Implementation of Intel virtual machine extension root operation on the NPS least privilege separation kernel

A virtual machine monitor (VMM) supports execution of multiple unmodified operating systems in virtual machines (VMs) on one computer. VMM support has been added to the Intel IA 32 architecture. Enforcement of data flow policies between VMs requires a highly trustworthy VMM. Such VMMs take advantage of hardware support. The work described here explores whether the Naval Postgraduate School Least Privilege Separation Kernel (LPSK) can incorporate Intel hardware support for virtualization. The Intel documentation and LPSK code were reviewed to determine the changes required to transition the target processor to Virtual Machine Extension (VMX) root operation. First, paging in the LPSK had to be enabled. Requirements for the VMXON and VMXOFF instructions were determined and changes were made to the LPSK to enable the target processor to transition to VMX root operation. Testing showed that the changes to the LPSK allowed the target processor to successfully transition to and from VMX root operation.http://archive.org/details/implementationof109455186Outstanding ThesisNaval Postgraduate School author (civilian)Approved for public release; distribution is unlimited