Editing CPUID

== CPUID ==
Two cases.

* '''A)''' <u>Remote CPUID</u>: Even if the user has JavaScript enabled in their browser, websites cannot remotely detect the user's CPU model and capabilities.
* '''B)''' <u>Local CPUID</u>: Unfortunately, locally running applications can use the non-privileged CPU instruction [https://en.wikipedia.org/wiki/CPUID CPUID]. This cannot be prevented.

The technical background of these two cases is being elaborated below.

{{box|text=
<u>CPUID technical background:</u>

* <u>Importance of this wiki chapter</u>: If the reader is time-poor, the rest of the text inside this box can be skipped.
* <u>Affected operating systems:</u> All. This issue is [[unspecific|unspecific to {{project name long}}]].
* <u>Affected computers</u>: All Intel and AMD CPUs are affected since 1993.
* <u>workarounds available?</u> None. There are no virtualizers capable to hide this information. <ref name=universal-virtualizer-issue />
* <u>CPUID technical introduction</u>: Quote [https://manpages.debian.org/{{Stable project version based on Debian codename}}/manpages/cpuid.4.en.html cpuid man page] (<u>Underline</u> added.):
** <blockquote><u>The CPUID instruction can be directly executed by a program using inline assembler.</u> However this device allows convenient access to all CPUs without changing process affinity. Most of the information in cpuid is reported by the kernel in cooked form either in /proc/cpuinfo or through subdirectories in /sys/devices/system/cpu. Direct CPUID access through this device should only be used in exceptional cases.</blockquote>
* <u>Remote websites:</u> Cannot fingerprint the user to remotely detect the the user's CPU model and capabilities. There are no test pages that claim to do it. One websites might make a first impression that it can be done, but it's not possible, see [[Browser_Tests#cpuid_visualiser|cpuid visualizer]] browser test. [https://github.com/streamich/cpuid CPUID in JavaScript] cannot do it either. While JavaScript is often viewed as synonym with the browser, JavaScript can also be used with out a browser. The CPUID in JavaScript might work with JavaScript on a server but not with JavaScript in a browser.
** <u>Popular demand by many website owners:</u> Many people asked about this generally on stackexchange (detecting hardware information using JavaScript) but nobody had a solution for CPU model and capabilities specifically.
** <u>No live demonstration available:</u> There is no hosted web service that demonstrates this feature. At least a few of the many [[Browser Tests]] would implement this. Specifually likely the [[The_World_Wide_Web_And_Your_Privacy#Fingerprint.com|popular Fingerprint.com]] improve their service with CPUID if this was possible.
** <u>Specifically asking:</u> This question has been specifually directed at only project that does something similar to this, which is [https://github.com/streamich/cpuid CPUID in JavaScript]. The project does not claim it works in browsers. Question for this specifically has been asked anyhow, see [https://github.com/streamich/cpuid/issues/6 Can cpuid x86 in JavaScript run inside a browser?]
** <u>[[Browser_Tests#AmIUnique|AmIUnique]] feature request:</u> [https://github.com/DIVERSIFY-project/amiunique/issues/63 detect CPUID using JavaScript] - reply received in summary: Not possible.
** <u>Alternative browser API:</u> Since this is not possible, an alternative browser API feature [https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency) <code>navigator.hardwareConcurrency</code>] was implemented by browsers vendors.
** <u>Alternative to CPUID</u>: The closest alternative to CPU fingerprinting using CPUID that has been found is [[Browser_Tests#WebCPU|WebCPU]].
* <u>Future</u>: The {{project name long}} project will not be able to fix the CPUID issue. At author if this wiki page is not aware of any virtualizer or kernel project which is interested in "hardware privacy". Very few related bug reports / feature requests exist. Users, researchers and developers interested in getting this issue fixed are encouraged to use the principles of [[Reporting_Bugs#Generic_Bug_Reproduction|Generic Bug Reporting]] and [[Free Support Principle]], in short, reproduce, describe the issue without reference to {{project name long}} and contact upstream projects (such as virtualizers, kernel) directly.
* <u>Related</u>: [[VM Fingerprinting]]
* <u>References</u>:
** <u>Upstream bug reports / feature requests:</u>
*** Qubes <u>unfixed, rejected</u> bug report: [https://github.com/QubesOS/qubes-issues/issues/1142 Stop telling VMs the exact physical CPU model in the computer]
** <u>Forum discussions:</u>
*** [https://forums.whonix.org/t/any-way-to-hide-cpu-info-from-whonix/11609 Any way to hide CPU info from Whonix?]
*** [https://forums.whonix.org/t/remote-detection-of-cpu-capabilities-cpuid-by-any-web-server-using-javascript-js/14261 Remote Detection of CPU Capabilities (CPUID) by any Web Server using JavaScript (JS)?]
*** See this for [https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/26 more discussion on CPUID].
** <u>For developers:</u>
*** The research paper [https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.302.7877&rep=rep1&type=pdf Virtualization Detection: New Strategies and Their Effectiveness] mentions CPUID several times and shares some ideas how leaking sensitive information using CPUID could be avoided.
*** https://security.stackexchange.com/questions/220357/fake-output-of-cpuid-instruction
*** https://github.com/torvalds/linux/blob/master/arch/x86/kvm/cpuid.c
}}
Description	What you type	What you get
Italic	''Italic text''	Italic text
Bold	'''Bold text'''	Bold text
Bold & italic	'''''Bold & italic text'''''	*Bold & italic text*
Description	What you type	What you get
Reference	Page text.<ref>[https://www.example.org/ Link text], additional text.</ref>	Page text.^[1]
Named reference	Page text.<ref name="test">[https://www.example.org/ Link text]</ref>	Page text.^[2]
Additional use of the same reference	Page text.<ref name="test" />	Page text.^[2]
Display references	<references />	↑ Link text, additional text. ↑ Link text