OCP Flashless Boot Specification.pdf

1、IntroductionOCP FlashlessBootSecurityOCP FlashlessBootBharat Pillilli,Principal Engineer,MicrosoftVarun Sampath,Principal Engineer,NVIDIAProblem Statement Eliminate FlashesSecurity:non-volatile boot media exposes hazards for each deviceFunctional issues downtimeSecurity issues bootkitsOperations:fla

2、sh supply chain is complex,multiply by each device in the serverPicking vendorsAligning requirementsField replaceabilityManageability:More firmware more updates more program/erase cycles more problemsFirmware update bottlenecked by program/eraseEach device needs robust file system handling:wear-out

3、risksOOB Firmware Updates(no host OS involvement)TargetAccess WidthLatencySPI read4B320nsPCI TLPs4B to 4KB2000nsMCTP over I3C packet64B21000nsSPI page program256B1120000nsMCTP over I2C packet64B138000000nsSPI sector erase64KB742000000nsCPU/Host Processor Modulesfirmware fetched from DC-SCMCan use eS

4、PI,but eSPI not multi-dropPCIe CEM devicesfirmware local to deviceDC-SCM itselfTop N for Boot Media(BM)EliminationHow to boot the FMCStake:no MCTP-T0 in immutable HW/ROMStake:I3C as early boot link layerDebate:short/mid-term leave FMC in flash?Debate:I3C address assignment:static vs dynamicDebate:Pu

5、sh model(OCP Recovery)vs Pull modelFirmware streaming protocolStake:MCTP-based,link-layer-independentDebate:PLDM-T5 vs something newHandling non-volatile variable storageDebate:Localized vs sharedInvestigation AreasDefine:“early firmware”vs“remainder firmware”Early FW implements MCTP and protocol to

6、 fetch remainder FWProtocol(I3C-link-layer-based)for fetching early FWProtocol(PLDM-T5&MCTP-based)for fetching remainder FWRequirementsShort/mid-term:early FW in flashLong-term:early FW fetched from remote agentNot requirementsPlatform appr