Apparatuses, methods, and systems for instructions to compartmentalize code

A hardware processor comprising:

• a compartment manager to:
• determine, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of memory,
• load a first compartment descriptor for the first compartment into one or more registers of the processor core from the memory, and
• check if the first compartment is marked in the first compartment descriptor, within the one or more registers of the processor core, as a management compartment;
• a decoder, for a request from the first compartment marked as the management compartment, to decode a first instruction into a decoded first instruction;
• and
• an execution circuit to execute the decoded first instruction to load a second compartment descriptor for a second compartment of the memory from a location specified by a pointer in a compartment pointer register into the one or more registers of the processor core and set a compartment mode register of the processor core to an inside mode that causes a switch of execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allows speculative memory accesses for the second subset of code only within the second compartment, and prevents a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the processor core.

A method comprising:

• determining, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of memory;
• loading a first compartment descriptor for the first compartment into one or more registers of the processor core from the memory;
• checking if the first compartment is marked in the first compartment descriptor, within the one or more registers of the processor core, as a management compartment;
• decoding, by a decoder of the processor core in response to the first compartment being marked in the first compartment descriptor as the management compartment for a request from the first compartment, a first instruction into a decoded first instruction;
• and
• executing, by an execution circuit of the processor core, the decoded first instruction to load a second compartment descriptor for a second compartment of the memory from a location specified by a pointer in a compartment pointer register into the one or more registers of the processor core and set a compartment mode register of the processor core to an inside mode that causes a switch of execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allows speculative memory accesses for the second subset of code only within the second compartment, and prevents a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the processor core.

A non-transitory machine readable medium that stores program code that when executed by a machine causes the machine to perform a method comprising:

• determining, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of memory;
• loading a first compartment descriptor for the first compartment into one or more registers of the processor core from the memory;
• checking if the first compartment is marked in the first compartment descriptor, within the one or more registers of the processor core, as a management compartment;
• decoding, by a decoder of the processor core in response to the first compartment being marked in the first compartment descriptor as the management compartment for a request from the first compartment, a first instruction into a decoded first instruction;
• and
• executing, by an execution circuit of the processor core, the decoded first instruction to load a second compartment descriptor for a second compartment of the memory from a location specified by a pointer in a compartment pointer register into the one or more registers of the processor core and set a compartment mode register of the processor core to an inside mode that causes a switch of execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allows speculative memory accesses for the second subset of code only within the second compartment, and prevents a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the processor core.