Re: [PATCH v9 3/6] x86/sev: Disable CPU hotplug while SNP is active

[Kalra, Ashish]

Hello Boris,

On 6/26/2026 11:40 AM, Borislav Petkov wrote:
> On Thu, Jun 25, 2026 at 02:42:23PM -0500, Kalra, Ashish wrote:
>> Hello Boris,
> 
> Hello Ashish,
> 
> lemme try to make sense of your AI reply...
> 
>> cpu_hotplug_disable()/cpu_hotplug_enable() are refcounted (cpu_hotplug_disabled++/--,
>> with a WARN on underflow), so they have to be balanced. This flag collapses them to
>> exactly one outstanding disable per SNP-active window, because the disable and enable
>> sites are not reached a symmetric number of times:
> 
> Well, why aren't they?
> 
> Why isn't a simple design where on SNP init hotplug is disabled - *exactly*
> one call to cpu_hotplug_disable() and on SNP shutdown hotplug is reenabled
> again - also exactly one call.
> 
> I know why...
> 

It can be that simple, and flag-free, by following the SNP_EN state:

  - cpu_hotplug_disable() when SNP_EN is programmed: in snp_prepare(), before snp_enable().
  - cpu_hotplug_enable() when SNP_EN is cleared: in snp_shutdown(), after the firmware clears
  it on X86_SNP_SHUTDOWN.

SNP_EN is set only by snp_enable() in snp_prepare() (gated by online == present),
and only the firmware clears it. So:

  - snp_prepare() programs SNP_EN and disables hotplug on the same path; if it's
  called again while SNP_EN is already set (re-init), it bails before the
  disable.
  - snp_shutdown() runs only on the X86_SNP_SHUTDOWN path, after SNP_EN has been
  cleared, and enables hotplug. A legacy shutdown leaves SNP_EN set and does
  not call snp_shutdown(), so hotplug correctly stays disabled.

We also have to re-enable cpu hotplug on the init failure paths 
(snp_prepare()'s online != present check, and the SNP_INIT_EX / DF_FLUSH failures in 
__sev_snp_init_locked()), so a failed init leaves hotplug enabled, as it was before
this support.

The only extra case is a kexec target that boots with SNP_EN already set (legacy
firmware -- on X86_SNP_SHUTDOWN firmware the full shutdown required before kexec
clears SNP_EN, so the target re-inits normally). There snp_prepare() bails, so I
do the disable once at boot in snp_rmptable_init() when SNP_EN is already set.
That and the snp_prepare() disable can't both run -- SNP_EN is either already set
at boot, or it gets programmed by snp_prepare().

No (extra) flag needed.

Thanks,
Ashish