Stateless and low-overhead domain isolation using cryptographic computing

A system, comprising:

• memory for storing a plurality of domains;
• and
• a processor coupled to the memory, the processor comprising:
• an instruction pointer register to store a first encoded pointer to a first encrypted code block of a first domain in the memory, wherein the first domain is to share a first address space of the memory with the plurality of domains;
• and
• circuitry to:
• decode the first encoded pointer to obtain a first linear address of the first encrypted code block;
• use the first linear address to access the first encrypted code block;
• and
• decrypt the first encrypted code block to generate a first decrypted code block using a first code key and a first code tweak derived at least in part from the first encoded pointer, the first code tweak including first domain metadata that uniquely identifies the first domain and first location information that represents a relative position of the first encrypted code block in the first address space.

A method comprising:

• decoding a first encoded pointer stored in an instruction pointer register of a processor to obtain a first linear address of a first encrypted code block of a first software component in memory, wherein the first software component shares a first linear address space of the memory with a plurality of software components;
• using the first linear address to access the first encrypted code block;
• determining a first offset of the first encrypted code block within a first memory slot of the first linear address space;
• and
• decrypting the first encrypted code block to generate a first decrypted code block using a first code key and a first code tweak that includes the first offset and first metadata that uniquely identifies the first software component.

A non-transitory machine readable medium comprising instructions that when executed by a processor, cause the processor to perform operations comprising:

• decoding a first encoded pointer stored in an instruction pointer register of the processor to obtain a first linear address of a first encrypted code block of a first software component in memory, wherein the first software component is to share a first address space of the memory with a plurality of software components;
• using the first linear address to access the first encrypted code block;
• and
• decrypting the first encrypted code block to generate a first decrypted code block using a first code key and a first code tweak that includes first metadata that uniquely identifies the first software component and first location information that represents a relative position of the first encrypted code block in the first address space.