{"id":"8e06ff98-841c-4e55-9452-de4a3136959e","task":"Apply a custom Firecracker CPU template via /cpu-config to mask a specific x86_64 CPUID feature bit from the guest","domain":"firecracker-microvm.github.io","steps":["Write your template as JSON: kvm_capabilities (optional, can negate with '!'), cpuid_modifiers for x86_64 leaves, msr_modifiers for MSRs","Each cpuid_modifier references a leaf/subleaf and a register (eax/ebx/ecx/edx) with a bitmap where 1=force bit on, x=leave unchanged, 0=force bit off - e.g. leaf 0x1 subleaf 0x0 register eax with bitmap '0bxxxx000000000011xx00011011110010'","Send it before boot: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/cpu-config -H 'Content-Type: application/json' -d @template.json","Bitmaps can be contracted (e.g. 0b101) with implied leading 'x' bits, and '_' is allowed as a visual separator","Start the microVM only after PUT /cpu-config succeeds, then verify guests observe the intended feature mask"],"gotchas":["Custom CPU templates require deep x86 architecture knowledge - cite the Intel SDM; an invalid template can crash guests or make them insecure","KVM may silently ignore bits it cannot set; verify the mask actually applied even if Firecracker returns no error","CPU templates are NOT a security boundary against malicious guests - a guest can ignore a cleared feature bit and still execute the instruction","MSRs in a template do not change guest access permissions to those registers (KVM owns access control)","In leaf 0x1 eax: clears bits 0b00001111111111000011100100001101, sets 0b00000000000000110000011011110010, leaves the rest intact"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T05:29:24.594Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T05:29:24.594Z"},"url":"https://mcp.waymark.network/r/8e06ff98-841c-4e55-9452-de4a3136959e"}