Description of problem:
This issue is found in another bug Bug 1961761 - Enabling Device Guard in Windows on RHV 4.4 gives BSOD on reboot. Windows guest stucks at the tiancore icon with secure boot and HyperV enabled.

Version-Release number of selected component (if applicable):
kernel-4.18.0-355.el8.x86_64
qemu-kvm-6.1.0-3.module+el8.6.0+12982+5e169f40.x86_64
edk2-ovmf-20210527gite1999b264f1f-3.el8.noarch
libvirt-7.8.0-1.module+el8.6.0+12982+5e169f40.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Boot a L1 win2016 guest and windows update to the latest with secure boot
guest XML please check attachment win2016.xml
2. Enable HyperV on the guest
Manual steps followed by the link
https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v#enable-the-hyper-v-role-through-settings
3. reboot

Actual results:
Windows guest stucks at the tiancore icon

Expected results:
Hyper V enabled success on the guest.

Additional info:
On the host, # cat /sys/module/kvm_intel/parameters/nested
1
Without adding hypervisor CPU feature policy in the guest XML, hyperV on the guest can be enabled, checked on the guest, hyperV hypervisor service not enabled.