diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
index 477c968409..f10f6b78ec 100644
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -31,6 +31,7 @@
 #include <asm/xstate.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/io.h>
+#include <asm/hvm/nestedhvm.h>
 #include <asm/hvm/support.h>
 #include <asm/hvm/vmx/vmx.h>
 #include <asm/hvm/vmx/vvmx.h>
@@ -97,6 +98,7 @@ custom_param("ept", parse_ept_param);
 
 static int parse_ept_param_runtime(const char *s)
 {
+    struct domain *d;
     int val;
 
     if ( !cpu_has_vmx_ept || !hvm_funcs.hap_supported ||
@@ -110,18 +112,31 @@ static int parse_ept_param_runtime(const char *s)
     if ( (val = parse_boolean("exec-sp", s, NULL)) < 0 )
         return -EINVAL;
 
-    if ( val != opt_ept_exec_sp )
+    opt_ept_exec_sp = val;
+
+    rcu_read_lock(&domlist_read_lock);
+    for_each_domain ( d )
     {
-        struct domain *d;
+        /* PV, or HVM Shadow domain?  Not applicable. */
+        if ( !paging_mode_hap(d) )
+            continue;
 
-        opt_ept_exec_sp = val;
+        /* Hardware domain? Not applicable. */
+        if ( is_hardware_domain(d) )
+            continue;
 
-        rcu_read_lock(&domlist_read_lock);
-        for_each_domain ( d )
-            if ( paging_mode_hap(d) )
-                p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
-        rcu_read_unlock(&domlist_read_lock);
+        /* Nested Virt?  Broken and exec_sp forced on to avoid livelocks. */
+        if ( nestedhvm_enabled(d) )
+            continue;
+
+        /* Setting already matches?  No need to rebuild the p2m. */
+        if ( d->arch.hvm.vmx.exec_sp == val )
+            continue;
+
+        d->arch.hvm.vmx.exec_sp = val;
+        p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
     }
+    rcu_read_unlock(&domlist_read_lock);
 
     printk("VMX: EPT executable superpages %sabled\n",
            val ? "en" : "dis");
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 6a5eeb5c13..a71df71bc1 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -404,6 +404,12 @@ static int vmx_domain_initialise(struct domain *d)
 
     d->arch.ctxt_switch = &csw;
 
+    /*
+     * Work around CVE-2018-12207?  The hardware domain is already permitted
+     * to reboot the system, so doesn't need mitigating against DoS's.
+     */
+    d->arch.hvm.vmx.exec_sp = is_hardware_domain(d) || opt_ept_exec_sp;
+
     if ( !has_vlapic(d) )
         return 0;
 
diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 6696bd6240..5dd00e11b5 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -63,10 +63,23 @@ void nvmx_cpu_dead(unsigned int cpu)
 
 int nvmx_vcpu_initialise(struct vcpu *v)
 {
+    struct domain *d = v->domain;
     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
     struct page_info *pg = alloc_domheap_page(NULL, 0);
 
+    /*
+     * Gross bodge.  The nested p2m logic can't cope with the CVE-2018-12207
+     * workaround of using NX EPT superpages, and livelocks.  Nested HVM isn't
+     * security supported, so disable the workaround until the nested p2m
+     * logic can be improved.
+     */
+    if ( !d->arch.hvm.vmx.exec_sp )
+    {
+        d->arch.hvm.vmx.exec_sp = true;
+        p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
+    }
+
     if ( !pg )
     {
         gdprintk(XENLOG_ERR, "nest: allocation for shadow vmcs failed\n");
diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
index f06e51904a..b5517769c9 100644
--- a/xen/arch/x86/mm/p2m-ept.c
+++ b/xen/arch/x86/mm/p2m-ept.c
@@ -178,7 +178,7 @@ static void ept_p2m_type_to_flags(struct p2m_domain *p2m, ept_entry_t *entry,
      * Don't create executable superpages if we need to shatter them to
      * protect against CVE-2018-12207.
      */
-    if ( !opt_ept_exec_sp && is_epte_superpage(entry) )
+    if ( !p2m->domain->arch.hvm.vmx.exec_sp && is_epte_superpage(entry) )
         entry->x = 0;
 }
 
diff --git a/xen/include/asm-x86/hvm/vmx/vmcs.h b/xen/include/asm-x86/hvm/vmx/vmcs.h
index b3e800138e..2713da74db 100644
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
@@ -63,6 +63,12 @@ struct vmx_domain {
     unsigned long apic_access_mfn;
     /* VMX_DOMAIN_* */
     unsigned int status;
+
+    /*
+     * Domain permitted to use Executable EPT Superpages?  Cleared to work
+     * around CVE-2018-12207 as appropriate.
+     */
+    bool exec_sp;
 };
 
 /*
