Patent ID: 8595487

Claim:
A method for isolating a kernel extension in a computer system with hardware virtualization support, the method comprising: executing a kernel in a first hardware protection domain, including calling to a first kernel extension, a first set of computer resource privileges being allowed for code executing in the first hardware protection domain; executing the first kernel extension in a second hardware protection domain, a second set of computer resource privileges being allowed for code executing in the second hardware protection domain, the first set of computer resource privileges being different from the second set of computer resource privileges, wherein each hardware protection domain is determined at least in part by events described in a virtual machine control data structure provided by the hardware virtualization support; wherein the kernel and the first kernel extension execute in a common execution privilege level, the common execution privilege level being a special execution privilege level allowing execution of instructions that are not allowed in other execution privilege levels; and wherein no virtualization hypervisor or emulation layer is interposed between hardware of the computer system and either the kernel or the first kernel extension.