[MODERATED] NX, nested virtualization and arch caps

Right now, the NX patches are not advertising the
ARCH_CAP_PSCHANGE_MC_NO bit to its guests (especially nested
hypervisors).  This is despite KVM's shadow paging will ensure that the
nested hypervisor's EPT pages are 4K in size.

This is because nx_huge_pages is writable.  Therefore, the value of the
parameter could change from Y to N while a guest runs, and then the
nested hypervisor would become vulnerable to the nested guest's bad
behavior.

On the other hand, if the ITLB_MULTIHIT mitigation is disabled, then any
guest is anyway vulnerable to other guests' shenanigans.  Therefore the
nested hypervisor can just ignore ITLB_MULTIHIT altogether, even if it
would then be vulnerable to L2's bad behavior.  And this means we can
unconditionally advertise to nested hypervisors that the processor is
not vulnerable.

Are there any issues with this reasoning?

Thanks,

Paolo