@@ -146,7 +146,9 @@ restore flow over both transports:
   valid only for a snapshot that advertises processor activation, implies fresh entropy and the
   post-restore gate, and must satisfy the snapshot's boot-online and immutable
   capacity bounds. `ProcessorConfig.processor_count`, when present, remains an
-  exact capacity assertion.
+  exact capacity assertion. On MSHV, a nonzero value instantiates and binds
+  only that VP prefix, as for `--restore-processors`; MSHV restores without a
+  target, and all KVM and WHP restores, instantiate the full VP capacity.
 * `restore_memory_bytes` selects a 128-MiB-aligned total RAM target between the
   snapshot base and immutable capacity. Zero selects the base. Expansion uses
   fresh private zeroed backing, implies fresh restore packet delivery and the
 
@@ -1566,7 +1566,7 @@ impl InitializedVm {
 
         let Self {
             partition,
-            vps,
+            mut vps,
             vmtime_keeper,
             vmtime_source,
             memory_manager,
@@ -1583,6 +1583,12 @@ impl InitializedVm {
             driver_source,
         } = self;
 
+        let instantiated_vp_count = snapshot_restore.select_instantiated_vps(
+            &mut vps,
+            processor_topology.vp_count(),
+            saved_state.is_some(),
+        )?;
+
         let mut resolver = ResourceResolver::new();
 
         // Expose the partition reference time source, if available.
@@ -3109,7 +3115,7 @@ impl InitializedVm {
             partition.clone().into_vm_partition(),
             PartitionUnitParams {
                 processor_topology: &processor_topology,
-                active_vp_count: None,
+                active_vp_count: Some(instantiated_vp_count),
                 halt_vps,
                 halt_request_recv,
                 client_notify_send: halt_send,
@@ -3124,24 +3130,35 @@ impl InitializedVm {
         .context("failed to create partition unit")?;
 
         // Start the VP backing threads.
+        assert_eq!(
+            vps.len(),
+            vp_runners.len(),
+            "every instantiated VP needs exactly one binder and one runner"
+        );
+        let vp_thread_bind = openvmm_defs::profile::ProfileSpan::start();
         try_join_all(vps.into_iter().zip(vp_runners).enumerate().map(
             |(vp_index, (mut vp, runner))| {
                 let partition = partition.clone();
                 let chipset = chipset.clone();
                 let (send, recv) = mesh::oneshot();
                 thread::Builder::new()
                     .name(format!("vp-{}", vp_index))
-                    .spawn(move || match vp.bind() {
-                        Ok(mut vp) => {
-                            send.send(Ok(()));
-                            block_on_vp(
-                                partition,
-                                VpIndex::new(vp_index as u32),
-                                vp.run(runner, &chipset),
-                            )
-                        }
-                        Err(err) => {
-                            send.send(Err(err));
+                    .spawn(move || {
+                        let vp_bind = openvmm_defs::profile::ProfileSpan::start();
+                        let bound = vp.bind();
+                        complete_vp_bind_profile(vp_bind, vp_index);
+                        match bound {
+                            Ok(mut vp) => {
+                                send.send(Ok(()));
+                                block_on_vp(
+                                    partition,
+                                    VpIndex::new(vp_index as u32),
+                                    vp.run(runner, &chipset),
+                                )
+                            }
+                            Err(err) => {
+                                send.send(Err(err));
+                            }
                         }
                     })
                     .unwrap();
@@ -3154,6 +3171,7 @@ impl InitializedVm {
             },
         ))
         .await?;
+        vp_thread_bind.complete("startup", "vp_thread_bind", Default::default());
 
         let mut this = LoadedVm {
             state_units,
@@ -3235,6 +3253,19 @@ impl InitializedVm {
     }
 }
 
+/// Emits the non-exclusive profile milestone of binding VP `vp_index`.
+fn complete_vp_bind_profile(span: openvmm_defs::profile::ProfileSpan, vp_index: usize) {
+    if vp_index == 0 {
+        span.complete_milestone("startup", "vp_bind_bsp", Default::default());
+    } else if openvmm_defs::profile::enabled() {
+        span.complete_milestone(
+            "startup",
+            &format!("vp_bind_ap_{vp_index}"),
+            Default::default(),
+        );
+    }
+}
+
 impl LoadedVmInner {
     fn slit_info(&self) -> Option<SlitInfo> {
         let num_nodes = self.numa_cfg.nodes.len();
 
@@ -2,15 +2,18 @@
 // Licensed under the MIT License.
 
 //! Snapshot restore support for the VM worker: the restore inputs taken from
-//! the worker parameters, the restore state kept by [`LoadedVm`], the steps
-//! around applying the saved state, and the post-restore start sequence
+//! the worker parameters, the restore state kept by [`LoadedVm`], the VP
+//! prefix instantiated by an explicit restore-time activation target, the
+//! steps around applying the saved state, and the post-restore start sequence
 //! (input gate, readiness event, and VP release).
 
 use super::LoadedVm;
 use super::clock;
 use super::clock::RestoreTime;
 use crate::partition::HvlitePartition;
 use anyhow::Context;
+use hypervisor_resources::HypervisorKind;
+use hypervisor_resources::MshvHandle;
 use membacking::FileMappingMode;
 use membacking::SharedMemoryBacking;
 use openvmm_defs::profile::ProfileSpan;
@@ -27,6 +30,7 @@ use std::fs::File;
 use std::future::Future;
 use std::io::Write as _;
 use std::time::Duration;
+use vm_resource::ResourceId;
 use vmm_core::partition_unit::StopGuard;
 
 /// Snapshot-restore inputs taken from the [`VmWorkerParameters`].
@@ -54,6 +58,13 @@ impl RestoreParameters {
             parameters.restore_apic_frequency_hz,
         )?;
         tracing::debug!(?restore_time, "received snapshot restore time contract");
+        let restore_vp_count = parameters.restore_vp_count.take();
+        let vp_prefix = restore_vp_prefix(parameters.hypervisor.id(), restore_vp_count);
+        tracing::debug!(
+            ?restore_vp_count,
+            ?vp_prefix,
+            "received restore-time VP activation target"
+        );
         let cpu_contract = parameters.restore_cpu_contract.take();
         let file_mapping_mode = if parameters.shared_memory_copy_on_write {
             FileMappingMode::CopyOnWrite
@@ -63,6 +74,7 @@ impl RestoreParameters {
         Ok(Self {
             state: SnapshotRestore {
                 time: restore_time,
+                vp_prefix,
                 ready_sink,
                 gate_timeout,
                 ..Default::default()
@@ -79,11 +91,52 @@ impl RestoreParameters {
     }
 }
 
+/// Returns the VP prefix that a restore instantiates, or `None` for the full
+/// VP capacity.
+///
+/// Only MSHV instantiates an explicit restore-time activation target: it
+/// creates application processors lazily while binding them, so discarding
+/// the suffix binders avoids creating VPs that the restore will not run.
+/// Other backends create their VPs with the partition and keep the full
+/// capacity.
+fn restore_vp_prefix(hypervisor: &str, restore_vp_count: Option<u32>) -> Option<u32> {
+    restore_vp_count.filter(|_| hypervisor == <MshvHandle as ResourceId<HypervisorKind>>::ID)
+}
+
+/// Discards the binders after an explicit VP prefix and returns the number
+/// of VPs to instantiate. The topology and saved VP inventory keep the full
+/// capacity.
+fn select_instantiated_vps<T>(
+    vps: &mut Vec<T>,
+    vp_capacity: u32,
+    vp_prefix: Option<u32>,
+    restoring: bool,
+) -> anyhow::Result<u32> {
+    anyhow::ensure!(
+        vps.len() == vp_capacity as usize,
+        "backend returned {} VP binders for topology capacity {vp_capacity}",
+        vps.len()
+    );
+    let Some(vp_prefix) = vp_prefix else {
+        return Ok(vp_capacity);
+    };
+    anyhow::ensure!(restoring, "a restore VP prefix requires saved state");
+    anyhow::ensure!(
+        (1..=vp_capacity).contains(&vp_prefix),
+        "restore VP prefix {vp_prefix} is outside topology capacity 1..={vp_capacity}"
+    );
+    vps.truncate(vp_prefix as usize);
+    Ok(vp_prefix)
+}
+
 /// Snapshot-restore state of a [`LoadedVm`].
 #[derive(Default)]
 pub(super) struct SnapshotRestore {
     /// Saved guest-clock contract, checked and applied around the restore.
     time: Option<RestoreTime>,
+    /// VP prefix instantiated for an explicit MSHV restore-time activation
+    /// target.
+    vp_prefix: Option<u32>,
     /// Whether the VM was loaded from saved state.
     restored_from_snapshot: bool,
     /// Holds the VPs stopped after a restore until the VM first starts.
@@ -101,6 +154,17 @@ pub(super) struct SnapshotRestore {
 }
 
 impl SnapshotRestore {
+    /// Discards the binders after the restore VP prefix, if any, before
+    /// binding creates their VPs. Returns the number of VPs to instantiate.
+    pub(super) fn select_instantiated_vps<T>(
+        &self,
+        vps: &mut Vec<T>,
+        vp_capacity: u32,
+        restoring: bool,
+    ) -> anyhow::Result<u32> {
+        select_instantiated_vps(vps, vp_capacity, self.vp_prefix, restoring)
+    }
+
     /// Returns a future that completes when the armed post-restore input gate
     /// expires, and never completes while the gate is not armed.
     pub(super) fn gate_expired(&self, driver: &impl Driver) -> impl Future<Output = ()> {
@@ -260,3 +324,78 @@ impl LoadedVm {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use test_with_tracing::test;
+
+    fn binders() -> Vec<u32> {
+        (0..8).collect()
+    }
+
+    #[test]
+    fn limits_only_explicit_mshv_restores() {
+        assert_eq!(restore_vp_prefix("mshv", Some(2)), Some(2));
+        assert_eq!(restore_vp_prefix("mshv", None), None);
+        for hypervisor in ["kvm", "whp", "hvf"] {
+            assert_eq!(restore_vp_prefix(hypervisor, Some(2)), None);
+            assert_eq!(restore_vp_prefix(hypervisor, None), None);
+        }
+    }
+
+    #[test]
+    fn restore_vp_prefix_discards_suffix_binders() {
+        for prefix in [1, 2, 4, 8] {
+            let mut vps = binders();
+            assert_eq!(
+                select_instantiated_vps(&mut vps, 8, Some(prefix), true).unwrap(),
+                prefix
+            );
+            assert_eq!(vps, (0..prefix).collect::<Vec<_>>());
+        }
+    }
+
+    #[test]
+    fn untargeted_loads_keep_every_binder() {
+        for restoring in [false, true] {
+            let mut vps = binders();
+            assert_eq!(
+                select_instantiated_vps(&mut vps, 8, None, restoring).unwrap(),
+                8
+            );
+            assert_eq!(vps, binders());
+        }
+    }
+
+    #[test]
+    fn rejects_invalid_restore_vp_prefix() {
+        for prefix in [0, 9] {
+            let mut vps = binders();
+            let error = select_instantiated_vps(&mut vps, 8, Some(prefix), true).unwrap_err();
+            assert_eq!(
+                error.to_string(),
+                format!("restore VP prefix {prefix} is outside topology capacity 1..=8")
+            );
+            assert_eq!(vps, binders());
+        }
+
+        let mut vps = binders();
+        let error = select_instantiated_vps(&mut vps, 8, Some(2), false).unwrap_err();
+        assert_eq!(
+            error.to_string(),
+            "a restore VP prefix requires saved state"
+        );
+        assert_eq!(vps, binders());
+    }
+
+    #[test]
+    fn rejects_a_partial_backend_binder_set() {
+        let mut vps = (0..4).collect::<Vec<u32>>();
+        let error = select_instantiated_vps(&mut vps, 8, None, true).unwrap_err();
+        assert_eq!(
+            error.to_string(),
+            "backend returned 4 VP binders for topology capacity 8"
+        );
+    }
+}
@@ -87,7 +87,8 @@ pub struct VmWorkerParameters {
     pub restore_ready_sink: Option<std::fs::File>,
     /// Timeout for the microVM post-restore input gate, when required.
     pub restore_gate_timeout: Option<std::time::Duration>,
-    /// MSHV VP prefix instantiated for an explicit restore-time activation target.
+    /// Explicit restore-time activation target. MSHV instantiates and binds
+    /// only VPs `0..N-1`; other backends instantiate the full VP capacity.
     pub restore_vp_count: Option<u32>,
     /// The VM RPC channel.
     pub rpc: mesh::Receiver<VmRpc>,