Providing isolation in virtualized systems using trust domains

A system comprising:

• a memory device to store one or more instructions;
• and
• a processing device operably coupled to the memory device, the processing device to execute the one or more instructions to:
• execute a trust domain resource manager (TDRM) to manage a trust domain (TD), wherein the TDRM is not comprised in a trusted computing base (TCB) of the TD;
• maintain a user execution state and a supervisor execution state of the TD in a trust domain thread control structure (TD-TCS) that is access-controlled against software accesses from at least one of the TDRM, a virtual machine manager (VMM), or other TDs executed by the processing device;
• and
• reference a memory ownership table (MOT) to obtain at least one key identifier (ID) corresponding to an encryption key assigned to the TD, the key ID to allow the processing device to decrypt memory pages assigned to the TD responsive to the processing device executing in the context of the TD, the memory pages assigned to the TD encrypted with the encryption key identified via the key ID, wherein the MOT is to store security attributes for a host physical memory page assigned to the TD, wherein a trust domain control structure (TDCS) is to manage metadata of the TD, wherein the TDRM is to cause creation of the TD using an instruction, wherein the instruction specifies a region of physical memory for the TDCS as a parameter of the instruction, and wherein execution of the instruction generates the encryption key assigned to the TD and the key ID and initializes a hash for a TD measurement in the TDCS, the key ID to be stored in the TDCS;
• wherein the MOT security attributes comprise:
• a TD identifier assigning the host physical memory page to the TD, and
• an expected guest physical address used in the TD for the TDRM to perform memory mapping of the host physical memory page.

A method comprising:

• executing, by a processing device, a trust domain resource manager (TDRM) to manage a trust domain (TD), wherein the TDRM is not comprised in a trusted computing base (TCB) of the TD;
• maintaining a user execution state and a supervisor execution state of the TD in a trust domain thread control structure (TD-TCS) that is access-controlled against software accesses from at least one of the TDRM, a virtual machine manager (VMM), or other TDs executed by the processing device;
• and
• referencing a memory ownership table (MOT) to obtain at least one encryption key identifier (ID) corresponding to an encryption key assigned to the TD, the key ID to allow the processing device to decrypt memory pages assigned to the TD responsive to the processing device executing in the context of the TD, the memory pages assigned to the TD encrypted with the encryption key identified via the encryption key ID, wherein the MOT is to store security attributes for a host physical memory page assigned to the TD, wherein a trust domain control structure (TDCS) is to manage metadata of the TD, wherein the TDRM is to cause creation of the TD using an instruction, wherein the instruction specifies a region of physical memory for the TDCS as a parameter of the instruction, and wherein execution of the instruction generates the encryption key assigned to the TD and the key ID and initializes a hash for a TD measurement in the TDCS, the key ID to be stored in the TDCS;
• wherein the MOT security attributes for the host physical memory page comprise:
• a TD identifier assigning the host physical memory page to the TD, and
• an expected guest physical address used in the TD for the TDRM to perform memory mapping of the host physical memory page.