CPUID Faulting is a feature available natively on Intel IvyBridge and newer processors, which allows a kernel or hypervisor to trap userspace CPUID instructions.

Xen provides this support to guests, and for HVM guests is the the position to offer CPUID Faulting even on hardware which lacks it natively.

The native definition of CPUID Faulting is that when enabled, CPUID instructions suffer #GP[0] when executed at CPL > 0. This behaviour is honoured exactly for HVM guests. PV guests kernels however execute in ring 1 (32bit PV) or ring 3 (64bit PV). For PV guests, the implemented behaviour will cause a #GP[0] fault when executed in guest userspace.

See also: tests/cpuid-faulting/main.c