Hierarchical virtualization with a multi-level virtualization mechanism
Hierarchical virtualization is disclosed, where such virtualization can be accomplished with a multi-level mechanism. The hierarchical virtualization includes using a hypervisor that maintains a first partition and using a virtualization stack within the first partition to create and control a second partition. Multiple virtualization stacks can subsist within the first partition, and each such virtualization stack can create and control multiple partitions. In one particular implementation, a child partition can have exclusive control over a portion or all of its resources with respect to a parent partition. The hypervisor as the ultimate arbiter in such a virtualized environment enforces such a setup and is able to communicate directly within any partition within the virtualized hierarchy.
1. A method for providing hierarchical virtualization, comprising:
creating, with a hypervisor microkernel, a first partition, the first partition having a first virtualization stack;
creating, with the first virtualization stack, a second partition;
receiving, by the first virtualization stack and from the second partition, a request to a hypervisor microkernel function of access to a hardware resource of a computer system not able to be provided by the first virtualization stack, the request indicating an access to a memory management function of the hypervisor microkernel; and
providing, by the hypervisor microkernel and to the second partition, access to the hardware resource.
2. The method according to claim 1 , further comprising:
receiving, by the hypervisor microkernel, a request to enumerate a resource of the first partition or the second partition; and
enumerating, by the hypervisor microkernel, the resource.
3. The method according to claim 1 , further comprising:
communicating directly with the hypervisor microkernel, by the second partition.
4. The method according to claim 1 , wherein the second partition contains a second virtualization stack, further comprising:
creating a third partition by the second virtualization stack.
5. The method according to claim 1 , wherein the first partition has a second virtualization stack simultaneously with the first partition having the first virtualization stack.
6. The method according to claim 1 , further comprising:
creating a third partition, by the first virtualization stack.
7. The method of claim 1 , wherein the second partition comprises a second virtualization stack, the second virtualization stack not providing access to the hardware resource, and further comprising:
creating, with the second virtualization stack, a third partition;
receiving, by the second virtualization stack and from the third partition, a second request to a hypervisor function of access to the hardware resource;
sending, from the second virtualization stack and to the first virtualization stack, an indication of the second request; and
providing, by the hypervisor microkernel and to the third partition, access to the hardware resource.
8. The method of claim 1 , wherein the request to the hypervisor function of access to the hardware resource of the computer system not provided by the first virtualization stack is indicative of transferring a resource from the second partition to another partition or sharing the resource between the second partition and another partition.
9. A system for providing secured hierarchical virtualization, comprising:
a hardware processor; and
a memory communicatively coupled to the hardware processor when the system is operational, the memory bearing processor-executable instructions that, upon execution by the hardware processor, cause the system to at least:
create a first partition with a hypervisor microkernel, the first partition having a first virtualization stack;
create, with the first virtualization stack, a second partition;
receive, by the first partition and from the second partition, a request to a hypervisor microkernel function of access to a hardware resource of the system not able to be provided by the first partition;
send, by the first partition and to the hypervisor microkernel, the request; and
provide, by the hypervisor microkernel and to the second partition, access to the hardware resource.
10. The system according to claim 9 , wherein the first virtualization stack provides exclusive access to the hardware resource to the second partition.
11. The system according to claim 9 , wherein the memory further bears processor-executable instructions that, upon execution by the hardware processor, cause the system to at least:
validate, by the hypervisor microkernel, that the first virtualization stack has provided access to the hardware resource.
12. The system according to claim 9 , wherein the request is made by an operating system kernel within the second partition.
13. The system according to claim 9 , wherein the request is made by a driver within the second partition.
14. The system according to claim 9 , wherein the request is made to a boot loader within the first partition.
15. A computer readable hardware device storing computer-executable instructions providing hierarchical virtualization, causing a computing device executing said computer-executable instructions to perform operations comprising:
creating a first partition with a hypervisor microkernel, the first partition having a first virtualization stack;
creating, with the first virtualization stack, a second partition;
receiving, by the first partition and from the second partition, a request to a hypervisor microkernel function of access to a hardware resource of a computer system not able to be provided by the first virtualization stack; and
providing, by the hypervisor microkernel and to the second partition, access to the hardware resource.
16. The computer readable hardware device according to claim 15 , further bearing computer-executable instructions causing computing device executing said computer-executable instructions to perform operations comprising:
creating a third partition by the first virtualization stack.
17. The computer readable hardware device according to claim 15 , wherein the first partition has a second virtualization stack, and further bearing computer-executable instructions causing computing device executing said computer-executable instructions to perform operations comprising:
creating, by the second virtualization stack, a third partition.
18. The computer readable hardware device according to claim 15 , wherein the second partition has a second virtualization stack.
19. The computer readable hardware device according to claim 18 , further bearing computer-executable instructions causing computing device executing said computer-executable instructions to perform operations comprising:
creating, by the second virtualization stack, a third partition.
20. The computer readable hardware device according to claim 18 , wherein the first partition has a second virtualization stack simultaneously with the first partition having the first virtualization stack.