diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c
index 05cd646..77e008a 100644
--- a/xen/arch/x86/cpuid.c
+++ b/xen/arch/x86/cpuid.c
@@ -3,10 +3,12 @@
 #include <asm/cpuid.h>
 
 const uint32_t known_features[] = INIT_KNOWN_FEATURES;
+const uint32_t special_features[] = INIT_SPECIAL_FEATURES;
 
 static void __init __maybe_unused build_assertions(void)
 {
     BUILD_BUG_ON(ARRAY_SIZE(known_features) != FSCAPINTS);
+    BUILD_BUG_ON(ARRAY_SIZE(special_features) != FSCAPINTS);
 }
 
 /*
diff --git a/xen/include/asm-x86/cpuid.h b/xen/include/asm-x86/cpuid.h
index b72d88f..0ecf357 100644
--- a/xen/include/asm-x86/cpuid.h
+++ b/xen/include/asm-x86/cpuid.h
@@ -10,6 +10,7 @@
 #include <xen/types.h>
 
 extern const uint32_t known_features[FSCAPINTS];
+extern const uint32_t special_features[FSCAPINTS];
 
 #endif /* __ASSEMBLY__ */
 #endif /* !__X86_CPUID_H__ */
diff --git a/xen/include/public/arch-x86/cpufeatureset.h b/xen/include/public/arch-x86/cpufeatureset.h
index 219ff1c..9389ed9 100644
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -81,6 +81,18 @@ enum {
  * CPUID instruction, but this is not preclude other sources of information.
  */
 
+/*
+ * Attribute syntax:
+ *
+ * Attributes for a particular feature are provided as characters before the
+ * first space in the comment immediately following the feature value.
+ *
+ * Special: '!'
+ *   This bit has special properties and is not a straight indication of a
+ *   piece of new functionality.  Xen will handle these differently,
+ *   and may override toolstack settings completely.
+ */
+
 /* Intel-defined CPU features, CPUID level 0x00000001.edx, word 0 */
 XEN_CPUFEATURE(FPU,           0*32+ 0) /*   Onboard FPU */
 XEN_CPUFEATURE(VME,           0*32+ 1) /*   Virtual Mode Extensions */
@@ -91,7 +103,7 @@ XEN_CPUFEATURE(MSR,           0*32+ 5) /*   Model-Specific Registers, RDMSR, WRM
 XEN_CPUFEATURE(PAE,           0*32+ 6) /*   Physical Address Extensions */
 XEN_CPUFEATURE(MCE,           0*32+ 7) /*   Machine Check Architecture */
 XEN_CPUFEATURE(CX8,           0*32+ 8) /*   CMPXCHG8 instruction */
-XEN_CPUFEATURE(APIC,          0*32+ 9) /*   Onboard APIC */
+XEN_CPUFEATURE(APIC,          0*32+ 9) /*!  Onboard APIC */
 XEN_CPUFEATURE(SEP,           0*32+11) /*   SYSENTER/SYSEXIT */
 XEN_CPUFEATURE(MTRR,          0*32+12) /*   Memory Type Range Registers */
 XEN_CPUFEATURE(PGE,           0*32+13) /*   Page Global Enable */
@@ -106,7 +118,7 @@ XEN_CPUFEATURE(MMX,           0*32+23) /*   Multimedia Extensions */
 XEN_CPUFEATURE(FXSR,          0*32+24) /*   FXSAVE and FXRSTOR instructions */
 XEN_CPUFEATURE(SSE,           0*32+25) /*   Streaming SIMD Extensions */
 XEN_CPUFEATURE(SSE2,          0*32+26) /*   Streaming SIMD Extensions-2 */
-XEN_CPUFEATURE(HTT,           0*32+28) /*   Hyper-Threading Technology */
+XEN_CPUFEATURE(HTT,           0*32+28) /*!  Hyper-Threading Technology */
 XEN_CPUFEATURE(TM1,           0*32+29) /*   Thermal Monitor 1 */
 XEN_CPUFEATURE(PBE,           0*32+31) /*   Pending Break Enable */
 
@@ -135,7 +147,7 @@ XEN_CPUFEATURE(POPCNT,        1*32+23) /*   POPCNT instruction */
 XEN_CPUFEATURE(TSC_DEADLINE,  1*32+24) /*   TSC Deadline Timer */
 XEN_CPUFEATURE(AESNI,         1*32+25) /*   AES instructions */
 XEN_CPUFEATURE(XSAVE,         1*32+26) /*   XSAVE/XRSTOR/XSETBV/XGETBV */
-XEN_CPUFEATURE(OSXSAVE,       1*32+27) /*   OSXSAVE */
+XEN_CPUFEATURE(OSXSAVE,       1*32+27) /*!  OSXSAVE */
 XEN_CPUFEATURE(AVX,           1*32+28) /*   Advanced Vector Extensions */
 XEN_CPUFEATURE(F16C,          1*32+29) /*   Half-precision convert instruction */
 XEN_CPUFEATURE(RDRAND,        1*32+30) /*   Digital Random Number Generator */
@@ -154,7 +166,7 @@ XEN_CPUFEATURE(3DNOW,         2*32+31) /*   3DNow! */
 
 /* AMD-defined CPU features, CPUID level 0x80000001.ecx, word 3 */
 XEN_CPUFEATURE(LAHF_LM,       3*32+ 0) /*   LAHF/SAHF in long mode */
-XEN_CPUFEATURE(CMP_LEGACY,    3*32+ 1) /*   If yes HyperThreading not valid */
+XEN_CPUFEATURE(CMP_LEGACY,    3*32+ 1) /*!  If yes HyperThreading not valid */
 XEN_CPUFEATURE(SVM,           3*32+ 2) /*   Secure virtual machine */
 XEN_CPUFEATURE(EXTAPIC,       3*32+ 3) /*   Extended APIC space */
 XEN_CPUFEATURE(CR8_LEGACY,    3*32+ 4) /*   CR8 in 32-bit mode */
@@ -187,14 +199,14 @@ XEN_CPUFEATURE(TSC_ADJUST,    5*32+ 1) /*   TSC_ADJUST MSR available */
 XEN_CPUFEATURE(BMI1,          5*32+ 3) /*   1st bit manipulation extensions */
 XEN_CPUFEATURE(HLE,           5*32+ 4) /*   Hardware Lock Elision */
 XEN_CPUFEATURE(AVX2,          5*32+ 5) /*   AVX2 instructions */
-XEN_CPUFEATURE(FDP_EXCP_ONLY, 5*32+ 6) /*   x87 FDP only updated on exception. */
+XEN_CPUFEATURE(FDP_EXCP_ONLY, 5*32+ 6) /*!  x87 FDP only updated on exception. */
 XEN_CPUFEATURE(SMEP,          5*32+ 7) /*   Supervisor Mode Execution Protection */
 XEN_CPUFEATURE(BMI2,          5*32+ 8) /*   2nd bit manipulation extensions */
 XEN_CPUFEATURE(ERMS,          5*32+ 9) /*   Enhanced REP MOVSB/STOSB */
 XEN_CPUFEATURE(INVPCID,       5*32+10) /*   Invalidate Process Context ID */
 XEN_CPUFEATURE(RTM,           5*32+11) /*   Restricted Transactional Memory */
 XEN_CPUFEATURE(PQM,           5*32+12) /*   Platform QoS Monitoring */
-XEN_CPUFEATURE(NO_FPU_SEL,    5*32+13) /*   FPU CS/DS stored as zero */
+XEN_CPUFEATURE(NO_FPU_SEL,    5*32+13) /*!  FPU CS/DS stored as zero */
 XEN_CPUFEATURE(MPX,           5*32+14) /*   Memory Protection Extensions */
 XEN_CPUFEATURE(PQE,           5*32+15) /*   Platform QoS Enforcement */
 XEN_CPUFEATURE(RDSEED,        5*32+18) /*   RDSEED instruction */
@@ -208,7 +220,7 @@ XEN_CPUFEATURE(SHA,           5*32+29) /*   SHA1 & SHA256 instructions */
 /* Intel-defined CPU features, CPUID level 0x00000007:0.ecx, word 6 */
 XEN_CPUFEATURE(PREFETCHWT1,   6*32+ 0) /*   PREFETCHWT1 instruction */
 XEN_CPUFEATURE(PKU,           6*32+ 3) /*   Protection Keys for Userspace */
-XEN_CPUFEATURE(OSPKE,         6*32+ 4) /*   OS Protection Keys Enable */
+XEN_CPUFEATURE(OSPKE,         6*32+ 4) /*!  OS Protection Keys Enable */
 
 /* AMD-defined CPU features, CPUID level 0x80000007.edx, word 7 */
 XEN_CPUFEATURE(ITSC,          7*32+ 8) /*   Invariant TSC */
diff --git a/xen/tools/gen-cpuid.py b/xen/tools/gen-cpuid.py
index ca413f8..5171c6e 100755
--- a/xen/tools/gen-cpuid.py
+++ b/xen/tools/gen-cpuid.py
@@ -16,11 +16,13 @@ class State(object):
 
         # State parsed from input
         self.names = {} # Name => value mapping
+        self.raw_special = set()
 
         # State calculated
         self.nr_entries = 0 # Number of words in a featureset
         self.common_1d = 0 # Common features between 1d and e1d
         self.known = [] # All known features
+        self.special = [] # Features with special semantics
 
 def parse_definitions(state):
     """
@@ -29,7 +31,8 @@ def parse_definitions(state):
     """
     feat_regex = re.compile(
         r"^XEN_CPUFEATURE\(([A-Z0-9_]+),"
-        "\s+([\s\d]+\*[\s\d]+\+[\s\d]+)\).*$")
+        "\s+([\s\d]+\*[\s\d]+\+[\s\d]+)\)"
+        "\s+/\*([!]*) .*$")
 
     this = sys.modules[__name__]
 
@@ -45,6 +48,7 @@ def parse_definitions(state):
 
         name = res.groups()[0]
         val = eval(res.groups()[1]) # Regex confines this to a very simple expression
+        attr = res.groups()[2]
 
         if hasattr(this, name):
             raise Fail("Duplicate symbol %s" % (name,))
@@ -64,6 +68,13 @@ def parse_definitions(state):
         # Construct a reverse mapping of value to name
         state.names[val] = name
 
+        for a in attr:
+
+            if a == "!":
+                state.raw_special.add(val)
+            else:
+                raise Fail("Unrecognised attribute '%s' for %s" % (a, name))
+
     if len(state.names) == 0:
         raise Fail("No features found")
 
@@ -112,6 +123,7 @@ def crunch_numbers(state):
         state.names[e1d_base + (f % 32)] = "E1D_" + state.names[f]
 
     state.common_1d = featureset_to_uint32s(common_1d, 1)[0]
+    state.special = featureset_to_uint32s(state.raw_special, nr_entries)
 
 
 def write_results(state):
@@ -131,9 +143,12 @@ def write_results(state):
 #define CPUID_COMMON_1D_FEATURES %s
 
 #define INIT_KNOWN_FEATURES { \\\n%s\n}
+
+#define INIT_SPECIAL_FEATURES { \\\n%s\n}
 """ % (state.nr_entries,
        state.common_1d,
        format_uint32s(state.known, 4),
+       format_uint32s(state.special, 4),
        ))
 
     state.output.write(
