dholler@dholler-thinkpadp1gen3:~$  ssh dholler@192.168.178.145
Web console: https://localhost:9090/

Last login: Tue Feb 24 16:02:23 2026 from 192.168.178.45
dholler@linux:~$ uname -a
Linux linux.fritz.box 6.12.0-208stefanha.mbec.202602171515.el10.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Feb 17 15:55:47 EST 2026 x86_64 GNU/Linux
dholler@linux:~$  rpm -qa qemu-kvm
qemu-kvm-10.1.0-12.el10.stefanha.mbec.202602171515.x86_64
dholler@linux:~$  rpm -qa libvirt
libvirt-11.10.0-4.el10.x86_64
dholler@linux:~$ export MACHINE=q35 
dholler@linux:~$ export ARCH=x86_64
dholler@linux:~$ export VIRTTYPE=kvm
dholler@linux:~$ virsh domcapabilities --machine $MACHINE --arch $ARCH --virttype $VIRTTYPE | virsh hypervisor-cpu-baseline --features /dev/stdin --machine $MACHINE --arch $ARCH --virttype $VIRTTYPE
<cpu mode='custom' match='exact'>
  <model fallback='forbid'>SierraForest</model>
  <vendor>Intel</vendor>
  <maxphysaddr mode='passthrough' limit='46'/>
  <feature policy='require' name='3dnowprefetch'/>
  <feature policy='require' name='abm'/>
  <feature policy='require' name='adx'/>
  <feature policy='require' name='aes'/>
  <feature policy='require' name='amd-ssbd'/>
  <feature policy='require' name='amd-stibp'/>
  <feature policy='require' name='apic'/>
  <feature policy='require' name='arat'/>
  <feature policy='require' name='arch-capabilities'/>
  <feature policy='require' name='avx'/>
  <feature policy='disable' name='avx-ifma'/>
  <feature policy='disable' name='avx-ne-convert'/>
  <feature policy='require' name='avx-vnni'/>
  <feature policy='disable' name='avx-vnni-int8'/>
  <feature policy='require' name='avx2'/>
  <feature policy='require' name='bhi-ctrl'/>
  <feature policy='require' name='bmi1'/>
  <feature policy='require' name='bmi2'/>
  <feature policy='disable' name='bus-lock-detect'/>
  <feature policy='require' name='clflush'/>
  <feature policy='require' name='clflushopt'/>
  <feature policy='require' name='clwb'/>
  <feature policy='require' name='cmov'/>
  <feature policy='disable' name='cmpccxadd'/>
  <feature policy='require' name='cx16'/>
  <feature policy='require' name='cx8'/>
  <feature policy='require' name='ddpd-u'/>
  <feature policy='require' name='de'/>
  <feature policy='require' name='erms'/>
  <feature policy='require' name='f16c'/>
  <feature policy='require' name='fbsdp-no'/>
  <feature policy='require' name='fdp-excptn-only'/>
  <feature policy='require' name='flush-l1d'/>
  <feature policy='require' name='fma'/>
  <feature policy='require' name='fpu'/>
  <feature policy='require' name='fsgsbase'/>
  <feature policy='require' name='fsrm'/>
  <feature policy='require' name='fsrs'/>
  <feature policy='require' name='fxsr'/>
  <feature policy='require' name='gds-no'/>
  <feature policy='require' name='gfni'/>
  <feature policy='require' name='hypervisor'/>
  <feature policy='require' name='ibpb'/>
  <feature policy='require' name='ibrs'/>
  <feature policy='require' name='ibrs-all'/>
  <feature policy='require' name='intel-psfd'/>
  <feature policy='require' name='invpcid'/>
  <feature policy='require' name='invtsc'/>
  <feature policy='require' name='ipred-ctrl'/>
  <feature policy='require' name='its-no'/>
  <feature policy='require' name='lahf_lm'/>
  <feature policy='require' name='lm'/>
  <feature policy='require' name='mca'/>
  <feature policy='disable' name='mcdt-no'/>
  <feature policy='require' name='mce'/>
  <feature policy='require' name='md-clear'/>
  <feature policy='require' name='mds-no'/>
  <feature policy='require' name='mmx'/>
  <feature policy='require' name='movbe'/>
  <feature policy='require' name='movdir64b'/>
  <feature policy='require' name='movdiri'/>
  <feature policy='require' name='msr'/>
  <feature policy='require' name='mtrr'/>
  <feature policy='require' name='nx'/>
  <feature policy='require' name='pae'/>
  <feature policy='require' name='pat'/>
  <feature policy='disable' name='pbrsb-no'/>
  <feature policy='require' name='pcid'/>
  <feature policy='require' name='pclmuldq'/>
  <feature policy='require' name='pdpe1gb'/>
  <feature policy='require' name='pge'/>
  <feature policy='require' name='pku'/>
  <feature policy='require' name='pni'/>
  <feature policy='require' name='popcnt'/>
  <feature policy='require' name='pschange-mc-no'/>
  <feature policy='require' name='psdp-no'/>
  <feature policy='require' name='pse'/>
  <feature policy='require' name='pse36'/>
  <feature policy='require' name='rdctl-no'/>
  <feature policy='require' name='rdpid'/>
  <feature policy='require' name='rdrand'/>
  <feature policy='require' name='rdseed'/>
  <feature policy='require' name='rdtscp'/>
  <feature policy='require' name='rfds-clear'/>
  <feature policy='require' name='rrsba-ctrl'/>
  <feature policy='require' name='sbdr-ssdp-no'/>
  <feature policy='require' name='sep'/>
  <feature policy='require' name='serialize'/>
  <feature policy='require' name='sha-ni'/>
  <feature policy='require' name='skip-l1dfl-vmentry'/>
  <feature policy='require' name='smap'/>
  <feature policy='require' name='smep'/>
  <feature policy='require' name='spec-ctrl'/>
  <feature policy='require' name='ss'/>
  <feature policy='require' name='ssbd'/>
  <feature policy='require' name='sse'/>
  <feature policy='require' name='sse2'/>
  <feature policy='require' name='sse4.1'/>
  <feature policy='require' name='sse4.2'/>
  <feature policy='require' name='ssse3'/>
  <feature policy='require' name='stibp'/>
  <feature policy='require' name='syscall'/>
  <feature policy='require' name='tsc'/>
  <feature policy='require' name='tsc-deadline'/>
  <feature policy='require' name='tsc_adjust'/>
  <feature policy='require' name='umip'/>
  <feature policy='require' name='vaes'/>
  <feature policy='require' name='vme'/>
  <feature policy='require' name='vmx'/>
  <feature policy='require' name='vmx-activity-hlt'/>
  <feature policy='require' name='vmx-activity-wait-sipi'/>
  <feature policy='require' name='vmx-apicv-register'/>
  <feature policy='require' name='vmx-apicv-vid'/>
  <feature policy='require' name='vmx-apicv-x2apic'/>
  <feature policy='require' name='vmx-apicv-xapic'/>
  <feature policy='require' name='vmx-cr3-load-noexit'/>
  <feature policy='require' name='vmx-cr3-store-noexit'/>
  <feature policy='require' name='vmx-cr8-load-exit'/>
  <feature policy='require' name='vmx-cr8-store-exit'/>
  <feature policy='require' name='vmx-desc-exit'/>
  <feature policy='require' name='vmx-enable-user-wait-pause'/>
  <feature policy='require' name='vmx-entry-ia32e-mode'/>
  <feature policy='require' name='vmx-entry-load-efer'/>
  <feature policy='require' name='vmx-entry-load-pat'/>
  <feature policy='require' name='vmx-entry-load-perf-global-ctrl'/>
  <feature policy='require' name='vmx-entry-noload-debugctl'/>
  <feature policy='require' name='vmx-ept'/>
  <feature policy='require' name='vmx-ept-1gb'/>
  <feature policy='require' name='vmx-ept-2mb'/>
  <feature policy='require' name='vmx-ept-execonly'/>
  <feature policy='require' name='vmx-eptad'/>
  <feature policy='require' name='vmx-eptp-switching'/>
  <feature policy='require' name='vmx-exit-ack-intr'/>
  <feature policy='require' name='vmx-exit-load-efer'/>
  <feature policy='require' name='vmx-exit-load-pat'/>
  <feature policy='require' name='vmx-exit-load-perf-global-ctrl'/>
  <feature policy='require' name='vmx-exit-nosave-debugctl'/>
  <feature policy='require' name='vmx-exit-save-efer'/>
  <feature policy='require' name='vmx-exit-save-pat'/>
  <feature policy='require' name='vmx-exit-save-preemption-timer'/>
  <feature policy='require' name='vmx-flexpriority'/>
  <feature policy='require' name='vmx-hlt-exit'/>
  <feature policy='require' name='vmx-ins-outs'/>
  <feature policy='require' name='vmx-intr-exit'/>
  <feature policy='require' name='vmx-invept'/>
  <feature policy='require' name='vmx-invept-all-context'/>
  <feature policy='require' name='vmx-invept-single-context'/>
  <feature policy='require' name='vmx-invlpg-exit'/>
  <feature policy='require' name='vmx-invpcid-exit'/>
  <feature policy='require' name='vmx-invvpid'/>
  <feature policy='require' name='vmx-invvpid-all-context'/>
  <feature policy='require' name='vmx-invvpid-single-addr'/>
  <feature policy='require' name='vmx-invvpid-single-context-noglobals'/>
  <feature policy='require' name='vmx-io-bitmap'/>
  <feature policy='require' name='vmx-io-exit'/>
  <feature policy='require' name='vmx-monitor-exit'/>
  <feature policy='require' name='vmx-movdr-exit'/>
  <feature policy='require' name='vmx-msr-bitmap'/>
  <feature policy='require' name='vmx-mtf'/>
  <feature policy='require' name='vmx-mwait-exit'/>
  <feature policy='require' name='vmx-nmi-exit'/>
  <feature policy='require' name='vmx-page-walk-4'/>
  <feature policy='require' name='vmx-pause-exit'/>
  <feature policy='require' name='vmx-pml'/>
  <feature policy='require' name='vmx-posted-intr'/>
  <feature policy='require' name='vmx-preemption-timer'/>
  <feature policy='require' name='vmx-rdpmc-exit'/>
  <feature policy='require' name='vmx-rdrand-exit'/>
  <feature policy='require' name='vmx-rdseed-exit'/>
  <feature policy='require' name='vmx-rdtsc-exit'/>
  <feature policy='require' name='vmx-rdtscp-exit'/>
  <feature policy='require' name='vmx-secondary-ctls'/>
  <feature policy='require' name='vmx-shadow-vmcs'/>
  <feature policy='require' name='vmx-store-lma'/>
  <feature policy='require' name='vmx-true-ctls'/>
  <feature policy='require' name='vmx-tsc-offset'/>
  <feature policy='require' name='vmx-tsc-scaling'/>
  <feature policy='require' name='vmx-unrestricted-guest'/>
  <feature policy='require' name='vmx-vintr-pending'/>
  <feature policy='require' name='vmx-vmfunc'/>
  <feature policy='require' name='vmx-vmwrite-vmexit-fields'/>
  <feature policy='require' name='vmx-vnmi'/>
  <feature policy='require' name='vmx-vnmi-pending'/>
  <feature policy='require' name='vmx-vpid'/>
  <feature policy='require' name='vmx-wbinvd-exit'/>
  <feature policy='require' name='vmx-xsaves'/>
  <feature policy='require' name='vpclmulqdq'/>
  <feature policy='require' name='waitpkg'/>
  <feature policy='disable' name='wbnoinvd'/>
  <feature policy='require' name='x2apic'/>
  <feature policy='require' name='xgetbv1'/>
  <feature policy='require' name='xsave'/>
  <feature policy='require' name='xsavec'/>
  <feature policy='require' name='xsaveopt'/>
  <feature policy='require' name='xsaves'/>
  <feature policy='require' name='zero-fcs-fds'/>
</cpu>

dholler@linux:~$ virsh capabilities |  virsh hypervisor-cpu-baseline --features /dev/stdin                                                     
Authorization not available. Check if polkit service is running or see debug message f
warning: using host CPU definition as input may provide incorrect results
<cpu mode='custom' match='exact'>
  <model fallback='forbid'>Snowridge</model>
  <vendor>Intel</vendor>
  <feature policy='require' name='3dnowprefetch'/>
  <feature policy='require' name='abm'/>
  <feature policy='require' name='acpi'/>
  <feature policy='require' name='adx'/>
  <feature policy='require' name='aes'/>
  <feature policy='require' name='apic'/>
  <feature policy='require' name='arat'/>
  <feature policy='require' name='arch-capabilities'/>
  <feature policy='require' name='arch-lbr'/>
  <feature policy='require' name='avx'/>
  <feature policy='require' name='avx-vnni'/>
  <feature policy='require' name='avx2'/>
  <feature policy='require' name='bhi-ctrl'/>
  <feature policy='require' name='bmi1'/>
  <feature policy='require' name='bmi2'/>
  <feature policy='disable' name='cldemote'/>
  <feature policy='require' name='clflush'/>
  <feature policy='require' name='clflushopt'/>
  <feature policy='require' name='clwb'/>
  <feature policy='require' name='cmov'/>
  <feature policy='disable' name='core-capability'/>
  <feature policy='require' name='cx16'/>
  <feature policy='require' name='cx8'/>
  <feature policy='require' name='ddpd-u'/>
  <feature policy='require' name='de'/>
  <feature policy='require' name='ds'/>
  <feature policy='require' name='ds_cpl'/>
  <feature policy='require' name='dtes64'/>
  <feature policy='require' name='erms'/>
  <feature policy='require' name='est'/>
  <feature policy='require' name='f16c'/>
  <feature policy='require' name='fbsdp-no'/>
  <feature policy='require' name='fdp-excptn-only'/>
  <feature policy='require' name='flush-l1d'/>
  <feature policy='require' name='fma'/>
  <feature policy='require' name='fpu'/>
  <feature policy='require' name='fsgsbase'/>
  <feature policy='require' name='fsrm'/>
  <feature policy='require' name='fsrs'/>
  <feature policy='require' name='fxsr'/>
  <feature policy='require' name='gds-no'/>
  <feature policy='require' name='gfni'/>
  <feature policy='require' name='ht'/>
  <feature policy='require' name='ibrs-all'/>
  <feature policy='require' name='intel-psfd'/>
  <feature policy='require' name='intel-pt'/>
  <feature policy='require' name='intel-pt-lip'/>
  <feature policy='require' name='invpcid'/>
  <feature policy='require' name='invtsc'/>
  <feature policy='require' name='ipred-ctrl'/>
  <feature policy='require' name='its-no'/>
  <feature policy='require' name='lahf_lm'/>
  <feature policy='require' name='lm'/>
  <feature policy='require' name='mca'/>
  <feature policy='require' name='mce'/>
  <feature policy='require' name='md-clear'/>
  <feature policy='require' name='mds-no'/>
  <feature policy='require' name='mmx'/>
  <feature policy='require' name='monitor'/>
  <feature policy='require' name='movbe'/>
  <feature policy='require' name='movdir64b'/>
  <feature policy='require' name='movdiri'/>
  <feature policy='disable' name='mpx'/>
  <feature policy='require' name='msr'/>
  <feature policy='require' name='mtrr'/>
  <feature policy='require' name='nx'/>
  <feature policy='require' name='pae'/>
  <feature policy='require' name='pat'/>
  <feature policy='require' name='pbe'/>
  <feature policy='require' name='pcid'/>
  <feature policy='require' name='pclmuldq'/>
  <feature policy='require' name='pdcm'/>
  <feature policy='require' name='pdpe1gb'/>
  <feature policy='require' name='pge'/>
  <feature policy='require' name='pks'/>
  <feature policy='require' name='pku'/>
  <feature policy='require' name='pni'/>
  <feature policy='require' name='popcnt'/>
  <feature policy='require' name='pschange-mc-no'/>
  <feature policy='require' name='psdp-no'/>
  <feature policy='require' name='pse'/>
  <feature policy='require' name='pse36'/>
  <feature policy='require' name='rdctl-no'/>
  <feature policy='require' name='rdpid'/>
  <feature policy='require' name='rdrand'/>
  <feature policy='require' name='rdseed'/>
  <feature policy='require' name='rdtscp'/>
  <feature policy='require' name='rfds-clear'/>
  <feature policy='require' name='rrsba-ctrl'/>
  <feature policy='require' name='sbdr-ssdp-no'/>
  <feature policy='require' name='sep'/>
  <feature policy='require' name='serialize'/>
  <feature policy='require' name='sha-ni'/>
  <feature policy='require' name='skip-l1dfl-vmentry'/>
  <feature policy='require' name='smap'/>
  <feature policy='require' name='smep'/>
  <feature policy='require' name='smx'/>
  <feature policy='require' name='spec-ctrl'/>
  <feature policy='disable' name='split-lock-detect'/>
  <feature policy='require' name='ss'/>
  <feature policy='require' name='ssbd'/>
  <feature policy='require' name='sse'/>
  <feature policy='require' name='sse2'/>
  <feature policy='require' name='sse4.1'/>
  <feature policy='require' name='sse4.2'/>
  <feature policy='require' name='ssse3'/>
  <feature policy='require' name='stibp'/>
  <feature policy='require' name='syscall'/>
  <feature policy='require' name='tm'/>
  <feature policy='require' name='tm2'/>
  <feature policy='require' name='tsc'/>
  <feature policy='require' name='tsc-deadline'/>
  <feature policy='require' name='tsc_adjust'/>
  <feature policy='require' name='umip'/>
  <feature policy='require' name='vaes'/>
  <feature policy='require' name='vme'/>
  <feature policy='require' name='vmx'/>
  <feature policy='require' name='vmx-activity-hlt'/>
  <feature policy='require' name='vmx-activity-wait-sipi'/>
  <feature policy='require' name='vmx-ept-1gb'/>
  <feature policy='require' name='vmx-ept-2mb'/>
  <feature policy='require' name='vmx-ept-execonly'/>
  <feature policy='require' name='vmx-eptad'/>
  <feature policy='require' name='vmx-eptp-switching'/>
  <feature policy='require' name='vmx-ins-outs'/>
  <feature policy='require' name='vmx-invept'/>
  <feature policy='require' name='vmx-invept-all-context'/>
  <feature policy='require' name='vmx-invept-single-context'/>
  <feature policy='require' name='vmx-invvpid'/>
  <feature policy='require' name='vmx-invvpid-all-context'/>
  <feature policy='require' name='vmx-invvpid-single-addr'/>
  <feature policy='require' name='vmx-invvpid-single-context-noglobals'/>
  <feature policy='require' name='vmx-page-walk-4'/>
  <feature policy='require' name='vmx-store-lma'/>
  <feature policy='require' name='vmx-true-ctls'/>
  <feature policy='require' name='vmx-vmwrite-vmexit-fields'/>
  <feature policy='require' name='vpclmulqdq'/>
  <feature policy='require' name='waitpkg'/>
  <feature policy='require' name='x2apic'/>
  <feature policy='require' name='xgetbv1'/>
  <feature policy='require' name='xsave'/>
  <feature policy='require' name='xsavec'/>
  <feature policy='require' name='xsaveopt'/>
  <feature policy='require' name='xsaves'/>
  <feature policy='require' name='xtpr'/>
  <feature policy='require' name='zero-fcs-fds'/>
</cpu>

bash: Authorization: command not found...
dholler@linux:~$ grep ept_mode_based_exec /proc/cpuinfo | head -1
vmx flags	: vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple shadow_vmcs ept_violation_ve ept_mode_based_exec tsc_scaling usr_wait_pause
dholler@linux:~$