Wow, it's not even in the SDM. Only docs I can find are: https://software.intel.com/security-software-guidance/insigh...

Glad it's possible to do this in virt now: used to be impossible to disable TSX (you could avoid advertising it via cpuid, but you couldn't actually prevent usage of the instructions).