Virtual Research Environment

Interact with and debug the PCC software stack.

Overview

The Private Cloud Compute Virtual Research Environment (PCC VRE) is a set of tools and images that can boot a version of PCC software and simulate a PCC node on a Mac with Apple silicon.

Beyond simply executing the production configuration of PCC, the VRE also enables researchers to load custom code or disable security features normally enforced by PCC’s attestations, so they can take a focused look at specific components of the PCC node.

A VRE instance virtualizes both the Application Processors and the Secure Enclave Processor (SEP), running minimally modified versions of system firmware to accommodate the differences between virtual and physical hardware.

Much like a physical PCC node, VRE provides the capability to generate SEP attestations and run inference requests. Security researchers can inspect and experiment with these code paths to get a deeper understanding of PCC’s components and how the system components handle user data.

Facilitating PCC research

To facilitate research on the platform, the Virtual Research Environment provides a range of capabilities beyond simply running the PCC software in its stock configuration. These include the ability to:

  • Configure darwin-init to experiment with different Restricted Execution Mode states and software settings.

  • Load custom Cryptexes that contain arbitrary code provisioned with arbitrary entitlements, including a shell.

  • Boot custom SPTM, TXM, and kernel cache firmware.

While the VRE allows researchers to inspect everything it contains, we encourage using it to identify potential vulnerabilities, such as the following:

  • Ways to execute unattested code, such as bypassing our code-signing and attestation mechanisms.

  • Exploitable flaws in request processing, which could potentially be used to leak user data.

  • Insufficient validation of system-configuration parameters, which could potentially be used to bypass our privacy protections.

  • Data-only attacks that abuse a Codeless cryptexes whose contents are not published, such as the model cryptexes.

  • Attack persistence techniques that survive reboots despite PCC’s use of an ephemeral data volume.

  • Any potential violations of our privacy protections, including through PCC’s diagnostic logging.