Multinode hubs for trusted computing

TECHNICAL FIELD

0001The present disclosure relates generally to the field of trusted computing, and more particularly, to multinode hubs for trusted computing.

BACKGROUND

0002Trusted Platform Module (TPM) hardware is used in many computing devices to provide a root of trust for operation of the device. TPM hardware is typically implemented as a discrete chipset, and one TPM hardware unit is associated with each coherent computing node of an integrated circuit (IC) package. Traditional IC packages have only included a single coherent computing node (and consequently a single TPM chipset); however, some current and future packages may include two, four or more coherent computing nodes. Including discrete TPM chipsets for each node in a multinode IC package may occupy a large device footprint and require significant resources, which may limit the benefits of including multiple nodes in an IC package. Existing TPM chipsets, however, interface with only a single node, and thus existing systems are constrained to duplicate such TPM chipsets in a multinode package.

BRIEF DESCRIPTION OF THE DRAWINGS

0003Embodiments will be readily understood by the following detailed description in conjunction with the accompanying drawings. To facilitate this description, like reference numerals designate like structural elements. Embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings.

0004<figref idref="DRAWINGS">FIG. 1</figref> is a block diagram of a computing system including a multinode hub, in accordance with various embodiments.

0005<figref idref="DRAWINGS">FIG. 2</figref> is a block diagram of an illustrative coherent computing node, in accordance with various embodiments.

0006<figref idref="DRAWINGS">FIG. 3</figref> depicts an illustrative memory region, in accordance with various embodiments.

0007<figref idref="DRAWINGS">FIG. 4</figref> is a block diagram of an illustrative TPM component, in accordance with various embodiments.

0008<figref idref="DRAWINGS">FIG. 5</figref> is a flow diagram of an illustrative process for providing initialization information to a multinode hub, in accordance with various embodiments.

0009<figref idref="DRAWINGS">FIG. 6</figref> is a flow diagram of an illustrative process for monitoring for accesses to memory regions, in accordance with various embodiments.

0010<figref idref="DRAWINGS">FIG. 7</figref> is a flow diagram of an illustrative process for processing trust operation data from multiple coherent computing nodes by a TPM module, in accordance with various embodiments.

0011<figref idref="DRAWINGS">FIG. 8</figref> is a block diagram of an example computing platform that may be suitable for practicing the disclosed embodiments

DETAILED DESCRIPTION

0012Embodiments of multinode hubs for trust operations are disclosed herein. In some embodiments, a multinode hub may include a plurality of memory regions, a trapping module, and a trusted platform module (TPM) component. Each memory region may be associated with and receive trust operation data from a coherent computing node. The trapping module may generate trap notifications in response to accesses to the plurality of memory regions by the associated coherent computing nodes. The trap notifications may indicate which of the plurality of memory locations has been accessed, and the TPM component may process the trust operation data in a memory region indicated by a trap notification.

0013Various embodiments of the multinode hubs disclosed herein may provide a trusted computing solution in a platform controller hub that scales sustainably with the number of coherent computing nodes in an IC package. In particular, various embodiments disclosed herein overcome the inability of existing TPMs to operate with more than one coherent computing node. This inability is based at least in part on the interfaces between existing TPMs and nodes (e.g., low pin count (LPC), serial peripheral interface (SPI) and enhanced SPI (eSPI)), which are not operable beyond a single coherent link. Consequently, implementing TPM functionality in multinode packages using conventional approaches may require duplicating TPM chipsets for each node in the package.

0014In some embodiments, the multinode hubs disclosed herein may multiplex an embedded security processor (e.g., the TPM component <b>110</b> discussed below) in a system-on-a-chip (SoC), rack scale architecture for the cloud, or micro server at apology. Additionally, embodiments of the multinode hubs disclosed herein may appear, from the perspective of a coherent computing node, to be a TPM dedicated to that coherent computing node (even though the TPM functionality may be shared among multiple coherent computing nodes). The multinode hubs disclosed herein may be implemented as part of an overall security architecture that uses TPM functionality that many stages along the device pathway (e.g., from server to handheld). In some embodiments, the multinode hubs may provide buffers for each of multiple nodes and protection of secrets between the nodes for rack scale architecture, microserver topologies and others. The multinode hubs and related techniques disclosed herein may improve the resilience of computing systems to malicious attack by enabling tamper detection in an efficient manner.

0015In the following detailed description, reference is made to the accompanying drawings which form a part hereof wherein like numerals designate like parts throughout, and in which is shown by way of illustration embodiments that may be practiced. It is to be understood that other embodiments may be utilized and structural or logical changes may be made without departing from the scope of the present disclosure. Therefore, the following detailed description is not to be taken in a limiting sense, and the scope of embodiments is defined by the appended claims and their equivalents.

0016Various operations may be described as multiple discrete actions or operations in turn, in a manner that is most helpful in understanding the claimed subject matter. However, the order of description should not be construed as to imply that these operations are necessarily order dependent. In particular, these operations may not be performed in the order of presentation. Operations described may be performed in a different order than the described embodiment. Various additional operations may be performed and/or described operations may be omitted in additional embodiments.

0017For the purposes of the present disclosure, the phrase “A and/or B” means (A), (B), or (A and B). For the purposes of the present disclosure, the phrase “A, B, and/or C” means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B and C).

0018The description uses the phrases “in an embodiment,” or “in embodiments,” which may each refer to one or more of the same or different embodiments. Furthermore, the terms “comprising,” “including,” “having,” and the like, as used with respect to embodiments of the present disclosure, are synonymous. As used herein, the terms “module” or “component” may refer to, be part of, or include an Application Specific Integrated Circuit (ASIC), an electronic circuit, a processor (shared, dedicated, or group) and/or memory (shared, dedicated, or group) that executes one or more software or firmware programs, a combinational logic circuit, and/or other suitable components that provide the described functionality. As used herein, a “TPM” may refer to components of a computing device that may improve the security of operations of the computing device by performing cryptographic operations, recording measurements of platform components (e.g., the Basic Input/Output Operating System (BIOS), hypervisors, or other software components). As used herein, “BIOS” may refer to an interface between an operating system and platform firmware, and may include Unified Extensible Firmware Interface (UEFI).

0019<figref idref="DRAWINGS">FIG. 1</figref> is a block diagram of a computing system <b>100</b> including a multinode hub <b>120</b>, in accordance with various embodiments. The computing system <b>100</b> may include multiple coherent computing nodes <b>102</b><i>a</i>-<i>n</i>, which may be coupled with the multinode hub <b>120</b>. As used herein, “n” may represent any desired integer value greater than or equal to two. References to a “coherent computing node <b>102</b>” may refer to any one or more of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. Although various elements of the computing system <b>100</b> may be discussed below and illustrated in <figref idref="DRAWINGS">FIG. 1</figref> as discrete elements, various elements may be combined or rearranged as suitable. For example, in some embodiments, the memory regions <b>104</b><i>a</i>-<i>n </i>may be included in the TPM component <b>110</b>. In some embodiments, the trapping module <b>106</b> may be included in the TPM component <b>110</b>. These examples are simply illustrative, and any combination or rearrangement consistent with the techniques disclosed herein may be implemented.

0020In some embodiments, the multinode hub <b>120</b> may be implemented at least in part in firmware programmed into appropriate hardware. For example, in some embodiments, firmware associated with the multinode hub <b>120</b> may be disposed in a non-re-writable memory. In some embodiments, firmware associated with the multinode hub <b>120</b> may be included in a UEFI Platform Initialization (PI) System Management Mode (SMM) driver, as discussed in additional detail below.

0021As shown in <figref idref="DRAWINGS">FIG. 1</figref>, individual coherent computing nodes <b>102</b><i>a</i>-<i>n </i>may be coupled with associated memory regions <b>104</b><i>a</i>-<i>n </i>of the multinode hub <b>120</b> via associated communication links <b>112</b><i>a</i>-<i>n</i>, respectively. References to a “memory region <b>104</b>” or a “communication link <b>112</b>” may refer to any one or more of the memory regions <b>104</b><i>a</i>-<i>n </i>or the communication links <b>112</b><i>a</i>-<i>n</i>, respectively. The memory regions <b>104</b><i>a</i>-<i>n </i>may receive trust operation data from the associated coherent computing nodes <b>102</b><i>a</i>-<i>n </i>via the associated communication links <b>112</b><i>a</i>-<i>n</i>. In some embodiments, each of the communication links <b>112</b><i>a</i>-<i>n </i>may include one or more serial or parallel buses enabling communication between the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>and the memory regions <b>104</b><i>a</i>-<i>n</i>. The memory regions <b>104</b><i>a</i>-<i>n </i>may be contiguous blocks of memory in a common memory device, discontiguous blocks of memory, distributed among a single or multiple memory devices, or distributed in any suitable manner.

0022The memory regions <b>104</b><i>a</i>-<i>n </i>may receive trust operation data from the associated coherent computing nodes <b>102</b><i>a</i>-<i>n </i>in any of a number of ways. For example, in some embodiments, a memory region <b>104</b> may receive trust operation data from an operating system (OS) of the associated coherent computing node <b>102</b>. In some embodiments, a memory region <b>104</b> may receive trust operation data from the associated coherent computing node <b>102</b> via a Direct Memory Access (DMA) transfer from the associated coherent computing node <b>102</b>.

0023In some embodiments, each coherent computing node <b>102</b> may include an Advanced Configuration and Power Interface (ACPI) table, which may include a base address of the associated memory region <b>104</b>, as discussed in additional detail below. In some embodiments, the memory regions <b>104</b><i>a</i>-<i>n </i>may be DMA buffers allocated by the BIOS of the associated coherent computing nodes <b>102</b><i>a</i>-<i>n</i>, respectively. In some embodiments, the memory regions <b>104</b><i>a</i>-<i>n </i>may be secured from each other. For example, in some embodiments, security may be achieved by implementing channels on a per coherent computing node or per context basis (e.g., each coherent computing node and/or context may be paired with a channel by suitable hardware). In some embodiments, the multinode hub <b>120</b> may encrypt each secret with a different seed key or apply page table protections. Such embodiments may be advantageous when processors included in the multinode hub <b>120</b> support such features (e.g., an x86 processor).

0024The memory regions <b>104</b><i>a</i>-<i>n </i>may be coupled with a trapping module <b>106</b>. The trapping module <b>106</b> may be configured to generate trap notifications in response to accesses to the memory regions <b>104</b><i>a</i>-<i>n </i>by the associated coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. For example, in some embodiments, the trapping module <b>106</b> may detect an attempt by the coherent computing node <b>102</b><i>a </i>to write data to the memory region <b>104</b><i>a </i>and may “doorbell” this attempt to the TPM component <b>110</b> (which may trigger the TPM component <b>110</b> to process the written data, as discussed below). In some embodiments, as illustrated in <figref idref="DRAWINGS">FIG. 1</figref>, the trapping module <b>106</b> may include trap hardware <b>108</b><i>a</i>-<i>n</i>. Each of the trap hardware <b>108</b><i>a</i>-<i>n </i>may be associated with a different one of the memory regions <b>104</b><i>a</i>-<i>n</i>, and may be configured to detect accesses to the associated memory regions <b>104</b><i>a</i>-<i>n </i>by the associated coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some embodiments, a trap notification generated by the trapping module <b>106</b> may indicate which of the memory regions <b>104</b><i>a</i>-<i>n </i>has been accessed. In some embodiments, the trapping module <b>106</b> may be a low level kernel driver that oversees all communication going to the TPM component <b>110</b>. In some embodiments, the trapping module <b>106</b> may use hardware interrupts or a filter driver.

0025In some embodiments, the trapping module <b>106</b> may include a chip having a number of readable and writable registers that may be used to specify a set of input/output (I/O) cycles to be trapped and to enable the trapping functionality. In some embodiments, accesses to the memory regions <b>104</b><i>a</i>-<i>n </i>may be trapped by hardware in the multinode hub <b>120</b> may be notified. These notifications may include an indication of the coherent computing node <b>102</b> that accessed the corresponding memory region <b>104</b>.

0026In some embodiments, the trapping module <b>106</b> may be included in or in communication with a legacy block (not shown). A legacy block may include one or more hardware blocks that support platform features for any number of previous hardware configurations. Examples of hardware blocks that may be included in a legacy block include LPC interface hardware (traditionally used to communicate with hardware TPMs) and input/output (I/O) advanced programmable interrupt controller (APIC) hardware. In some such embodiments, the trapping module <b>106</b> may detect and trap attempts to invoke TPM-related functions using legacy configurations, and route these attempts to the TPM component <b>110</b> for appropriate processing. This may enable the use of the multinode hubs <b>120</b> disclosed herein with legacy hardware (e.g., LPC-based hardware or Trusted Execution Technology hardware for validating the integrity of BIOS or hypervisors).

0027In some embodiments, the multinode hub <b>120</b> may receive notification of other actions of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. For example, the multinode hub <b>120</b> may receive notification of power state transitions (e.g., S<b>0</b>, S<b>3</b>, S<b>5</b>, etc.) of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. This may allow the multinode hub <b>120</b> to avoid improper power state transitions (e.g., improperly sending the coherent computing node <b>102</b><i>a </i>to power state S<b>5</b> while also sending the coherent computing node <b>102</b><i>b </i>to power state S<b>5</b>).

0028The trapping module <b>106</b> may be coupled with a trusted platform module (TPM) component <b>110</b>. The TPM component <b>110</b> may be configured to perform trust-related operations as specified by the Trusted Computing Group standard or any other desired operation. For example, the TPM component <b>110</b> may be configured to perform the operations performed by hardware-based TPMs (e.g., the TPM chipsets discussed above). In some embodiments, the TPM component <b>110</b> may be configured in accordance with the Platform Trust Technology standard.

0029In the multinode hub <b>120</b>, the TPM component <b>110</b> may be configured to process trust operation data in response to trap notifications. In particular, the TPM component <b>110</b> may be configured to process trust operation data from a memory region (e.g., of the memory regions <b>104</b><i>a</i>-<i>n</i>) indicated in the trap notification as accessed by an associated coherent computing node (e.g., of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>).

0030The TPM component <b>110</b> may process the trust operation data from a memory region <b>104</b> in any of a number of ways. For example, in some embodiments, the TPM component <b>110</b> may verify an integrity of a BIOS of the coherent computing node <b>102</b> associated with the memory region <b>104</b>. The TPM component <b>110</b> may verify a launch of a hypervisor by the coherent computing node <b>102</b> associated with the memory region <b>104</b>. These trust operation data processing examples are simply illustrative, and the TPM component <b>110</b> may perform remote attestation, the sealing of secrets, drive encryption, password protection, and providing the root of trust for the computing system <b>100</b>, among other operations. In some embodiments, the TPM component <b>110</b> may include a memory used by the TPM component <b>110</b> to process trust operation data from memory regions <b>104</b> associated with two or more different coherent computing nodes <b>102</b>, as discussed in additional detail below.

0031In some embodiments, the TPM component <b>110</b> may return results of trust operation data processing to appropriate ones of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some embodiments, the TPM component <b>110</b> may return these results to the memory regions <b>104</b><i>a</i>-<i>n</i>. For example, when the TPM component <b>110</b> processes trust operation data from the memory region <b>104</b><i>a</i>, the TPM component <b>110</b> may return the results of the trust operation data processing to the memory region <b>104</b><i>a </i>(e.g., to a command-response buffer of the memory region <b>104</b><i>a</i>, as discussed below with reference to <figref idref="DRAWINGS">FIG. 3</figref>). In some embodiments, the TPM component <b>110</b> may return the results of trust operation data processing to the memory regions <b>104</b><i>a</i>-<i>n </i>through one or more general-purpose DMA (GPDMA) transfer (not illustrated in <figref idref="DRAWINGS">FIG. 1</figref>). In some embodiments, the multinode hub <b>120</b> may include a different GPDMA pathway between the TPM component <b>110</b> and each of the memory regions <b>104</b><i>a</i>-<i>n</i>. As noted above, in some embodiments, the memory regions <b>104</b><i>a</i>-<i>n </i>may be BIOS allocated DMA buffers.

0032In some embodiments, the trapping module <b>106</b> may be configured to trap block or trap (e.g., transmit a trap notification to the TPM component <b>110</b> indicating the access of a memory location <b>104</b> but preventing the contents submitted to the memory location <b>104</b> from being stored in the memory location <b>104</b>). In some embodiments, the trapping module <b>106</b> may be configured to write through (e.g., the trap notification may be transmitted to the TPM component <b>110</b> concurrently with writing data to the memory location <b>104</b>). In some embodiments, the trapping module <b>106</b> may be configured to trap and drain (e.g., transmit a trap notification to the TPM component <b>110</b> and eventually allowing the contents submitted to the memory location <b>104</b> to be stored in the memory location <b>104</b>). In various embodiments, notification and storage of data in the memory location <b>1</b><b>4</b> may be synchronous (e.g., upon notification, the data may be written to the memory location <b>104</b> so that the TPM component <b>110</b> may operate on the data).

0033The components of the computing system <b>100</b> may be distributed among one or more hardware elements in any of a number of ways. For example, in some embodiments, the multinode hub <b>120</b> may be included in an integrated circuit (IC) package along with two or more of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some embodiments, the multinode hub <b>120</b> may be included in an IC package that is separate from a package including at least one of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some embodiments, the multinode hub <b>120</b> may be included in an IC package that is separate from one or more packages including all of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. For example, the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>in such embodiments may include one or more microserver systems-on-a-chip (SoCs). In some such embodiments, the communication links <b>112</b><i>a</i>-<i>n </i>and may be configured to support Enhanced Serial Peripheral Interface (eSPI), Inter-Integrated Circuit (I2C)/System Management Bus (SMBus), alert and error pins, Platform Environment Control Interface (PECI), Peripheral Component Interconnect Express (PCIe), Universal Asynchronous Receiver/Transmitter (UART), or any other desired communication protocol.

0034In some embodiments, one or more components of the multinode hub <b>120</b> may be included in a manageability engine (ME). In some embodiments, the ME may be a Converged Security and Manageability Engine (CSME) having firmware included in a non-re-writable memory so that it cannot be tampered with by third parties. This may be desirable for maintaining the integrity of one or more components of the multinode hub <b>120</b> (e.g., the TPM component <b>110</b>). In some embodiments, one or more components of the multinode hub <b>120</b> may be included in an innovation engine (IE) having re-writable memory to allow the inclusion of desired code by third parties. In some embodiments, processors included in the multinode hub <b>120</b> may have architectures that enable task isolation, page tables, data isolation and related functionality (e.g., x86 processors or ARM processors).

0035As noted above, in some embodiments, firmware associated with the multinode hub <b>120</b> may be included in a UEFI PI SMM driver or other macrocode firmware. Such embodiments may be useful in low power applications (e.g., low power SoC applications) in which it is not feasible, desired, or necessary to use an additional processor for the multinode hub <b>120</b>. In such embodiments, virtualization may be used to provide multiple OS functionality, if desired, but may not be needed to implement other functionality of the multinode hub <b>120</b>.

0036In some embodiments, the multinode hub <b>120</b> may provide a single hardware/firmware implementation of TPM functionality that may support all of the components of a Field Replaceable Unit (FRU) without compromising the measurement and/or attestation performance that would be provided by multiple discrete TPM chipsets. In some embodiments, the multinode hub <b>120</b> may isolate operations at a per-node, per-OS context instantiation. This may enable secure computing for coherent computing nodes that are capable of dynamic switching of OS contexts. For example, if the coherent computing node <b>102</b><i>a </i>supports dynamic switching of OS contexts between a first OS (e.g., Microsoft WINDOWS) and a second OS (e.g., Google ANDROID), the multinode hub <b>120</b> may be configured to perform trust operations for the first and second OSs. The multinode hub <b>120</b> may be configured to identify the OS requesting me trust operation due to the different signatures of different OSs. The OS identity may also be determined via ACPI (e.g., by using the _OSI method). Once the coherent computing node <b>102</b> and the particular OS are identified, a TPM instance for the node and OS may be created. In some embodiments, the multinode hub <b>120</b> may provide trust functionality for servers (e.g., rack scale architecture or microservers) as they switch from OS contexts that handle and-user workloads to service partitions for maintenance, and vice versa.

0037Various embodiments of the coherent computing node <b>102</b>, the memory region <b>104</b>, and the TPM component <b>110</b> are now discussed.

0038<figref idref="DRAWINGS">FIG. 2</figref> is a block diagram of an illustrative coherent computing node <b>102</b>, in accordance with various embodiments. One or more of the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>of <figref idref="DRAWINGS">FIG. 1</figref> may include some or all of the components of the coherent computing node <b>102</b> illustrated in <figref idref="DRAWINGS">FIG. 2</figref>.

0039As illustrated, the coherent computing node <b>102</b> may include a BIOS <b>202</b>, and OS <b>210</b>, and applications <b>220</b>. The BIOS <b>202</b> may include core BIOS <b>204</b>, a TPM EFI driver <b>206</b>, and an Authentication Control Module (ACM) <b>208</b>. In various embodiments, the BIOS <b>210</b> and its components may be implemented as firmware. The core BIOS <b>204</b> may test system components and initiate the loading of the OS <b>210</b>. The TPM EFI driver <b>206</b> may be configured to communicate with the TPM component <b>110</b>. For example, the TPM EFI driver <b>206</b> may be configured to enable communication between the BIOS <b>202</b> and a host controller interface of the TPM component <b>110</b> (e.g., the interface <b>414</b>, discussed below). The ACM <b>208</b> may be a digitally signed component embedded in the coherent computing node <b>102</b> (e.g., by the manufacture of a chipset of the coherent computing node <b>102</b>) configured to measure code of the BIOS <b>202</b> during secure startup. In some embodiments, the ACM <b>208</b> may itself be measured by a processor of the coherent computing node <b>102</b> prior to the ACM <b>208</b> measuring code of the BIOS <b>202</b>.

0040The OS <b>210</b> may include an OS boot loader <b>212</b>, TPM Base Services (TBS) <b>216</b>, ACPI Methods <b>214</b>, and a TPM driver <b>218</b>. In various embodiments, the OS <b>210</b> and its components may be implemented as hardware configured with suitable software. The OS boot loader <b>212</b> may load the OS <b>210</b> after completion of any scheduled self-tests, and may be in communication with the core BIOS <b>204</b>. The TBS <b>216</b> may manage and schedule TPM access for multiple applications in the OS <b>210</b>, and may provide services as an application programming interface (API) through remote procedure calls. The ACPI Methods <b>214</b> may provide operations for configuring and querying hardware. The TPM driver <b>218</b> may enable communication between the OS <b>210</b> and the TPM component <b>110</b>. In some embodiments, the TPM driver <b>218</b> may be invoked by the TBS <b>216</b>. In some embodiments, the TPM driver <b>218</b> may be embodied in a TPM.sys file.

0041In some embodiments, before the OS <b>210</b> is booted, the BIOS <b>202</b> may initialize a TPM interface with a base address for an associated memory region and additional information relevant to the coherent computing node <b>102</b> and/or the associated memory region. For example, the BIOS <b>202</b> may allocate a DMA base address for the coherent computing node <b>102</b>, and may pass that base address along with the additional information to the multinode hub <b>120</b> (where it may be stored). In some embodiments, the coherent computing node <b>120</b> may enumerate its assigned memory region via an ACPI table populated to that coherent computing node <b>120</b> by its BIOS <b>202</b>. In particular, the ACPI table may include the base address of the memory region (e.g., the DMA buffer) associated with the coherent computing node <b>102</b>. Various embodiments of this functionality are discussed below with reference to <figref idref="DRAWINGS">FIG. 5</figref>.

0042The applications <b>220</b> may include one or more hypervisors/virtual machines (VMs) <b>222</b>, communications applications <b>224</b>, and other applications <b>226</b>. In some embodiments, the applications <b>220</b> may be measured by the TPM component <b>110</b> and/or may request trust operations be performed by the TPM component <b>110</b>. In various embodiments, the TPM component <b>110</b> may reside underneath hypervisor's war VMs, and may also be a part of a virtualized TPM agent.

0043<figref idref="DRAWINGS">FIG. 3</figref> depicts an illustrative memory region <b>104</b>, in accordance with various embodiments. The memory region <b>104</b> may include a control area <b>302</b> and a command-response buffer <b>304</b>. Although the control area <b>302</b> and the command-response buffer <b>304</b> are illustrated as contiguous, this need not be the case; the control area <b>302</b> and the command-response buffer <b>304</b> may be distributed among various memory devices and locations in any suitable manner.

0044A coherent computing node <b>102</b> may submit a command to the TPM component <b>110</b> by writing the command to the command-response buffer <b>304</b>, and may issue a write to a protocol by writing to the control area <b>302</b>. For example, the command submitted to the TPM component <b>110</b> may be TPM_Seal. Upon writing the command of TPM_Seal to the command area of the command-response buffer <b>304</b>, the trapping module <b>106</b> may trap the write, notify the multinode hub <b>120</b> and provide the instance of memory location, contents (TPM_Seal), OS instance, and identity of the accessing coherent computing node node <b>102</b>. The multinode hub <b>120</b> may then act upon the command and resume control back after updating the response.

0045In some embodiments, accesses by a coherent computing node <b>102</b> to the control area <b>302</b> may be trapped by the trapping module <b>106</b> (which may include separate trap hardware <b>108</b> for different coherent computing nodes <b>102</b>). The trapping module <b>106</b> may generate a trap notification in response to the access to the control area <b>302</b>, which may signal to the TPM component <b>110</b> that the associated coherent computing node <b>102</b> has a command ready to process. In some embodiments, the control area <b>302</b> and the command-response buffer may be configured in accordance with the TPM <b>2</b>.<b>0</b> and/or any other suitable specification.

0046<figref idref="DRAWINGS">FIG. 4</figref> is a block diagram of an illustrative TPM component <b>110</b>, in accordance with various embodiments. In some embodiments, the TPM component <b>110</b> may be implemented as firmware. As noted above, in some embodiments, the TPM component <b>110</b> may be implemented as or included in an ME.

0047The TPM component <b>110</b> may include an interface <b>414</b>, one or more processing devices <b>402</b>, and a memory <b>404</b>. The interface <b>414</b> may enable communication between the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>and the TPM component <b>110</b>. In some embodiments, the trapping module <b>106</b> may be included in the interface <b>414</b>. In some embodiments, the identity of a coherent computing node <b>102</b> may be derived from information annotated at a platform baseboard and strapped accordingly (e.g., analogously to dual in-line memory module (DIMM) slot ID).

0048In some embodiments, the one or more processing devices <b>402</b> may include a microcontroller. The selection of a microcontroller for use in the TPM component <b>110</b> may depend upon the desired speed of data processing. As many common trust operations may not be particularly computationally intensive (e.g., measuring trust, secrets, integrity, and tamper detection), slower processing devices may be used without sacrificing performance. For example, in some embodiments, x86 or ARM processors may be suitable (and may be advantageous due to their support of page table isolation).

0049In response to the trapping module <b>106</b> generating a trap notification, the TPM component <b>110</b> may process a requested command from a coherent computing node <b>120</b> based on the trust operation data provided to the associated memory region <b>104</b>. For example, in some embodiments in which the coherent computing node <b>102</b> writes to the control area <b>302</b>, the TPM component <b>110</b> may DMA-in the command from the command-response buffer <b>304</b>, process the command, and then DMA-out the result to the command-response buffer <b>304</b>. The TPM component <b>110</b> may also DMA a “command complete” message to the control area <b>302</b>. During this time, the coherent computing node <b>102</b> may have been pulling on the control area <b>302</b>, waiting for the command complete message. When the coherent computing node <b>102</b> detects the command complete message, the coherent computing node <b>102</b> may consider the command to be completed. In some embodiments, the coherent computing node <b>102</b> will be notified of the command complete message by a “trap and notify” mechanism. In some embodiments, the coherent computing node <b>102</b> may poll the memory buffer.

0050The memory <b>404</b> may include a data processing memory <b>406</b>, a re-writable memory <b>408</b>, and a non-re-writable memory <b>410</b>. The TPM component <b>110</b> may use the data processing memory <b>406</b> for processing trust operation data from multiple coherent computing nodes. Thus, in some embodiments, the TPM component <b>110</b> may advantageously centralize and share memory for performing trust operations for multiple coherent computing nodes, thereby reducing the memory footprint relative to multiple discrete TPM chipsets. In some embodiments, the non-re-writable memory <b>410</b> may include TPM firmware <b>412</b> (e.g., as discussed above). In some embodiments, the TPM firmware <b>412</b> may be included in the re-writable memory <b>408</b> (e.g., as discussed above with reference to Innovation Engine embodiments). In some embodiments, the TPM firmware <b>412</b> may be partially included in the rewritable memory <b>408</b> and partially included in non-re-writable memory <b>410</b>. The memory <b>404</b> may include one or more types of memory such as Random Access Memory (RAM) and Flash memory, for example. In some cases, the amount of memory available to the multinode hub <b>120</b> will be limited; consequently, aligning all accesses from each coherent computing node <b>102</b> to a shared buffer may enable the provision of TPM functionality to all of the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>while preserving scarce embedded resources.

0051In some embodiments, the TPM component <b>110</b> may include isolated firmware components providing trust operation data processing to different ones of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. For example, the isolated firmware components may be compartmentalized into different secure containers and/or processes, which may provide an additional level of protection towards assuring that the secret data from a coherent computing node <b>102</b> is handled separate and securely from other coherent computing nodes <b>102</b>. In some firmware arrangements, different firmware modules may be isolated to prevent inter-module interference. Each firmware module may be compartmentalized by creating unique instances of some or all of the TPM component <b>110</b> as modules. The firmware source may be common, but may be instantiated for each coherent computing node <b>102</b>. This may represent a trade-off between redundancy and space. In embedded applications, limited resources may make this redundancy particularly expensive, and thus a singular TPM instance (accompanied by isolation of the secrets of each coherent computing node <b>102</b>) may be preferred.

0052<figref idref="DRAWINGS">FIG. 5</figref> is a flow diagram of an illustrative process <b>500</b> for providing initialization information to a multinode hub, in accordance with various embodiments. For illustrative purposes, operations of the process <b>500</b> may be described as performed by a coherent computing node <b>102</b> of the computing system <b>100</b>, but the operations of the process <b>500</b>, including individual operations of the process <b>500</b>, may be performed by any suitably configured component or combination of components of the computing system <b>100</b>.

0053The process <b>500</b> may begin at the operation <b>502</b> in which a base address for a memory region may be provided to an ACPI table. The base address may be provided at the operation <b>502</b> by the BIOS of a coherent computing node associated with the memory region (e.g., the BIOS <b>202</b> of the coherent computing node <b>102</b>). In some embodiments, the base address may be used as a DMA base address for transferring data into the particular memory region via a DMA transfer operation.

0054At the operation <b>504</b>, additional information may be retrieved from a memory of a coherent computing node associated with the memory region of the operation <b>502</b>. The additional information may be descriptive of the coherent computing node, and may include, for example node ID, socket ID, memory location, and node OS instance, for example. This information may be passed to the multinode hub <b>120</b> via a control/status register (CSR) with an interrupt, for example.

0055At the operation <b>506</b>, the base address and additional information may be passed to a TPM component of the multinode hub. For example, a coherent computing node <b>102</b> may pass the base address and additional information to the TPM component <b>110</b> of the multinode hub <b>120</b>. In some embodiments, additional information any passed to the TPM component via a TPM driver, such as the TPM EFI driver <b>206</b>. The process <b>500</b> may then end. Since addresses may be tagged with node-specific information, coordination between coherent computing nodes <b>102</b><i>a</i>-<i>n </i>in providing addresses may not be required. In some embodiments, an address may be tagged using the upper unused address bits.

0056In some embodiments, in response to receiving the base address and additional information of the operation <b>506</b>, the multinode hub may execute the process <b>600</b> of <figref idref="DRAWINGS">FIG. 6</figref> (discussed below) to monitor for accesses to the memory regions associated with the base addresses and additional information. The operations of the process <b>500</b> may be repeated, in series or in parallel, to pass base address and additional information to a multinode hub from different coherent computing nodes.

0057<figref idref="DRAWINGS">FIG. 6</figref> is a flow diagram of an illustrative process <b>600</b> for monitoring for accesses to memory regions, in accordance with various embodiments. For illustrative purposes, operations of the process <b>600</b> may be described as performed by the trapping module <b>106</b> of the computing system <b>100</b>, but the operations of the process <b>600</b>, including individual operations of the process <b>600</b>, may be performed by any suitably configured component or combination of components of the computing system <b>100</b>.

0058The process <b>600</b> may begin at the operation <b>602</b> in which a base address may be received for each of a plurality of memory regions from each coherent computing node of an associated plurality of coherent computing nodes. For example, the trapping module <b>106</b> may receive a base address from each of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>, with each base address associated with a different one of the memory regions <b>104</b><i>a</i>-<i>n</i>. In some embodiments, a component other than the trapping module <b>106</b> may receive the base addresses, but the trapping module <b>106</b> may be configured to access the base addresses to generate trap notifications, as discussed below. In some embodiments, at least one of the base addresses received at the operation <b>602</b> may include a DMA base address.

0059At the operation <b>604</b>, the received plurality of base addresses may be stored. In some embodiments, the received plurality of base addresses may be stored in the memory <b>404</b> of the TPM component <b>110</b> (e.g., in a RAM memory). In some embodiments, a received base address may be stored and allowed to persist until the coherent computing node that provided the base address is restarted and/or the multinode hub <b>120</b> is restarted.

0060At the operation <b>606</b>, a trap notification may be generated for a TPM component. The trap notification may be generated in response to an access, by an associated coherent computing node, of a memory region of the plurality of memory regions. In some embodiments, the trap notification may indicate which of the plurality of memory regions has been accessed. the process <b>600</b> may then end.

0061In some embodiments, in response to receiving the trap notification generated at the operation <b>606</b>, the TPM component <b>110</b> may execute the process <b>700</b> of <figref idref="DRAWINGS">FIG. 7</figref> (discussed below). The operations of the process <b>600</b> may be repeated, in series or in parallel, to generate trap notifications as different ones of the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>access their associated memory regions <b>104</b><i>a</i>-<i>n</i>. As noted above, in some embodiments, different trap hardware <b>108</b><i>a</i>-<i>n </i>may generate the trap notifications for accesses to different ones of the memory regions <b>104</b><i>a</i>-<i>n. </i>

0062<figref idref="DRAWINGS">FIG. 7</figref> is a flow diagram of an illustrative process <b>700</b> for processing trust operation data from multiple coherent computing nodes by a TPM module, in accordance with various embodiments. For illustrative purposes, operations of the process <b>700</b> may be described as performed by the TPM component <b>110</b> of the computing system <b>100</b>, but the operations of the process <b>700</b>, including individual operations of the process <b>700</b>, may be performed by any suitably configured component or combination of components of the computing system <b>100</b>.

0063The process <b>700</b> may begin at the operation <b>702</b> in which a trap notification may be received. The trap notification may be indicative of an access to a particular memory region associated with a particular coherent computing node. For example, the TPM component <b>110</b> may receive a trap notification from the trapping module <b>106</b>. The trap notification may indicate an access to a particular memory region of the memory regions <b>104</b><i>a</i>-<i>n </i>associated with a particular coherent computing node of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some embodiments, the trap notification of the operation <b>702</b> may be generated in response to an access to a particular memory region.

0064At the operation <b>704</b>, trust operation data for the particular memory region associated with the trap notification of the operation <b>702</b> may be processed. This trust operation data may be stored in the particular memory region by a coherent computing node associated with the memory region. For example, one of the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>may provide trust operation data to be stored in the associated memory region <b>104</b><i>a</i>-<i>n</i>. The TPM component <b>110</b> may process this trust operation data at the operation <b>704</b>.

0065At the operation <b>706</b>, results of the trust operation data processing may be returned to the coherent computing node associated with the particular memory region of the operation <b>704</b>. For example, the TPM component <b>110</b> may return results of the processing of trust operation data from one of the memory regions <b>104</b><i>a</i>-<i>n </i>to the associated coherent computing node <b>102</b><i>a</i>-<i>n</i>. The process <b>700</b> may then end.

0066<figref idref="DRAWINGS">FIG. 8</figref> is a block diagram of an example computing platform <b>800</b> that may be suitable for practicing the disclosed embodiments (e.g., the embodiments discussed above with reference to the computing system <b>100</b> of <figref idref="DRAWINGS">FIG. 1</figref>). In some embodiments, the computing platform <b>800</b> may be configured to provide one or more coherent computing nodes (such as the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>). For example, different ones of the processors <b>802</b> of the computing platform <b>800</b> may provide different ones of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some embodiments, each of the coherent computing nodes <b>102</b><i>a</i>-<i>n </i>of the computing system <b>100</b> may include a computing platform such as the computing platform <b>800</b>. Various other elements of the computing platform <b>800</b> may be shared between multiple coherent computing nodes or may be separate for different coherent computing nodes. The computing platform <b>800</b> may include, or be part of, any of a number of computing systems, such as a server computing system.

0067As shown, the computing platform <b>800</b> includes a number of processing devices <b>802</b>, and a system memory <b>804</b>. The processing devices <b>802</b> may include one or more processing cores or other processing devices. Additionally, the computing platform <b>800</b> may include one or more mass storage devices <b>806</b> (such as solid-state drive, diskette, hard drive, compact disc read only memory (CDROM) and so forth), input/output devices <b>808</b> (such as display, keyboard, cursor control, camera, microphone, GPS receiver, motion detectors, and so forth) and communication interfaces <b>810</b> (such as network interface cards, modems, WiFi devices, Bluetooth devices, and so forth). The elements may be coupled to each other via a system bus <b>812</b>, which represents one or more buses. In the case of multiple buses, they may be bridged by one or more bus bridges (not shown). The techniques and systems described herein may be used to provide trust-related operations to any suitable component of the computing platform <b>800</b> or combination of multiple computing platforms <b>800</b>.

0068Each of these elements may perform its conventional functions known in the art. In particular, system memory <b>804</b> and mass storage <b>806</b> may be employed to store a working copy and a permanent copy of programming instructions implementing any suitable methods disclosed herein when executed by the respective processing devices <b>802</b>, herein collectively denoted as computational logic <b>822</b>. For example, in some embodiments, the computing platform <b>800</b> may implement one or more of the coherent computing nodes <b>102</b><i>a</i>-<i>n</i>. In some such embodiments, the system memory <b>804</b> and the mass storage <b>806</b> may be employed to store, as computer-readable media, a working copy and a permanent copy of programming instructions implementing the method of <figref idref="DRAWINGS">FIG. 5</figref>, or portions thereof. In another example, in some embodiments, the computing platform <b>800</b> may implement one or more portions of the multinode hub <b>120</b>. In some such embodiments, the system memory <b>804</b> and the mass storage <b>806</b> may be employed to store a working copy and a permanent copy of programming instructions implementing the methods of <figref idref="DRAWINGS">FIGS. 5</figref> and/or <b>6</b>, or portions thereof. The various components may be implemented by assembler instructions supported by processing devices <b>802</b> or high-level languages, such as, for example, C, that can be compiled into such instructions.

0069The permanent copy of the programming instructions may be placed into permanent storage <b>806</b> in the factory, or in the field, through, for example, a computer-readable distribution medium (not shown), such as a compact disc (CD), or through communication interface <b>810</b> (e.g., from a distribution server (not shown)). That is, one or more computer-readable distribution media having an implementation of the multinode hub (or portions thereof) may be employed to distribute the multinode hub (or portions thereof) and program various computing devices. The constitution of elements <b>802</b>-<b>812</b> are known, and accordingly will not be further described.

0070In various embodiments, one or more of the elements of the computing platform <b>800</b> illustrated in <figref idref="DRAWINGS">FIG. 8</figref> may not be included, or additional components may be included. For example, in some embodiments in which the computing platform <b>800</b> is configured to implement the multinode hub <b>120</b>, the computing platform <b>800</b> may not include I/O devices <b>808</b>. In some embodiments in which the computing platform <b>800</b> is configured to implement a coherent computing node <b>102</b>, the communication interface <b>810</b> may include an interface to the communication link <b>112</b> and/or the communication link <b>112</b> itself.

0071Computer-readable media (including non-transitory computer-readable media), methods, systems and devices for performing the above-described techniques are illustrative examples of embodiments disclosed herein. Additionally, other devices in the above-described interactions may be configured to perform various disclosed techniques.

0072The following paragraphs provide illustrative embodiments of the present disclosure. Example 1 is a multinode hub, including: a plurality of memory regions, each memory region associated with one of a plurality of coherent computing nodes and to receive trust operation data from the associated coherent computing node; a trapping module, coupled with the plurality of memory regions, to generate trap notifications in response to accesses to the plurality of memory regions by the associated plurality of coherent computing nodes, wherein a trap notification indicates which of the plurality of memory regions has been accessed; and a TPM component, coupled with the trapping module, to process trust operation data in a memory region indicated by a trap notification.

0073Example 2 may include the subject matter of Example 1, and may further specify that the TPM component is to verify an integrity of a BIOS of the coherent computing node associated with the memory region indicated by the trap notification, as part of processing of the trust operation data in the memory region indicated by the trap notification.

0074Example 3 may include the subject matter of any of Examples 1 and 2, and may further specify that the TPM component is to verify a launch of a hypervisor by the coherent computing node associated with the memory region indicated by the trap notification, as part of processing the trust operation data in the memory region indicated by the trap notification.

0075Example 4 may include the subject matter of any of Examples 1-3, and may further include non re-writeable memory, wherein firmware associated with the multinode hub is disposed in the non re-writeable memory.

0076Example 5 may include the subject matter of any of Examples 1-4, and may further specify that the multinode hub is included in an integrated circuit package along with the plurality of coherent computing nodes.

0077Example 6 may include the subject matter of any of Examples 1-5, and may further include one or more serial or parallel buses to couple the plurality of coherent computing nodes with the associated plurality of memory regions to enable the plurality of coherent computing nodes to communicate with the associated plurality of memory regions.

0078Example 7 may include the subject matter of any of Examples 1-4, and may further specify that the multinode hub is included in an integrated circuit package separate from a package including at least one of the plurality of coherent computing nodes.

0079Example 8 may include the subject matter of any of Examples 1-7, and may further specify that the plurality of memory regions is to receive trust operation data from an operating system of the associated coherent computing node.

0080Example 9 may include the subject matter of any of Examples 1-8, and may further specify that base addresses of the plurality of memory regions are included in ACPI tables of the associated coherent computing nodes.

0081Example 10 may include the subject matter of any of Examples 1-9, and may further specify that the plurality of memory regions is to receive trust operation data via a DMA transfer from the associated coherent computing node.

0082Example 11 may include the subject matter of any of Examples 1-10, and may further include a UEFI PI SMM driver having firmware associated with the multinode hub.

0083Example 12 may include the subject matter of any of Examples 1-11, and may further specify that the TPM component includes a memory, and the TPM component is to process trust operation data from memory regions associated with different coherent computing nodes in the memory.

0084Example 13 is a computing system having a multinode hub, including: a plurality of coherent computing nodes; and the multinode hub. The multinode hub includes: a plurality of memory regions, each memory region associated with one of the plurality of coherent computing nodes and to receive trust operation data from the associated coherent computing node; a trapping module, coupled with the plurality of memory regions, to generate trap notifications in response to accesses to the plurality of memory regions by the associated plurality of coherent computing nodes, wherein a trap notification indicates which of the plurality of memory regions has been accessed; and a TPM component, coupled with the trapping module, to process trust operation data in a memory region indicated by a trap notification.

0085Example 14 may include the subject matter of Example 13, and may further specify that the multinode hub is included in an integrated circuit package along with the plurality of coherent computing nodes.

0086Example 15 may include the subject matter of Example 13, and may further include one or more serial or parallel buses to couple the plurality of coherent computing nodes with the associated plurality of memory regions to enable the plurality of coherent computing nodes to communicate with the associated plurality of memory regions.

0087Example 16 may include the subject matter of Example 13, and may further specify that the multinode hub is included in an integrated circuit package separate from a package including at least one of the plurality of coherent computing nodes.

0088Example 17 may include the subject matter of any of Examples 13-16, and may further specify that the TPM component includes a memory, and that the TPM component is to process trust operation data from memory regions associated with different coherent computing nodes in the memory.

0089Example 18 is a method of processing trust operation data on a multinode hub, including: receiving, by a TPM component of the multinode hub, a trap notification indicative of an access to a memory region by a coherent computing node associated with the memory region, wherein the memory region is one of a plurality of memory regions in the trap notification further indicates which of the plurality of memory regions has been accessed; processing, by the TPM component, trust operation data from the memory region in response to receiving the trap notification; and providing, by the TPM component, results of the processing of the trust operation data from the memory region to the coherent computing node.

0090Example 19 may include the subject matter of Example 18, and may further specify that providing results of the trust operation data processing to the coherent computing node associated with the memory region includes providing results of the trust operation data processing to the memory region.

0091Example 20 may include the subject matter of any of examples 18-19, and may further include receiving, by the TPM component, a second trap notification indicative of an access to a second memory region by a second coherent computing node associated with the second memory region, wherein the second memory region is different from the memory region; processing, by the TPM component, trust operation data from the second memory region in response to receiving the trap notification, wherein processing the trust operation data from the second memory region comprises utilizing a memory also utilized for processing the trust operation data from the first memory region; and providing, by the TPM component, results of the processing of the trust operation data from the second memory region to the second coherent computing node.

0092Example 21 is a method of initializing a multinode hub, including: receiving, by the multinode hub, a base address for each of a plurality of memory regions from each of an associated plurality of coherent computing nodes; storing, by the multinode hub, the received plurality of base addresses; and generating, by the multinode hub, a trap notification for a TPM component of the multinode hub, in response to an access, by an associated coherent computing node, of a memory region of the plurality of memory regions, wherein the trap notification indicates which of the plurality of memory regions has been accessed.

0093Example 22 may include the subject matter of Example 21, and may further include generating, by the multinode hub, a second trap notification for the TPM component in response to an access, by an associated second coherent computing node, of a second memory region of the plurality of memory regions, wherein the second memory region is different from the memory region.

0094Example 23 may include the subject matter of Example 22, and may further specify that generating includes generating, by a first trap component of a trapping module of the multinode hub, the trap notification and generating, by a second trap component of the trapping module of the multinode hub, the second trap notification, and wherein the first trap component and the second trap component included different hardware.

0095Example 24 may include the subject matter of any of Examples 21-23, and may further specify that the plurality of base addresses comprises at least one DMA base address.

0096Example 25 is one or more computer-readable media having instructions thereon that, in response to execution by one or more processing devices of an apparatus, cause the apparatus to perform the method of any of Examples 18-24.

0097Example 26 is an apparatus comprising means for performing the method of any of Examples 18-24.

0098Example 27 is one or more computer-readable media having instructions thereon that, in response to execution by one or more processing devices of an apparatus, cause the apparatus to operate a TPM component of a multinode hub to: receive a trap notification indicative of an access to a memory region by a coherent computing node associated with the memory region, wherein the memory region is one of a plurality of memory regions in the trap notification further indicates which of the plurality of memory regions has been accessed; process trust operation data from the memory region in response to receiving the trap notification; and provide results of the processing of the trust operation data from the memory region to the coherent computing node.

0099Example 28 may include the subject matter of Example 27, and may further specify that provide results of the trust operation data processing to the coherent computing node associated with the memory region comprises provide results of the trust operation data processing to the memory region.

0100Example 29 may include the subject matter of any of Examples 27-28, and may further have instructions thereon that, in response to execution by the one or more processing devices of the apparatus, cause the apparatus to operate the TPM component of the multinode hub to: receive a second trap notification indicative of an access to a second memory region by a second coherent computing node associated with the second memory region, wherein the second memory region is different from the memory region; process trust operation data from the second memory region in response to receiving the trap notification, wherein processing the trust operation data from the second memory region comprises utilizing a memory also utilized for processing the trust operation data from the first memory region; and provide results of the processing of the trust operation data from the second memory region to the second coherent computing node.

0101Example 30 is one or more computer-readable media having instructions thereon that, in response to execution by one or more processing devices of an apparatus, cause the apparatus to operate a multinode hub to: receive a base address for each of a plurality of memory regions from each of an associated plurality of coherent computing nodes; store the received plurality of base addresses; and generate a trap notification for a TPM component of the multinode hub, in response to an access, by an associated coherent computing node, of a memory region of the plurality of memory regions, wherein the trap notification indicates which of the plurality of memory regions has been accessed.

0102Example 31 may include the subject matter of Example 30, and may further have instructions thereon that, in response to execution by the one or more processing devices of the apparatus, cause the apparatus to operate the multinode hub to generate a second trap notification for the TPM component in response to an access, by an associated second coherent computing node, of a second memory region of the plurality of memory regions, wherein the second memory region is different from the memory region.

0103Example 32 may include the subject matter of Example 31, and may further specify that generate comprises generate, by a first trap component of a trapping module of the multinode hub, the trap notification and generate, by a second trap component of the trapping module of the multinode hub, the second trap notification, and wherein the first trap component and the second trap component included different hardware.

0104Example 33 may include the subject matter of any of Examples 30-32, and may further specify that the plurality of base addresses comprises at least one Direct Memory Access (DMA) base address.