[RFC PATCH 0/2] random: tracing: Expose last boot ID on persistent instance

[RFC PATCH 0/2] random: tracing: Expose last boot ID on persistent instance

[Masami Hiramatsu (Google)]

Hi,

Here is an RFC series to expose the boot ID (random UUID for each
boot) in the last_boot_info of the persistent ring buffer instance.

The persistent ring buffer can hold trace data beyond reboot/crashes.
This means the recorded data does not always come from the last boot.
Currently we just assume that the data comes from the last boot.

On the other hand, the kernel provides a random generated UUID for
each boot time, called "boot ID". If you record the logs with the
boot ID, it is easy to do cross-referencing it with other logs.

Similarly, recording the Boot ID for persistent ring buffer
instances would make it easier to determine which boot the read
data came from.

For example:

 # cat /proc/sys/kernel/random/boot_id
 df152e7a-c0a7-4d32-9f0b-7f5c39fb7b68

(enable tracing on persistent instance and reboot)

 # cat /sys/kernel/tracing/instances/ptracingtest/last_boot_info
# boot_id: df152e7a-c0a7-4d32-9f0b-7f5c39fb7b68
ffffffff81000000       [kernel]


Thank you,

---

Masami Hiramatsu (Google) (2):
      random: Expose boot ID to other subsystems
      tracing: Record and show boot ID in last_boot_info


 drivers/char/random.c  |   27 +++++++++++++++++++++------
 include/linux/random.h |    9 +++++++++
 kernel/trace/trace.c   |   14 ++++++++++++--
 3 files changed, 42 insertions(+), 8 deletions(-)

--
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[RFC PATCH 1/2] random: Expose boot ID to other subsystems

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Add get_boot_id() to expose current boot ID to other kernel subsystems.
Note that since this is only meaningful if user can access it via sysctl,
it returns NULL if CONFIG_SYSCTL=n.

Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 drivers/char/random.c  |   27 +++++++++++++++++++++------
 include/linux/random.h |    9 +++++++++
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index b4da1fb976c1..96a5a165627a 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1615,6 +1615,25 @@ static int sysctl_random_write_wakeup_bits = POOL_READY_BITS;
 static int sysctl_poolsize = POOL_BITS;
 static u8 sysctl_bootid[UUID_SIZE];
 
+/**
+ * get_boot_id - return the boot ID UUID
+ *
+ * This function returns a pointer to the boot ID UUID, which is generated on
+ * demand the first time this function is called. The boot ID is a UUID that
+ * is unique to each boot of the system.
+ */
+const u8 *get_boot_id(void)
+{
+	static DEFINE_SPINLOCK(bootid_spinlock);
+
+	spin_lock(&bootid_spinlock);
+	if (!sysctl_bootid[8])
+		generate_random_uuid(sysctl_bootid);
+	spin_unlock(&bootid_spinlock);
+
+	return sysctl_bootid;
+}
+
 /*
  * This function is used to return both the bootid UUID, and random
  * UUID. The difference is in whether table->data is NULL; if it is,
@@ -1638,12 +1657,8 @@ static int proc_do_uuid(const struct ctl_table *table, int write, void *buf,
 		uuid = tmp_uuid;
 		generate_random_uuid(uuid);
 	} else {
-		static DEFINE_SPINLOCK(bootid_spinlock);
-
-		spin_lock(&bootid_spinlock);
-		if (!uuid[8])
-			generate_random_uuid(uuid);
-		spin_unlock(&bootid_spinlock);
+		/* Ensure that the boot ID is initialized. */
+		get_boot_id();
 	}
 
 	snprintf(uuid_string, sizeof(uuid_string), "%pU", uuid);
diff --git a/include/linux/random.h b/include/linux/random.h
index 8a8064dc3970..aaf630f14931 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -130,6 +130,15 @@ static inline int get_random_bytes_wait(void *buf, size_t nbytes)
 	return ret;
 }
 
+#ifdef CONFIG_SYSCTL
+const u8 *get_boot_id(void);
+#else
+static inline const u8 *get_boot_id(void)
+{
+	return NULL;
+}
+#endif
+
 #ifdef CONFIG_SMP
 int random_prepare_cpu(unsigned int cpu);
 int random_online_cpu(unsigned int cpu);

Re: [RFC PATCH 1/2] random: Expose boot ID to other subsystems

[Jason A. Donenfeld]

On Thu, May 21, 2026 at 11:57:09PM +0900, Masami Hiramatsu (Google) wrote:
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> Add get_boot_id() to expose current boot ID to other kernel subsystems.
> Note that since this is only meaningful if user can access it via sysctl,
> it returns NULL if CONFIG_SYSCTL=n.

Wouldn't this be nice to have even on !SYSCTL systems? Why disable it for this
case?

> +/**
> + * get_boot_id - return the boot ID UUID
> + *
> + * This function returns a pointer to the boot ID UUID, which is generated on
> + * demand the first time this function is called. The boot ID is a UUID that
> + * is unique to each boot of the system.
> + */
> +const u8 *get_boot_id(void)
> +{
> +	static DEFINE_SPINLOCK(bootid_spinlock);
> +
> +	spin_lock(&bootid_spinlock);
> +	if (!sysctl_bootid[8])
> +		generate_random_uuid(sysctl_bootid);
> +	spin_unlock(&bootid_spinlock);
> +
> +	return sysctl_bootid;
> +}
> +
>  /*
>   * This function is used to return both the bootid UUID, and random
>   * UUID. The difference is in whether table->data is NULL; if it is,
> @@ -1638,12 +1657,8 @@ static int proc_do_uuid(const struct ctl_table *table, int write, void *buf,
>  		uuid = tmp_uuid;
>  		generate_random_uuid(uuid);
>  	} else {
> -		static DEFINE_SPINLOCK(bootid_spinlock);
> -
> -		spin_lock(&bootid_spinlock);
> -		if (!uuid[8])
> -			generate_random_uuid(uuid);
> -		spin_unlock(&bootid_spinlock);
> +		/* Ensure that the boot ID is initialized. */
> +		get_boot_id();

I find this a little odd, this implicit behavior now that sysctl_bootid ==
uuid. But perhaps that's the cleanest approach there is?

[RFC PATCH 2/2] tracing: Record and show boot ID in last_boot_info

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Record the boot ID (random UUID for each boot) when tracing on the
persistent ring buffer and show it in the last_boot_info file.
User can use this boot ID when cross-referencing it with other logs.

For example:

  # cat /proc/sys/kernel/random/boot_id
 df152e7a-c0a7-4d32-9f0b-7f5c39fb7b68

 (enable tracing on persistent instance and reboot)

  # cat /sys/kernel/tracing/instances/ptracingtest/last_boot_info
 # boot_id: df152e7a-c0a7-4d32-9f0b-7f5c39fb7b68
 ffffffff81000000	[kernel]

 Thus, if user saves the other logs with this boot_id,
 user can easily find the appropriate logs.

Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 kernel/trace/trace.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 6eb4d3097a4d..c56694bb5e0c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -34,10 +34,12 @@
 #include <linux/percpu.h>
 #include <linux/splice.h>
 #include <linux/kdebug.h>
+#include <linux/random.h>
 #include <linux/string.h>
 #include <linux/mount.h>
 #include <linux/rwsem.h>
 #include <linux/slab.h>
+#include <linux/uuid.h>
 #include <linux/ctype.h>
 #include <linux/init.h>
 #include <linux/panic_notifier.h>
@@ -4804,6 +4806,7 @@ struct trace_mod_entry {
 struct trace_scratch {
 	unsigned int		clock_id;
 	unsigned long		text_addr;
+	u8			boot_id[UUID_SIZE];
 	unsigned long		nr_entries;
 	struct trace_mod_entry	entries[];
 };
@@ -4921,6 +4924,7 @@ static void update_last_data(struct trace_array *tr)
 	/* Reset the module list and reload them */
 	if (tr->scratch) {
 		struct trace_scratch *tscratch = tr->scratch;
+		const u8 *boot_id = get_boot_id();
 
 		tscratch->clock_id = tr->clock_id;
 		memset(tscratch->entries, 0,
@@ -4929,6 +4933,11 @@ static void update_last_data(struct trace_array *tr)
 
 		guard(mutex)(&scratch_mutex);
 		module_for_each_mod(save_mod, tr);
+		/* Also, update boot ID if exists */
+		if (boot_id)
+			memcpy(tscratch->boot_id, boot_id, sizeof(tscratch->boot_id));
+		else
+			memset(tscratch->boot_id, 0, sizeof(tscratch->boot_id));
 	}
 
 	/*
@@ -5822,9 +5831,10 @@ static void show_last_boot_header(struct seq_file *m, struct trace_array *tr)
 	 * Otherwise it shows the KASLR address from the previous boot which
 	 * should not be the same as the current boot.
 	 */
-	if (tscratch && (tr->flags & TRACE_ARRAY_FL_LAST_BOOT))
+	if (tscratch && (tr->flags & TRACE_ARRAY_FL_LAST_BOOT)) {
+		seq_printf(m, "# boot_id: %pUb\n", tscratch->boot_id);
 		seq_printf(m, "%lx\t[kernel]\n", tscratch->text_addr);
-	else
+	} else
 		seq_puts(m, "# Current\n");
 }
 

Re: [RFC PATCH 2/2] tracing: Record and show boot ID in last_boot_info

[Steven Rostedt]

On Thu, 21 May 2026 23:57:16 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> @@ -4804,6 +4806,7 @@ struct trace_mod_entry {
>  struct trace_scratch {
>  	unsigned int		clock_id;
>  	unsigned long		text_addr;
> +	u8			boot_id[UUID_SIZE];
>  	unsigned long		nr_entries;
>  	struct trace_mod_entry	entries[];
>  };

I just don't like wasting scratch space if boot_id isn't defined. But I
can't figure out a way to optionally have it there without wasting space
anyway.

If the get_boot_id() is accepted by the random folks, then I'm fine with
this change.

-- Steve

Re: [RFC PATCH 2/2] tracing: Record and show boot ID in last_boot_info

[Masami Hiramatsu]

On Thu, 21 May 2026 11:16:30 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Thu, 21 May 2026 23:57:16 +0900
> "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> 
> > @@ -4804,6 +4806,7 @@ struct trace_mod_entry {
> >  struct trace_scratch {
> >  	unsigned int		clock_id;
> >  	unsigned long		text_addr;
> > +	u8			boot_id[UUID_SIZE];
> >  	unsigned long		nr_entries;
> >  	struct trace_mod_entry	entries[];
> >  };
> 
> I just don't like wasting scratch space if boot_id isn't defined. But I
> can't figure out a way to optionally have it there without wasting space
> anyway.

Yeah, it needs to be placed in the scratch area or ring-buffer meta page.
In most cases the boot_id is enabled (random subsystem seems to provide
this UUID always), so it will be rarely waste of memory except
CONFIG_SYSCTL=n.

> 
> If the get_boot_id() is accepted by the random folks, then I'm fine with
> this change.

Yeah, BTW, Sashiko found this can be initialized before we get enough
entropy for random seed. Maybe we need one more delay.

Thank you,


> 
> -- Steve


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [RFC PATCH 2/2] tracing: Record and show boot ID in last_boot_info

[Steven Rostedt]

On Sun, 24 May 2026 10:44:39 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:

> > If the get_boot_id() is accepted by the random folks, then I'm fine with
> > this change.  
> 
> Yeah, BTW, Sashiko found this can be initialized before we get enough
> entropy for random seed. Maybe we need one more delay.

Well, maybe for adding the boot_id later, but the code that initializes the
buffers needs to stay early. With the backup instance, the persistent ring
buffer can restart tracing immediately.

-- Steve

Re: [RFC PATCH 2/2] tracing: Record and show boot ID in last_boot_info

[Masami Hiramatsu]

On Thu, 28 May 2026 16:36:33 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Sun, 24 May 2026 10:44:39 +0900
> Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:
> 
> > > If the get_boot_id() is accepted by the random folks, then I'm fine with
> > > this change.  
> > 
> > Yeah, BTW, Sashiko found this can be initialized before we get enough
> > entropy for random seed. Maybe we need one more delay.
> 
> Well, maybe for adding the boot_id later, but the code that initializes the
> buffers needs to stay early. With the backup instance, the persistent ring
> buffer can restart tracing immediately.

Agreed, so the buffer will be made in early stage without initializing
the boot_id field, and it will be updated when user reads the boot_id
from kernel. Anyway, without reading boot_id from user space, it is
meaningless.

Thank you,


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [RFC PATCH 0/2] random: tracing: Expose last boot ID on persistent instance

[Mathieu Desnoyers]

On 2026-05-21 10:56, Masami Hiramatsu (Google) wrote:
> Hi,
> 
> Here is an RFC series to expose the boot ID (random UUID for each
> boot) in the last_boot_info of the persistent ring buffer instance.
> 
> The persistent ring buffer can hold trace data beyond reboot/crashes.
> This means the recorded data does not always come from the last boot.
> Currently we just assume that the data comes from the last boot.
> 
> On the other hand, the kernel provides a random generated UUID for
> each boot time, called "boot ID". If you record the logs with the
> boot ID, it is easy to do cross-referencing it with other logs.
> 
> Similarly, recording the Boot ID for persistent ring buffer
> instances would make it easier to determine which boot the read
> data came from.
> 
> For example:
> 
>   # cat /proc/sys/kernel/random/boot_id
>   df152e7a-c0a7-4d32-9f0b-7f5c39fb7b68
> 
> (enable tracing on persistent instance and reboot)
> 
>   # cat /sys/kernel/tracing/instances/ptracingtest/last_boot_info
> # boot_id: df152e7a-c0a7-4d32-9f0b-7f5c39fb7b68
> ffffffff81000000       [kernel]
> 

FWIW, we've used boot id to uniquely identify traces belonging
to a given kernel execution and allow validation that traces
can indeed be correlated across CPU and across kernel vs userspace
for years in LTTng.

Good to see this approach proposed for Ftrace as well.

Thanks,

Mathieu

> 
> Thank you,
> 
> ---
> 
> Masami Hiramatsu (Google) (2):
>        random: Expose boot ID to other subsystems
>        tracing: Record and show boot ID in last_boot_info
> 
> 
>   drivers/char/random.c  |   27 +++++++++++++++++++++------
>   include/linux/random.h |    9 +++++++++
>   kernel/trace/trace.c   |   14 ++++++++++++--
>   3 files changed, 42 insertions(+), 8 deletions(-)
> 
> --
> Masami Hiramatsu (Google) <mhiramat@kernel.org>


-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com