Caliptra SPDM VDM Commands

Overview

This document describes how Caliptra external commands are transported over SPDM Vendor Defined Messages (VDM) via MCTP. This is the out-of-band (OOB) path for accessing Caliptra device management commands from an external agent such as a BMC.

For command definitions (categories, payloads, and completion codes), see Caliptra Common Commands.

For the unified software architecture shared between OOB (SPDM VDM) and in-band (MCI Mailbox) paths, see Unified Caliptra Command Handling.

Transport Stack

┌─────────────────────────────────────────┐
│        Caliptra VDM Commands            │
│ (FirmwareVersion, ExportAttestedCsr, …) │
├─────────────────────────────────────────┤
│      Caliptra Command Header            │
│     (Command Version, Command Code)     │
├─────────────────────────────────────────┤
│        OCP SPDM VDM Framing             │
│     (IANA Registry ID, Vendor ID)       │
├─────────────────────────────────────────┤
│              SPDM                       │
│     (VENDOR_DEFINED_REQUEST/RESPONSE)   │
├─────────────────────────────────────────┤
│              MCTP                       │
│        (Message Type 0x05)              │
├─────────────────────────────────────────┤
│         Physical Layer                  │
│              (I3C)                      │
└─────────────────────────────────────────┘

SPDM VDM Encapsulation

Common Caliptra commands are carried within SPDM VENDOR_DEFINED_REQUEST and VENDOR_DEFINED_RESPONSE messages using the OCP-assigned Vendor ID (42623). The command range 0x010x20 is reserved in the OCP registry and defined by the Caliptra Working Group.

OCP VDM Header

The SPDM VDM standard header identifies the vendor organization:

FieldSizeValueDescription
Standard ID2 bytes0x0005IANA Enterprise ID format
Vendor ID Length1 byte0x04Length of the Vendor ID field (4 bytes)
Vendor ID (IANA)4 bytes0x0000A67FOCP Caliptra Working Group IANA Enterprise Number

Caliptra VDM Message Header

Following the OCP VDM standard header, the Caliptra-specific message header appears:

FieldSizeDescription
Command Version1 byteProtocol version. Current value: 0x01
Command Code1 byteIdentifies the command (see Command List)

Response Format

Responses follow the same header structure. The Command Code in the response mirrors the request. The response payload begins with an CaliptraCompletionCode (1 byte) indicating success or failure:

FieldSizeDescription
Command Version1 byte0x01
Command Code1 byteSame as request command code
Completion Code1 byteOCP completion code (0x00 = Success)
PayloadN bytesCommand-specific response data

See Completion Codes for the full list of error codes.

Command Codes

The following table maps SPDM VDM command codes to Caliptra common commands. For command payload definitions, see Caliptra Common Commands.

Command CodeCommand NameR/ODescription
0x01Firmware VersionRRetrieve firmware version information.
0x02Device CapabilitiesRRetrieve device capabilities.
0x03Device IDRRetrieve device ID.
0x04Device InformationRRetrieve device information.
0x05Get Debug LogRRetrieve debug log.
0x06Clear Debug LogRClear debug log.
0x07Get Attestation LogORetrieve attestation measurement log.
0x08Clear Attestation LogOClear attestation log (requires authorization).
0x09Get AttestationORetrieve attestation evidence.
0x0ARequest Debug UnlockORequest debug unlock in production environment.
0x0BAuthorize Debug Unlock TokenOSend debug unlock token for authorization.
0x0CExport IDevID CSRRExport IDevID certificate signing request.
0x0DSet Slot 0 CertRSet CA-signed IDevID certificate in slot 0.
0x0EGet Slot 0 StateOCheck provisioning state of certificate slot 0.
0x0FExport Attested CSROExport attested CSR for a device identity key.
0x10Program Field EntropyOProgram field entropy into the device.
0x11Device Ownership TransferOTransfer device ownership.

R = Required, O = Optional