Enabling Protected Processor Identification Number (PPIN) on Lenovo ThinkSystem Servers

Both Intel and AMD processors all have serial number assigned to them, known as the Protected Processor Identification Number (PPIN). This number makes it easy to identify a specific CPU, which is particularly useful in troubleshooting scenarios.

PPIN is calculated based on the physical characteristics of different chips and added in the factory using fuses on the silicon die. Fuses are one-time programmable devices on a chip used to configure or set specific functionalities during the chip manufacturing process. Once set, the fuses cannot be altered, ensuring PPIN uniqueness and security within the same CPU series. However, the uniqueness of the PPIN number is only guaranteed within the same series of CPUs. In different CPU series, PPIN numbers may be duplicated. PPIN is unique to physical cores, logical cores on the same physical core share the same PPIN.

The algorithm developed by CPU vendors calculates a unique PPIN number based on the hardware characteristics of the processor and other factors. Typically, the generated PPIN is linked to the processor's unique serial number.

The software can communicate with the processor through specific instructions or interfaces and request to obtain the PPIN number. This usually requires the operating system or application program to provide corresponding functional interfaces. Through the specified interface, the software can read the PPIN number from the processor.

Linux kernel version 5.18 and later introduces a new sysfs interface to acquire PPIN number. Users can acquire PPIN by reading /sys/devices/system/cpu/cpuX/topology/ppin when enabling PPIN feature.

The PPIN feature can be enabled by following steps:

1. In System Setup (F1 at boot), enter the UEFI System Configuration and Boot Management as shown in Figure 1:

   
   Figure 1. Boot Management in Lenovo System Setup

2. From the BIOS setup menu path, select System Information > AMD CBS GN > CPU Common Options and set PPIN Opt-in to Enable to enable the PPIN feature as shown in Figure 2.

   
   Figure 2. PPIN feature in Lenovo System Setup

3. Save your changes and exit the UEFI System Configuration menu.
4. Once the kernel boots up, you can acquire each of processor’s PPIN number by reading the kernel sysfs interface at /sys/devices/system/cpu/cpuX/topology/ppin. Each processor has own unique PPIN number.

   Alternatively, you can acquire it via XCC/XCC2 using OneCLI commands. See the following page for details:
   https://pubs.lenovo.com/sr630-v3/enable_intel_on_demand#reading-ppin

Note: In some platform, PPIN Opt-in is hidden, it is enabled by default.

PPIN working model is shown as in Figure 3.

Figure 3. PPIN working model

At the hardware level, when PPIN is enabled, the PPIN algorithm generates PPIN based on hardware features and stores it in efuse. When the CPU powers on, this is directly reflected in the CPU's MSR registers.

At the kernel level, during CPU initialization, the kernel reads the values from the MSR registers and stores PPIN into the software cpuinfo_x86 structure. The PPIN in this structure is then provided to the created sysfs and MCE (Machine Check Error) software components.

At the user level, PPIN can be obtained through both active and passive methods. In the active method, users can retrieve PPIN by reading /sys/device/system/cpu/cpuX/topology/ppin. In the passive method, MCE generally adopts a passive approach. When the system detects an error, it triggers MCE and inputs PPIN information into MCE log files. However, this paper mainly describes how to obtain PPIN using the active method.

The Linux kernel supports PPIN starting from Version 5.18.

All ThinkSystem servers with Intel Xeon Scalable processors or AMD EPYC processors support PPIN.

If you cannot acquire PPIN number under the /sys/devices/system/cpu/cpuX/topology/ppin, you can use the following steps to do troubleshooting.

1. Check kernel version

   Use the command uname -a to check whether your kernel version >= 5.18. If not, upgrade kernel please.

2. Check CPU platform

   Use  lscpu command to check whether your CPU platform supports PPIN feature. For Intel platform, it needs Xeon or later platforms to support this feature. For AMD platform, it needs EPYC or later platforms.

3. Check whether PPIN feature is enabled

   For Intel if PPIN feature is enabled, lscpu | grep ppin has the intel_ppin flag as shown in Figure 4:

   
   Figure 4. CPU flags for Intel ppin

   For AMD, if PPIN feature is enabled, lscpu | grep ppin has the amd_ppin flag as shown in Figure 5:

   
   Figure 5. CPU flags for AMD ppin

For more information, see the following web pages:

• Linux kernel 5.18
  https://kernelnewbies.org/Linux_5.18
• Convenient Intel PPIN Reporting To Come With Linux 5.18
  https://www.phoronix.com/news/Intel-PPIN-Linux-5.18
• AMD Plumbing Linux Support For Reading The CPU's Protected Processor Identification Number (PPIN)
  https://www.phoronix.com/news/AMD-PPIN-Processor-ID-Linux

Dong Wang is a Linux engineer in the Lenovo Infrastructure Solution Group in Beijing, China.

Thanks to the following people for their contributions to this project:

• Adrian Huang, Lenovo OS engineer, Lenovo ISG, Taiwan