MIT researchers have developed a groundbreaking operating system kernel called Fractal, designed to provide an unprecedented level of insight into the inner workings of modern processors. Fractal is a powerful tool that enables security researchers to study the behavior of processors in ways that were previously impossible. By treating the hardware itself as the object of study, Fractal offers a clean room for chip research, free from the interference of an operating system. This allows researchers to gain a deeper understanding of the processor's behavior, including the branch predictors and caches, which are crucial for understanding the security implications of attacks like Spectre and Meltdown. One of the key features of Fractal is its ability to switch privilege levels at runtime while executing the same instructions in the same address space. This technique, called multi-privilege concurrency, is made possible by the introduction of the outer kernel thread, which sits inside a user process's memory but executes with kernel privileges. This results in an experimental setup with almost no background noise, allowing researchers to make clean and accurate measurements. The MIT team used Fractal to study the M1 processor, which implements an ARM specification called CSV2. They confirmed that the protection works for the execute stage of indirect branch prediction, but also found something unexpected. The CPU still fetches the target into the instruction cache before the protection kicks in, which can be observed through a side channel. This means user code can still influence what the kernel pulls into its caches across the privilege boundary. The team also produced the first evidence that Apple Silicon exhibits Phantom speculation, a class of misprediction previously demonstrated only on AMD and Intel processors. In addition to these findings, Fractal also overturned a previous result on the M1’s conditional branch predictor, showing that it has no privilege isolation at all. Fractal is designed as infrastructure rather than a single experiment, with familiar POSIX system calls, a C library, and ports of standard tools like vim, GCC, and the dash shell. This allows researchers to move existing experiment code over with minimal friction. The MIT team disclosed their findings to Apple’s product security team, and Apple’s engineers also examined Fractal. The longer-term ambition is for Fractal to become a shared infrastructure that the whole community builds on, enabling more reliable and accurate results in microarchitecture research. Fractal is a strong architecture contribution that turns an often ad hoc microarchitectural reverse-engineering workflow into reusable research infrastructure, making difficult hardware experiments much easier to interpret.
