L0 KVM and Win10 L1 nested virtualization not working (Windows boot loop)

I'm having a hard time getting nested virtualization inside my Win10 Pro guest running on KVM host working. Enabling Windows Hypervisor hypervisorlaunchtype auto results in a boot loop/boot to Automatic Repair.

Host:

CentOS Linux release 8.2.2004 (Core)

Intel(R) Xeon(R) E-2176G CPU @ 3.70GHz

# cat /sys/module/kvm_intel/parameters/nested
1

flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d

Guest:

Microsoft Windows [Version 10.0.19041.508]

I've tried multiple configurations, migrated my Windows from BIOS to UEFI, tried a clean Windows installation, disabled/rebooted/enabled/rebooted the Hypervisor features, etc. nothing working yet.

My current configuration:

  <os>
    <type arch='x86_64' machine='pc-q35-rhel7.6.0'>hvm</type>
    <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
    <nvram>/var/lib/libvirt/qemu/nvram/win10_VARS.fd</nvram>
  </os>
  <features>
    <acpi/>
    <apic eoi='on'/>
    <hyperv>
      <relaxed state='on'/>
      <vapic state='on'/>
      <spinlocks state='on' retries='8191'/>
    </hyperv>
    <kvm>
      <hidden state='on'/>
    </kvm>
    <vmport state='off'/>
    <smm state='on'/>
  </features>
  <cpu mode='host-passthrough' check='partial'>
    <topology sockets='1' cores='4' threads='2'/>
    <feature policy='require' name='ds'/>
    <feature policy='require' name='acpi'/>
    <feature policy='require' name='ss'/>
    <feature policy='require' name='ht'/>
    <feature policy='require' name='tm'/>
    <feature policy='require' name='pbe'/>
    <feature policy='require' name='dtes64'/>
    <feature policy='require' name='monitor'/>
    <feature policy='require' name='ds_cpl'/>
    <feature policy='require' name='vmx'/>
    <feature policy='require' name='smx'/>
    <feature policy='require' name='est'/>
    <feature policy='require' name='tm2'/>
    <feature policy='require' name='xtpr'/>
    <feature policy='require' name='pdcm'/>
    <feature policy='require' name='osxsave'/>
    <feature policy='require' name='tsc_adjust'/>
    <feature policy='require' name='clflushopt'/>
    <feature policy='require' name='intel-pt'/>
    <feature policy='require' name='md-clear'/>
    <feature policy='require' name='stibp'/>
    <feature policy='require' name='ssbd'/>
    <feature policy='require' name='xsaves'/>
    <feature policy='require' name='pdpe1gb'/>
    <feature policy='require' name='invtsc'/>
    <feature policy='disable' name='hypervisor'/>
  </cpu>

Note the last feature hypervisor: If disable, Windows boots and reports Hyper-V as working (systeminfo reports Hyper-V Requirements as available, TaskManager shows Virtualization enabled, etc.), but Hyper-V cannot launch any VM, system logs report that hypervisor is not running. Setting the feature to require brings me in the boot loop/boot to Automatic Repair.

And since it's a bit hard to google this option in this context:

• What does the hypervisor feature exactly do? Where is it documented?

It seems to me that the windows hypervisor crashes on launch with the feature enabled and with the feature disabled just cannot start and continues the boot process.

I'm now out of ideas what else I could try and also believe that I've checked pretty much every search result on the topic. But maybe I've missed something, so please

• Can anyone report a successful setup like this? And if so, sharing the guest config would be great!
• Any other ideas I should try to make this work?

Thanks!

PS: Virtualization itself works great and fast, so I'm pretty sure everything from hardware side is OK, but maybe there're things I should check for as well?!