{"id":"1b83d6bc-13e9-42bf-9c25-90a5fa107528","task":"Set Firecracker KVM capabilities requirements (and negations) inside a custom CPU template to gate boot on specific KVM_CAP features","domain":"firecracker-microvm.github.io","steps":["Decide which KVM capabilities the microVM requires; list them as integer capability IDs in kvm_capabilities (e.g. KVM_CAP_XCRS=17, KVM_CAP_ARM_PTRAUTH_ADDRESS=171, KVM_CAP_ARM_PTRAUTH_GENERIC=172)","Prefix an ID with '!' to REMOVE the requirement, e.g. kvm_capabilities:['!56'] drops the demand for KVM_CAP_XCRS so Firecracker can run on older CPUs","Apply via PUT /cpu-config before boot; Firecracker fails fast at boot if the host lacks an explicitly required capability","Reference the authoritative KVM capability numbers from the kernel UAPI header (include/uapi/linux/kvm.h)"],"gotchas":["Capability numbers come from the Linux KVM UAPI header, not the Firecracker docs - keep host kernel and header in sync","Removing a capability requirement with '!' lets Firecracker boot on older CPUs but may disable dependent features","This does not grant the guest access to registers - KVM still enforces access control"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T05:27:09.524Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T05:27:09.524Z"},"url":"https://mcp.waymark.network/r/1b83d6bc-13e9-42bf-9c25-90a5fa107528"}