $conf
diff --git a/modules.d/95dasd/parse-dasd.sh b/modules.d/95dasd/parse-dasd.sh
deleted file mode 100755
index cda3970..0000000
--- a/modules.d/95dasd/parse-dasd.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-for dasd_arg in $(getargs rd.dasd= -d rd_DASD= DASD=); do
-    (
-        local OLDIFS="$IFS"
-        IFS=","
-        # shellcheck disable=SC2086
-        set -- $dasd_arg
-        IFS="$OLDIFS"
-        echo "$@" | normalize_dasd_arg >> /etc/dasd.conf
-    )
-done
diff --git a/modules.d/95dasd_mod/module-setup.sh b/modules.d/95dasd_mod/module-setup.sh
index c59dd3a..155eaac 100755
--- a/modules.d/95dasd_mod/module-setup.sh
+++ b/modules.d/95dasd_mod/module-setup.sh
@@ -4,7 +4,6 @@
 check() {
     local _arch=${DRACUT_ARCH:-$(uname -m)}
     [ "$_arch" = "s390" -o "$_arch" = "s390x" ] || return 1
-    require_binaries grep sed seq
 
     return 0
 }
@@ -22,6 +21,5 @@ installkernel() {
 # called by dracut
 install() {
     inst_hook cmdline 31 "$moddir/parse-dasd-mod.sh"
-    inst_multiple grep sed seq
     inst_multiple -o dasd_cio_free
 }
diff --git a/modules.d/95dasd_mod/parse-dasd-mod.sh b/modules.d/95dasd_mod/parse-dasd-mod.sh
index 2b86d45..b635ecf 100755
--- a/modules.d/95dasd_mod/parse-dasd-mod.sh
+++ b/modules.d/95dasd_mod/parse-dasd-mod.sh
@@ -1,18 +1,4 @@
 #!/bin/sh
-mod_args=""
-
-for dasd_arg in $(getargs rd.dasd= -d rd_DASD= DASD=); do
-    mod_args="$mod_args,$dasd_arg"
-done
-
-mod_args="${mod_args#*,}"
-
-if [ -x /sbin/dasd_cio_free -a -n "$mod_args" ]; then
-    [ -d /etc/modprobe.d ] || mkdir -m 0755 -p /etc/modprobe.d
-    echo "options dasd_mod dasd=$mod_args" >> /etc/modprobe.d/dasd_mod.conf
-fi
-
-unset dasd_arg
 if [ -x /sbin/dasd_cio_free ]; then
     dasd_cio_free
 fi
diff --git a/modules.d/95dasd_rules/module-setup.sh b/modules.d/95dasd_rules/module-setup.sh
deleted file mode 100755
index 06c57a4..0000000
--- a/modules.d/95dasd_rules/module-setup.sh
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/bash
-
-# called by dracut
-cmdline() {
-    is_dasd() {
-        local _dev=$1
-        local _devpath
-        _devpath=$(
-            cd -P /sys/dev/block/"$_dev" || exit
-            echo "$PWD"
-        )
-
-        [ "${_devpath#*/dasd}" == "$_devpath" ] && return 1
-        _ccw="${_devpath%%/block/*}"
-        echo "rd.dasd=${_ccw##*/}"
-        return 0
-    }
-    [[ $hostonly ]] || [[ $mount_needs ]] && {
-        for_each_host_dev_and_slaves_all is_dasd || return 255
-    } | sort | uniq
-}
-
-# called by dracut
-check() {
-    local _arch=${DRACUT_ARCH:-$(uname -m)}
-    local found=0
-    local bdev
-    [ "$_arch" = "s390" -o "$_arch" = "s390x" ] || return 1
-
-    [[ $hostonly ]] || [[ $mount_needs ]] && {
-        for bdev in /sys/block/*; do
-            case "${bdev##*/}" in
-                dasd*)
-                    found=$((found + 1))
-                    break
-                    ;;
-            esac
-        done
-        [ $found -eq 0 ] && return 255
-    }
-    return 0
-}
-
-# called by dracut
-depends() {
-    echo 'dasd_mod' bash
-    return 0
-}
-
-# called by dracut
-install() {
-    inst_hook cmdline 30 "$moddir/parse-dasd.sh"
-    if [[ $hostonly_cmdline == "yes" ]]; then
-        local _dasd
-        _dasd=$(cmdline)
-        [[ $_dasd ]] && printf "%s\n" "$_dasd" >> "${initdir}/etc/cmdline.d/95dasd.conf"
-    fi
-    if [[ $hostonly ]]; then
-        inst_rules_wildcard "51-dasd-*.rules"
-        inst_rules_wildcard "41-dasd-*.rules"
-        mark_hostonly /etc/udev/rules.d/51-dasd-*.rules
-        mark_hostonly /etc/udev/rules.d/41-dasd-*.rules
-    fi
-    inst_rules 59-dasd.rules
-}
diff --git a/modules.d/95dasd_rules/parse-dasd.sh b/modules.d/95dasd_rules/parse-dasd.sh
deleted file mode 100755
index 4454aec..0000000
--- a/modules.d/95dasd_rules/parse-dasd.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-allow_device() {
-    local ccw=$1
-
-    if [ -x /sbin/cio_ignore ] && cio_ignore -i "$ccw" > /dev/null; then
-        cio_ignore -r "$ccw"
-    fi
-}
-
-if [[ -f /sys/firmware/ipl/ipl_type ]] && [[ $(< /sys/firmware/ipl/ipl_type) == "ccw" ]]; then
-    allow_device "$(< /sys/firmware/ipl/device)"
-fi
-
-for dasd_arg in $(getargs root=) $(getargs resume=); do
-    [[ $dasd_arg =~ /dev/disk/by-path/ccw-* ]] || continue
-
-    ccw_dev="${dasd_arg##*/ccw-}"
-    allow_device "${ccw_dev%%-*}"
-done
-
-for dasd_arg in $(getargs rd.dasd=); do
-    IFS=',' read -r -a devs <<< "$dasd_arg"
-    declare -p devs
-    for dev in "${devs[@]}"; do
-        case "$dev" in
-            autodetect | probeonly) ;;
-
-            *-*)
-                IFS="-" read -r start end _ <<< "${dev%(ro)}"
-                prefix=${start%.*}
-                start=${start##*.}
-                for rdev in $(seq $((16#$start)) $((16#$end))); do
-                    allow_device "$(printf "%s.%04x" "$prefix" "$rdev")"
-                done
-                ;;
-            *)
-                IFS="." read -r sid ssid chan _ <<< "${dev%(ro)}"
-                allow_device "$(printf "%01x.%01x.%04x" $((16#$sid)) $((16#$ssid)) $((16#$chan)))"
-                ;;
-        esac
-    done
-done
diff --git a/modules.d/95fcoe/parse-fcoe.sh b/modules.d/95fcoe/parse-fcoe.sh
index bde6b62..a6f284b 100755
--- a/modules.d/95fcoe/parse-fcoe.sh
+++ b/modules.d/95fcoe/parse-fcoe.sh
@@ -23,7 +23,7 @@ if ! getargbool 1 rd.fcoe -d -n rd.nofcoe; then
     return 0
 fi
 
-if ! [ -e /sys/bus/fcoe/ctlr_create ] && ! modprobe -b -a fcoe && ! modprobe -b -a libfcoe; then
+if ! [ -e /sys/bus/fcoe/ctlr_create ] && ! modprobe -b fcoe && ! modprobe -b libfcoe; then
     die "FCoE requested but kernel/initrd does not support FCoE"
 fi
 
diff --git a/modules.d/95iscsi/module-setup.sh b/modules.d/95iscsi/module-setup.sh
index 2bea2fc..5eaab4e 100755
--- a/modules.d/95iscsi/module-setup.sh
+++ b/modules.d/95iscsi/module-setup.sh
@@ -198,14 +198,9 @@ install() {
         "$systemdsystemunitdir"/sockets.target.wants/iscsid.socket \
         "$systemdsystemunitdir"/sockets.target.wants/iscsiuio.socket
 
+    inst_simple /etc/iscsi/iscsid.conf
     if [[ $hostonly ]]; then
-        local -a _filenames
-
-        inst_dir /etc/iscsi
-        mapfile -t -d '' _filenames < <(find /etc/iscsi -type f -print0)
-        inst_multiple "${_filenames[@]}"
-    else
-        inst_simple /etc/iscsi/iscsid.conf
+        inst_simple /etc/iscsi/initiatorname.iscsi
     fi
 
     # Detect iBFT and perform mandatory steps
diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh
index 7574711..99f25a6 100755
--- a/modules.d/95iscsi/parse-iscsiroot.sh
+++ b/modules.d/95iscsi/parse-iscsiroot.sh
@@ -95,7 +95,11 @@ if ! [ -e /sys/module/iscsi_tcp ]; then
     modprobe -b -q iscsi_tcp || die "iscsiroot requested but kernel/initrd does not support iscsi"
 fi
 
-modprobe --all -b -q qla4xxx cxgb3i cxgb4i bnx2i be2iscsi
+modprobe -b -q qla4xxx
+modprobe -b -q cxgb3i
+modprobe -b -q cxgb4i
+modprobe -b -q bnx2i
+modprobe -b -q be2iscsi
 
 if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then
     if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then
diff --git a/modules.d/95lunmask/parse-lunmask.sh b/modules.d/95lunmask/parse-lunmask.sh
index 5e05e5b..147e3de 100755
--- a/modules.d/95lunmask/parse-lunmask.sh
+++ b/modules.d/95lunmask/parse-lunmask.sh
@@ -32,8 +32,9 @@ for lunmask_arg in $(getargs rd.lunmask); do
         IFS="$OLDIFS"
         if [ -d /sys/module/scsi_mod ]; then
             printf "manual" > /sys/module/scsi_mod/parameters/scan
-        elif [ ! -f /etc/modprobe.d/95lunmask.conf ]; then
-            echo "options scsi_mod scan=manual" > /etc/modprobe.d/95lunmask.conf
+        elif [ ! -f /run/modprobe.d/95lunmask.conf ]; then
+            mkdir -p /run/modprobe.d
+            echo "options scsi_mod scan=manual" > /run/modprobe.d/95lunmask.conf
         fi
         create_udev_rule "$1" "$2" "$3"
     )
diff --git a/modules.d/95nfs/module-setup.sh b/modules.d/95nfs/module-setup.sh
index 16bafe3..abe1ee5 100755
--- a/modules.d/95nfs/module-setup.sh
+++ b/modules.d/95nfs/module-setup.sh
@@ -128,11 +128,5 @@ install() {
     grep -E '^nfsnobody:|^rpc:|^rpcuser:' "$dracutsysrootdir"/etc/passwd >> "$initdir/etc/passwd"
     grep -E '^nogroup:|^rpc:|^nobody:' "$dracutsysrootdir"/etc/group >> "$initdir/etc/group"
 
-    # rpc user needs to be able to write to this directory to save the warmstart
-    # file
-    chmod 770 "$initdir/var/lib/rpcbind"
-    grep -q '^rpc:' "$dracutsysrootdir"/etc/passwd \
-        && grep -q '^rpc:' "$dracutsysrootdir"/etc/group
-
     dracut_need_initqueue
 }
diff --git a/modules.d/95nfs/nfs-lib.sh b/modules.d/95nfs/nfs-lib.sh
index f000671..7896da9 100755
--- a/modules.d/95nfs/nfs-lib.sh
+++ b/modules.d/95nfs/nfs-lib.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
-. /lib/net-lib.sh
+type get_ip > /dev/null 2>&1 || . /lib/net-lib.sh
 
 # TODO: make these things not pollute the calling namespace
 
diff --git a/modules.d/95nfs/parse-nfsroot.sh b/modules.d/95nfs/parse-nfsroot.sh
index 0c8dbbb..a07c5f4 100755
--- a/modules.d/95nfs/parse-nfsroot.sh
+++ b/modules.d/95nfs/parse-nfsroot.sh
@@ -123,6 +123,8 @@ root="$fstype"
 # shellcheck disable=SC2016
 echo '[ -e $NEWROOT/proc ]' > "$hookdir"/initqueue/finished/nfsroot.sh
 
+# rpc user needs to be able to write to this directory to save the warmstart
+# file
 mkdir -p /var/lib/rpcbind
 chown rpc:rpc /var/lib/rpcbind
 chmod 770 /var/lib/rpcbind
diff --git a/modules.d/95nvmf/module-setup.sh b/modules.d/95nvmf/module-setup.sh
index a8f3034..6a1e3f5 100755
--- a/modules.d/95nvmf/module-setup.sh
+++ b/modules.d/95nvmf/module-setup.sh
@@ -3,8 +3,6 @@
 # called by dracut
 check() {
     require_binaries nvme jq || return 1
-    [ -f /etc/nvme/hostnqn ] || return 255
-    [ -f /etc/nvme/hostid ] || return 255
 
     is_nvmf() {
         local _dev=$1
@@ -36,6 +34,8 @@ check() {
     }
 
     [[ $hostonly ]] || [[ $mount_needs ]] && {
+        [ -f /etc/nvme/hostnqn ] || return 255
+        [ -f /etc/nvme/hostid ] || return 255
         pushd . > /dev/null
         for_each_host_dev_and_slaves is_nvmf
         local _is_nvmf=$?
@@ -130,8 +130,8 @@ install() {
         _nvmf_args=$(cmdline)
         [[ "$_nvmf_args" ]] && printf "%s" "$_nvmf_args" >> "${initdir}/etc/cmdline.d/95nvmf-args.conf"
     fi
-    inst_simple "/etc/nvme/hostnqn"
-    inst_simple "/etc/nvme/hostid"
+    inst_simple -H "/etc/nvme/hostnqn"
+    inst_simple -H "/etc/nvme/hostid"
 
     inst_multiple ip sed
 
diff --git a/modules.d/95nvmf/parse-nvmf-boot-connections.sh b/modules.d/95nvmf/parse-nvmf-boot-connections.sh
index 6601837..b2a5ae0 100755
--- a/modules.d/95nvmf/parse-nvmf-boot-connections.sh
+++ b/modules.d/95nvmf/parse-nvmf-boot-connections.sh
@@ -236,7 +236,9 @@ if ! getargbool 0 rd.nvmf.nonbft; then
     done
 fi
 
-initqueue --onetime modprobe --all -b -q nvme_tcp nvme_core nvme_fabrics
+initqueue --onetime modprobe -b -q nvme_tcp
+initqueue --onetime modprobe -b -q nvme_core
+initqueue --onetime modprobe -b -q nvme_fabrics
 
 parse_nvmf_discover() {
     traddr="none"
diff --git a/modules.d/95qeth_rules/module-setup.sh b/modules.d/95qeth_rules/module-setup.sh
deleted file mode 100755
index a84ac15..0000000
--- a/modules.d/95qeth_rules/module-setup.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/bash
-
-# called by dracut
-check() {
-    local _arch=${DRACUT_ARCH:-$(uname -m)}
-    local _online=0
-    [ "$_arch" = "s390" -o "$_arch" = "s390x" ] || return 1
-    dracut_module_included network || return 1
-
-    [[ $hostonly ]] && {
-        for i in /sys/devices/qeth/*/online; do
-            [ ! -f "$i" ] && continue
-            read -r _online < "$i"
-            [ "$_online" -eq 1 ] && return 0
-        done
-    }
-    return 255
-}
-
-# called by dracut
-installkernel() {
-    instmods qeth
-}
-
-# called by dracut
-install() {
-    ccwid() {
-        qeth_path=$(readlink -e -q "$1"/device)
-        basename "$qeth_path"
-    }
-
-    inst_rules_qeth() {
-        for rule in /etc/udev/rules.d/{4,5}1-qeth-${1}.rules; do
-            # prefer chzdev generated 41- rules
-            if [ -f "$rule" ]; then
-                inst_rules "$rule"
-                break
-            fi
-        done
-    }
-
-    has_carrier() {
-        carrier=0
-        # not readable in qeth interfaces
-        # that have just been assembled, ignore
-        # read error and assume no carrier
-        read -r carrier 2> /dev/null < "$1/carrier"
-        [ "$carrier" -eq 1 ] && return 0
-        return 1
-    }
-
-    for dev in /sys/class/net/*; do
-        has_carrier "$dev" || continue
-        id=$(ccwid "$dev")
-        [ -n "$id" ] && inst_rules_qeth "$id"
-    done
-
-}
diff --git a/modules.d/95resume/module-setup.sh b/modules.d/95resume/module-setup.sh
index d255103..d419566 100755
--- a/modules.d/95resume/module-setup.sh
+++ b/modules.d/95resume/module-setup.sh
@@ -10,13 +10,31 @@ check() {
         return 1
     }
 
-    # Only support resume if hibernation is currently on
-    # and no swap is mounted on a net device
-    [[ $hostonly ]] || [[ $mount_needs ]] && {
-        swap_on_netdevice || [[ -f /sys/power/resume && "$(< /sys/power/resume)" == "0:0" ]] || grep -rq '^\|[[:space:]]resume=' /proc/cmdline /etc/cmdline /etc/cmdline.d /etc/kernel/cmdline /usr/lib/kernel/cmdline 2> /dev/null && return 255
-    }
-
-    return 0
+    # If hostonly check if we want to include the resume module
+    if [[ $hostonly ]] || [[ $mount_needs ]]; then
+        # Resuming won't work if swap is on a netdevice
+        swap_on_netdevice && return 255
+        if grep -rq 'resume=' /proc/cmdline /etc/cmdline /etc/cmdline.d /etc/kernel/cmdline /usr/lib/kernel/cmdline 2> /dev/null; then
+            # hibernation support requested on kernel command line
+            return 0
+        else
+            # resume= not set on kernel command line
+            if [[ -f /sys/power/resume ]]; then
+                if [[ "$(< /sys/power/resume)" == "0:0" ]]; then
+                    # hibernation supported by the kernel, but not enabled
+                    return 255
+                else
+                    # hibernation supported by the kernel and enabled
+                    return 0
+                fi
+            else
+                # resume file doesn't exist, hibernation not supported by kernel
+                return 255
+            fi
+        fi
+    else
+        return 0
+    fi
 }
 
 # called by dracut
@@ -44,6 +62,7 @@ install() {
     if dracut_module_included "systemd" && [[ -x $dracutsysrootdir$systemdutildir/systemd-hibernate-resume ]]; then
         inst_multiple -o \
             "$systemdutildir"/system-generators/systemd-hibernate-resume-generator \
+            "$systemdsystemunitdir"/systemd-hibernate-resume.service \
             "$systemdsystemunitdir"/systemd-hibernate-resume@.service \
             "$systemdutildir"/systemd-hibernate-resume
         return 0
diff --git a/modules.d/95rootfs-block/mount-root.sh b/modules.d/95rootfs-block/mount-root.sh
index c488b11..973069b 100755
--- a/modules.d/95rootfs-block/mount-root.sh
+++ b/modules.d/95rootfs-block/mount-root.sh
@@ -30,22 +30,13 @@ mount_root() {
         fsck_ask_err
     done
 
-    READONLY=
     fsckoptions=
     if [ -f "$NEWROOT"/etc/sysconfig/readonly-root ]; then
         # shellcheck disable=SC1090
         . "$NEWROOT"/etc/sysconfig/readonly-root
     fi
 
-    if getargbool 0 "readonlyroot=" -y readonlyroot; then
-        READONLY=yes
-    fi
-
-    if getarg noreadonlyroot; then
-        READONLY=no
-    fi
-
-    if [ -f "$NEWROOT"/fastboot ] || getargbool 0 fastboot; then
+    if [ -f "$NEWROOT"/fastboot ]; then
         fastboot=yes
     fi
 
@@ -106,8 +97,8 @@ mount_root() {
     # esc_root=$(echo ${root#block:} | sed 's,\\,\\\\,g')
     # printf '%s %s %s %s 1 1 \n' "$esc_root" "$NEWROOT" "$rootfs" "$rflags" >/etc/fstab
 
-    if fsck_able "$rootfs" \
-        && [ "$rootfsck" != "0" -a -z "$fastboot" -a "$READONLY" != "yes" ] \
+    if ! getargbool 0 ro && fsck_able "$rootfs" \
+        && [ "$rootfsck" != "0" -a -z "$fastboot" ] \
         && ! strstr "${rflags}" _netdev \
         && ! getargbool 0 rd.skipfsck; then
         umount "$NEWROOT"
diff --git a/modules.d/95udev-rules/module-setup.sh b/modules.d/95udev-rules/module-setup.sh
index 3ca12ee..e5b7f97 100755
--- a/modules.d/95udev-rules/module-setup.sh
+++ b/modules.d/95udev-rules/module-setup.sh
@@ -8,8 +8,6 @@ install() {
     # ultimately, /lib/initramfs/rules.d or somesuch which includes links/copies
     # of the rules we want so that we just copy those in would be best
     inst_multiple udevadm cat uname blkid
-    inst_dir /etc/udev
-    inst_multiple -o /etc/udev/udev.conf
 
     [[ -d ${initdir}/$systemdutildir ]] || mkdir -p "${initdir}/$systemdutildir"
     for _i in "${systemdutildir}"/systemd-udevd "${udevdir}"/udevd /sbin/udevd; do
@@ -33,7 +31,6 @@ install() {
         59-scsi-sg3_utils.rules \
         60-block.rules \
         60-cdrom_id.rules \
-        60-pcmcia.rules \
         60-persistent-storage.rules \
         64-btrfs.rules \
         70-uaccess.rules \
@@ -45,9 +42,6 @@ install() {
         "$moddir/59-persistent-storage.rules" \
         "$moddir/61-persistent-storage.rules"
 
-    # legacy persistent network device name rules
-    [[ $hostonly ]] && inst_rules 70-persistent-net.rules
-
     {
         for i in cdrom tape dialout floppy; do
             if ! grep -q "^$i:" "$initdir"/etc/group 2> /dev/null; then
@@ -72,12 +66,14 @@ install() {
         "${udevdir}"/path_id \
         "${udevdir}"/input_id \
         "${udevdir}"/scsi_id \
-        "${udevdir}"/usb_id \
-        "${udevdir}"/pcmcia-socket-startup \
-        "${udevdir}"/pcmcia-check-broken-cis
-
-    inst_multiple -o /etc/pcmcia/config.opts
+        "${udevdir}"/usb_id
 
     inst_libdir_file "libnss_files*"
 
+    # Install the hosts local user configurations if enabled.
+    if [[ $hostonly ]]; then
+        inst_dir /etc/udev
+        inst_multiple -H -o \
+            /etc/udev/udev.conf
+    fi
 }
diff --git a/modules.d/95zfcp/module-setup.sh b/modules.d/95zfcp/module-setup.sh
index e1f3aa3..b547f9b 100755
--- a/modules.d/95zfcp/module-setup.sh
+++ b/modules.d/95zfcp/module-setup.sh
@@ -5,7 +5,7 @@ check() {
     arch=${DRACUT_ARCH:-$(uname -m)}
     [ "$arch" = "s390" -o "$arch" = "s390x" ] || return 1
 
-    require_binaries zfcp_cio_free grep sed seq || return 1
+    require_binaries zfcp_cio_free sed || return 1
 
     return 0
 }
@@ -23,7 +23,7 @@ installkernel() {
 # called by dracut
 install() {
     inst_hook cmdline 30 "$moddir/parse-zfcp.sh"
-    inst_multiple zfcp_cio_free grep sed seq
+    inst_multiple zfcp_cio_free sed
 
     inst_script /sbin/zfcpconf.sh
     inst_rules 56-zfcp.rules
diff --git a/modules.d/95zfcp/parse-zfcp.sh b/modules.d/95zfcp/parse-zfcp.sh
index 495aa67..41216dd 100755
--- a/modules.d/95zfcp/parse-zfcp.sh
+++ b/modules.d/95zfcp/parse-zfcp.sh
@@ -2,15 +2,4 @@
 
 getargbool 1 rd.zfcp.conf -d -n rd_NO_ZFCPCONF || rm /etc/zfcp.conf
 
-for zfcp_arg in $(getargs rd.zfcp -d 'rd_ZFCP='); do
-    echo "$zfcp_arg" | grep '^0\.[0-9a-fA-F]\.[0-9a-fA-F]\{4\}\(,0x[0-9a-fA-F]\{16\},0x[0-9a-fA-F]\{16\}\)\?$' > /dev/null
-    test $? -ne 0 && die "For argument 'rd.zfcp=$zfcp_arg'\nSorry, invalid format."
-    (
-        IFS=","
-        # shellcheck disable=SC2086
-        set $zfcp_arg
-        echo "$@" >> /etc/zfcp.conf
-    )
-done
-
 zfcp_cio_free
diff --git a/modules.d/95zfcp_rules/module-setup.sh b/modules.d/95zfcp_rules/module-setup.sh
deleted file mode 100755
index dfa7951..0000000
--- a/modules.d/95zfcp_rules/module-setup.sh
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/bin/bash
-
-# called by dracut
-cmdline() {
-    is_zfcp() {
-        local _dev=$1
-        local _devpath
-        _devpath=$(
-            cd -P /sys/dev/block/"$_dev" || exit
-            echo "$PWD"
-        )
-        local _sdev _scsiid _hostno _lun _wwpn _ccw _port_type
-        local _allow_lun_scan _is_npiv
-
-        read -r _allow_lun_scan < /sys/module/zfcp/parameters/allow_lun_scan
-        [ "${_devpath#*/sd}" == "$_devpath" ] && return 1
-        _sdev="${_devpath%%/block/*}"
-        [ -e "${_sdev}"/fcp_lun ] || return 1
-        _scsiid="${_sdev##*/}"
-        _hostno="${_scsiid%%:*}"
-        [ -d /sys/class/fc_host/host"${_hostno}" ] || return 1
-        read -r _port_type < /sys/class/fc_host/host"${_hostno}"/port_type
-        case "$_port_type" in
-            NPIV*)
-                _is_npiv=1
-                ;;
-        esac
-        read -r _ccw < "${_sdev}"/hba_id
-        if [ "$_is_npiv" ] && [ "$_allow_lun_scan" = "Y" ]; then
-            echo "rd.zfcp=${_ccw}"
-        else
-            read -r _lun < "${_sdev}"/fcp_lun
-            read -r _wwpn < "${_sdev}"/wwpn
-            echo "rd.zfcp=${_ccw},${_wwpn},${_lun}"
-        fi
-        return 0
-    }
-    [[ $hostonly ]] || [[ $mount_needs ]] && {
-        for_each_host_dev_and_slaves_all is_zfcp
-    } | sort | uniq
-}
-
-# called by dracut
-check() {
-    local _arch=${DRACUT_ARCH:-$(uname -m)}
-    local _ccw
-    [ "$_arch" = "s390" -o "$_arch" = "s390x" ] || return 1
-
-    [[ $hostonly ]] || [[ $mount_needs ]] && {
-        found=0
-        for _ccw in /sys/bus/ccw/devices/*/host*; do
-            [ -d "$_ccw" ] || continue
-            found=$((found + 1))
-        done
-        [ $found -eq 0 ] && return 255
-    }
-    return 0
-}
-
-# called by dracut
-depends() {
-    echo bash
-    return 0
-}
-
-# called by dracut
-install() {
-    inst_hook cmdline 30 "$moddir/parse-zfcp.sh"
-    if [[ $hostonly_cmdline == "yes" ]]; then
-        local _zfcp
-
-        for _zfcp in $(cmdline); do
-            printf "%s\n" "$_zfcp" >> "${initdir}/etc/cmdline.d/94zfcp.conf"
-        done
-    fi
-    if [[ $hostonly ]]; then
-        inst_rules_wildcard "51-zfcp-*.rules"
-        inst_rules_wildcard "41-zfcp-*.rules"
-    fi
-}
diff --git a/modules.d/95zfcp_rules/parse-zfcp.sh b/modules.d/95zfcp_rules/parse-zfcp.sh
deleted file mode 100755
index 5e7d909..0000000
--- a/modules.d/95zfcp_rules/parse-zfcp.sh
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/bin/bash
-
-create_udev_rule() {
-    local ccw=$1
-    local wwpn=$2
-    local lun=$3
-    local _rule=/etc/udev/rules.d/51-zfcp-${ccw}.rules
-    local _cu_type _dev_type
-
-    if [ -x /sbin/cio_ignore ] && cio_ignore -i "$ccw" > /dev/null; then
-        cio_ignore -r "$ccw"
-    fi
-
-    if [ -e /sys/bus/ccw/devices/"${ccw}" ]; then
-        read -r _cu_type < /sys/bus/ccw/devices/"${ccw}"/cutype
-        read -r _dev_type < /sys/bus/ccw/devices/"${ccw}"/devtype
-    fi
-    if [ "$_cu_type" != "1731/03" ]; then
-        return 0
-    fi
-    if [ "$_dev_type" != "1732/03" ] && [ "$_dev_type" != "1732/04" ]; then
-        return 0
-    fi
-
-    [ -z "$wwpn" ] || [ -z "$lun" ] && return
-    m=$(sed -n "/.*${wwpn}.*${lun}.*/p" "$_rule")
-    if [ -z "$m" ]; then
-        cat >> "$_rule" << EOF
-ACTION=="add", KERNEL=="rport-*", ATTR{port_name}=="$wwpn", SUBSYSTEMS=="ccw", KERNELS=="$ccw", ATTR{[ccw/$ccw]$wwpn/unit_add}="$lun"
-EOF
-    fi
-}
-
-if [[ -f /sys/firmware/ipl/ipl_type ]] \
-    && [[ $(< /sys/firmware/ipl/ipl_type) == "fcp" ]]; then
-    (
-        read -r _wwpn < /sys/firmware/ipl/wwpn
-        read -r _lun < /sys/firmware/ipl/lun
-        read -r _ccw < /sys/firmware/ipl/device
-
-        create_udev_rule "$_ccw" "$_wwpn" "$_lun"
-    )
-fi
-
-for zfcp_arg in $(getargs rd.zfcp); do
-    (
-        OLDIFS="$IFS"
-        IFS=","
-        # shellcheck disable=SC2086
-        set $zfcp_arg
-        IFS="$OLDIFS"
-        create_udev_rule "$1" "$2" "$3"
-    )
-done
-
-for zfcp_arg in $(getargs root=) $(getargs resume=); do
-    (
-        case $zfcp_arg in
-            /dev/disk/by-path/ccw-*)
-                ccw_arg=${zfcp_arg##*/}
-                ;;
-        esac
-        if [ -n "$ccw_arg" ]; then
-            OLDIFS="$IFS"
-            IFS="-"
-            set -- "$ccw_arg"
-            IFS="$OLDIFS"
-            _wwpn=${4%:*}
-            _lun=${4#*:}
-            create_udev_rule "$2" "$wwpn" "$lun"
-        fi
-    )
-done
diff --git a/modules.d/95znet/module-setup.sh b/modules.d/95znet/module-setup.sh
index df37c66..95164bb 100755
--- a/modules.d/95znet/module-setup.sh
+++ b/modules.d/95znet/module-setup.sh
@@ -5,7 +5,7 @@ check() {
     arch=${DRACUT_ARCH:-$(uname -m)}
     [ "$arch" = "s390" -o "$arch" = "s390x" ] || return 1
 
-    require_binaries znet_cio_free grep sed seq readlink || return 1
+    require_binaries grep sed seq readlink chzdev || return 1
 
     return 0
 }
@@ -24,6 +24,37 @@ installkernel() {
 # called by dracut
 install() {
     inst_hook cmdline 30 "$moddir/parse-ccw.sh"
-    inst_rules 81-ccw.rules
-    inst_multiple znet_cio_free grep sed seq readlink /lib/udev/ccw_init
+    inst_multiple grep sed seq readlink chzdev
+    if [[ $hostonly ]]; then
+        local _tempfile
+        _tempfile=$(mktemp --tmpdir="${DRACUT_TMPDIR}" dracut-zdev.XXXXXX)
+        {
+            chzdev qeth --export - --configured --persistent --quiet --type
+            chzdev lcs --export - --configured --persistent --quiet --type
+            chzdev ctc --export - --configured --persistent --quiet --type
+        } 2> /dev/null > "$_tempfile"
+        ddebug < "$_tempfile"
+        chzdev --import "$_tempfile" --persistent --base "/etc=$initdir/etc" \
+            --yes --no-root-update --force 2>&1 | ddebug
+        lszdev --configured --persistent --info \
+            --base "/etc=$initdir/etc" 2>&1 | ddebug
+        rm -f "$_tempfile"
+        # these are purely generated udev rules so we have to glob expand
+        # within $initdir and strip the $initdir prefix for mark_hostonly
+        local -a _array
+        # shellcheck disable=SC2155
+        local _nullglob=$(shopt -p nullglob)
+        shopt -u nullglob
+        # shellcheck disable=SC2086
+        readarray -t _array < <(
+            ls -1 $initdir/etc/udev/rules.d/41-*.rules 2> /dev/null
+        )
+        [[ ${#_array[@]} -gt 0 ]] && mark_hostonly "${_array[@]#$initdir}"
+        # shellcheck disable=SC2086
+        readarray -t _array < <(
+            ls -1 $initdir/etc/modprobe.d/s390x-*.conf 2> /dev/null
+        )
+        [[ ${#_array[@]} -gt 0 ]] && mark_hostonly "${_array[@]#$initdir}"
+        $_nullglob
+    fi
 }
diff --git a/modules.d/95znet/parse-ccw.sh b/modules.d/95znet/parse-ccw.sh
index d895360..ccf05bc 100755
--- a/modules.d/95znet/parse-ccw.sh
+++ b/modules.d/95znet/parse-ccw.sh
@@ -1,7 +1,50 @@
 #!/bin/bash
 
+znet_base_args="--no-settle --yes --no-root-update --force"
+
+# at this point in time dracut's vinfo() only logs to journal which is hard for
+# s390 users to find and access on a line mode console such as 3215 mode
+# so use a vinfo alternative that still prints to the console via kmsg
+znet_vinfo() {
+    while read -r _znet_vinfo_line || [ -n "$_znet_vinfo_line" ]; do
+        # Prefix "<30>" represents facility LOG_DAEMON 3 and loglevel INFO 6:
+        # (facility << 3) | level.
+        echo "<30>dracut: $_znet_vinfo_line" > /dev/kmsg
+    done
+}
+
 for ccw_arg in $(getargs rd.ccw -d 'rd_CCW=') $(getargs rd.znet -d 'rd_ZNET='); do
-    echo "$ccw_arg" >> /etc/ccw.conf
+    (
+        SAVED_IFS="$IFS"
+        IFS=","
+        # shellcheck disable=SC2086
+        set -- $ccw_arg
+        IFS="$SAVED_IFS"
+        type="$1"
+        subchannel1="$2"
+        subchannel2="$3"
+        subchannel3="$4"
+        echo "rd.znet ${ccw_arg} :" | znet_vinfo
+        if [ "$#" -lt 3 ]; then
+            echo "rd.znet needs at least 3 list items: type,subchannel1,subchannel2" | znet_vinfo
+        fi
+        if [ "$1" = "qeth" ]; then
+            if [ "$#" -lt 4 ]; then
+                echo "rd.znet for type qeth needs at least 4 list items: qeth,subchannel1,subchannel2,subchannel3" | znet_vinfo
+            fi
+            subchannels="$subchannel1:$subchannel2:$subchannel3"
+            shift 4
+            # shellcheck disable=SC2086
+            chzdev --enable --persistent $znet_base_args \
+                "$type" "$subchannels" "$@" 2>&1 | znet_vinfo
+        else
+            subchannels="$subchannel1:$subchannel2"
+            shift 3
+            # shellcheck disable=SC2086
+            chzdev --enable --persistent $znet_base_args \
+                "$type" "$subchannels" "$@" 2>&1 | znet_vinfo
+        fi
+    )
 done
 
 for ifname in $(getargs rd.znet_ifname); do
@@ -10,16 +53,16 @@ for ifname in $(getargs rd.znet_ifname); do
         warn "Invalid arguments for rd.znet_ifname="
     else
         {
-            ifname_subchannels=${ifname_subchannels//,/|}
+            ifname_subchannels="${ifname_subchannels//,/|}"
+            # sanitize for use in udev label: replace non-word characters by _
+            ifname_if_label="${ifname_if//[^[:word:]]/_}"
 
-            echo 'ACTION!="add|change", GOTO="ccw_ifname_end"'
-            echo 'ATTR{type}!="1", GOTO="ccw_ifname_end"'
-            echo 'SUBSYSTEM!="net", GOTO="ccw_ifname_end"'
+            echo "ACTION!=\"add|change\", GOTO=\"ccw_ifname_${ifname_if_label}_end\""
+            echo "ATTR{type}!=\"1\", GOTO=\"ccw_ifname_${ifname_if_label}_end\""
+            echo "SUBSYSTEM!=\"net\", GOTO=\"ccw_ifname_${ifname_if_label}_end\""
             echo "SUBSYSTEMS==\"ccwgroup\", KERNELS==\"$ifname_subchannels\", DRIVERS==\"?*\" NAME=\"$ifname_if\""
-            echo 'LABEL="ccw_ifname_end"'
+            echo "LABEL=\"ccw_ifname_${ifname_if_label}_end\""
 
-        } > /etc/udev/rules.d/81-ccw-ifname.rules
+        } >> /etc/udev/rules.d/81-ccw-ifname.rules
     fi
 done
-
-znet_cio_free
diff --git a/modules.d/98dracut-systemd/dracut-cmdline.sh b/modules.d/98dracut-systemd/dracut-cmdline.sh
index 646fead..d2919e1 100755
--- a/modules.d/98dracut-systemd/dracut-cmdline.sh
+++ b/modules.d/98dracut-systemd/dracut-cmdline.sh
@@ -6,7 +6,7 @@ fi
 type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
 
 [ -f /usr/lib/initrd-release ] && . /usr/lib/initrd-release
-[ -n "$VERSION" ] && info "dracut-$VERSION"
+[ -n "$DRACUT_VERSION" ] && info "dracut-$DRACUT_VERSION"
 
 if ! getargbool 1 'rd.hostonly'; then
     [ -f /etc/cmdline.d/99-cmdline-ask.conf ] && mv /etc/cmdline.d/99-cmdline-ask.conf /tmp/99-cmdline-ask.conf
@@ -17,8 +17,10 @@ fi
 
 info "Using kernel command line parameters:" "$(getcmdline)"
 
-getargbool 0 rd.udev.log-priority=info -d rd.udev.info -d -n -y rdudevinfo && echo 'udev_log="info"' >> /etc/udev/udev.conf
-getargbool 0 rd.udev.log-priority=debug -d rd.udev.debug -d -n -y rdudevdebug && echo 'udev_log="debug"' >> /etc/udev/udev.conf
+getargbool 0 rd.udev.log_level=info -d rd.udev.log-priority=info -d rd.udev.info -d -y rdudevinfo \
+    && echo 'udev_log="info"' >> /etc/udev/udev.conf
+getargbool 0 rd.udev.log_level=debug -d rd.udev.log-priority=debug -d rd.udev.debug -d -y rdudevdebug \
+    && echo 'udev_log="debug"' >> /etc/udev/udev.conf
 
 source_conf /etc/conf.d
 
@@ -45,7 +47,7 @@ export fstype
 
 make_trace_mem "hook cmdline" '1+:mem' '1+:iomem' '3+:slab'
 # run scriptlets to parse the command line
-getarg 'rd.break=cmdline' -d 'rdbreak=cmdline' && emergency_shell -n cmdline "Break before cmdline"
+getargs 'rd.break=cmdline' -d 'rdbreak=cmdline' && emergency_shell -n cmdline "Break before cmdline"
 source_hook cmdline
 
 [ -f /lib/dracut/parse-resume.sh ] && . /lib/dracut/parse-resume.sh
diff --git a/modules.d/98dracut-systemd/dracut-emergency.sh b/modules.d/98dracut-systemd/dracut-emergency.sh
index c6637a5..bc396fc 100755
--- a/modules.d/98dracut-systemd/dracut-emergency.sh
+++ b/modules.d/98dracut-systemd/dracut-emergency.sh
@@ -39,20 +39,20 @@ else
     export hook="shutdown-emergency"
     warn "$action has failed. To debug this issue add \"rd.shell rd.debug\" to the kernel command line."
     source_hook "$hook"
-    [ -z "$_emergency_action" ] && _emergency_action=halt
+    [ -z "$_emergency_action" ] && _emergency_action=poweroff
 fi
 
 /bin/rm -f -- /.console_lock
 
 case "$_emergency_action" in
     reboot)
-        reboot || exit 1
+        reboot -f || exit 1
         ;;
     poweroff)
-        poweroff || exit 1
+        poweroff -f || exit 1
         ;;
     halt)
-        halt || exit 1
+        halt -f || exit 1
         ;;
 esac
 
diff --git a/modules.d/98dracut-systemd/dracut-initqueue.sh b/modules.d/98dracut-systemd/dracut-initqueue.sh
index ce919ce..b0882db 100755
--- a/modules.d/98dracut-systemd/dracut-initqueue.sh
+++ b/modules.d/98dracut-systemd/dracut-initqueue.sh
@@ -9,7 +9,7 @@ type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
 source_conf /etc/conf.d
 
 make_trace_mem "hook initqueue" '1:shortmem' '2+:mem' '3+:slab'
-getarg 'rd.break=initqueue' -d 'rdbreak=initqueue' && emergency_shell -n initqueue "Break before initqueue"
+getargs 'rd.break=initqueue' -d 'rdbreak=initqueue' && emergency_shell -n initqueue "Break before initqueue"
 
 RDRETRY=$(getarg rd.retry -d 'rd_retry=')
 RDRETRY=${RDRETRY:-180}
diff --git a/modules.d/98dracut-systemd/dracut-mount.sh b/modules.d/98dracut-systemd/dracut-mount.sh
index 7892941..3e58126 100755
--- a/modules.d/98dracut-systemd/dracut-mount.sh
+++ b/modules.d/98dracut-systemd/dracut-mount.sh
@@ -9,7 +9,7 @@ source_conf /etc/conf.d
 
 make_trace_mem "hook mount" '1:shortmem' '2+:mem' '3+:slab'
 
-getarg 'rd.break=mount' -d 'rdbreak=mount' && emergency_shell -n mount "Break before mount"
+getargs 'rd.break=mount' -d 'rdbreak=mount' && emergency_shell -n mount "Break before mount"
 # mount scripts actually try to mount the root filesystem, and may
 # be sourced any number of times. As soon as one succeeds, no more are sourced.
 i=0
diff --git a/modules.d/98dracut-systemd/dracut-pre-mount.sh b/modules.d/98dracut-systemd/dracut-pre-mount.sh
index ee51605..d7482c5 100755
--- a/modules.d/98dracut-systemd/dracut-pre-mount.sh
+++ b/modules.d/98dracut-systemd/dracut-pre-mount.sh
@@ -11,7 +11,7 @@ source_conf /etc/conf.d
 make_trace_mem "hook pre-mount" '1:shortmem' '2+:mem' '3+:slab'
 # pre pivot scripts are sourced just before we doing cleanup and switch over
 # to the new root.
-getarg 'rd.break=pre-mount' 'rdbreak=pre-mount' && emergency_shell -n pre-mount "Break before pre-mount"
+getargs 'rd.break=pre-mount' -d 'rdbreak=pre-mount' && emergency_shell -n pre-mount "Break before pre-mount"
 source_hook pre-mount
 
 export -p > /dracut-state.sh
diff --git a/modules.d/98dracut-systemd/dracut-pre-pivot.sh b/modules.d/98dracut-systemd/dracut-pre-pivot.sh
index 8bf2325..fa81b33 100755
--- a/modules.d/98dracut-systemd/dracut-pre-pivot.sh
+++ b/modules.d/98dracut-systemd/dracut-pre-pivot.sh
@@ -11,11 +11,11 @@ source_conf /etc/conf.d
 make_trace_mem "hook pre-pivot" '1:shortmem' '2+:mem' '3+:slab'
 # pre pivot scripts are sourced just before we doing cleanup and switch over
 # to the new root.
-getarg 'rd.break=pre-pivot' 'rdbreak=pre-pivot' && emergency_shell -n pre-pivot "Break before pre-pivot"
+getargs 'rd.break=pre-pivot' -d 'rdbreak=pre-pivot' && emergency_shell -n pre-pivot "Break before pre-pivot"
 source_hook pre-pivot
 
 # pre pivot cleanup scripts are sourced just before we switch over to the new root.
-getarg 'rd.break=cleanup' 'rdbreak=cleanup' && emergency_shell -n cleanup "Break before cleanup"
+getargs 'rd.break=cleanup' -d 'rdbreak=cleanup' && emergency_shell -n cleanup "Break before cleanup"
 source_hook cleanup
 
 _bv=$(getarg rd.break -d rdbreak) && [ -z "$_bv" ] \
diff --git a/modules.d/98dracut-systemd/dracut-pre-trigger.sh b/modules.d/98dracut-systemd/dracut-pre-trigger.sh
index dd0215e..8758ba9 100755
--- a/modules.d/98dracut-systemd/dracut-pre-trigger.sh
+++ b/modules.d/98dracut-systemd/dracut-pre-trigger.sh
@@ -12,7 +12,7 @@ make_trace_mem "hook pre-trigger" '1:shortmem' '2+:mem' '3+:slab'
 
 source_hook pre-trigger
 
-getarg 'rd.break=pre-trigger' 'rdbreak=pre-trigger' && emergency_shell -n pre-trigger "Break before pre-trigger"
+getargs 'rd.break=pre-trigger' -d 'rdbreak=pre-trigger' && emergency_shell -n pre-trigger "Break before pre-trigger"
 
 udevadm control --reload > /dev/null 2>&1 || :
 
diff --git a/modules.d/98dracut-systemd/dracut-pre-udev.sh b/modules.d/98dracut-systemd/dracut-pre-udev.sh
index feab32c..9c8ac9d 100755
--- a/modules.d/98dracut-systemd/dracut-pre-udev.sh
+++ b/modules.d/98dracut-systemd/dracut-pre-udev.sh
@@ -10,15 +10,11 @@ source_conf /etc/conf.d
 make_trace_mem "hook pre-udev" '1:shortmem' '2+:mem' '3+:slab'
 # pre pivot scripts are sourced just before we doing cleanup and switch over
 # to the new root.
-getarg 'rd.break=pre-udev' 'rdbreak=pre-udev' && emergency_shell -n pre-udev "Break before pre-udev"
+getargs 'rd.break=pre-udev' -d 'rdbreak=pre-udev' && emergency_shell -n pre-udev "Break before pre-udev"
 source_hook pre-udev
 
-_modprobe_d=/etc/modprobe.d
-if [ -d /usr/lib/modprobe.d ]; then
-    _modprobe_d=/usr/lib/modprobe.d
-elif [ -d /lib/modprobe.d ]; then
-    _modprobe_d=/lib/modprobe.d
-elif [ ! -d $_modprobe_d ]; then
+_modprobe_d=/run/modprobe.d
+if [ ! -d $_modprobe_d ]; then
     mkdir -p $_modprobe_d
 fi
 
@@ -31,8 +27,6 @@ for i in $(getargs rd.driver.pre -d rdloaddriver=); do
     )
 done
 
-[ -d /etc/modprobe.d ] || mkdir -p /etc/modprobe.d
-
 for i in $(getargs rd.driver.blacklist -d rdblacklist=); do
     (
         IFS=,
diff --git a/modules.d/98dracut-systemd/module-setup.sh b/modules.d/98dracut-systemd/module-setup.sh
index 3195377..0ea26d4 100755
--- a/modules.d/98dracut-systemd/module-setup.sh
+++ b/modules.d/98dracut-systemd/module-setup.sh
@@ -4,12 +4,15 @@
 check() {
     [[ $mount_needs ]] && return 1
 
+    # If the binary(s) requirements are not fulfilled the module can't be installed
+    require_binaries "$systemdutildir"/systemd || return 1
+
     return 0
 }
 
 # called by dracut
 depends() {
-    echo "systemd-initrd"
+    echo "systemd-initrd systemd-ask-password"
     return 0
 }
 
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
index 39609d8..e83ee94 100755
--- a/modules.d/99base/dracut-lib.sh
+++ b/modules.d/99base/dracut-lib.sh
@@ -451,7 +451,7 @@ die() {
     fi
 
     if [ -n "$DRACUT_SYSTEMD" ]; then
-        systemctl --no-block --force halt
+        systemctl --no-block --force poweroff
     fi
 
     exit 1
@@ -973,25 +973,25 @@ emergency_shell() {
     _emergency_action=$(getarg rd.emergency)
     [ -z "$_emergency_action" ] \
         && [ -e /run/initramfs/.die ] \
-        && _emergency_action=halt
+        && _emergency_action=poweroff
 
     if getargbool 1 rd.shell -d -y rdshell || getarg rd.break -d rdbreak; then
         _emergency_shell "$_rdshell_name"
     else
         source_hook "$hook"
         warn "$action has failed. To debug this issue add \"rd.shell rd.debug\" to the kernel command line."
-        [ -z "$_emergency_action" ] && _emergency_action=halt
+        [ -z "$_emergency_action" ] && _emergency_action=poweroff
     fi
 
     case "$_emergency_action" in
         reboot)
-            reboot || exit 1
+            reboot -f || exit 1
             ;;
         poweroff)
-            poweroff || exit 1
+            poweroff -f || exit 1
             ;;
         halt)
-            halt || exit 1
+            halt -f || exit 1
             ;;
     esac
 }
@@ -1130,8 +1130,20 @@ show_memstats() {
     esac
 }
 
+# parameter: <memory_name:>  example: MemTotal:
+# Check /proc/meminfo
+# echo the field value, if present.
+check_meminfo() {
+    local - m sz
+    set +x
+    while read -r m sz _ || [ "$m" ]; do
+        [ "$m" = "$1" ] && echo "$sz" && return 0
+    done < /proc/meminfo
+    return 1
+}
+
 remove_hostonly_files() {
-    rm -fr /etc/cmdline /etc/cmdline.d/*.conf "$hookdir/initqueue/finished"
+    rm -fr /etc/cmdline /etc/cmdline.d/*.conf "$hookdir"/initqueue/finished/*.sh
     if [ -f /lib/dracut/hostonly-files ]; then
         while read -r line || [ -n "$line" ]; do
             [ -e "$line" ] || [ -h "$line" ] || continue
@@ -1151,28 +1163,3 @@ load_fstype() {
     done < /proc/filesystems
     modprobe "$1"
 }
-
-# parameter: size of live image
-# calls emergency shell if ram size is too small for the image
-check_live_ram() {
-    minmem=$(getarg rd.minmem)
-    minmem=${minmem:-1024}
-    imgsize=$1
-    memsize=$(($(sed -n 's/MemTotal: *\([[:digit:]]*\).*/\1/p' /proc/meminfo) / 1024))
-
-    if [ -z "$imgsize" ]; then
-        warn "Image size could not be determined"
-        return 0
-    fi
-
-    if [ $((memsize - imgsize)) -lt "$minmem" ]; then
-        sed -i "N;/and attach it to a bug report./s/echo$/echo\n\
-         echo \n\
-         echo 'Warning!!!'\n\
-         echo 'The memory size of your system is too small for this live image.'\n\
-         echo 'Expect killed processes due to out of memory conditions.'\n\
-         echo \n/" /usr/bin/dracut-emergency
-
-        emergency_shell
-    fi
-}
diff --git a/modules.d/99base/init.sh b/modules.d/99base/init.sh
index 285059e..727f279 100755
--- a/modules.d/99base/init.sh
+++ b/modules.d/99base/init.sh
@@ -123,7 +123,7 @@ fi
 
 # run scriptlets to parse the command line
 make_trace_mem "hook cmdline" '1+:mem' '1+:iomem' '3+:slab'
-getarg 'rd.break=cmdline' -d 'rdbreak=cmdline' && emergency_shell -n cmdline "Break before cmdline"
+getargs 'rd.break=cmdline' -d 'rdbreak=cmdline' && emergency_shell -n cmdline "Break before cmdline"
 source_hook cmdline
 
 [ -z "$root" ] && die "No or empty root= argument"
@@ -133,12 +133,14 @@ export root rflags fstype netroot NEWROOT
 
 # pre-udev scripts run before udev starts, and are run only once.
 make_trace_mem "hook pre-udev" '1:shortmem' '2+:mem' '3+:slab'
-getarg 'rd.break=pre-udev' -d 'rdbreak=pre-udev' && emergency_shell -n pre-udev "Break before pre-udev"
+getargs 'rd.break=pre-udev' -d 'rdbreak=pre-udev' && emergency_shell -n pre-udev "Break before pre-udev"
 source_hook pre-udev
 
 UDEV_LOG=err
-getargbool 0 rd.udev.info -d -y rdudevinfo && UDEV_LOG=info
-getargbool 0 rd.udev.debug -d -y rdudevdebug && UDEV_LOG=debug
+getargbool 0 rd.udev.log_level=info -d rd.udev.log-priority=info -d rd.udev.info -d -y rdudevinfo \
+    && UDEV_LOG=info
+getargbool 0 rd.udev.log_level=debug -d rd.udev.log-priority=debug -d rd.udev.debug -d -y rdudevdebug \
+    && UDEV_LOG=debug
 
 # start up udev and trigger cold plugs
 UDEV_LOG=$UDEV_LOG "$systemdutildir"/systemd-udevd --daemon --resolve-names=never
@@ -148,7 +150,7 @@ UDEV_QUEUE_EMPTY="udevadm settle --timeout=0"
 udevproperty "hookdir=$hookdir"
 
 make_trace_mem "hook pre-trigger" '1:shortmem' '2+:mem' '3+:slab'
-getarg 'rd.break=pre-trigger' -d 'rdbreak=pre-trigger' && emergency_shell -n pre-trigger "Break before pre-trigger"
+getargs 'rd.break=pre-trigger' -d 'rdbreak=pre-trigger' && emergency_shell -n pre-trigger "Break before pre-trigger"
 source_hook pre-trigger
 
 udevadm control --reload > /dev/null 2>&1 || :
@@ -157,7 +159,7 @@ udevadm trigger --type=subsystems --action=add > /dev/null 2>&1
 udevadm trigger --type=devices --action=add > /dev/null 2>&1
 
 make_trace_mem "hook initqueue" '1:shortmem' '2+:mem' '3+:slab'
-getarg 'rd.break=initqueue' -d 'rdbreak=initqueue' && emergency_shell -n initqueue "Break before initqueue"
+getargs 'rd.break=initqueue' -d 'rdbreak=initqueue' && emergency_shell -n initqueue "Break before initqueue"
 
 RDRETRY=$(getarg rd.retry -d 'rd_retry=')
 RDRETRY=${RDRETRY:-180}
@@ -223,10 +225,10 @@ unset RDRETRY
 # pre-mount happens before we try to mount the root filesystem,
 # and happens once.
 make_trace_mem "hook pre-mount" '1:shortmem' '2+:mem' '3+:slab'
-getarg 'rd.break=pre-mount' -d 'rdbreak=pre-mount' && emergency_shell -n pre-mount "Break before pre-mount"
+getargs 'rd.break=pre-mount' -d 'rdbreak=pre-mount' && emergency_shell -n pre-mount "Break before pre-mount"
 source_hook pre-mount
 
-getarg 'rd.break=mount' -d 'rdbreak=mount' && emergency_shell -n mount "Break before mount"
+getargs 'rd.break=mount' -d 'rdbreak=mount' && emergency_shell -n mount "Break before mount"
 # mount scripts actually try to mount the root filesystem, and may
 # be sourced any number of times. As soon as one succeeds, no more are sourced.
 _i_mount=0
@@ -262,12 +264,12 @@ done
 # pre pivot scripts are sourced just before we doing cleanup and switch over
 # to the new root.
 make_trace_mem "hook pre-pivot" '1:shortmem' '2+:mem' '3+:slab'
-getarg 'rd.break=pre-pivot' -d 'rdbreak=pre-pivot' && emergency_shell -n pre-pivot "Break before pre-pivot"
+getargs 'rd.break=pre-pivot' -d 'rdbreak=pre-pivot' && emergency_shell -n pre-pivot "Break before pre-pivot"
 source_hook pre-pivot
 
 make_trace_mem "hook cleanup" '1:shortmem' '2+:mem' '3+:slab'
 # pre pivot cleanup scripts are sourced just before we switch over to the new root.
-getarg 'rd.break=cleanup' -d 'rdbreak=cleanup' && emergency_shell -n cleanup "Break before cleanup"
+getargs 'rd.break=cleanup' -d 'rdbreak=cleanup' && emergency_shell -n cleanup "Break before cleanup"
 source_hook cleanup
 
 # By the time we get here, the root filesystem should be mounted.
diff --git a/modules.d/99base/loginit.sh b/modules.d/99base/loginit.sh
index cdb305b..7c47a5a 100755
--- a/modules.d/99base/loginit.sh
+++ b/modules.d/99base/loginit.sh
@@ -18,6 +18,6 @@ while read -r line || [ -n "$line" ]; do
     fi
     echo "<31>dracut: $line" >&5
     # if "quiet" is specified we output to /dev/console
-    [ -n "$QUIET" ] || echo "dracut: $line"
+    [ "$QUIET" = "yes" ] || echo "dracut: $line"
     echo "$line" >&6
 done
diff --git a/modules.d/99base/module-setup.sh b/modules.d/99base/module-setup.sh
index 54b0deb..bfdc51d 100755
--- a/modules.d/99base/module-setup.sh
+++ b/modules.d/99base/module-setup.sh
@@ -45,7 +45,10 @@ install() {
 
     [ -e "${initdir}/lib" ] || mkdir -m 0755 -p "${initdir}"/lib
     mkdir -m 0755 -p "${initdir}"/lib/dracut
-    mkdir -m 0755 -p "${initdir}"/lib/dracut/hooks
+    mkdir -m 0755 -p "${initdir}"/var/lib/dracut/hooks
+
+    # symlink to old hooks location for compatibility
+    ln_r /var/lib/dracut/hooks /lib/dracut/hooks
 
     mkdir -p "${initdir}"/tmp
 
diff --git a/modules.d/99base/rdsosreport.sh b/modules.d/99base/rdsosreport.sh
index dadf30b..61ca458 100755
--- a/modules.d/99base/rdsosreport.sh
+++ b/modules.d/99base/rdsosreport.sh
@@ -28,7 +28,7 @@ cat /proc/self/mountinfo
 cat /proc/mounts
 
 blkid
-blkid -o udev
+command -v udevadm > /dev/null 2> /dev/null && udevadm info --export-db
 
 ls -l /dev/disk/by*
 
diff --git a/modules.d/99img-lib/img-lib.sh b/modules.d/99img-lib/img-lib.sh
index 4700832..efc6475 100755
--- a/modules.d/99img-lib/img-lib.sh
+++ b/modules.d/99img-lib/img-lib.sh
@@ -106,3 +106,37 @@ unpack_img() {
         }
     fi
 }
+
+# parameter: <size of live image> in MiB
+# Call emergency shell if ram size is too small for the image.
+# Increase /run tmpfs size, if needed.
+check_live_ram() {
+    local minmem imgsize memsize runsize runavail
+    minmem=$(getarg rd.minmem)
+    imgsize=$1
+    memsize=$(($(check_meminfo MemTotal:) >> 10))
+    # shellcheck disable=SC2046
+    set -- $(findmnt -bnro SIZE,AVAIL /run)
+    # bytes to MiB
+    runsize=$(($1 >> 20))
+    runavail=$(($2 >> 20))
+
+    [ "$imgsize" ] || {
+        warn "Image size could not be determined"
+        return 0
+    }
+
+    if [ $((memsize - imgsize)) -lt "${minmem:=1024}" ]; then
+        sed -i "N;/and attach it to a bug report./s/echo$/echo\n\
+         echo \n\
+         echo 'Warning!!!'\n\
+         echo 'The memory size of your system is too small for this live image.'\n\
+         echo 'Expect killed processes due to out of memory conditions.'\n\
+         echo \n/" /usr/bin/dracut-emergency
+
+        emergency_shell
+    elif [ $((runavail - imgsize)) -lt "$minmem" ]; then
+        # Increase /run tmpfs size, if needed.
+        mount -o remount,size=$((runsize - runavail + imgsize + minmem))M /run
+    fi
+}
diff --git a/modules.d/99memstrack/module-setup.sh b/modules.d/99memstrack/module-setup.sh
index 27563eb..b25a966 100755
--- a/modules.d/99memstrack/module-setup.sh
+++ b/modules.d/99memstrack/module-setup.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 
 check() {
-    if ! require_binaries pgrep pkill memstrack; then
-        dinfo "memstrack is not available"
-        dinfo "If you need to use rd.memdebug>=4, please install memstrack and procps-ng"
-        return 1
-    fi
+    # If you need to use rd.memdebug>=4, please install all the required binary dependencies
+    require_binaries \
+        pgrep \
+        pkill \
+        memstrack \
+        || return 1
 
     return 0
 }
diff --git a/modules.d/99shutdown/module-setup.sh b/modules.d/99shutdown/module-setup.sh
index 2b99902..f53017f 100755
--- a/modules.d/99shutdown/module-setup.sh
+++ b/modules.d/99shutdown/module-setup.sh
@@ -17,9 +17,11 @@ install() {
     inst_multiple umount poweroff reboot halt losetup stat sleep timeout
     inst_multiple -o kexec
     inst "$moddir/shutdown.sh" "$prefix/shutdown"
-    [ -e "${initdir}/lib" ] || mkdir -m 0755 -p "${initdir}"/lib
-    mkdir -m 0755 -p "${initdir}"/lib/dracut
-    mkdir -m 0755 -p "${initdir}"/lib/dracut/hooks
+    mkdir -m 0755 -p "${initdir}"/var/lib/dracut/hooks
+
+    # symlink to old hooks location for compatibility
+    ln_r /var/lib/dracut/hooks /lib/dracut/hooks
+
     for _d in $hookdirs shutdown shutdown-emergency; do
         mkdir -m 0755 -p "${initdir}"/lib/dracut/hooks/"$_d"
     done
diff --git a/modules.d/99shutdown/shutdown.sh b/modules.d/99shutdown/shutdown.sh
index d611d44..d48d7d1 100755
--- a/modules.d/99shutdown/shutdown.sh
+++ b/modules.d/99shutdown/shutdown.sh
@@ -39,7 +39,7 @@ if [ "$ACTION" = "kexec" ] && ! command -v kexec > /dev/null 2>&1; then
 fi
 
 trap "emergency_shell --shutdown shutdown Signal caught!" 0
-getarg 'rd.break=pre-shutdown' && emergency_shell --shutdown pre-shutdown "Break before pre-shutdown"
+getargs 'rd.break=pre-shutdown' && emergency_shell --shutdown pre-shutdown "Break before pre-shutdown"
 
 source_hook pre-shutdown
 
@@ -155,7 +155,7 @@ elif [ -x /oldroot/bin/plymouth ]; then
     /oldroot/bin/plymouth --hide-splash
 fi
 
-getarg 'rd.break=shutdown' && emergency_shell --shutdown shutdown "Break before shutdown"
+getargs 'rd.break=shutdown' && emergency_shell --shutdown shutdown "Break before shutdown"
 
 case "$ACTION" in
     reboot | poweroff | halt)