I think what Erik is trying to do is to make it possible to disable as
many of these in the kernel as possible; I/O is easy, it's off by
default; RDTSC and RDPMC can be disabled in the kernel, and I think
even XSTORE can be disabled.
I'm a little sceptical it will work reliably, but we'll see.
There's also LSL (forgot that earlier). It is used by the vgetcpu()
because it's faster than CPUID or RDTSCP. Kernel
sets a magic segment up which has different limits for different CPUs.