1. A method for isolating a kernel extension in a computer system with hardware virtualization support, the method comprising: executing a kernel in a first hardware protection domain, including calling to a first kernel extension, a first set of computer resource privileges being allowed for code executing in the first hardware protection domain; and executing the first kernel extension in a second hardware protection domain, a second set of computer resource privileges being allowed for code executing in the second hardware protection domain, the first set of computer resource privileges being different from the second set of computer resource privileges.