Tdx islands with self-contained scope enabling tdx keyid scaling

A method performed by a Trust Domain Island (TDI) Resource Manager (TDIRM) in a system comprising a plurality of sockets, each comprising a plurality of cores and a plurality of multi-key total memory encryption (MK-TME) circuits, the method comprising:

• initializing a TDI Control Structure (TDICS) associated with a first TDI;
• initializing a TDI Protected Memory (TDIPM) associated with the first TDI;
• identifying a host key identifier (HKID) in a key ownership table (KOT);
• assigning the HKID to a cryptographic key and storing the HKID in the TDICS;
• and
• associating a first core with the first TDI, adding a memory page from an address space of the first core to the TDIPM, and transferring execution control to the first core to execute the first TDI, wherein a scope of the TDIPM is limited to bounds of the first TDI.

An apparatus comprising:

• at least one multi-key total-memory-encryption circuits (MK-TME) circuit;
• and
• a trust domain island resource manager (TDIRM) to:
• initialize a trust domain island control structure (TDICS) associated with a TD island,
• initialize a TD island protected memory (TDIPM) associated with the TD island,
• identify a host key identifier (HKID) in a key ownership table (KOT),
• assign the HKID to a cryptographic key in a MK-TME circuit and store the HKID in the TDICS,
• associate a first core of the plurality of cores with the TD island,
• add a memory page from an address space of the first core to the TDIPM, and
• transfer execution control to the first core to execute the TD island, and wherein
• a scope of the TDIPM is limited to bounds of the TD island.