{"id":528540,"date":"2026-06-10T18:52:11","date_gmt":"2026-06-10T18:52:11","guid":{"rendered":"https:\/\/www.europesays.com\/ie\/528540\/"},"modified":"2026-06-10T18:52:11","modified_gmt":"2026-06-10T18:52:11","slug":"to-study-how-chips-really-work-mit-researchers-built-their-own-operating-system-mit-news","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ie\/528540\/","title":{"rendered":"To study how chips really work, MIT researchers built their own operating system | MIT News"},"content":{"rendered":"

A new kernel, or core program within an operating system, gives researchers a cleaner view of what\u2019s happening inside a processor. Called Fractal<\/a> and developed at MIT, the kernel has already surfaced previously unknown behavior in Apple\u2019s M1.<\/p>\n

When security researchers want to understand what a modern processor is really doing with the kind of detail that determines whether attacks like Spectre and Meltdown are possible, they usually run their experiments on top of an operating system that was never built for the job. They open up macOS or Linux, patch the kernel by hand, and hope the modifications hold. The approach is unstable, hard to reproduce, and on Apple\u2019s platforms, slated for deprecation.<\/p>\n

A team at MIT\u2019s Computer Science and Artificial Intelligence Laboratory (CSAIL) decided to build something different. Fractal, an operating system kernel written from the ground up, treats the hardware itself as the object of study. Its first major use, a deep look at branch predictors \u2014 a CPU\u2019s way of guessing what code to run next, before it knows for certain, so it doesn\u2019t have to waste time waiting to find out \u2014 inside Apple\u2019s M1 processor, has already turned up findings that prior work missed, including the first evidence that a class of speculative attack known as \u201cPhantom\u201d affects Apple Silicon.<\/p>\n

\u201cWe\u2019re using hardware in ways it wasn\u2019t designed for,\u201d says Joseph Ravichandran, the MIT PhD student in electrical engineering and computer science (EECS) who led the project. \u201cIt\u2019s not even obvious that this is a possible thing you could do with the hardware. But we found a way to pull all these different primitives off. It\u2019s like a microscope. If you\u2019ve got a hand magnifying glass, you can see a little bit. But if you had an electron microscope, now we\u2019re really talking. That\u2019s what Fractal is. The electron microscope of operating systems.\u201d<\/p>\n

A clean room for chip research<\/strong><\/p>\n

The core problem Fractal solves is one that researchers have worked around for years. Modern processors keep state in many internal structures: branch predictors, caches, translation lookaside buffers, and more. To study how those structures behave across the boundary between user code and kernel code, two domains the chip is supposed to keep isolated, researchers need to run nearly identical experiments on each side of that boundary. On a general-purpose operating system, that is very difficult. The system itself manages privilege levels, address spaces, and scheduling, and it injects its own activity into every measurement.<\/p>\n

Fractal inverts the model. It boots directly on bare metal, with no other software running, and exposes primitives that let a single experiment switch privilege levels at runtime while executing the same instructions in the same address space. The team calls the underlying technique multi-privilege concurrency, and it relies on a new construct they introduced: the outer kernel thread, which sits inside a user process\u2019s memory but executes with kernel privileges.<\/p>\n

The result is an experimental setup with almost no background noise. Where measurements taken under macOS or Linux are blurred by interrupts, scheduler activity, and address-space management, Fractal produces flat baselines and clean signals.<\/p>\n

What Fractal found on the M1<\/strong><\/p>\n

Apple\u2019s M1 implements an ARM specification called CSV2, which is supposed to prevent code running in one privilege level from steering speculation in another. Using Fractal, the MIT team confirmed that the protection works for the execute stage of indirect branch prediction: a user-mode program cannot make the kernel speculatively execute a chosen target through the indirect branch predictor.<\/p>\n

But the team also found something the chip\u2019s designers may not have intended. The CPU still fetches the target into the instruction cache before the protection kicks in. That fetch is observable through a side channel, which means user code can still influence what the kernel pulls into its caches across the privilege boundary. The same pattern appeared between processes assigned different address space identifiers.<\/p>\n

The team also produced the first evidence that Apple Silicon exhibits Phantom speculation, a class of misprediction previously demonstrated only on AMD and Intel processors. In Phantom, ordinary instructions, including a no-op, can be misinterpreted by the CPU as branches, triggering speculative behavior the program never asked for. On the M1, Fractal showed that Phantom fetches succeed across both privilege levels and address spaces, though the execute phase remains blocked.<\/p>\n

A separate Fractal experiment overturned a finding from earlier work on the M1\u2019s conditional branch predictor, which had reported that cross-privilege training worked on Apple\u2019s performance cores, but not its efficiency cores. The Fractal team showed that the conditional branch predictor has no privilege isolation at all, on either core type, and that the earlier result was likely an artifact of macOS quietly migrating threads between cores during system calls.<\/p>\n

\u201cFor us, it is a true independent variable,\u201d Ravichandran says. \u201cYou change the privilege level, nothing else changes. The only thing that could explain whether the attack succeeds or not is the privilege level.\u201d<\/p>\n

A tool, not a one-off<\/strong><\/p>\n

Fractal supports x86_64, ARM64, and RISC-V, and consists of more than 31,000 lines of code. The team designed it as infrastructure rather than as a single experiment, with familiar POSIX system calls, a C library, and ports of standard tools like vim, GCC, and the dash shell, so that researchers can move existing experiment code over with minimal friction.<\/p>\n

The MIT team disclosed its M1 findings to Apple\u2019s product security team. In an unusual reversal, Apple\u2019s engineers also examined Fractal.\u00a0<\/p>\n

The longer-term ambition is bigger than any single result. Ravichandran wants Fractal to become to microarchitecture research what tools like QEMU and FFmpeg are to their fields: shared infrastructure that the whole community builds on.\u00a0<\/p>\n

\u201cMy hope is that our results as a community get significantly more reliable, significantly more accurate,\u201d says Ravichadran. \u201cWith this reduced noise, this clarity, and this guarantee that you\u2019re running on the right core, on the right system.\u201d<\/p>\n

\u201cFractal is a strong architecture contribution because it turns an often ad hoc microarchitectural reverse-engineering workflow into reusable research infrastructure,\u201d says\u00a0University of Southern California assistant professor\u00a0Mengyuan Li, who wasn\u2019t involved in the paper. \u201cBy reducing software noise and giving researchers tighter control across privilege boundaries, it makes difficult hardware experiments much easier to interpret.\u201d<\/p>\n

Ravichandran worked with Mengjia Yan, an MIT associate professor of EECS and CSAIL principal investigator, on the paper. Their work was supported, in part, by the National Science Foundation, the U.S. Air Force Office of Scientific Research, and ACE, which is part of a program sponsored by the U.S. Defense Advanced Research Projects Agency. They presented their work at the IEEE Symposium on Security and Privacy in San Francisco, California.<\/p>\n","protected":false},"excerpt":{"rendered":"A new kernel, or core program within an operating system, gives researchers a cleaner view of what\u2019s happening…\n","protected":false},"author":2,"featured_media":528541,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[74],"tags":[227971,227968,227972,227973,117807,227979,18,227967,227978,227970,19,17,227980,227977,25688,6343,227969,46709,214943,1313,227975,227976,82,227974,20263],"class_list":["post-528540","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-address-space-id","tag-apple-m1","tag-branch-predictors","tag-caches","tag-computer-processors","tag-darpa-funding","tag-eire","tag-fractal-os","tag-general-purpose-operating-systems","tag-hardware-privilege-level","tag-ie","tag-ireland","tag-joseph-ravichandran","tag-kernels","tag-linux","tag-macos","tag-microarchitecture-security","tag-mit-csail","tag-nsf-funding","tag-operating-systems","tag-phantom-speculation","tag-side-channel-attacks","tag-technology","tag-translation-lookaside-buffers","tag-unix"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@ie\/116727326078781821","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/528540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/comments?post=528540"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/528540\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media\/528541"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media?parent=528540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/categories?post=528540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/tags?post=528540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}