Re: [PATCH 4/4] configfs-tsm-report: Introduce TCB stability enumeration and watchdog

[Dan Williams <dan.j.williams@intel.com>]

Dave Hansen wrote:
> I figured I'd just write down what I think is the contract that we're
> trending towards:
> 
>  1. Attestation includes a snapshot of the TCB, which includes the TDX
>     module and microcode versions.
>  2. There is a record made of each attestation which includes those
>     versions.
>  3. The machine owner is in control of the components of the TCB and may
>     upgrade the components to a later version at any time but can not
>     downgrade them.
>  4. If there is a security regression in a TCB component (say microcode
>     version $V), any TD that ever attested with microcode version $V or
>     any earlier version should be considered exposed to the regression.
>  5. The attestation record is the sole means of limiting the scope of
>     the impact from the regression.
> 
> The subtle part of that is that the attestation really isn't for a
> single version.  It's fundamentally for that version or any later future
> version of the machine owner's choosing.

So, in summary per Alex's last note: "there is no operationally viable
way to be a confidential computing tenant in the cloud and distrust
updates from the platform vendor deployed at will by the cloud
operator".