Algorithm and apparatus to deploy virtual machine monitor on demand

A computing device, comprising:

• a memory;
• and
• a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising:
• initializing a hypervisor, a security monitor, and a high-level operating system (HLOS);
• disabling the hypervisor after initialization;
• monitoring for a signal from the security monitor to start a sandbox session;
• enabling the hypervisor in response to receiving the signal to start the sandbox session;
• implementing access control while the hypervisor is enabled;
• and
• allocating memory by the HLOS so that an intermediate physical address in the HLOS's intermediate physical address space is the same as a physical address in a physical address space and so that a virtual address in the HLOS's virtual address space is mapped to the physical address via the intermediate physical address when the hypervisor is enabled and when the hypervisor is disabled.

A computing device, comprising:

• means for initializing a hypervisor, a security monitor, and a high-level operating system (HLOS);
• means for disabling the hypervisor after initialization;
• means for monitoring for a signal from the security monitor to start a sandbox session;
• means for enabling the hypervisor in response to receiving the signal to start the sandbox session;
• means for implementing access control while the hypervisor is enabled;
• and
• means for allocating memory by the HLOS so that an intermediate physical address in the HLOS's intermediate physical address space is the same as a physical address in a physical address space and so that a virtual address in the HLOS 's virtual address space is mapped to the physical address via the intermediate physical address when the hypervisor is enabled and when the hypervisor is disabled.

A non-transitory processor-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for managing memory on a computing device, the operations comprising:

• initializing a hypervisor, a security monitor, and a high-level operating system (HLOS);
• disabling the hypervisor after initialization;
• monitoring for a signal from the security monitor to start a sandbox session;
• enabling the hypervisor in response to receiving the signal to start the sandbox session;
• implementing access control while the hypervisor is enabled;
• and
• allocating memory by the HLOS so that an intermediate physical address in the HLOS's intermediate physical address space is the same as a physical address in a physical address space and so that a virtual address in the HLOS's virtual address space is mapped to the physical address via the intermediate physical address when the hypervisor is enabled and when the hypervisor is disabled.