In the world of computer science, where the inner workings of processors and operating systems are often shrouded in complexity, a team of researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) has made a groundbreaking discovery. They've built an operating system kernel, Fractal, that acts as a microscope for studying the intricate details of modern processors. This innovative tool has the potential to revolutionize the field of microarchitecture research, offering a new level of insight and control for researchers.
A Clean Room for Chip Research
The core challenge that Fractal addresses is the difficulty of studying the behavior of internal processor structures across the boundary between user code and kernel code. Modern processors manage state in various internal structures, and researchers need to run experiments on both sides of this boundary to understand their behavior. However, this is a complex task due to the system's management of privilege levels, address spaces, and scheduling.
Fractal inverts this model by booting directly on bare metal with no other software running. It exposes primitives that allow a single experiment to switch privilege levels at runtime while executing the same instructions in the same address space. This technique, called multi-privilege concurrency, relies on a new construct: the outer kernel thread, which executes with kernel privileges while sitting inside a user process's memory.
The result is an experimental setup with minimal background noise. Fractal produces flat baselines and clean signals, free from the interruptions, scheduler activity, and address-space management that blur measurements taken under macOS or Linux.
What Fractal Found on the M1
The MIT team used Fractal to study Apple's M1 processor, implementing an ARM specification called CSV2, which is designed to prevent code running in one privilege level from steering speculation in another. They confirmed that the protection works for the execute stage of indirect branch prediction, showing that a user-mode program cannot make the kernel speculatively execute a chosen target through the indirect branch predictor.
However, they also discovered something unexpected. The CPU fetches the target into the instruction cache before the protection kicks in, and this fetch is observable through a side channel. This means user code can still influence what the kernel pulls into its caches across the privilege boundary.
The team also found evidence of Phantom speculation, a class of misprediction previously demonstrated only on AMD and Intel processors. On the M1, Fractal showed that Phantom fetches succeed across both privilege levels and address spaces, though the execute phase remains blocked.
A Tool, Not a One-Off
Fractal is designed as infrastructure rather than a single experiment. It supports x86_64, ARM64, and RISC-V, and consists of over 31,000 lines of code. The team has included familiar POSIX system calls, a C library, and ports of standard tools like vim, GCC, and the dash shell, making it easy for researchers to move existing experiment code over with minimal friction.
The MIT team disclosed their findings to Apple's product security team, and in an unusual reversal, Apple's engineers also examined Fractal. The longer-term ambition is to make Fractal a shared infrastructure that the whole community builds on, similar to tools like QEMU and FFmpeg.
A New Era for Microarchitecture Research
Fractal represents a significant contribution to the field of microarchitecture research. By reducing software noise and giving researchers tighter control across privilege boundaries, it makes difficult hardware experiments much easier to interpret. In my opinion, this tool has the potential to revolutionize the way we study and understand modern processors, leading to more reliable and accurate results.
As Ravichandran puts it, 'Fractal is like an electron microscope for operating systems.' It allows us to see the intricate details of processor behavior, providing a new level of insight and control for researchers. This is a fascinating development, and I can't wait to see how it shapes the future of microarchitecture research.
