Caliptra SPDM VDM Commands

Overview

This document describes how Caliptra common commands are transported over SPDM Vendor Defined Messages (VDM) via MCTP. This is the out-of-band (OOB) path for standard, vendor-neutral Caliptra device management commands that require SPDM-defined semantics, SPDM authorization, or SPDM streaming/chunking.

For command definitions (categories, payloads, and completion codes), see Caliptra Common Commands.

For the unified software architecture shared between OOB (SPDM VDM) and in-band (MCI Mailbox) paths, see Unified Caliptra Command Handling.

Transport Stack

┌─────────────────────────────────────────┐
│        Caliptra VDM Commands            │
│ (FirmwareVersion, ExportAttestedCsr, …) │
├─────────────────────────────────────────┤
│      Caliptra Command Header            │
│     (Command Version, Command Code)     │
├─────────────────────────────────────────┤
│        OCP SPDM VDM Framing             │
│     (IANA Registry ID, Vendor ID)       │
├─────────────────────────────────────────┤
│              SPDM                       │
│     (VENDOR_DEFINED_REQUEST/RESPONSE)   │
├─────────────────────────────────────────┤
│              MCTP                       │
│        (Message Type 0x05)              │
├─────────────────────────────────────────┤
│         Physical Layer                  │
│              (I3C)                      │
└─────────────────────────────────────────┘

SPDM VDM Encapsulation

Caliptra commands assigned to SPDM VDM are carried within SPDM VENDOR_DEFINED_REQUEST and VENDOR_DEFINED_RESPONSE messages using the OCP-assigned Vendor ID (42623). The command range 0x01-0x20 is reserved in the OCP registry and defined by the Caliptra Working Group.

OCP VDM Header

The SPDM VDM standard header identifies the vendor organization:

Caliptra VDM Message Header

Following the OCP VDM standard header, the Caliptra-specific message header appears:

Response Format

Responses follow the same header structure. The Command Code in the response mirrors the request. The response payload begins with a CaliptraCompletionCode (1 byte) indicating success or failure. Command-specific response data, if any, follows the completion code:

See Completion Codes for the full list of error codes.

The SPDM VDM completion code is transport-specific response status and is not included in the transport-agnostic common response payload tables.

Command Codes

The following table maps SPDM VDM command codes to Caliptra common commands. For command payload definitions, see Caliptra Common Commands.

These command codes are assigned from the Caliptra range reserved in the OCP command registry.

R = Required, O = Optional

Authorization-Gated Subcommands

The following subcommands are assigned to the SPDM VDM IANA authorization-gated path and are carried under AuthorizedCommand. Only subcommands marked Supported are currently dispatched; requests for Planned subcommands return InvalidParameter. AuthorizedCommand does not define the authorization mechanism by itself. The concrete SPDM authorization mechanism and message flow are still under design and will be specified separately.