MSR IA32_TSX_CTRL, introduced with a microcode update a while back.
Glad it's possible to do this in virt now: used to be impossible to disable TSX (you could avoid advertising it via cpuid, but you couldn't actually prevent usage of the instructions).