tdx: simplify configure_vcpu() CPUID handling for TD vCPUs

[liangzhou121]

Remove redundant/incorrect per-vCPU CPUID patches that duplicated or conflicted with what the TDX module already virtualizes:

• Drop the manual X2APIC bit (leaf 1 ECX[21]) force-set: the TDX module already reports this as a Fixed1 bit, so patching it in cloud-hypervisor was redundant.
• Drop the leaf 0x8000_0008 virtual/physical address width override (LA57-based) and the leaf 0x4000_0200 fake KVM signature injection, neither of which is needed for correct TD guest CPUID.
• Replace the ad-hoc '#[cfg(not(feature = "tdx"))]' gating around MSR and LINT setup with explicit 'if !tdx_enabled' checks plus comments explaining why: the vCPU's MSR and local APIC state are owned by the TDX module and are not accessible via KVM_SET_MSRS / KVM_GET_LAPIC/KVM_SET_LAPIC for guest-state-protected TD vCPUs.

[Copilot]

🟡 Changes recommended

The new #[cfg(feature = "tdx")] guards unintentionally prevent regs::setup_msrs() and interrupts::set_lint() from compiling/running in non-TDX builds, likely regressing normal guest initialization.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR simplifies configure_vcpu() for TDX-enabled builds by removing per-vCPU CPUID patches that duplicate/conflict with what the TDX module already virtualizes, and by making MSR/LAPIC (LINT) setup conditional on whether the vCPU is a TD.

Changes:

• Removes TDX-specific CPUID patching (x2APIC bit force-set, 0x8000_0008 width override, and fake KVM signature injection).
• Keeps per-vCPU topology/APIC ID CPUID updates, then relies on the existing common CPUID generation and topology patching.
• Replaces #[cfg(not(feature = "tdx"))] gating for MSR and LINT setup with runtime if !tdx_enabled checks (with explanatory comments).

File summaries

File	Description
arch/src/x86_64/mod.rs	Removes redundant TDX CPUID patching and makes MSR/LINT setup conditional for TD vCPUs.

Review details

Suppressed comments (1)

arch/src/x86_64/mod.rs:943

• interrupts::set_lint(vcpu) is now only compiled when feature = "tdx" (because the if !tdx_enabled { ... } statement is #[cfg(feature = "tdx")]). In non-TDX builds this means the LINT setup is never performed. Add a #[cfg(not(feature = "tdx"))] fallback call so non-TDX builds keep the previous behavior.

    if !tdx_enabled {
        interrupts::set_lint(vcpu).map_err(|e| Error::LocalIntConfiguration(e.into()))?;

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[guzongmin]

LGTM