Security Research on Processors MIT's "Fractal" Kernel Makes it Possible to Measure Chip Behavior More Accurately

Related Vendors

FAULHABER Drive Systems

dataTec AG

SIMTOS (Seoul International Machine Tool Show)

MIT researchers have developed their own operating system kernel, called Fractal, which allows for more precise analysis of processors. Using this method, they were able to identify previously unobserved behavior on Apple’s M1 chip that poses a potential security risk.

When security researchers want to investigate how modern processors actually work, they quickly run into limitations with conventional operating systems. Systems like macOS, Linux, or Windows are designed for stability, security, and everyday use—not for conducting measurements inside a chip with as little interference as possible.

A team at MIT's Computer Science and Artificial Intelligence Laboratory has therefore developed its own operating system kernel. Fractal is designed to give researchers a more direct view of microarchitectures—that is, internal structures such as caches, memory translations, and branch predictions.

The kernel was written from the ground up for experimental purposes. It runs directly on the hardware, replacing the standard operating system. The goal is not to create a system suitable for everyday use, but to enable measurements in which external influences distort the results as little as possible.

Controlled Experiments Instead of Operating System Noise

A key problem with previous research is that operating systems perform their own operations during each experiment. They manage memory areas, schedule and unschedule processes, and trigger interrupts, thereby altering the very conditions that are supposed to remain constant.

This is where Fractal comes in. The kernel allows tests to be run across different privilege levels without significantly altering other parameters. The researchers refer to this technique as multi-privilege concurrency.

To achieve this, Fractal uses, among other things, what are known as outer kernel threads. These are located in the memory of a user process but run with kernel privileges. This allows the same code to be executed in similar environments, once with user privileges and once with higher privileges.

This is complemented by cooperative multitasking and a proprietary memory system called gmap. Both are designed to prevent the operating system from interrupting tests or silently altering memory allocations between measurements.

New Findings on the Apple M1

As its first major use case, the team examined the Apple M1 processor. The focus was on branch predictions, which CPUs use to estimate which code might be executed next. Such mechanisms are important for performance, but can also be relevant for side-channel attacks. This behavior was responsible for the Meltdown and Spectre security vulnerabilities in x86 processors that came to light in 2017.. Security researchers had warned, that this vulnerability could also affect ARM processors, but have not yet been able to provide clear evidence of this.

The researchers first confirmed that an ARM security feature called CSV2 is effective in one key aspect on the M1. Specifically, user programs cannot simply cause the kernel to speculatively execute a selected target via indirect branch prediction.

At the same time, Fractal exhibited behavior that had not been documented previously. The processor apparently fetches a potential target into the instruction cache before the protective mechanism takes full effect. This process can be observed via a side channel.

In addition, the team found initial evidence that Apple Silicon is affected by what is known as "phantom speculation." In this scenario, ordinary instructions—such as a no-op—can be temporarily treated by the processor as if they were jumps. On the M1, such accesses across privilege and address space boundaries were observed, but execution of the instructions remained blocked.

Another experiment corrected earlier assumptions regarding the M1’s conditional branch prediction. According to the team, Fractal demonstrated that this prediction is not isolated by privilege levels on either performance or efficiency cores. Earlier divergent measurements may have been influenced by thread migrations under macOS.

A Tool for Further Research

Fractal is not designed as a single experiment, but as a research infrastructure. The kernel supports x86_64, ARM64, and RISC-V and comprises more than 31,000 lines of code. It also includes well-known interfaces and tools to make it easier to port existing experiments.

According to the researchers, the findings regarding the M1 were reported to Apple’s product security team. The team is cautious in its assessment of the practical implications of the observed phantom speculation findings, as while speculative fetches were observed, no execution was detected.

The work was presented at the IEEE Symposium on Security and Privacy in San Francisco. In the long term, Fractal is intended to help other research teams make measurements of processors more reproducible and easier to compare. The kernel is available as an open-source project under the MIT license. Ravichandran has released the kernel on GitHub and the complete experimental setup on Zenodo; further details can be found on the Fractal website.(sg)