x86-64.net

System

Intel TDX instructions

Intel TDX runs confidential virtual machines, trust domains, under the Intel TDX module, which the hypervisor and the guests call with the SEAM instructions.

CPUID
See the ISA sets below.
Instructions
4 mnemonics
Processors
Emerald Rapids, Granite Rapids, Diamond Rapids

Intel Trust Domain Extensions (TDX) run confidential virtual machines, called trust domains, whose register state is isolated from the host and whose memory is encrypted. They build on SEAM (Secure Arbitration Mode), an extension of VMX: a software module that the processor attests, the Intel TDX module, runs in SEAM root operation from a protected memory range and manages the trust domains, which run in SEAM non-root operation.

The hypervisor calls the module with SEAMCALL, and the module returns with SEAMRET; a trust domain calls it with TDCALL, which the Linux kernel uses in TDX guests. SEAMOPS offers operations that only the module may use. Which service each call requests is up to the module, by a leaf number in RAX, and is documented in Intel’s TDX module specifications rather than in the processor manual.

Instructions

Mnemonics with at least one form in TDX. Each page lists all forms of the mnemonic, including those of other extensions.
MnemonicSummaryForms
SEAMCALLCalls the SEAM module (the Intel TDX module) from a hypervisor in VMX root operation, entering SEAM root operation.1
SEAMOPSInvokes a SEAM-specific operation; only software in SEAM root operation, the SEAM module, can execute it.1
SEAMRETReturns from the SEAM module in SEAM root operation to the hypervisor that called it with SEAMCALL.1
TDCALLCalls the SEAM module from a trust domain, a guest in SEAM non-root operation, by a VM exit.1

CPUID and processors

XED splits TDX into 1 ISA set. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.

XED ISA sets of TDX. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
TDX

No CPUID bit: processors with SEAM report its range register (SEAMRR) in bit 15 of the IA32_MTRRCAP MSR, and the TDX module has to be loaded.

Emerald Rapids, Granite Rapids, Diamond Rapids

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model.
  2. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (325384-093, September 2026)
  3. Linux kernel documentation: Intel Trust Domain Extensions (TDX)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.