[Sanddancer]

Yep. This is all stuff that VT-x can already do, only it's giving a nice little wrapper to do it to the "base" operating system. More than a bit of me sees this as something to encourage operating system developers to actually use the security features that virtualization allows, instead of doing the bare minimum and obvious with it.

[cuongpm]

The protected OS is de-privileged though. In order to protect a hardware virtualized hypervisor (i.e., one that also requires VT-x), they need to implement some sort of nested virtual machine.

[wtallis]

Haswell and later processors have extra hardware support to make nested virtual machines faster. It's not a problem.

[dman]

Any details about this?

[wtallis]

The feature is called VMCS shadowing. Wikipedia's description cites an Intel whitepaper (https://www-ssl.intel.com/content/dam/www/public/us/en/docum...) which describes how it's intended to help with the case of using McAfee's Deep Safe hypervisor (which does basically the same thing as this Kernel Guard, but for Windows) nested inside of Xen.