Patent ID: 8286164

Claim:
A method, in a data processing system, for performing secure recursive virtualization of the data processing system, the method comprising: responsive to a condition being met to generate a new domain, allocating, by either a virtual machine monitor (VMM) or an operating system (OS), a portion of memory allocated to the VMM or the OS to the new domain; loading, by either the VMM or the OS, an initial program for the new domain into the portion of memory; calling, by either the VMM or the OS, secure recursive virtualization firmware (SVF) in the data processing system to request that the new domain be generated; responsive to receiving the call to generate the new domain from either the VMM or the OS, determining, by the SVF, whether the call is from a privileged domain or a non-privileged domain, wherein the privileged domain is authorized to generate either another privileged domain or a non-privileged domain and wherein the non-privileged domain is not authorized to generate either a privileged domain or another non-privileged domain; responsive to the request being from the privileged domain, removing, by the SVF, all access to the new domain from any other domain in the data processing system; responsive to receiving an indication from the SVF that the new domain has been generated, scheduling, by either the VMM or the OS, an execution of the initial program; reserving, by the SVF, a sub-portion of the portion of memory allocated to the new domain for secure recursive virtualization metadata (SVM); initializing, by the SVF, the SVM; marking, by the SVF, the new domain as either privileged or non-privileged as per the request from either the VMM or the OS; and returning, by the SVF, the indication to either the VMM or the OS that the new domain has been generated.