Transparent enablement of large frames for secure guests

A computer system comprising:

• at least one computing device;
• a set of one or more computer-readable storage media;
• and
• program instructions, collectively stored in the set of one or more computer-readable storage media, for causing the at least one computing device to perform computer operations including:
• enabling host translation for a large page for a given block of memory of a secure guest, the enabling comprising:
• executing, in a trusted computing environment, a call from a host to import a page to a memory of the secure guest, wherein the secure guest is managed by the host in an untrusted computing environment;
• based on executing the import, determining that a page virtual address matches a page corresponding absolute address;
• based on determining that there is a match, increasing a counter associated with the large page, wherein the large page corresponds to the page corresponding absolute address of a small page being imported, wherein the counter indicates a number of small pages comprising the large page imported to the memory of guests managed by the host;
• determining that the counter indicates that all the small pages comprising the large page were imported;
• based on determining that the counter indicates that all the small pages comprising the large page were imported, determining that all the small pages comprising the large page meet pre-defined security requirements;
• and
• based on determining that all the small pages comprising the large page meet the pre-defined security requirements, enabling host translation for the large page for the given block of memory of the secure guest.

A computer-implemented method comprising:

• requesting execution of an instruction to perform an action defined by the instruction, wherein the executing the instruction includes:
• enabling host translation for a large page for a given block of memory of a secure guest, the enabling comprising:
• executing, in a trusted computing environment, a call from a host to import a page to a memory of the secure guest, wherein the secure guest is managed by the host in an untrusted computing environment;
• based on executing the import, determining that a page virtual address matches a page corresponding absolute address;
• based on determining that there is a match, increasing a counter associated with the large page, wherein the large page corresponds to the page corresponding absolute address of a small page being imported, wherein the counter indicates a number of small pages comprising the large page imported to the memory of guests managed by the host;
• determining that the counter indicates that all the small pages comprising the large page were imported;
• based on determining that the counter indicates that all the small pages comprising the large page were imported, determining that all the small pages comprising the large page meet pre-defined security requirements;
• and
• based on determining that all the small pages comprising the large page meet the pre-defined security requirements, enabling host translation for the large page for the given block of memory of the secure guest.