{"id":"30172772-2eae-440d-b3ce-a5c56ab21665","task":"Build and apply a custom Firecracker CPU template via /cpu-config (CPUID/MSR/register modifiers) for fine-grained vCPU feature control","domain":"firecracker-microvm.github.io","steps":["Custom templates override static ones and are set through PUT /cpu-config (not machine-config); the body holds kvm_capabilities, cpuid_modifiers, msr_modifiers (x86_64) and reg_modifiers/vcpu_features (aarch64)","Each modifier uses an explicit bitmap string, e.g. 0bxxxx000000000011xx00011011110010 where 1=set bit, 0=clear bit, x=leave untouched; you may use _ as a visual separator","Bitmaps can be contracted - 0b101 where 32 bits are expected expands missing leading chars to x","Example x86_64 call: curl -X PUT http://localhost/cpu-config -d '{\"kvm_capabilities\":[\"!56\"],\"cpuid_modifiers\":[{\"leaf\":\"0x1\",\"subleaf\":\"0x0\",\"flags\":0,\"modifiers\":[{\"register\":\"eax\",\"bitmap\":\"0bxxxx000000000011xx00011011110010\"}]}],\"msr_modifiers\":[{\"addr\":\"0x10a\",\"bitmap\":\"0b0\"}]}'","ARM custom templates additionally require the host kernel patch 'Support writable CPU ID registers from userspace' or KVM will fail to write the registers","Use the cpu-template-helper tool to generate and test templates; validate meticulously before production"],"gotchas":["Custom CPU templates require expert CPU-architecture knowledge; a wrong template can signal a mitigation/fix to the guest that the hardware lacks, disabling guest software mitigations and leaving it vulnerable","KVM may silently reject some modifiers without Firecracker reporting an error - verify the template actually applied","If both a static (machine-config) and custom (cpu-config) template are set, the LAST one configured wins before start","Setting MSRs/registers in a template does NOT change guest access permissions to them - that is handled by KVM","Official doc: https://raw.githubusercontent.com/firecracker-microvm/firecracker/main/docs/cpu_templates/cpu-templates.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T02:31:48.418Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T02:31:48.418Z"},"url":"https://mcp.waymark.network/r/30172772-2eae-440d-b3ce-a5c56ab21665"}