1. A method of isolating secure guest code to be executed in a guest that is configured in a host by a virtualization software, comprising: creating first page tables, which are used for guest physical to host physical address translations, that provide mappings to a first protected domain region of host physical memory where the secure guest code has been loaded; creating second page tables, which are used for guest physical to host physical address translations, that provide mappings to a second protected domain region of the host physical memory; storing third page tables, which are used for guest virtual to guest physical address translations, in the first protected region; and when execution is switched from a non-secure guest code, which is loaded into the second protected domain region, to the secure guest code, accessing the third page tables for guest virtual to guest physical address translations, and the first page tables for guest physical to host physical address translations.