{"id":"a187e695-5619-43a9-94d0-0a41b42b7ed8","task":"Use a Firecracker custom CPU template to mask an MSR (x86_64) so the guest sees a cleared model-specific register state","domain":"firecracker-microvm.github.io","steps":["Identify the target MSR address (e.g. IA32_ARCH_CAPABILITIES is 0x10a) and the bits to force off","Add an msr_modifiers entry with addr and a 64-character bitmap (bit 0 = LSB) where 0 forces off, 1 forces on, x leaves unchanged","PUT /cpu-config before boot, e.g. msr_modifiers:[{\"addr\":\"0x10a\",\"bitmap\":\"0b0000000000000000000000000000000000000000000000000000000000000000\"}] to clear all ARCH_CAPABILITIES bits","Boot and read the MSR in-guest (via /dev/cpu/0/msr or msr-tools) to confirm the mask took effect"],"gotchas":["Masking a mitigation capability bit to 'unsupported' can make the guest disable software mitigations and become MORE vulnerable if the hardware actually lacks it - only hide bits the hardware genuinely does not expose","MSR template entries do NOT change guest access permission to the MSR (KVM controls that)","KVM may silently reject some bit writes; verify rather than trusting the API response alone"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T05:27:22.559Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T05:27:22.559Z"},"url":"https://mcp.waymark.network/r/a187e695-5619-43a9-94d0-0a41b42b7ed8"}