A processor comprising: decode circuitry to decode a secure arbitration mode, SEAM-, CALL instruction for a virtual machine monitor, VMM, in a legacy virtual machine extension, VMX, root operation mode to provide an entrance into a SEAM VMX root operation mode; and execution circuitry to perform operations corresponding to the SEAMCALL instruction, including to: cause a virtual machine, VM, exit; store,, a state of the VMM in the legacy VMX root mode of the processor to a SEAM virtual machine control structure, VMCS; load,, a state of a SEAM module of the processor from the SEAM VMCS; transition,, the processor from the legacy VMX root operation mode to the SEAM VMX root operation mode, wherein the SEAM module is to be hosted in the SEAM VMX root operation mode; inhibit system management interrupts, SMI, and non-maskable interrupts, NMI, in the SEAM VMX root operation mode; and invoke the SEAM module; further comprising - a memory to store the SEAM module and the SEAM VMCS, the SEAM module including instructions, which if executed by the processor, are to cause the processor to perform operations including to create a trust domain, TD, to add a page to the TD, and to enter into the TD; and wherein the SEAM module is trusted by the TD but the VMM is not trusted by the TD, and the SEAM module is a trusted arbiter between the VMM and the TD; and the VMM is to work as a trust domain resource manager, TDRM. decode circuitry to decode a secure arbitration mode, SEAM-, CALL instruction for a virtual machine monitor, VMM, in a legacy virtual machine extension, VMX, root operation mode to provide an entrance into a SEAM VMX root operation mode; and execution circuitry to perform operations corresponding to the SEAMCALL instruction, including to: cause a virtual machine, VM, exit; store,, a state of the VMM in the legacy VMX root mode of the processor to a SEAM virtual machine control structure, VMCS; load,, a state of a SEAM module of the processor from the SEAM VMCS; transition,, the processor from the legacy VMX root operation mode to the SEAM VMX root operation mode, wherein the SEAM module is to be hosted in the SEAM VMX root operation mode; inhibit system management interrupts, SMI, and non-maskable interrupts, NMI, in the SEAM VMX root operation mode; and invoke the SEAM module; cause a virtual machine, VM, exit; store,, a state of the VMM in the legacy VMX root mode of the processor to a SEAM virtual machine control structure, VMCS; load,, a state of a SEAM module of the processor from the SEAM VMCS; transition,, the processor from the legacy VMX root operation mode to the SEAM VMX root operation mode, wherein the SEAM module is to be hosted in the SEAM VMX root operation mode; inhibit system management interrupts, SMI, and non-maskable interrupts, NMI, in the SEAM VMX root operation mode; and invoke the SEAM module; further comprising - a memory to store the SEAM module and the SEAM VMCS, the SEAM module including instructions, which if executed by the processor, are to cause the processor to perform operations including to create a trust domain, TD, to add a page to the TD, and to enter into the TD; and - a memory to store the SEAM module and the SEAM VMCS, the SEAM module including instructions, which if executed by the processor, are to cause the processor to perform operations including to create a trust domain, TD, to add a page to the TD, and to enter into the TD; and wherein the SEAM module is trusted by the TD but the VMM is not trusted by the TD, and the SEAM module is a trusted arbiter between the VMM and the TD; and the VMM is to work as a trust domain resource manager, TDRM. the SEAM module is trusted by the TD but the VMM is not trusted by the TD, and the SEAM module is a trusted arbiter between the VMM and the TD; and the VMM is to work as a trust domain resource manager, TDRM.