+TdxApWait:
+ cmp byte[TDX_WORK_AREA_PGTBL_READY], 0
+ je TdxApWait

Don't we need memory fence before je TdxApWait. I did not check
what the compiler generates for this loop.

Below is the code compiler generated for this loop. (VS2017/release)
106 <1> TdxApWait:
107 0000070B 803D04B0800000 <1> cmp byte[TDX_WORK_AREA_PGTBL_READY], 0
108 00000712 74F7 <1> je TdxApWait
109 00000714 EB17 <1> jmp ExitInitTdxWorkarea

This is the code lfence is added.
106 <1> TdxApWait:
107 0000070B 803D04B0800000 <1> cmp byte[TDX_WORK_AREA_PGTBL_READY], 0
108 00000712 0FAEE8 <1> lfence
109 00000715 74F4 <1> je TdxApWait
110 00000717 EB17 <1> jmp ExitInitTdxWorkarea

I am not sure if lfence is needed.