Researchers at MIT have developed a new kernel named Fractal, which provides a clearer understanding of processor activities. This kernel has already revealed previously unknown behaviors in Apple’s M1 chip. Traditionally, security researchers seeking to investigate processor functions modify existing operating systems like macOS or Linux, a method that is unstable and difficult to replicate, especially on Apple platforms due for deprecation.<\/p>\n
The team from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) created Fractal to study hardware directly. This new operating system kernel is designed from scratch to examine branch predictors, which help CPUs choose what code to run next. Using Fractal, researchers discovered that a speculative attack called “Phantom” affects Apple Silicon, a finding missed in prior studies.<\/p>\n
Joseph Ravichandran, the MIT PhD student leading the project, likened Fractal to an electron microscope for operating systems, allowing unprecedented insight into hardware mechanisms. Fractal addresses a longstanding challenge by allowing researchers to study processor structures like branch predictors and caches across user and kernel code boundaries without interference from the operating system’s activities.<\/p>\n
Fractal runs directly on hardware without other software, offering tools that enable experiments to switch privilege levels while executing in the same address space. This approach, called multi-privilege concurrency, introduces the outer kernel thread, which operates with kernel privileges within a user process’s memory.<\/p>\n
Using Fractal, the MIT team confirmed the ARM specification CSV2 on the M1, which prevents user-mode programs from influencing kernel speculation. However, they found the CPU still pre-fetches targets into the instruction cache, creating a side channel that allows user code to affect kernel cache contents. This behavior also occurs between processes with different address space identifiers.<\/p>\n
The team also provided evidence of Phantom speculation on Apple Silicon, where instructions can be misinterpreted as branches, triggering unintended speculative execution. Fractal’s experiments revealed no privilege isolation in the M1’s conditional branch predictor, contradicting earlier findings due to macOS thread migrations.<\/p>\n
Fractal supports x86_64, ARM64, and RISC-V architectures, consisting of over 31,000 lines of code. It is designed as a research infrastructure with familiar system calls and tools to facilitate the transition of existing experimental code. The MIT team shared their findings with Apple’s security team, who also examined Fractal.<\/p>\n
Ravichandran aims for Fractal to become essential infrastructure for microarchitecture research, akin to tools like QEMU and FFmpeg in their fields. The goal is to enhance the reliability and accuracy of research results by minimizing software noise and ensuring precise control across privilege boundaries.<\/p>\n
Fractal’s development was supported by the National Science Foundation, the U.S. Air Force Office of Scientific Research, and ACE, part of a DARPA-sponsored program. The research was presented at the IEEE Symposium on Security and Privacy in San Francisco, California.<\/p>\n