Application execution enclave memory method and apparatus

The one or more computer-readable media 24, wherein on allocation of a host physical memory page from the unallocated subset of the host physical memory pages to receive increased security protection to replace the corresponding host physical memory page of the virtual machine-physical memory page to be designated to receive the increased security protection, the virtual machine monitor is to resume the virtual machine;

• wherein each virtual machine is to maintain a first translation table to map virtual pages of the virtual machine to virtual machine-physical memory pages, wherein to facilitate the mapping of virtual machine-physical memory pages of the virtual machines to the host physical memory pages, the virtual machine monitor is to maintain a second translation table to map the virtual machine-physical memory pages to the host physical memory pages;
• and wherein the computer device further comprises an input/output management unit having a third translation table that caches entries of the first and second translation page tables associated with direct management access;
• wherein to allocate a host physical memory page from the unallocated subset of the host physical memory pages to receive increased security protection to replace the corresponding host physical memory page of the virtual machine-physical memory page to be designated to receive the increased security protection, the virtual machine monitor updates the second translation table;
• wherein the virtual machine monitor is to further maintain a holding pool of replaced host physical memory pages;
• wherein the virtual machine monitor is to place the replaced corresponding host physical memory page into the holding pool of replaced host physical memory pages, on replacement of the corresponding host physical memory page with the host physical memory page from the from the unallocated subset of the host physical memory pages to receive increased security protection;
• and
• wherein the virtual machine monitor is to recover the replaced host physical memory pages in the holding pool back into the unallocated subset of the host physical memory pages to receive increased security protection, in response to the holding pool reaching a threshold number of replaced host physical memory pages, and as part of the recovery process, the virtual machine monitor is to cause the virtual machines to invalidate corresponding mapping entries in the first translation tables of the virtual machines and the third translation table in the input/output memory management unit.