PARTITIONING A HYPERVISOR INTO VIRTUAL HYPERVISORS

• US 20170060613A1
• Filed: 12/29/2015
• Published: 03/02/2017
• Est. Priority Date: 08/28/2015
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: LAPLACE, Cyprien, WARKENTIN, Andrei, TUCH, Harvey, FAINKICHEN, Alexander
• Granted Patent: US 11,422,840 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

In an example, a computer system includes a hardware platform and a hypervisor executing on the hardware platform. The hypervisor includes a kernel and a plurality of user-space instances within a user-space above the kernel. Each user-space instance is isolated from each other user-space instance through namespaces. Each user-space instance includes resources confined by hierarchical resource groups. The computer system includes a plurality of virtual hypervisors, where each virtual hypervisor executes in a respective user-space instance of the plurality of user-space instances.

Claims

1. A computer system, comprising:

a hardware platform;

a hypervisor executing on the hardware platform, the hypervisor including a kernel;

a plurality of user-space instances managed by the kernel, each user-space instance being isolated from each other user-space instance through namespaces, each user-space instance having resources confined by hierarchical resource groups; and

a plurality of virtual hypervisors, each virtual hypervisor executing in a respective user-space instance of the plurality of user-space instances.

2. The computer system of claim 1, further comprising:

one or more virtualized computing instances executing within each of the plurality of virtual hypervisors.

3. The computer system of claim 1, wherein each user-space instance is isolated from each other user-space instance through process namespaces, each user-space instance including processes executing within a respective process namespace.

4. The computer system of claim 1, wherein the kernel includes a virtual file system interface providing hardware and kernel state, the kernel configured to hide or stub one or more nodes of the virtual file system interface for processes executing in each user-space instance.

5. The computer system of claim 1, wherein the kernel includes a system call interface, the kernel configured to hide or stub one or more system calls of the system call interface for processes executing in each user-space instance.

6. The computer system of claim 1, wherein each virtual hypervisor comprises a management plane providing an application programming interface (API).

7. The computer system of claim 1, wherein each user-space instance is isolated from each other user-space instance through storage namespaces, each user-space instance including a respective storage namespace backed by at least one of persistent storage or non-persistent storage.

8. The computer system of claim 7, wherein the persistent storage for each user-space instance comprises a storage volume configured to store state information comprising at least one of:

virtual computing instance files;

log files;

or configuration files.

9. The computer system of claim 7, wherein the storage namespace includes at least one of:

at least one mount point or at least one re-parse point.

10. The computer system of claim 1, wherein each user-space instance is isolated from each other user-space instance through network namespaces, each user-space instance including an instance of a network stack in a respective network namespace.

11. A method of creating a tenant in a multi-tenant hypervisor executing on a hardware platform of a host, the method comprising:

creating a user-space instance managed by a kernel of the multi-tenant hypervisor, the user-space instance being isolated from one or more other user-space instances through namespaces, the user-space instance having resources confined by hierarchical resource groups; and

creating a virtual hypervisor within the user-space instance.

12. The method of claim 11, wherein the step of creating the user-space instance comprises:

provisioning persistent storage for storing tenant state;

provisioning a storage namespace; and

provisioning a network namespace.

13. The method of claim 12, wherein the step of provisioning the storage namespace comprises:

creating a root file system linked with a global file system of the multi-tenant hypervisor for the user-space instance; and

creating one or mount points, one or more re-parse points, or one or more symbolic links in the root file system.

14. The method of claim 12, wherein the step of provisioning the network namespace comprises:

creating a network stack instance for the user-space instance; and

creating a simulated physical network interface card (NIC) for the user-space instance.

15. The method of claim 11, wherein the step of creating the virtual hypervisor comprises:

provisioning an instance of a management plane in the namespaces of the user-space instance.

16. The method of claim 15, wherein the step of provisioning the instance of the management plane comprises:

populating a root file system for the user-space instance with files for management daemons and processes; and

creating one or more virtual network devices.

17. The method of claim 15, wherein the step of creating the virtual hypervisor further comprises:

storing a configuration of the virtual hypervisor as part of tenant state in persistent storage allocated for use by the user-space instance.

18. The method of claim 15, wherein the step of creating the virtual hypervisor further comprises:

starting up the management plane for access by a user.

19. A non-transitory computer readable medium having instructions stored thereon that when executed by a processor cause the processor to perform a method of creating a tenant in a multi-tenant hypervisor executing on a hardware platform of a host, the method comprising:

creating a user-space instance managed by a kernel of the multi-tenant hypervisor, the user-space instance being isolated from one or more other user-space instances through namespaces, the user-space instance having resources confined by hierarchical resource groups; and

creating a virtual hypervisor within the user-space instance.

20. The non-transitory computer readable medium of claim 19, wherein the step of creating the user-space instance comprises:

provisioning persistent storage for storing tenant state;

provisioning a storage namespace; and

provisioning a network namespace.