4 ms·

To study how chips work, MIT researchers built their own operating system

366 points by speckx 5mo ago

themafia 5mo ago
The results are interesting but the whole project is worth a look. https://people.csail.mit.edu/mengjia/data/2026.SP.fractal.pdf https://people.csail.mit.edu/mengjia/data/2026.SP.fractal.pd...
junofan 5mo ago
[flagged]
- avs733 5mo ago
  Worth noting this is pretty standard university PR. It is written with author involvement so it’s likely technically correct but it is aimed at getting it picked up so it often makes it sound flowery and contains multiple descriptions of generally the same thing with different analogies or simplifications that anyone writing an article from this can parrot easily.
  - SadErn 5mo ago
    [dead]
  - junofan 4mo ago
    It’s clearly AI-assisted.
jdougan 5mo ago
I wonder if this could be practical for controlled environment devices like game consoles.
- pyrolistical 5mo ago
  What do you mean? By the time you have kernel access like that you’ve already won.
  - karlgkk 5mo ago
    It’s practical in the sense that it lets a researcher find additional silicon bugs, although most game consoles now use merchant archs anyways
  - myng111 5mo ago
    I suppose the theory is when you're attacking a console like the Xbox One with some known hypervisors vulnerabilities, but generally what is considered to be secure hardware, you could use the patchable hypervisor vulnerability to install your custom OS, then use the OS itself to find silicon bugs, finally securing a pathway for permanent access to the device.
deleted 5mo ago
[deleted]
JdeBP 5mo ago
The paper's reference to https://github.com/blacktop/darwin-xnu-build https://github.com/blacktop/darwin-xnu-build does not support the statement made by the paper. It's not redaction or obfuscation that makes building XNU difficult. It's having the right toolchain; modifying makefiles and code to accommodate a slightly different toolchain; and needing a load of extra stuff that isn't pre-supplied with XNU. A lot of the patches and issues there are about compiler differences, language standard differences, and plain missing stuff. This is a secondary niggle in the larger scheme of things, though. Not using something like XNU in the first place is the way, for the reasons that the paper goes into. (Whilst 'of course it runs NetBSD' applies to the M1, one wouldn't use NetBSD for this for the same reasons that one wouldn't use XNU.) People experienced in this sort of thing likely nodded along at decisions like coöperative rather than preëmptive multitasking. I wonder whether they considered the Watanabe shell rather than the Debian Almquist shell. They picked vim instead of nvi2, after all.
- saagarjha 5mo ago
  I assume the idea is that finding tools and assembling other projects together into a build environment is comparatively easy but papering over entire components being missing is much harder
  - JdeBP 5mo ago
    No. As I said, that's really a secondary niggle with the paper itself misrepresenting its reference, which as you can see already provides patches to paper over such stuff, as through the problem with XNU were redaction, which it isn't per that reference. The primary reason not to use XNU is what the paper goes into in detail; which is the architecture of XNU simply getting in the way, just as the architecture of NetBSD would for the same reasons. If XNU being incomplete were the primary problem, NetBSD, a complete operating system that supports loadable kernel modules and provides a coherent development toolchain out of the box, would be the answer. But it is not.
    - saagarjha 5mo ago
      Just because someone did it doesn't make it easy? I found the reference to support the claim fairly well
bell-cot 5mo ago
> When security researchers want to understand what a modern processor is really doing with the kind of detail that determines whether attacks like Spectre and Meltdown are possible, they usually run their experiments on top of an operating system that was never built for the job. They open up macOS or Linux, patch the kernel by hand, and hope the modifications hold. The approach is unstable, hard to reproduce, and on Apple’s platforms, slated for deprecation. > A team at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) decided to build something different. Fractal, an operating system kernel written from the ground up, treats the hardware itself as the object of study. > Fractal supports x86_64, ARM64, and RISC-V, and consists of more than 31,000 lines of code. The team designed it as infrastructure rather than as a single experiment, with familiar POSIX system calls, a C library, and ports of standard tools like vim, GCC, and the dash shell, so that researchers can move existing experiment code over with minimal friction. I was around the "what does the hardware really do?" space 4-ish decades ago - hacking together your own Minimum Viable OS was table stakes. Obviously MIT's Fractal is vastly larger than anything we did back then - but is anyone in this space now, to comment on how special Fractal is...or isn't?
landr0id 5mo ago
Not to take away from the authors' work, but this was actually the approach taken by some engineers while Spectre / Meltdown were still under embargo. Not sure if they ever mentioned their work publicly so I will avoid naming them, but some talented folks from Microsoft who basically came to the same conclusion that a specialized environment free of noise was necessary both to test mitigations and find variants.
- costco 5mo ago
  Related (2019): https://gamozolabs.github.io/metrology/2019/08/19/sushi_roll.html https://gamozolabs.github.io/metrology/2019/08/19/sushi_roll... https://gamozolabs.github.io/metrology/2019/12/30/load-port-monitor.html https://gamozolabs.github.io/metrology/2019/12/30/load-port-...
  - landr0id 5mo ago
    I suppose they did make their work public after all :) Thank you for pulling up the references.
p0w3n3d 5mo ago
Will it allow them install personally-made software, or will it require Google's approval?
jprx 5mo ago
Hi everyone, Joseph (paper author) here. You can find Fractal on Github: https://github.com/jprx/fractal https://github.com/jprx/fractal The full paper, slides from my S&P talk, and all our experiment data can be found at the Fractal project website here: https://fractal-os.com https://fractal-os.com We've been building Fractal internally for a very long time (first commit was almost exactly 2 years ago), so it's exciting to finally share it with the world. Let me know what you think!
- hamburgererror 5mo ago
  Can it run Doom?
  - jprx 5mo ago
    Haven't gotten around to it yet haha
    - acka 5mo ago
      Studying how a processor running an operating system actually behaves by peeking right through the privilege barrier is the ultimate wall hack. Who needs noclip when we have Fractal?
  - kdkdnfnfnf 5mo ago
    [dead]
  - KellyCriterion 5mo ago
    ....no, Crysis! :-P scnr
- dataflow 5mo ago
  At the risk of sounding extremely dumb, I have a question for you: if the hardware is susceptible to something that you can't actually reproduce with the software everyone runs on it, who should care, and why? Is it even really fair to call it a vulnerability at that point? Is the idea that this is supposed to help identify a different mechanism of exploiting the vulnerabilities with the shipped OS too? To give an analogy, it almost feels like removing the protection circuitry from a Li-Ion battery and then testing if it can catch fire, and observing that it does. Should it really worry users?
j16sdiz 5mo ago
I am very confused by calling this kind of work "researches". They are not pushing the boundary of human knowledge - they are playing game (reverse engineering) with other human.. maybe that is me having a very narrow definition of "research"
- srdjanr 5mo ago
  Security researcher is a common term, there's also market research which doesn't look like it falls under your definition
- ReptileMan 5mo ago
  Feel free to suggest a more suitable word. Research is usually defined against the the body of knowledge of the entity performing it and not all of humanity that ever lived.
  - asdewqqwer 5mo ago
    Yet a published peer-reviewed research should be against humanity. I am also curious whether such research can bring knowledge that apple don't know, otherwise even it is impressive, there is a level of sadness in it from my view.
    - exe34 5mo ago
      No it's against what's published by all of humanity. So if somebody knows something and hasn't published it, someone else can still scoop them.
- sabas123 5mo ago
  I actually do a phd in a closely related area. Creating better tools to do research with is definitely part of the research process. While there is a lot of work in general operating systems, those aimed to specifically do a lot of microarchitectural experiments is still undiscovered ground.
- IshKebab 5mo ago
  Yes your definition of research is incorrect.
brador 5mo ago
PHDs should be tool masters not knowledge basins. Great to see.
feeley 5mo ago
I'm really excited about this work, although I haven't read the code or paper yet. It seems to me Fractal would be ideal for running benchmarks for compilers so that the OS-induced noise is kept to a minimum. Author: do you see issues with that use case?
- vanderZwan 5mo ago
  I think you're better off watching any of the various recordings "Performance Matters" conference talks[0] by Emery Berger to learn about all the ways that developers are benchmarking the wrong thing using the wrong techniques, and what you could do instead [0] https://www.youtube.com/watch?v=7g1Acy5eGbE&t=5m3s https://www.youtube.com/watch?v=7g1Acy5eGbE&t=5m3s
polnurfer 5mo ago
They didn’t build an operating system, they built a boot program that exposes the chip in a way an operating system doesn’t behave.
- throawayonthe 5mo ago
  a boot program that happens to be unix-like, have a libc, tools like binutils, coreutils, dash, vim, gcc and a GUI have a filesystem, userspace, peripheral support... https://github.com/jprx/fractal https://github.com/jprx/fractal
austy69 5mo ago
It is so cool to see some bare metal OSs being built. Do projects like this pave the way for a better standard ISA and less driver code, like the problem described in Casey Muratori's video "the 30 million line code problem"? I'm a bit new to this space, but this seems like a step in that direction.
- surajrmal 5mo ago
  Hardware is getting more specialized these days. It's becoming more difficult than ever to write bare metal code. I don't think most (any?) software wants to manage the details a BSP solves for them.
- revengerwizard 5mo ago
  The only way to lessen the need of drivers would be to have more standardized and stable hardware interfaces and peripherals.
palmblock_dev 5mo ago
[dead]
ReyX 5mo ago
The "outer kernel thread" idea -- userspace memory but kernel privileges -- is such an obviously good idea in retrospect that I'm surprised nobody did it before. You spend half your time in microarchitecture research just trying to control for OS noise. The Apple M1 phantom speculation finding is wild. I wonder if this is actually a bug in Apple's implementation or if CSV2 just has a fundamental race condition between the protection and the i-cache fill. The paper makes it sound like the latter. Also, 31k LOC for a from-scratch kernel supporting three ISAs is... not a lot. That's either very impressive or they're skipping a lot of stuff a production kernel needs. Curious which.
deleted 5mo ago
[deleted]
varispeed 5mo ago
That title gave me a mild chuckle. As if the chips were wonders of nature that you can find deep in the forest, bring to a lab and build an operating system for them to study. Nice one! :-)

366 points by speckx 5mo ago

The results are interesting but the whole project is worth a look. https://people.csail.mit.edu/mengjia/data/2026.SP.fractal.pdf https://people.csail.mit.edu/mengjia/data/2026.SP.fractal.pd...

junofan 5mo ago

[flagged]

avs733 5mo ago
Worth noting this is pretty standard university PR. It is written with author involvement so it’s likely technically correct but it is aimed at getting it picked up so it often makes it sound flowery and contains multiple descriptions of generally the same thing with different analogies or simplifications that anyone writing an article from this can parrot easily.
- SadErn 5mo ago
  [dead]
- junofan 4mo ago
  It’s clearly AI-assisted.

jdougan 5mo ago

I wonder if this could be practical for controlled environment devices like game consoles.

pyrolistical 5mo ago
What do you mean? By the time you have kernel access like that you’ve already won.
- karlgkk 5mo ago
  It’s practical in the sense that it lets a researcher find additional silicon bugs, although most game consoles now use merchant archs anyways
- myng111 5mo ago
  I suppose the theory is when you're attacking a console like the Xbox One with some known hypervisors vulnerabilities, but generally what is considered to be secure hardware, you could use the patchable hypervisor vulnerability to install your custom OS, then use the OS itself to find silicon bugs, finally securing a pathway for permanent access to the device.

deleted 5mo ago

[deleted]

JdeBP 5mo ago

The paper's reference to https://github.com/blacktop/darwin-xnu-build https://github.com/blacktop/darwin-xnu-build does not support the statement made by the paper. It's not redaction or obfuscation that makes building XNU difficult. It's having the right toolchain; modifying makefiles and code to accommodate a slightly different toolchain; and needing a load of extra stuff that isn't pre-supplied with XNU. A lot of the patches and issues there are about compiler differences, language standard differences, and plain missing stuff. This is a secondary niggle in the larger scheme of things, though. Not using something like XNU in the first place is the way, for the reasons that the paper goes into. (Whilst 'of course it runs NetBSD' applies to the M1, one wouldn't use NetBSD for this for the same reasons that one wouldn't use XNU.) People experienced in this sort of thing likely nodded along at decisions like coöperative rather than preëmptive multitasking. I wonder whether they considered the Watanabe shell rather than the Debian Almquist shell. They picked vim instead of nvi2, after all.

saagarjha 5mo ago
I assume the idea is that finding tools and assembling other projects together into a build environment is comparatively easy but papering over entire components being missing is much harder
- JdeBP 5mo ago
  No. As I said, that's really a secondary niggle with the paper itself misrepresenting its reference, which as you can see already provides patches to paper over such stuff, as through the problem with XNU were redaction, which it isn't per that reference. The primary reason not to use XNU is what the paper goes into in detail; which is the architecture of XNU simply getting in the way, just as the architecture of NetBSD would for the same reasons. If XNU being incomplete were the primary problem, NetBSD, a complete operating system that supports loadable kernel modules and provides a coherent development toolchain out of the box, would be the answer. But it is not.
  - saagarjha 5mo ago
    Just because someone did it doesn't make it easy? I found the reference to support the claim fairly well

bell-cot 5mo ago

> When security researchers want to understand what a modern processor is really doing with the kind of detail that determines whether attacks like Spectre and Meltdown are possible, they usually run their experiments on top of an operating system that was never built for the job. They open up macOS or Linux, patch the kernel by hand, and hope the modifications hold. The approach is unstable, hard to reproduce, and on Apple’s platforms, slated for deprecation. > A team at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) decided to build something different. Fractal, an operating system kernel written from the ground up, treats the hardware itself as the object of study. > Fractal supports x86_64, ARM64, and RISC-V, and consists of more than 31,000 lines of code. The team designed it as infrastructure rather than as a single experiment, with familiar POSIX system calls, a C library, and ports of standard tools like vim, GCC, and the dash shell, so that researchers can move existing experiment code over with minimal friction. I was around the "what does the hardware really do?" space 4-ish decades ago - hacking together your own Minimum Viable OS was table stakes. Obviously MIT's Fractal is vastly larger than anything we did back then - but is anyone in this space now, to comment on how special Fractal is...or isn't?

landr0id 5mo ago

Not to take away from the authors' work, but this was actually the approach taken by some engineers while Spectre / Meltdown were still under embargo. Not sure if they ever mentioned their work publicly so I will avoid naming them, but some talented folks from Microsoft who basically came to the same conclusion that a specialized environment free of noise was necessary both to test mitigations and find variants.

costco 5mo ago
Related (2019): https://gamozolabs.github.io/metrology/2019/08/19/sushi_roll.html https://gamozolabs.github.io/metrology/2019/08/19/sushi_roll... https://gamozolabs.github.io/metrology/2019/12/30/load-port-monitor.html https://gamozolabs.github.io/metrology/2019/12/30/load-port-...
- landr0id 5mo ago
  I suppose they did make their work public after all :) Thank you for pulling up the references.

p0w3n3d 5mo ago

Will it allow them install personally-made software, or will it require Google's approval?

jprx 5mo ago

Hi everyone, Joseph (paper author) here. You can find Fractal on Github: https://github.com/jprx/fractal https://github.com/jprx/fractal The full paper, slides from my S&P talk, and all our experiment data can be found at the Fractal project website here: https://fractal-os.com https://fractal-os.com We've been building Fractal internally for a very long time (first commit was almost exactly 2 years ago), so it's exciting to finally share it with the world. Let me know what you think!

hamburgererror 5mo ago
Can it run Doom?
- jprx 5mo ago
  Haven't gotten around to it yet haha
  - acka 5mo ago
    Studying how a processor running an operating system actually behaves by peeking right through the privilege barrier is the ultimate wall hack. Who needs noclip when we have Fractal?
- kdkdnfnfnf 5mo ago
  [dead]
- KellyCriterion 5mo ago
  ....no, Crysis! :-P scnr
dataflow 5mo ago
At the risk of sounding extremely dumb, I have a question for you: if the hardware is susceptible to something that you can't actually reproduce with the software everyone runs on it, who should care, and why? Is it even really fair to call it a vulnerability at that point? Is the idea that this is supposed to help identify a different mechanism of exploiting the vulnerabilities with the shipped OS too? To give an analogy, it almost feels like removing the protection circuitry from a Li-Ion battery and then testing if it can catch fire, and observing that it does. Should it really worry users?

j16sdiz 5mo ago

I am very confused by calling this kind of work "researches". They are not pushing the boundary of human knowledge - they are playing game (reverse engineering) with other human.. maybe that is me having a very narrow definition of "research"

srdjanr 5mo ago
Security researcher is a common term, there's also market research which doesn't look like it falls under your definition
ReptileMan 5mo ago
Feel free to suggest a more suitable word. Research is usually defined against the the body of knowledge of the entity performing it and not all of humanity that ever lived.
- asdewqqwer 5mo ago
  Yet a published peer-reviewed research should be against humanity. I am also curious whether such research can bring knowledge that apple don't know, otherwise even it is impressive, there is a level of sadness in it from my view.
  - exe34 5mo ago
    No it's against what's published by all of humanity. So if somebody knows something and hasn't published it, someone else can still scoop them.
sabas123 5mo ago
I actually do a phd in a closely related area. Creating better tools to do research with is definitely part of the research process. While there is a lot of work in general operating systems, those aimed to specifically do a lot of microarchitectural experiments is still undiscovered ground.
IshKebab 5mo ago
Yes your definition of research is incorrect.

brador 5mo ago

PHDs should be tool masters not knowledge basins. Great to see.

feeley 5mo ago

I'm really excited about this work, although I haven't read the code or paper yet. It seems to me Fractal would be ideal for running benchmarks for compilers so that the OS-induced noise is kept to a minimum. Author: do you see issues with that use case?

vanderZwan 5mo ago
I think you're better off watching any of the various recordings "Performance Matters" conference talks[0] by Emery Berger to learn about all the ways that developers are benchmarking the wrong thing using the wrong techniques, and what you could do instead [0] https://www.youtube.com/watch?v=7g1Acy5eGbE&t=5m3s https://www.youtube.com/watch?v=7g1Acy5eGbE&t=5m3s

polnurfer 5mo ago

They didn’t build an operating system, they built a boot program that exposes the chip in a way an operating system doesn’t behave.

throawayonthe 5mo ago
a boot program that happens to be unix-like, have a libc, tools like binutils, coreutils, dash, vim, gcc and a GUI have a filesystem, userspace, peripheral support... https://github.com/jprx/fractal https://github.com/jprx/fractal

austy69 5mo ago

It is so cool to see some bare metal OSs being built. Do projects like this pave the way for a better standard ISA and less driver code, like the problem described in Casey Muratori's video "the 30 million line code problem"? I'm a bit new to this space, but this seems like a step in that direction.

surajrmal 5mo ago
Hardware is getting more specialized these days. It's becoming more difficult than ever to write bare metal code. I don't think most (any?) software wants to manage the details a BSP solves for them.
revengerwizard 5mo ago
The only way to lessen the need of drivers would be to have more standardized and stable hardware interfaces and peripherals.

palmblock_dev 5mo ago

[dead]

ReyX 5mo ago

The "outer kernel thread" idea -- userspace memory but kernel privileges -- is such an obviously good idea in retrospect that I'm surprised nobody did it before. You spend half your time in microarchitecture research just trying to control for OS noise. The Apple M1 phantom speculation finding is wild. I wonder if this is actually a bug in Apple's implementation or if CSV2 just has a fundamental race condition between the protection and the i-cache fill. The paper makes it sound like the latter. Also, 31k LOC for a from-scratch kernel supporting three ISAs is... not a lot. That's either very impressive or they're skipping a lot of stuff a production kernel needs. Curious which.

deleted 5mo ago

[deleted]

varispeed 5mo ago

That title gave me a mild chuckle. As if the chips were wonders of nature that you can find deep in the forest, bring to a lab and build an operating system for them to study. Nice one! :-)