1 . A method, implemented at a computer system that includes a processor, for providing a virtual machine (VM) management capability via guest firmware, the method comprising: operating a guest firmware within a first guest privilege context of a guest partition operating as a VM, the guest partition also including a second guest privilege context that is restricted from accessing memory associated with the first guest privilege context, and that is configured to operate a guest operating system (OS); and at the guest firmware, establishing a communications channel between the first guest privilege context and a client device; receiving, over the communications channel, a request for performance of a management operation against the VM; and based on the request, initiating the management operation, including at least one of: changing a power state of the VM; stopping or restarting the guest OS; presenting a serial console associated with the guest OS; presenting a graphical console associated with the guest OS; updating a firmware associated with the guest partition; or managing a virtual device presented by the first guest privilege context.
2 . The method of claim 1 , wherein initiating the management operation includes changing the power state of the VM, including at least one of starting a virtual processor associated with the guest partition or stopping the virtual processor.
3 . The method of claim 1 , wherein initiating the management operation includes stopping or restarting the guest OS, including setting an Advanced Configuration and Power Interface (ACPI) state.
4 . The method of claim 1 , wherein initiating the management operation includes presenting the serial console associated with the guest OS.
5 . The method of claim 1 , wherein initiating the management operation includes presenting the graphical console associated with the guest OS.
6 . The method of claim 1 , wherein initiating the management operation includes updating the firmware associated with the guest partition, and wherein the firmware is one of: the guest firmware; a Basic Input Output System (BIOS) firmware used by the guest OS; or a Unified Extensible Firmware Interface (UEFI) firmware used by the guest OS.
7 . The method of claim 1 , wherein initiating the management operation includes managing the virtual device presented by the first guest privilege context, and wherein the virtual device is one of: a virtual network interface over which the communications channel is established; a virtual console device over which the graphical or the serial console is presented; or a hardware interface device presented to the second guest privilege context.
8 . The method of claim 1 , wherein establishing the communications channel between the first guest privilege context and the client device comprises establishing the communications channel between a virtual network interface created by the guest firmware and the client device.
9 . The method of claim 1 , wherein establishing the communications channel between the first guest privilege context and the client device comprises establishing the communications channel between the guest firmware and a proxy component operating at a host partition.
10 . The method of claim 1 , wherein establishing the communications channel between the first guest privilege context and the client device comprises negotiating an encryption protocol with the client device.
11 . The method of claim 1 , further comprising creating the first guest privilege context and the second guest privilege context based on one or more of second-level address translation or nested virtualization.
12 . The method of claim 1 , wherein the guest OS is unaware of the first guest privilege context.
13 . The method of claim 1 , wherein a memory region associated with the guest partition is inaccessible to a host OS.
14 . A computer system, comprising: a processing system; and a computer storage media that stores computer-executable instructions that are executable by the processing system to at least: create a first guest privilege context and a second guest privilege context of a guest partition operating as a VM based on one or more of second-level address translation or nested virtualization, the second guest privilege being restricted from accessing memory associated with the first guest privilege context and being configured to operate a guest operating system (OS); operate a guest firmware within the first guest privilege context; establish a communications channel between the first guest privilege context and a client device; receive, over the communications channel, a request for performance of a management operation against the VM; and based on the request, initiate the management operation, including at least one of: change a power state of the VM; stop or restart the guest OS; present a serial console associated with the guest OS; present a graphical console associated with the guest OS; update a firmware associated with the guest partition; or manage a virtual device presented by the first guest privilege context.
15 . The computer system of claim 14 , wherein initiating the management operation includes changing the power state of the VM.
16 . The computer system of claim 14 , wherein initiating the management operation includes stopping or restarting the guest OS.
17 . The computer system of claim 14 , wherein initiating the management operation includes presenting the serial console associated with the guest OS or presenting the graphical console associated with the guest OS.
18 . The computer system of claim 14 , wherein initiating the management operation includes updating the firmware associated with the guest partition.
19 . The computer system of claim 14 , wherein initiating the management operation includes managing the virtual device presented by the first guest privilege context.
20 . A computer program product comprising a computer storage media that stores computer-executable instructions that are executable by a processing system to at least: operate a guest firmware within a first guest privilege context of a guest partition operating as a VM, the guest partition also including a second guest privilege context that is restricted from accessing memory associated with the first guest privilege context, and that is configured to operate a guest operating system (OS), wherein the guest OS is unaware of the first guest privilege context and wherein a memory region associated with the guest partition is inaccessible to a host OS; and at the guest firmware, establish a communications channel between the first guest privilege context and a client device; receive, over the communications channel, a request for performance of a management operation against the VM; and based on the request, initiate the management operation, including at least one of: change a power state of the VM; stop or restart the guest OS; present a serial console associated with the guest OS; present a graphical console associated with the guest OS; update a firmware associated with the guest partition; or manage a virtual device presented by the first guest privilege context.
