From 469f4527bc3ebb79e9e2733c2a0d7d6c078e7a3a Mon Sep 17 00:00:00 2001
From: AlmaLinux RelEng Bot <eabdullin@almalinux.org>
Date: Mon, 30 Mar 2026 10:36:05 -0400
Subject: [PATCH] import CS kexec-tools-2.0.29-17.el9

---
 SOURCES/98-kexec.rules                        |   4 +
 SOURCES/98-kexec.rules.ppc64                  |   4 +
 SOURCES/crashkernel-howto.txt                 |   6 +-
 SOURCES/dracut-kdump.sh                       |  35 +--
 SOURCES/dracut-kexec-crypt-setup.sh           |  21 ++
 SOURCES/dracut-module-setup.sh                |  56 ++++
 SOURCES/kdump-lib-initramfs.sh                |  55 +++-
 SOURCES/kdump-lib.sh                          |  56 +++-
 SOURCES/kdump-udev-throttler                  |  30 ++-
 SOURCES/kdump.service                         |   1 +
 SOURCES/kdump.sysconfig                       |   2 +-
 SOURCES/kdump.sysconfig.aarch64               |   2 +-
 SOURCES/kdump.sysconfig.i386                  |   2 +-
 SOURCES/kdump.sysconfig.ppc64                 |   2 +-
 SOURCES/kdump.sysconfig.ppc64le               |   2 +-
 SOURCES/kdump.sysconfig.s390x                 |   2 +-
 SOURCES/kdump.sysconfig.x86_64                |   2 +-
 SOURCES/kdumpctl                              | 253 +++++++++++++++++-
 SOURCES/kdumpctl.8                            |  19 +-
 SOURCES/kexec-kdump-howto.txt                 |  35 ++-
 ...ata-race-in-multi-threading-mode-num.patch | 120 +++++++++
 SOURCES/mkdumprd                              |  14 -
 SOURCES/supported-kdump-targets.txt           |   1 +
 SPECS/kexec-tools.spec                        |  87 ++++--
 24 files changed, 711 insertions(+), 100 deletions(-)
 create mode 100644 SOURCES/dracut-kexec-crypt-setup.sh
 create mode 100644 SOURCES/kexec-tools-2.0.29-makedumpfile-Fix-a-data-race-in-multi-threading-mode-num.patch

diff --git a/SOURCES/98-kexec.rules b/SOURCES/98-kexec.rules
index b73b701..52b2ee8 100644
--- a/SOURCES/98-kexec.rules
+++ b/SOURCES/98-kexec.rules
@@ -1,3 +1,7 @@
+# The kernel updates the crash elfcorehdr for CPU and memory changes
+SUBSYSTEM=="cpu", ATTRS{crash_hotplug}=="1", GOTO="kdump_reload_end"
+SUBSYSTEM=="memory", ATTRS{crash_hotplug}=="1", GOTO="kdump_reload_end"
+
 SUBSYSTEM=="cpu", ACTION=="add", GOTO="kdump_reload"
 SUBSYSTEM=="cpu", ACTION=="remove", GOTO="kdump_reload"
 SUBSYSTEM=="memory", ACTION=="online", GOTO="kdump_reload"
diff --git a/SOURCES/98-kexec.rules.ppc64 b/SOURCES/98-kexec.rules.ppc64
index e9db276..e7735b3 100644
--- a/SOURCES/98-kexec.rules.ppc64
+++ b/SOURCES/98-kexec.rules.ppc64
@@ -1,3 +1,7 @@
+# The kernel updates the crash elfcorehdr for CPU and memory changes
+SUBSYSTEM=="cpu", ATTRS{crash_hotplug}=="1", GOTO="kdump_reload_end"
+SUBSYSTEM=="memory", ATTRS{crash_hotplug}=="1", GOTO="kdump_reload_end"
+
 SUBSYSTEM=="cpu", ACTION=="online", GOTO="kdump_reload_cpu"
 SUBSYSTEM=="memory", ACTION=="online", GOTO="kdump_reload_mem"
 SUBSYSTEM=="memory", ACTION=="offline", GOTO="kdump_reload_mem"
diff --git a/SOURCES/crashkernel-howto.txt b/SOURCES/crashkernel-howto.txt
index 6c66ee7..a46e859 100644
--- a/SOURCES/crashkernel-howto.txt
+++ b/SOURCES/crashkernel-howto.txt
@@ -65,13 +65,13 @@ Reset using kdumpctl
 To make it easier to reset the `crashkernel=` kernel cmdline to this default
 value properly, `kdumpctl` also provides a sub-command:
 
-	`kdumpctl reset-crashkernel [--kernel=path_to_kernel] [--reboot]`
+	`kdumpctl reset-crashkernel [--kernel=path_to_kernel]`
 
 This command will reset the bootloader's kernel cmdline to the default value.
 It will also update bootloader config if the bootloader has a standalone config
 file. User will have to reboot the machine after this command to make it take
-effect if --reboot is not specified. For more details, please refer to the
-reset-crashkernel command in `man kdumpctl`.
+effect. For more details, please refer to the reset-crashkernel command in `man
+kdumpctl`.
 
 Reset manually
 --------------
diff --git a/SOURCES/dracut-kdump.sh b/SOURCES/dracut-kdump.sh
index f0619c0..19afbdb 100755
--- a/SOURCES/dracut-kdump.sh
+++ b/SOURCES/dracut-kdump.sh
@@ -17,8 +17,7 @@ KDUMP_PATH="/var/crash"
 KDUMP_LOG_FILE="/run/initramfs/kexec-dmesg.log"
 KDUMP_TEST_ID=""
 KDUMP_TEST_STATUS=""
-CORE_COLLECTOR=""
-DEFAULT_CORE_COLLECTOR="makedumpfile -l --message-level 7 -d 31"
+CORE_COLLECTOR="makedumpfile -l --message-level 7 -d 31"
 DMESG_COLLECTOR="/sbin/vmcore-dmesg"
 FAILURE_ACTION="systemctl reboot -f"
 DATEDIR=$(date +%Y-%m-%d-%T)
@@ -104,12 +103,25 @@ get_kdump_confs()
 		esac
 	done < "$KDUMP_CONF_PARSED"
 
-	if [ -z "$CORE_COLLECTOR" ]; then
-		CORE_COLLECTOR="$DEFAULT_CORE_COLLECTOR"
-		if is_ssh_dump_target || is_raw_dump_target; then
-			CORE_COLLECTOR="$CORE_COLLECTOR -F"
-		fi
-	fi
+	case $CORE_COLLECTOR in
+	    *makedumpfile*)
+	        # Ensure no -F in makedumpfile by default.
+	        CORE_COLLECTOR=$(echo "$CORE_COLLECTOR" | sed -e "s/-F//g")
+	        if is_ssh_dump_target || is_raw_dump_target; then
+	            CORE_COLLECTOR="$CORE_COLLECTOR -F"
+	        fi
+	        THREADS=$(nproc)
+	        if [ "$THREADS" -gt 1 ]; then
+	            case "$CORE_COLLECTOR" in
+	                *-F* | *-E*) ;;
+
+	               *)
+	                    CORE_COLLECTOR="$CORE_COLLECTOR --num-threads=$THREADS"
+	                    ;;
+	            esac
+	        fi
+	        ;;
+	esac
 }
 
 # store the kexec kernel log to a file.
@@ -136,13 +148,6 @@ dump_fs()
 		fi
 	fi
 
-	# Remove -F in makedumpfile case. We don't want a flat format dump here.
-	case $CORE_COLLECTOR in
-	*makedumpfile*)
-		CORE_COLLECTOR=$(echo "$CORE_COLLECTOR" | sed -e "s/-F//g")
-		;;
-	esac
-
 	if [ -z "$KDUMP_TEST_ID" ]; then
 		_dump_fs_path=$(echo "$1/$KDUMP_PATH/$HOST_IP-$DATEDIR/" | tr -s /)
 	else
diff --git a/SOURCES/dracut-kexec-crypt-setup.sh b/SOURCES/dracut-kexec-crypt-setup.sh
new file mode 100644
index 0000000..1a00ce5
--- /dev/null
+++ b/SOURCES/dracut-kexec-crypt-setup.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+LUKS_CONFIGFS_RESTORE=/sys/kernel/config/crash_dm_crypt_keys/restore
+RESTORED=1
+MAX_WAIT_TIME=10
+wait_time=0
+
+while [ $wait_time -lt $MAX_WAIT_TIME ]; do
+    [ -e $LUKS_CONFIGFS_RESTORE ] && break
+    sleep 1
+    wait_time=$((wait_time + 1))
+done
+
+if [ $wait_time -ge $MAX_WAIT_TIME ]; then
+    echo "$LUKS_CONFIGFS_RESTORE isn't ready after ${MAX_WAIT_TIME}s, something wrong!"
+    exit 1
+fi
+
+if ! grep -q "$RESTORED" "$LUKS_CONFIGFS_RESTORE"; then
+    echo $RESTORED > $LUKS_CONFIGFS_RESTORE
+fi
diff --git a/SOURCES/dracut-module-setup.sh b/SOURCES/dracut-module-setup.sh
index c32b381..9eec2d3 100755
--- a/SOURCES/dracut-module-setup.sh
+++ b/SOURCES/dracut-module-setup.sh
@@ -1145,6 +1145,59 @@ remove_cpu_online_rule() {
     sed -i '/SUBSYSTEM=="cpu"/d' "$file"
 }
 
+kdump_check_crypt_targets() {
+    local _devuuid _key_desc
+    declare -a _luks_devs
+
+    # Currently only x86_64 is supported
+    [[ "$(uname -m)" != "x86_64" ]] && return 1
+
+    mapfile -t _luks_devs < <(get_all_kdump_crypt_dev)
+
+    if [[ ${#_luks_devs[@]} -lt 1 ]]; then
+        return
+    fi
+
+    if [[ ! -d $LUKS_CONFIGFS ]]; then
+        dwarn "$LUKS_CONFIGFS not available"
+        return 1
+    fi
+
+    # This overrides behaviour of 90crypt
+    inst cryptsetup
+    instmods dm_crypt
+
+    echo > "$initdir/etc/cmdline.d/90crypt.conf"
+    echo > "$initdir/etc/crypttab"
+    echo > "${initdir}/sbin/crypt-run-generator"
+
+    # configfs is mounted after dracut pre-udev hook
+    # shellcheck disable=SC2154
+    inst_hook initqueue 20 "$moddir/kexec-crypt-setup.sh"
+
+    # shellcheck disable=SC2154
+    mkdir -p "$hookdir/initqueue/finished"
+    CRYPTSETUP_PATH=$(command -v cryptsetup)
+    for _devuuid in "${_luks_devs[@]}"; do
+        _key_desc=$LUKS_KEY_PRFIX$_devuuid
+        cat << EOF >> "${initdir}/etc/udev/rules.d/70-luks-kdump.rules"
+ENV{ID_FS_UUID}=="$_devuuid", \
+RUN+="/sbin/initqueue  --settled --unique --onetime --name kdump-crypt-target-%k \
+$CRYPTSETUP_PATH luksOpen --volume-key-keyring \
+%%user:$_key_desc \$env{DEVNAME} luks-$_devuuid"
+EOF
+    done
+
+    # latest systemd makes /usr read-only by default
+    mkdir -p "${initdir}/etc/systemd/system.conf.d"
+    cat << EOF > "${initdir}/etc/systemd/system.conf.d/kdump_luks.conf"
+[Manager]
+ProtectSystem=false
+EOF
+
+    dracut_need_initqueue
+}
+
 install() {
     declare -A unique_netifs ipv4_usage ipv6_usage
     local arch has_ovs_bridge is_nvmf
@@ -1183,6 +1236,7 @@ install() {
     inst "/usr/bin/printf" "/sbin/printf"
     inst "/usr/bin/logger" "/sbin/logger"
     inst "/usr/bin/chmod" "/sbin/chmod"
+    inst "/usr/bin/nproc" "/sbin/nproc"
     inst "/lib/kdump/kdump-lib-initramfs.sh" "/lib/kdump-lib-initramfs.sh"
     inst "/lib/kdump/kdump-logger.sh" "/lib/kdump-logger.sh"
     inst "$moddir/kdump.sh" "/usr/bin/kdump.sh"
@@ -1204,6 +1258,8 @@ install() {
 
     kdump_check_nvmf_target
 
+    kdump_check_crypt_targets
+
     kdump_install_systemd_conf
 
     # nfs/ssh dump will need to get host ip in second kernel and need to call 'ip' tool, see get_host_ip for more detail
diff --git a/SOURCES/kdump-lib-initramfs.sh b/SOURCES/kdump-lib-initramfs.sh
index e1b5d53..da52524 100755
--- a/SOURCES/kdump-lib-initramfs.sh
+++ b/SOURCES/kdump-lib-initramfs.sh
@@ -8,23 +8,62 @@ KDUMP_CONFIG_FILE="/etc/kdump.conf"
 FENCE_KDUMP_CONFIG_FILE="/etc/sysconfig/fence_kdump"
 FENCE_KDUMP_SEND="/usr/libexec/fence_kdump_send"
 LVM_CONF="/etc/lvm/lvm.conf"
+# shellcheck disable=SC2034
+LUKS_CONFIGFS=/sys/kernel/config/crash_dm_crypt_keys
+# shellcheck disable=SC2034
+LUKS_KEY_PRFIX="kdump-cryptsetup:vk-"
 
 # Read kdump config in well formated style
 kdump_read_conf()
 {
-	# Following steps are applied in order: strip trailing comment, strip trailing space,
-	# strip heading space, match non-empty line, remove duplicated spaces between conf name and value
-	[ -f "$KDUMP_CONFIG_FILE" ] && sed -n -e "s/#.*//;s/\s*$//;s/^\s*//;s/\(\S\+\)\s*\(.*\)/\1 \2/p" $KDUMP_CONFIG_FILE
+	kdump_get_conf_val ""
 }
 
 # Retrieves config value defined in kdump.conf
-# $1: config name, sed regexp compatible
+# $1: config name, if empty print full config
 kdump_get_conf_val()
 {
-	# For lines matching "^\s*$1\s+", remove matched part (config name including space),
-	# remove tailing comment, space, then store in hold space. Print out the hold buffer on last line.
-	[ -f "$KDUMP_CONFIG_FILE" ] &&
-		sed -n -e "/^\s*\($1\)\s\+/{s/^\s*\($1\)\s\+//;s/#.*//;s/\s*$//;h};\${x;p}" $KDUMP_CONFIG_FILE
+	_to_find="$1"
+	_found=""
+
+	[ -f "$KDUMP_CONFIG_FILE" ] || return
+
+	# On lines that are _not_ comments or empty remove...
+	# Note: The additional braces {} are required as piping into a while
+	# loop creates a sub-shell. So without the braces $_found would only be
+	# set inside the loop but empty outside of it.
+	grep -Ev -e '^\s*#' -e '^\s*$' "$KDUMP_CONFIG_FILE" | {
+		while read -r _opt _val; do
+			# ...trailing comments...
+			case "$_val" in
+			*\#*)
+				_val="${_val%%#*}"
+				_val="${_val%"${_val##*[![:space:]]}"}"
+				;;
+			esac
+
+			# ...quotes
+			case "$_val" in
+			\"*\")
+				_val="${_val#\"}"
+				_val="${_val%\"}"
+				;;
+			esac
+
+			if [ -z "$_to_find" ]; then
+				echo "$_opt $_val"
+			elif echo "$_opt" | grep -q -E "^($_to_find)$"; then
+				# make sure to only return the last match to
+				# mirror the old behavior
+				_found="$_val"
+			fi
+		done
+
+		[ -n "$_found" ] && echo "$_found"
+	}
+
+	# make sure we return 0 even when a option isn't set
+	return 0
 }
 
 is_mounted()
diff --git a/SOURCES/kdump-lib.sh b/SOURCES/kdump-lib.sh
index f31fc3e..fabdbe7 100755
--- a/SOURCES/kdump-lib.sh
+++ b/SOURCES/kdump-lib.sh
@@ -101,7 +101,7 @@ to_dev_name()
 
 is_user_configured_dump_target()
 {
-	[[ $(kdump_get_conf_val "ext[234]\|xfs\|btrfs\|minix\|raw\|nfs\|ssh\|virtiofs") ]] || is_mount_in_dracut_args
+	[[ $(kdump_get_conf_val "ext[234]|xfs|btrfs|minix|raw|nfs|ssh|virtiofs") ]] || is_mount_in_dracut_args
 }
 
 get_block_dump_target()
@@ -112,7 +112,7 @@ get_block_dump_target()
 		return
 	fi
 
-	_target=$(kdump_get_conf_val "ext[234]\|xfs\|btrfs\|minix\|raw\|virtiofs")
+	_target=$(kdump_get_conf_val "ext[234]|xfs|btrfs|minix|raw|virtiofs")
 	[[ -n $_target ]] && to_dev_name "$_target" && return
 
 	_target=$(get_dracut_args_target "$(kdump_get_conf_val "dracut_args")")
@@ -130,7 +130,7 @@ get_block_dump_target()
 
 is_dump_to_rootfs()
 {
-	[[ $(kdump_get_conf_val 'failure_action\|default') == dump_to_rootfs ]]
+	[[ $(kdump_get_conf_val 'failure_action|default') == dump_to_rootfs ]]
 }
 
 is_lvm2_thinp_dump_target()
@@ -1135,6 +1135,39 @@ _crashkernel_add()
 	echo "${ret%,}"
 }
 
+# Parses the kdump or fadump command line to extract a valid
+# positive nr_cpus=<N> value, defaulting to 1 if none is found.
+find_nr_cpus()
+{
+	local _cmdline_append
+	local _nr_cpus=1
+
+	# shellcheck disable=SC2153
+	if [[ $DEFAULT_DUMP_MODE == "fadump" ]]; then
+		_cmdline_append=$(grep '^\s*FADUMP_COMMANDLINE_APPEND\s*=' /etc/sysconfig/kdump | \
+			sed 's/^\s*FADUMP_COMMANDLINE_APPEND\s*=\s*"\(.*\)".*$/\1/')
+
+	else
+		_cmdline_append=$(grep '^\s*KDUMP_COMMANDLINE_APPEND\s*=' /etc/sysconfig/kdump | \
+			sed 's/^\s*KDUMP_COMMANDLINE_APPEND\s*=\s*"\(.*\)".*$/\1/')
+	fi
+
+	for arg in $_cmdline_append; do
+		case $arg in
+		nr_cpus=[0-9]*)
+			# Only accept if it's strictly digits after '='
+			value=${arg#nr_cpus=}
+			if [[ $value =~ ^[1-9][0-9]*$ ]]; then
+				_nr_cpus=$value
+			fi
+			;;
+		esac
+	done
+
+	ddebug "Configured nr_cpus=$_nr_cpus"
+	echo "$_nr_cpus"
+}
+
 # get default crashkernel
 # $1 dump mode, if not specified, dump_mode will be judged by is_fadump_capable
 # $2 kernel-release, if not specified, got by _get_kdump_kernel_version
@@ -1184,6 +1217,14 @@ kdump_get_arch_recommend_crashkernel()
 			has_mlx5 && ((_delta += 150))
 		fi
 	elif [[ $_arch == "ppc64le" ]]; then
+		local _per_cpu_area
+		local _nr_cpus
+
+		# 1MB per CPU
+		_per_cpu_area=1
+		_nr_cpus=$(find_nr_cpus)
+
+		_delta=$((_delta + _per_cpu_area * _nr_cpus))
 		if [[ $_dump_mode == "fadump" ]]; then
 			_ck_cmdline="4G-16G:768M,16G-64G:1G,64G-128G:2G,128G-1T:4G,1T-2T:6G,2T-4T:12G,4T-8T:20G,8T-16T:36G,16T-32T:64G,32T-64T:128G,64T-:180G"
 		else
@@ -1210,7 +1251,12 @@ kdump_get_arch_recommend_size()
 	get_recommend_size "$_sys_mem" "$_ck_cmdline"
 }
 
-# Print all underlying crypt devices of a block device
+maj_min_to_uuid()
+{
+	lsblk -no uuid,MAJ:MIN | awk -v dev="$1" 'NF==2 && $2 == dev {print $1}'
+}
+
+# Print all underlying crypt devices (UUID) of a block device
 # print nothing if device is not on top of a crypt device
 # $1: the block device to be checked in maj:min format
 get_luks_crypt_dev()
@@ -1221,7 +1267,7 @@ get_luks_crypt_dev()
 
 	_type=$(blkid -u filesystem,crypto -o export -- "/dev/block/$1" | \
 		sed -n -E "s/^TYPE=(.*)$/\1/p")
-	[[ $_type == "crypto_LUKS" ]] && echo "$1"
+	[[ $_type == "crypto_LUKS" ]] && maj_min_to_uuid "$1"
 
 	for _x in "/sys/dev/block/$1/slaves/"*; do
 		[[ -f $_x/dev ]] || continue
diff --git a/SOURCES/kdump-udev-throttler b/SOURCES/kdump-udev-throttler
index cd77a31..5d3a6d4 100755
--- a/SOURCES/kdump-udev-throttler
+++ b/SOURCES/kdump-udev-throttler
@@ -15,17 +15,27 @@
 
 throttle_lock="/var/lock/kdump-udev-throttle"
 
-exec 9>$throttle_lock
-if [ $? -ne 0 ]; then
-        echo "Failed to create the lock file! Fallback to non-throttled kdump service restart"
-        /bin/kdumpctl reload
-        exit 1
+LUKS_CONFIGFS_REUSE=/sys/kernel/config/crash_dm_crypt_keys/reuse
+reuse_luks_keys()
+{
+	[[ -f $LUKS_CONFIGFS_REUSE ]] || echo 1 > $LUKS_CONFIGFS_REUSE
+}
+
+unuse_luks_keys()
+{
+
+	[[ -f $LUKS_CONFIGFS_REUSE ]] || echo 0 > $LUKS_CONFIGFS_REUSE
+}
+
+if ! exec 9> $throttle_lock; then
+	echo "Failed to create the lock file! Fallback to non-throttled kdump service restart"
+	/bin/kdumpctl reload
+	exit 1
 fi
 
-flock -n 9
-if [ $? -ne 0 ]; then
-        echo "Throttling kdump restart for concurrent udev event"
-        exit 0
+if ! flock -n 9; then
+	echo "Throttling kdump restart for concurrent udev event"
+	exit 0
 fi
 
 # Wait for at least 1 second, at most 4 seconds for udev to settle
@@ -37,6 +47,8 @@ sleep 1 && udevadm settle --timeout 3
 # holding two locks at the same time and we might miss some events
 exec 9>&-
 
+reuse_luks_keys
 /bin/kdumpctl reload
+unuse_luks_keys
 
 exit 0
diff --git a/SOURCES/kdump.service b/SOURCES/kdump.service
index 406a790..01a02b1 100644
--- a/SOURCES/kdump.service
+++ b/SOURCES/kdump.service
@@ -12,6 +12,7 @@ ExecReload=/usr/bin/kdumpctl reload
 RemainAfterExit=yes
 StartLimitInterval=0
 PrivateTmp=yes
+KeyringMode=shared
 
 [Install]
 WantedBy=multi-user.target
diff --git a/SOURCES/kdump.sysconfig b/SOURCES/kdump.sysconfig
index a79fce9..c949b8a 100644
--- a/SOURCES/kdump.sysconfig
+++ b/SOURCES/kdump.sysconfig
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices novmcoredd cma=0 hugetlb_cma=0 kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices novmcoredd cma=0 hugetlb_cma=0 kfence.sample_interval=0 initramfs_options=size=90%"
 
 # Any additional kexec arguments required.  In most situations, this should
 # be left empty
diff --git a/SOURCES/kdump.sysconfig.aarch64 b/SOURCES/kdump.sysconfig.aarch64
index dd9e138..d6a0c5b 100644
--- a/SOURCES/kdump.sysconfig.aarch64
+++ b/SOURCES/kdump.sysconfig.aarch64
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices cgroup_disable=memory udev.children-max=2 panic=10 swiotlb=noforce novmcoredd cma=0 hugetlb_cma=0 kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices cgroup_disable=memory udev.children-max=2 panic=10 swiotlb=noforce novmcoredd cma=0 hugetlb_cma=0 kfence.sample_interval=0 initramfs_options=size=90%"
 
 # Any additional kexec arguments required.  In most situations, this should
 # be left empty
diff --git a/SOURCES/kdump.sysconfig.i386 b/SOURCES/kdump.sysconfig.i386
index 0089cd5..c65d76b 100644
--- a/SOURCES/kdump.sysconfig.i386
+++ b/SOURCES/kdump.sysconfig.i386
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices numa=off udev.children-max=2 panic=10 transparent_hugepage=never novmcoredd cma=0 hugetlb_cma=0 kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices numa=off udev.children-max=2 panic=10 transparent_hugepage=never novmcoredd cma=0 hugetlb_cma=0 kfence.sample_interval=0 initramfs_options=size=90%"
 
 # Any additional kexec arguments required.  In most situations, this should
 # be left empty
diff --git a/SOURCES/kdump.sysconfig.ppc64 b/SOURCES/kdump.sysconfig.ppc64
index 9d958ed..c2e4c69 100644
--- a/SOURCES/kdump.sysconfig.ppc64
+++ b/SOURCES/kdump.sysconfig.ppc64
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 noirqdistrib reset_devices cgroup_disable=memory numa=off udev.children-max=2 ehea.use_mcs=0 panic=10 kvm_cma_resv_ratio=0 transparent_hugepage=never novmcoredd hugetlb_cma=0 kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 noirqdistrib reset_devices cgroup_disable=memory numa=off udev.children-max=2 ehea.use_mcs=0 panic=10 kvm_cma_resv_ratio=0 transparent_hugepage=never novmcoredd hugetlb_cma=0 kfence.sample_interval=0 initramfs_options=size=90%"
 
 # Any additional kexec arguments required.  In most situations, this should
 # be left empty
diff --git a/SOURCES/kdump.sysconfig.ppc64le b/SOURCES/kdump.sysconfig.ppc64le
index a2d113f..f4041d7 100644
--- a/SOURCES/kdump.sysconfig.ppc64le
+++ b/SOURCES/kdump.sysconfig.ppc64le
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 noirqdistrib reset_devices cgroup_disable=memory numa=off udev.children-max=2 ehea.use_mcs=0 panic=10 kvm_cma_resv_ratio=0 transparent_hugepage=never novmcoredd hugetlb_cma=0 kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=16 noirqdistrib reset_devices cgroup_disable=memory numa=off udev.children-max=2 ehea.use_mcs=0 panic=10 kvm_cma_resv_ratio=0 transparent_hugepage=never novmcoredd hugetlb_cma=0 kfence.sample_interval=0 initramfs_options=size=90%"
 
 # This variable lets us append arguments to fadump (powerpc) capture kernel,
 # further to the parameters passed via the bootloader.
diff --git a/SOURCES/kdump.sysconfig.s390x b/SOURCES/kdump.sysconfig.s390x
index b50411a..b022468 100644
--- a/SOURCES/kdump.sysconfig.s390x
+++ b/SOURCES/kdump.sysconfig.s390x
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="nr_cpus=1 cgroup_disable=memory numa=off udev.children-max=2 panic=10 transparent_hugepage=never novmcoredd vmcp_cma=0 cma=0 hugetlb_cma=0 kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="nr_cpus=1 cgroup_disable=memory numa=off udev.children-max=2 panic=10 transparent_hugepage=never novmcoredd vmcp_cma=0 cma=0 hugetlb_cma=0 kfence.sample_interval=0 initramfs_options=size=90%"
 
 # Any additional /sbin/mkdumprd arguments required.
 MKDUMPRD_ARGS=""
diff --git a/SOURCES/kdump.sysconfig.x86_64 b/SOURCES/kdump.sysconfig.x86_64
index b972cc1..147742e 100644
--- a/SOURCES/kdump.sysconfig.x86_64
+++ b/SOURCES/kdump.sysconfig.x86_64
@@ -21,7 +21,7 @@ KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swio
 
 # This variable lets us append arguments to the current kdump commandline
 # after processed by KDUMP_COMMANDLINE_REMOVE
-KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 acpi_no_memhotplug transparent_hugepage=never nokaslr hest_disable novmcoredd cma=0 hugetlb_cma=0 pcie_ports=compat kfence.sample_interval=0"
+KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 acpi_no_memhotplug transparent_hugepage=never nokaslr hest_disable novmcoredd cma=0 hugetlb_cma=0 pcie_ports=compat kfence.sample_interval=0 initramfs_options=size=90%"
 
 # Any additional kexec arguments required.  In most situations, this should
 # be left empty
diff --git a/SOURCES/kdumpctl b/SOURCES/kdumpctl
index 1bdbb07..18dc06e 100755
--- a/SOURCES/kdumpctl
+++ b/SOURCES/kdumpctl
@@ -47,6 +47,7 @@ trap '
     ret=$?;
     is_mounted $TMPMNT && umount -f $TMPMNT;
     rm -rf "$KDUMP_TMPDIR"
+    [[ -d $LUKS_CONFIGFS ]] && find $LUKS_CONFIGFS/ -mindepth 1 -type d -delete
     exit $ret;
     ' EXIT
 
@@ -654,6 +655,8 @@ function load_kdump_kernel_key()
                 return
         fi
 
+	# %.ima keyring is writable to the user, no need to use
+	# "sudo -i keyctl"
 	keyctl padd asymmetric "" %:.ima < "/usr/share/doc/kernel-keys/$KDUMP_KERNELVER/kernel-signing-ppc.cer"
 }
 
@@ -677,6 +680,12 @@ load_kdump()
 		chcon -t boot_t "$KDUMP_KERNEL"
 	fi
 
+	if ! prepare_luks; then
+		derror "kexec: failed to prepare for a LUKS target"
+		return 1
+	fi
+
+	[[ ${KEYCTL_CMD[0]} == sudo ]] && KEXEC="sudo -i $KEXEC"
 	ddebug "$KEXEC $KEXEC_ARGS $standard_kexec_args --command-line=$KDUMP_COMMANDLINE --initrd=$TARGET_INITRD $KDUMP_KERNEL"
 
 	# shellcheck disable=SC2086
@@ -1051,6 +1060,135 @@ check_final_action_config()
 	fi
 }
 
+remove_luks_vol_keys()
+{
+	local _key_line _key_id _key_desc _status=1
+
+	# Get all keys from @u keyring and process each line
+	# sudo process by default only has the permission to list the keys
+	# stored in user keyring i.e. "sudo keyctl list" can work not
+	# "sudo keyctl unlink/show"
+	while read -r _key_line; do
+		# Skip header lines and empty lines
+		[[ $_key_line =~ ^[0-9]+: ]] || continue
+
+		# Extract key ID (first field before colon)
+		_key_id=${_key_line%%:*}
+
+		# Extract key description (everything after "logon: " or "user: ")
+		if [[ $_key_line =~ logon:\ (.+)$ ]]; then
+			_key_desc=${BASH_REMATCH[1]}
+		else
+			continue
+		fi
+
+		# Check if key description starts with LUKS_KEY_PRFIX
+		if [[ $_key_desc == "$LUKS_KEY_PRFIX"* ]]; then
+			"${KEYCTL_CMD[@]}" unlink "$_key_id"
+			_status=0
+		fi
+	done < <(keyctl list @u 2> /dev/null || true)
+
+	return $_status
+}
+
+_get_luks_key_by_unlock()
+{
+	local _devuuid=$1 _key_des=$2
+	local _max_retries
+	local _attempt=1
+
+	local _luks_unlock_cmd=""
+
+	# Check if stdin is a terminal.
+	if [ -t 0 ]; then
+		_max_retries=5
+		ddebug "Attempting to unlock LUKS device. You have $_max_retries attempts."
+	else
+		# Not a terminal (e.g., running as system service), so only try once
+		# for cases where volume key is sealed to TPM which doesn't need user
+		# interaction.
+		_max_retries=1
+		ddebug "Attempting to unlock LUKS device (non-interactive mode)..."
+	fi
+
+	while [ "$_attempt" -le "$_max_retries" ]; do
+		if cryptsetup open "UUID=$_devuuid" DUMMY "--link-vk-to-keyring=@u::%logon:$_key_des" --test-passphrase; then
+			ddebug "Success: LUKS device unlocked."
+			# For an interactive terminal, it's possible an user manually entered a passphrase
+			[ -t 0 ] && dwarn "If you typed passphrase to unlock it manually, please run 'kdumpctl setup-crypttab' (see man kdumpctl)."
+			return 0
+		fi
+		_attempt=$((_attempt + 1))
+	done
+
+	derror "Error: Could not unlock the LUKS device."
+	return 1
+}
+
+# Some users may use "sudo kdumpctl". sudo process by default inherits the
+# session keyring (@s) of the original user which means it can't read LUKS keys
+# stored in root's user (@u) which is only linked to root's session keyring.
+# So use "sudo -i keyctl" and "sudo kexec" automatically in order to be able to
+# search and read the LUKS key(s).
+KEYCTL_CMD=(keyctl)
+prepare_luks()
+{
+	local _key_id _key_des _luks_unlock_cmd
+	declare -a _luks_devs
+
+	# Use "sudo -i" to use the root's session keyring to access LUKS keys
+	if ! keyctl show @s | grep -qs "_uid.0$"; then
+		KEYCTL_CMD=(sudo -i keyctl)
+	fi
+
+	mapfile -t _luks_devs < <(get_all_kdump_crypt_dev)
+
+	if [[ ${#_luks_devs[@]} -lt 1 ]]; then
+		if remove_luks_vol_keys; then
+			dwarn "Encrypted device not in dump path, please drop the link-volume-key option in $CRYPTTAB_FILE"
+		fi
+		return 0
+	fi
+
+	# Currently only x86_64 is supported
+	if [[ "$(uname -m)" != "x86_64" ]]; then
+		dwarn "Warning: Encrypted device is in dump path, which is not recommended, see kexec-kdump-howto.txt for more details."
+		return 0
+	fi
+
+	if [[ ! -d $LUKS_CONFIGFS ]]; then
+		dwarn "$LUKS_CONFIGFS not available, please use a newer kernel or see kexec-kdump-howto.txt to make sure dumping to encrypted target will work."
+		remove_luks_vol_keys
+		return 0
+	fi
+
+	# For the case of CPU/memory hotplugging, we can reuse loaded keys
+	[[ $(cat $LUKS_CONFIGFS/reuse) == 1 ]] && return 0
+
+	for _devuuid in "${_luks_devs[@]}"; do
+		_key_dir=$LUKS_CONFIGFS/$_devuuid
+		_key_des=$LUKS_KEY_PRFIX$_devuuid
+		if _key_id=$("${KEYCTL_CMD[@]}" request logon "$_key_des" 2> /dev/null); then
+			ddebug "Succesfully get @u::%logon:$_key_des"
+		elif _get_luks_key_by_unlock "$_devuuid" "$_key_des"; then
+			if ! _key_id=$("${KEYCTL_CMD[@]}" request logon "$_key_des"); then
+				derror "Probably you are using 'sudo kdumpctl' or 'sudo su', please retry with 'sudo -i kdumpctl'"
+				return 1
+			fi
+			ddebug "Succesfully get @u::%logon:$_key_des after cryptsetup"
+		else
+			derror "Failed to get logon key $_key_des. Run 'kdumpctl restart' manually to start kdump."
+			return 1
+		fi
+
+		# Let the key expire after 300 seconds
+		"${KEYCTL_CMD[@]}" timeout "$_key_id" 300
+		mkdir "$_key_dir"
+		printf "%s" "$_key_des" > "$_key_dir"/description
+	done
+}
+
 start()
 {
 	if ! check_dump_feasibility; then
@@ -1097,6 +1235,112 @@ start()
 	dinfo "Starting kdump: [OK]"
 }
 
+# @description Updates a crypttab file to add the 'link-volume-key' option for kdump devices.
+#
+# It gets the list of kdump-related UUIDs by calling the 'get_all_kdump_crypt_dev' function.
+# The function is idempotent and performs pre-flight checks before making any modifications.
+#
+# @exitcode 0 If the update was successful or no changes were needed.
+# @exitcode 1 If there is an error (e.g. UUID mismatch).
+#
+# @stdout No output on success.
+# @stderr Progress and error messages are printed to stderr.
+CRYPTTAB_FILE=/etc/crypttab
+setup_crypttab()
+{
+	local _devuuid uuids_string temp_file
+	declare -a _luks_devs
+
+	if [[ "$(uname -m)" != "x86_64" ]]; then
+		dwarn "Currently only x86_64 supported"
+		return 0
+	fi
+
+	if [[ ! -f $CRYPTTAB_FILE ]]; then
+		dinfo "$CRYPTTAB_FILE doesn't exist, skip setup"
+		return 0
+	fi
+
+	mapfile -t _luks_devs < <(get_all_kdump_crypt_dev)
+	if [[ ${#_luks_devs[@]} -eq 0 ]]; then
+		dinfo "No LUKS-encrypted device found to process. Exiting."
+		return 0
+	fi
+
+	for _devuuid in "${_luks_devs[@]}"; do
+		if ! awk -v devuuid="$_devuuid" '!/^[[:space:]]*#/ && $2 == "UUID="devuuid { found=1; exit } END { exit !found }' "$CRYPTTAB_FILE"; then
+			derror "Device UUID=${_devuuid} doesn't exist."
+			return 1
+		fi
+	done
+
+	uuids_string="${_luks_devs[*]}"
+	temp_file=$(mktemp)
+
+	local status_updates
+
+	status_updates=$({
+		awk -v prefix="$LUKS_KEY_PRFIX" -v targets="$uuids_string" '
+    BEGIN {
+        split(targets, temp_arr, " ")
+        for (i in temp_arr) { target_uuids[temp_arr[i]] = 1 }
+    }
+    /^#|^$/ { print; next }
+    {
+        split($2, uuid_parts, "=")
+        current_uuid = uuid_parts[2]
+
+        if (current_uuid in target_uuids) {
+            target_option = "link-volume-key=@u::%logon:" prefix current_uuid
+
+            if (!index($0, target_option)) {
+                # If we need to modify, check if we are replacing or adding
+                if (index($0, "link-volume-key=")) {
+                    print "STATUS:REPLACED:" current_uuid > "/dev/stderr"
+                } else {
+                    print "STATUS:ADDED:" current_uuid > "/dev/stderr"
+                }
+
+                # Remove any existing, incorrect link-volume-key option
+                sub(/,?link-volume-key=[^, ]+/, "", $4)
+                sub(/^,/, "", $4)
+
+                # Add the correct option
+                if (NF < 3 || $3 == "") { $3 = "none" }
+                if ($4 == "" || $4 == "none") {
+                    $4 = target_option
+                } else {
+                    $4 = $4 "," target_option
+                }
+            }
+        }
+        print
+    }' "$CRYPTTAB_FILE" > "$temp_file"
+	} 2>&1)
+
+	if cmp -s "$CRYPTTAB_FILE" "$temp_file"; then
+		dinfo "No changes were needed. $CRYPTTAB_FILE is already up to date."
+		rm "$temp_file"
+		return 0
+	else
+		mv "$temp_file" "$CRYPTTAB_FILE"
+		restorecon "$CRYPTTAB_FILE"
+		dinfo "Success! $CRYPTTAB_FILE has been updated."
+
+		# Parse status updates and report on each changed UUID
+		while IFS=: read -r _ status uuid; do
+			if [[ $status == "ADDED" ]]; then
+				dinfo "   - Added link-volume-key for UUID: $uuid"
+			elif [[ $status == "REPLACED" ]]; then
+				dinfo "   - Replaced link-volume-key for UUID: $uuid"
+			fi
+		done < <(echo "$status_updates" | grep "STATUS:")
+		dinfo "If the dump target is rootfs and you call this command manually, you will need to run 'dracut -f --regenerate-all' to regenerate initramfs."
+
+		return 0
+	fi
+}
+
 reload()
 {
 	if ! is_kernel_loaded "$DEFAULT_DUMP_MODE"; then
@@ -1597,6 +1841,10 @@ reset_crashkernel()
 				_grubby_kernel_path=$_val
 				;;
 			--reboot)
+				# --reboot option was deprecated with
+				# kdump-utils v1.0.45. Keep the code for now to
+				# not break any user setup.
+				dwarn "Option --reboot is deprecated and will be removed in RHEL11."
 				_reboot=yes
 				;;
 			*)
@@ -2045,8 +2293,11 @@ main()
 			reset_crashkernel_for_installed_kernel "$2"
 		fi
 		;;
+	setup-crypttab)
+		setup_crypttab
+		;;
 	*)
-		dinfo $"Usage: $0 {estimate|start|stop|status|restart|reload|rebuild|reset-crashkernel|propagate|showmem|test}"
+		dinfo $"Usage: $0 {estimate|start|stop|status|restart|reload|rebuild|reset-crashkernel|propagate|showmem|test|setup-crypttab}"
 		exit 1
 		;;
 	esac
diff --git a/SOURCES/kdumpctl.8 b/SOURCES/kdumpctl.8
index 06a78e7..9b79978 100644
--- a/SOURCES/kdumpctl.8
+++ b/SOURCES/kdumpctl.8
@@ -53,7 +53,7 @@ based on the current kdump setup, and list some details of memory usage.
 .I get-default-crashkernel
 Return the default crashkernel value provided by kexec-tools.
 .TP
-.I reset-crashkernel [--kernel=path_to_kernel] [--reboot]
+.I reset-crashkernel [--kernel=path_to_kernel]
 Reset crashkernel to default value recommended by kexec-tools. If no kernel
 is specified, will reset KDUMP_KERNELVER if it's defined in /etc/sysconfig/kdump
 or the current running kernel's crashkernel value if KDUMP_KERNELVER is empty. You can
@@ -62,10 +62,6 @@ grubby's kernel-path=ALL and kernel-path=DEFAULT. ppc64le supports FADump and
 supports an additional [--fadump=[on|off|nocma]] parameter to toggle FADump
 on/off.
 
-If the optional parameter [--reboot] is provided the system will automatically
-reboot for changes to take effect. If no changes were made to the kernel
-command line the reboot is omitted.
-
 Note: The memory requirements for kdump varies heavily depending on the
 used hardware and system configuration. Thus the recommended
 crashkernel might not work for your specific setup. Please test if
@@ -80,6 +76,19 @@ by "kdumpctl status". Note, fadump is not supported.
 If the optional parameter [--force] is provided, there will be no confirmation
 before triggering the system crash. Dangerous though, this option is meant
 for automation testing.
+.TP
+.I setup-crypttab
+Add the 'link-volume-key' option to /etc/crypttab so vmcore can be saved to
+LUKS-encrypted disk volume. For more info on link-volume-key option,
+please "man crypttab".
+
+This step is optional. If kdump.service can start successfully, there is no
+need for this step. You can confirm if this step is needed by running
+"kdumpctl restart". If you need to input any passpharse to unlock the the
+encrypted volume, then please run "kdumpctl setup-crypttab".
+
+Note this subcommand is only helpful to x86_64 for now.
+
 .SH "SEE ALSO"
 .BR kdump.conf (5),
 .BR mkdumprd (8)
diff --git a/SOURCES/kexec-kdump-howto.txt b/SOURCES/kexec-kdump-howto.txt
index c65d45a..89a207c 100644
--- a/SOURCES/kexec-kdump-howto.txt
+++ b/SOURCES/kexec-kdump-howto.txt
@@ -882,16 +882,23 @@ or else kdump may not work as expeceted.
 Notes on encrypted dump target
 ------------------------------
 
-Currently, kdump is not working well with encrypted dump target.
-First, user have to give the password manually in capture kernel,
-so a working interactive terminal is required in the capture kernel.
+Currently, only x86_64 supports encrypted dump target. And depending on
+your setup, you may need to run "kdumpctl setup-crypttab" once in order
+for kdump.service to work on boot automatically next time. You can
+confirm if this step is needed by running "kdumpctl restart". If you have
+to input passphrase to unlock the encrypted volume, then please run 
+"kdumpctl setup-crypttab".
+
+For other architectures, kdump is not working well. First, user have
+to give the password manually in capture kernel, so a working
+interactive terminal is required in the capture kernel.
 And another major issue is that an OOM problem will occur with certain
 encryption setup. For example, the default setup for LUKS2 will use a
 memory hard key derivation function to mitigate brute force attach,
 it's impossible to reduce the memory usage for mounting the encrypted
 target. In such case, you have to either reserved enough memory for
-crash kernel according, or update your encryption setup.
-It's recommanded to use a non-encrypted target (eg. remote target)
+crash kernel accordingly, or update your encryption setup.
+It's recommended to use a non-encrypted target (eg. remote target)
 instead.
 
 Notes on device dump
@@ -928,10 +935,14 @@ For example:
 
 Notes on how to use multiple cpus on a capture kernel on x86 system:
 
-Make sure that you are using a kernel that supports disable_cpu_apicid
-kernel option as a capture kernel, which is needed to avoid x86 specific
-hardware issue (*). The disable_cpu_apicid kernel option is automatically
-appended by kdumpctl script and is ignored if the kernel doesn't support it.
+The disable_cpu_apicid kernel option is automatically appended by kdumpctl
+script to capture kernel to avoid x86 specific hardware issue and is ignored
+if the kernel doesn't support it. For newer kernels that contain commit
+5c5682b9f87a ("x86/cpu: Detect real BSP on crash kernels"), this hardware
+issue on x86 has been fixed in the kernel. However, adding disable_cpu_apicid
+is not harmful for newer kernels, and it is still added to the capture kernel
+to maintain backward compatibility with older kernels that do not contain
+commit 5c5682b9f87a.
 
 You need to specify how many cpus to be used in a capture kernel by specifying
 the number of cpus in nr_cpus kernel option in /etc/sysconfig/kdump. nr_cpus
@@ -941,9 +952,9 @@ You should use necessary and sufficient number of cpus on a capture kernel.
 Warning: Don't use too many cpus on a capture kernel, or the capture kernel
 may lead to panic due to Out Of Memory.
 
-(*) Without disable_cpu_apicid kernel option, capture kernel may lead to
-hang, system reset or power-off at boot, depending on your system and runtime
-situation at the time of crash.
+(*) Without the disable_cpu_apicid kernel option, a capture kernel that does
+not contain commit 5c5682b9f87a may hang, reset, or power-off at boot,
+depending on your system and runtime situation at the time of the crash.
 
 
 Debugging Tips
diff --git a/SOURCES/kexec-tools-2.0.29-makedumpfile-Fix-a-data-race-in-multi-threading-mode-num.patch b/SOURCES/kexec-tools-2.0.29-makedumpfile-Fix-a-data-race-in-multi-threading-mode-num.patch
new file mode 100644
index 0000000..9a2b900
--- /dev/null
+++ b/SOURCES/kexec-tools-2.0.29-makedumpfile-Fix-a-data-race-in-multi-threading-mode-num.patch
@@ -0,0 +1,120 @@
+From 65bf4c9ef0fd0cbf2fb99b60e15b00d984b391b8 Mon Sep 17 00:00:00 2001
+From: Tao Liu <ltao@redhat.com>
+Date: Wed, 25 Jun 2025 14:23:44 +1200
+Subject: [PATCH] [PATCH v2] Fix a data race in multi-threading mode
+ (--num-threads=N)
+
+A vmcore corrupt issue has been noticed in powerpc arch [1]. It can be
+reproduced with upstream makedumpfile.
+
+When analyzing the corrupt vmcore using crash, the following error
+message will output:
+
+    crash: compressed kdump: uncompress failed: 0
+    crash: read error: kernel virtual address: c0001e2d2fe48000  type:
+    "hardirq thread_union"
+    crash: cannot read hardirq_ctx[930] at c0001e2d2fe48000
+    crash: compressed kdump: uncompress failed: 0
+
+If the vmcore is generated without num-threads option, then no such
+errors are noticed.
+
+With --num-threads=N enabled, there will be N sub-threads created. All
+sub-threads are producers which responsible for mm page processing, e.g.
+compression. The main thread is the consumer which responsible for
+writing the compressed data into file. page_flag_buf->ready is used to
+sync main and sub-threads. When a sub-thread finishes page processing,
+it will set ready flag to be FLAG_READY. In the meantime, main thread
+looply check all threads of the ready flags, and break the loop when
+find FLAG_READY.
+
+page_flag_buf->ready is read/write by main/sub-threads simultaneously,
+but it is unprotected and unsafe. I have tested both mutex and atomic_rw
+can fix this issue. This patch takes atomic_rw for its simplicity.
+
+[1]: https://github.com/makedumpfile/makedumpfile/issues/15
+
+Resolves: https://github.com/makedumpfile/makedumpfile/issues/15
+Tested-by: Sourabh Jain <sourabhjain@linux.ibm.com>
+Signed-off-by: Tao Liu <ltao@redhat.com>
+---
+ makedumpfile.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/makedumpfile.c b/makedumpfile.c
+index 4e087ee..12fb0d8 100644
+--- a/makedumpfile-1.7.6/makedumpfile.c
++++ b/makedumpfile-1.7.6/makedumpfile.c
+@@ -8635,7 +8635,8 @@ kdump_thread_function_cyclic(void *arg) {
+ 
+ 		while (buf_ready == FALSE) {
+ 			pthread_testcancel();
+-			if (page_flag_buf->ready == FLAG_READY)
++			if (__atomic_load_n(&page_flag_buf->ready,
++					__ATOMIC_SEQ_CST) == FLAG_READY)
+ 				continue;
+ 
+ 			/* get next dumpable pfn */
+@@ -8651,7 +8652,8 @@ kdump_thread_function_cyclic(void *arg) {
+ 			info->current_pfn = pfn + 1;
+ 
+ 			page_flag_buf->pfn = pfn;
+-			page_flag_buf->ready = FLAG_FILLING;
++			__atomic_store_n(&page_flag_buf->ready, FLAG_FILLING,
++					__ATOMIC_SEQ_CST);
+ 			pthread_mutex_unlock(&info->current_pfn_mutex);
+ 			sem_post(&info->page_flag_buf_sem);
+ 
+@@ -8740,7 +8742,8 @@ kdump_thread_function_cyclic(void *arg) {
+ 			page_flag_buf->index = index;
+ 			buf_ready = TRUE;
+ next:
+-			page_flag_buf->ready = FLAG_READY;
++			__atomic_store_n(&page_flag_buf->ready, FLAG_READY,
++					__ATOMIC_SEQ_CST);
+ 			page_flag_buf = page_flag_buf->next;
+ 
+ 		}
+@@ -8869,7 +8872,8 @@ write_kdump_pages_parallel_cyclic(struct cache_data *cd_header,
+ 			 * current_pfn is used for recording the value of pfn when checking the pfn.
+ 			 */
+ 			for (i = 0; i < info->num_threads; i++) {
+-				if (info->page_flag_buf[i]->ready == FLAG_UNUSED)
++				if (__atomic_load_n(&info->page_flag_buf[i]->ready,
++						__ATOMIC_SEQ_CST) == FLAG_UNUSED)
+ 					continue;
+ 				temp_pfn = info->page_flag_buf[i]->pfn;
+ 
+@@ -8877,7 +8881,8 @@ write_kdump_pages_parallel_cyclic(struct cache_data *cd_header,
+ 				 * count how many threads have reached the end.
+ 				 */
+ 				if (temp_pfn >= end_pfn) {
+-					info->page_flag_buf[i]->ready = FLAG_UNUSED;
++					__atomic_store_n(&info->page_flag_buf[i]->ready,
++						FLAG_UNUSED, __ATOMIC_SEQ_CST);
+ 					end_count++;
+ 					continue;
+ 				}
+@@ -8899,7 +8904,8 @@ write_kdump_pages_parallel_cyclic(struct cache_data *cd_header,
+ 			 * If the page_flag_buf is not ready, the pfn recorded may be changed.
+ 			 * So we should recheck.
+ 			 */
+-			if (info->page_flag_buf[consuming]->ready != FLAG_READY) {
++			if (__atomic_load_n(&info->page_flag_buf[consuming]->ready,
++					__ATOMIC_SEQ_CST) != FLAG_READY) {
+ 				clock_gettime(CLOCK_MONOTONIC, &new);
+ 				if (new.tv_sec - last.tv_sec > WAIT_TIME) {
+ 					ERRMSG("Can't get data of pfn.\n");
+@@ -8941,7 +8947,8 @@ write_kdump_pages_parallel_cyclic(struct cache_data *cd_header,
+ 				goto out;
+ 			page_data_buf[index].used = FALSE;
+ 		}
+-		info->page_flag_buf[consuming]->ready = FLAG_UNUSED;
++		__atomic_store_n(&info->page_flag_buf[consuming]->ready,
++				FLAG_UNUSED, __ATOMIC_SEQ_CST);
+ 		info->page_flag_buf[consuming] = info->page_flag_buf[consuming]->next;
+ 	}
+ finish:
+-- 
+2.49.0
+
diff --git a/SOURCES/mkdumprd b/SOURCES/mkdumprd
index 77c3538..d4a7de4 100644
--- a/SOURCES/mkdumprd
+++ b/SOURCES/mkdumprd
@@ -359,24 +359,10 @@ check_resettable()
 	return 1
 }
 
-check_crypt()
-{
-	local _dev
-
-	for _dev in $(get_kdump_targets); do
-		if [[ -n $(get_luks_crypt_dev "$(get_maj_min "$_dev")") ]]; then
-			derror "Device $_dev is encrypted." && return 1
-		fi
-	done
-}
-
 if ! check_resettable; then
 	exit 1
 fi
 
-if ! check_crypt; then
-	dwarn "Warning: Encrypted device is in dump path, which is not recommended, see kexec-kdump-howto.txt for more details."
-fi
 
 # firstly get right SSH_KEY_LOCATION
 keyfile=$(kdump_get_conf_val sshkey)
diff --git a/SOURCES/supported-kdump-targets.txt b/SOURCES/supported-kdump-targets.txt
index 4ae0d59..8259ea4 100644
--- a/SOURCES/supported-kdump-targets.txt
+++ b/SOURCES/supported-kdump-targets.txt
@@ -49,6 +49,7 @@ storage:
         NVMe-FC (qla2xxx, lpfc)
         NVMe/TCP configured by NVMe Boot Firmware Table (users may need to
             increase the crashkernel value)
+        LUKS-encrypted volume (only x86_64 supported for now)
 
 network:
         Hardware using kernel modules: (igb, ixgbe, ice, i40e, e1000e, igc,
diff --git a/SPECS/kexec-tools.spec b/SPECS/kexec-tools.spec
index 7151a22..0ea8833 100644
--- a/SPECS/kexec-tools.spec
+++ b/SPECS/kexec-tools.spec
@@ -5,7 +5,7 @@
 
 Name: kexec-tools
 Version: 2.0.29
-Release: 10%{?dist}
+Release: 17%{?dist}
 License: GPLv2
 Summary: The kexec/kdump userspace component
 
@@ -60,6 +60,7 @@ Source106: dracut-kdump-capture.service
 Source107: dracut-kdump-emergency.target
 Source108: dracut-early-kdump.sh
 Source109: dracut-early-kdump-module-setup.sh
+Source110: dracut-kexec-crypt-setup.sh
 
 Source200: dracut-fadump-init-fadump.sh
 Source201: dracut-fadump-module-setup.sh
@@ -114,6 +115,7 @@ Requires:       systemd-udev%{?_isa}
 #
 # Patches 601 onward are generic patches
 #
+Patch601: kexec-tools-2.0.29-makedumpfile-Fix-a-data-race-in-multi-threading-mode-num.patch
 
 %description
 kexec-tools provides /sbin/kexec binary that facilitates a new
@@ -129,6 +131,8 @@ mkdir -p -m755 kcp
 tar -z -x -v -f %{SOURCE9}
 tar -z -x -v -f %{SOURCE19}
 
+%patch601 -p1
+
 %ifarch ppc
 %define archdef ARCH=ppc
 %endif
@@ -250,6 +254,7 @@ cp %{SOURCE102} $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpb
 cp %{SOURCE104} $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpbase/%{remove_dracut_prefix %{SOURCE104}}
 cp %{SOURCE106} $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpbase/%{remove_dracut_prefix %{SOURCE106}}
 cp %{SOURCE107} $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpbase/%{remove_dracut_prefix %{SOURCE107}}
+cp %{SOURCE110} $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpbase/%{remove_dracut_prefix %{SOURCE110}}
 chmod 755 $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpbase/%{remove_dracut_prefix %{SOURCE100}}
 chmod 755 $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99kdumpbase/%{remove_dracut_prefix %{SOURCE101}}
 mkdir -p -m755 $RPM_BUILD_ROOT/etc/kdump-adv-conf/kdump_dracut_modules/99earlykdump
@@ -283,8 +288,8 @@ servicelog_notify --add --command=/usr/lib/kdump/kdump-migrate-action.sh --match
 %endif
 
 # This portion of the script is temporary.  Its only here
-# to fix up broken boxes that require special settings 
-# in /etc/sysconfig/kdump.  It will be removed when 
+# to fix up broken boxes that require special settings
+# in /etc/sysconfig/kdump.  It will be removed when
 # These systems are fixed.
 
 if [ -d /proc/bus/mckinley ]
@@ -297,7 +302,7 @@ then
 elif [ -d /proc/sgi_sn ]
 then
 	# This is for SGI SN boxes
-	# They require the --noio option to kexec 
+	# They require the --noio option to kexec
 	# since they don't support legacy io
 	sed -e's/\(^KEXEC_ARGS.*\)\("$\)/\1 --noio"/' \
 	/etc/sysconfig/kdump > /etc/sysconfig/kdump.new
@@ -407,6 +412,46 @@ fi
 %endif
 
 %changelog
+* Fri Feb 13 2026 Pingfan Liu <piliu@redhat.com> - 2.0.29-17
+- Fix a data race in multi-threading mode (--num-threads=N)
+
+* Thu Jan 22 2026 Tao Liu <ltao@redhat.com> - 2.0.29-16
+- kexec-kdump-howto.txt: update paragraphs related to disable_cpu_apicid
+
+* Wed Jan 21 2026 Lichen Liu <lichliu@redhat.com> - 2.0.29-15
+- sysconfig: use initramfs_options to reduce memory usage
+- kdump-lib-initramfs: rewrite kdump_get_conf_val
+- kdump-lib-initramfs: Fix performance regression in kdump_get_conf_val
+
+* Tue Dec 23 2025 Pingfan Liu <piliu@redhat.com> - 2.0.29-14
+- powerpc: Set nr_cpus=16 for kdump kernel
+- powerpc: consider CPU count while calculating crashkernel value
+- Use all available CPUs to collect dump
+
+* Thu Dec 11 2025 Pingfan Liu <piliu@redhat.com> - 2.0.29-13
+- update 98-kexec rules for crash hotplug
+
+* Fri Nov 14 2025 Tao Liu <ltao@redhat.com> - 2.0.29-12
+- Allow "sudo kdumpctl" for LUKS dump target
+- Restore SELinux label of crypttab file
+- Allow kdump.service to access LUKS volume keys
+- Wait for LUKS configfs API to be ready
+- Change LUKS volume key prefix to kdump-cryptsetup:vk-
+- Remove unused LUKS volume keys from keyring
+- Limit LUKS support to x86_64
+- Add kdumpctl setup-crypttab subcommand
+- Return LUKS devices in the form of UUIDs directly
+- Fix SC2181 issues in kdump-udev-throttler
+- LUKS: make /usr writable
+- Address CPU/memory hot plugging for kdump LUKS support
+- shfmt kdump-udev-throttler
+- Use cryptsetup --link-vk-to-keyring to save volume keys
+- Support dumping to a LUKS-encrypted target
+- Add a helper function to get uuid by MAJ:MIN
+
+* Fri Oct 3 2025 Tao Liu <ltao@redhat.com> - 2.0.29-11
+- kdumpctl: deprecate --reboot for reset-creashkernel
+
 * Thu Aug 7 2025 Tao Liu <ltao@redhat.com> - 2.0.29-10
 - sysconfig: disable kfence in kdump kernel
 
@@ -1265,7 +1310,7 @@ fi
 - Revert "dracut-module-setup.sh: pass correct ip= param for ipv6"
 
 * Sat Apr 28 2018 Dave Young <dyoung@redhat.com> - 2.0.17-2
-- pull in makedumpfile 1.6.3 
+- pull in makedumpfile 1.6.3
 
 * Sat Apr 28 2018 Dave Young <dyoung@redhat.com> - 2.0.17-1
 - pull in 2.0.17
@@ -1325,10 +1370,10 @@ fi
 * Tue Aug 8 2017 Dave Young <dyoung@redhat.com> - 2.0.15-10
 - Improve 'cpu add' udev rules
 - module-setup: suppress the early iscsi error messages
-- mkdumprd: use 300s as the default systemd unit timeout for kdump mount 
+- mkdumprd: use 300s as the default systemd unit timeout for kdump mount
 
 * Mon Aug 7 2017 Dave Young <dyoung@redhat.com> - 2.0.15-9
-- fix makedumpfile bug 1474706 
+- fix makedumpfile bug 1474706
 
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.15-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
@@ -1484,9 +1529,9 @@ fi
 - module-setup: Use get_ifcfg_filename() to get the proper ifcfg file
 
 * Mon May 30 2016 Dave Young <dyoung@redhat.com> - 2.0.12-4
-- update kdump anaconda addon to add mem range in tui 
+- update kdump anaconda addon to add mem range in tui
 - .gitignore: Update to make it more generic
-- kdumpctl: check_rebuild improvement 
+- kdumpctl: check_rebuild improvement
 - kdumpctl: Do not rebuild initramfs when $KDUMP_BOOTDIR is read only
 
 * Tue Mar 29 2016 Dave Young <dyoung@redhat.com> - 2.0.12-3
@@ -1497,7 +1542,7 @@ fi
 - ppc64le: fix kexec hang due to ppc64 elf abi breakage
 
 * Tue Mar 22 2016 Dave Young <dyoung@redhat.com> - 2.0.12-1
-- Rebase kexec-tools to 2.0.12 
+- Rebase kexec-tools to 2.0.12
 
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.11-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
@@ -1510,7 +1555,7 @@ fi
 - fix bogus date in changelog
 
 * Thu Nov 19 2015 Dave Young <dyoung@redhat.com> - 2.0.11-2
-- Rebase to upstream makedumpfile 1.5.9 
+- Rebase to upstream makedumpfile 1.5.9
 
 * Mon Nov 9 2015 Dave Young <dyoung@redhat.com> - 2.0.11-1
 - Rebase to upstream kexec-tools 2.0.11
@@ -1520,7 +1565,7 @@ fi
 - Remove duplicate prefix path ${initdir}
 
 * Tue Sep 8 2015 Dave Young <dyoung@redhat.com> - 2.0.10-8
-- update kdump addon to fix a kickstart installationi issue 
+- update kdump addon to fix a kickstart installationi issue
 
 * Wed Aug 19 2015 Dave Young <dyoung@redhat.com> - 2.0.10-7
 - add man page for kdumpctl
@@ -1862,7 +1907,7 @@ fi
 
 * Thu Mar 14 2013 Baoquan He <bhe@redhat.com> - 2.0.3-69
 - Support for eppic language as a subpackage
- 
+
 * Thu Mar 14 2013 Baoquan He <bhe@redhat.com> - 2.0.3-68
 - tune sysconfig to save memory usage
 - Remove useless codes related to LOGGER in kdumpctl
@@ -1989,7 +2034,7 @@ fi
 - do not add fstab-sys module in dracut cmdline
 - omit dash module
 - network dns config fix
-- shell exit value fix 
+- shell exit value fix
 
 * Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.3-52
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
@@ -2316,7 +2361,7 @@ fi
 - Make makedumpfile a dynamic binary
 
 * Mon Jul 06 2009 Neil Horman <nhorman@redhat.com> 2.0.0-19
-- Fix build issue 
+- Fix build issue
 
 * Mon Jul 06 2009 Neil Horman <nhorman@redhat.com> 2.0.0-18
 - Updated initscript to use mkdumprd2 if manifest is present
@@ -2528,7 +2573,7 @@ fi
 - updating mkdumprd to use new kcp syntax
 
 * Wed Aug 23 2006 Neil Horman <nhorman@redhat.com> - 1.101-48
-- Bumping revision number 
+- Bumping revision number
 
 * Tue Aug 22 2006 Jarod Wilson <jwilson@redhat.com> - 1.101-47
 - ppc64 no-more-platform fix
@@ -2548,7 +2593,7 @@ fi
 
 * Tue Aug 15 2006 Neil Horman <nhorman@redhat.com> - 1.101-44
 - updated init script to implement status function/scrub err messages
- 
+
 * Wed Aug 09 2006 Jarod Wilson <jwilson@redhat.com> - 1.101-43
 - Misc spec cleanups and macro-ifications
 
@@ -2556,13 +2601,13 @@ fi
 - Add %%dir /var/crash, so default kdump setup works
 
 * Thu Aug 03 2006 Neil Horman <nhorman@redhat.com> - 1.101-41
-- fix another silly makefile error for makedumpfile 
+- fix another silly makefile error for makedumpfile
 
 * Thu Aug 03 2006 Neil Horman <nhorman@redhat.com> - 1.101-40
-- exclude makedumpfile from build on non-x86[_64] arches 
+- exclude makedumpfile from build on non-x86[_64] arches
 
 * Thu Aug 03 2006 Neil Horman <nhorman@redhat.com> - 1.101-39
-- exclude makedumpfile from build on non-x86[_64] arches 
+- exclude makedumpfile from build on non-x86[_64] arches
 
 * Thu Aug 03 2006 Neil Horman <nhorman@redhat.com> - 1.101-38
 - updating makedumpfile makefile to use pkg-config on glib-2.0
@@ -2659,7 +2704,7 @@ fi
 
 * Wed Nov 16 2005 Thomas Graf <tgraf@redhat.com> - 1.101-5
 - Report missing kdump kernel image as warning
- 
+
 * Thu Nov  3 2005 Jeff Moyer <jmoyer@redhat.com> - 1.101-4
 - Build for x86_64 as well.  Kdump support doesn't work there, but users
   should be able to use kexec.