MIT CSAIL researchers built Fractal, a custom OS kernel designed from scratch to study processor internals with minimal noise. Unlike patching macOS or Linux, Fractal boots on bare metal and introduces 'multi-privilege concurrency' — letting experiments switch privilege levels at runtime in the same address space. Applied to Apple's M1, it uncovered that CSV2 branch predictor protections block speculative execution but not instruction cache fetches, creating an observable side channel. It also produced the first evidence of Phantom speculation on Apple Silicon, and corrected a prior finding about the M1's conditional branch predictor that was an artifact of macOS thread migration. Fractal supports x86_64, ARM64, and RISC-V across 31,000+ lines of code and is intended as shared community infrastructure for microarchitecture research.
