Protected container key management processors, methods, systems, and instructions

A method performed by a processor comprising:

• receiving an instruction, the instruction indicating a first structure in a protected container memory and indicating a second structure in the protected container memory;
• and
• in response to the instruction:
• determining whether a status indicator allows at least one key to be exchanged between the first and second structures;
• and
• exchange the at least one key between the first and second structures when the status indicator allows the at least one key to be exchanged between the first and second structures.

A processor comprising:

• a memory controller;
• and
• a core coupled with the memory controller, the core to:
• determine whether a status indicator is configured to allow at least one key to be exchanged between a first structure in a protected container memory and a second structure in the protected container memory;
• and
• exchange the at least one key between the first and second structures when the status indicator is configured to allow the at least one key to be exchanged between the first and second structures.

A system to process instructions comprising:

• an interconnect;
• a processor coupled with the interconnect, the processor to receive an instruction that is to indicate a first structure in a protected container memory and is to indicate a second structure in the protected container memory, the processor, in response to the instruction, to:
• determine whether a status indicator is configured to allow at least one key to be exchanged between the first and second structures;
• and
• exchange the at least one key between the first and second structures when the status indicator is configured to allow the at least one key to be exchanged between the first and second structures;
• and
• a dynamic random access memory (DRAM) coupled with the interconnect, the DRAM storing a set of instructions corresponding to a trusted protected container, the set of instructions, when executed by the processor, to cause the processor to perform operations comprising configure the status indicator to allow the at least one key to be exchanged between the first and second structures at a time when the trusted protected container intends to allow the at least one key to be migrated from the system to another system as part of a protected container migration.