Firmware Recovery Protocols

[Tom Joseph]

Hello all,

Devices such as GPUs, CPUs, and  NICs support firmware update using
standard protocols like MCTP and PLDM T5. They also support recovery
protocols, providing out-of-band mechanisms to detect when a device enters
a fault state where firmware update is not possible and to securely restore
it to a known good condition.

The Open Compute Project (OCP) offers a secure firmware protocol [1] to
determine if a device is in recovery mode and to facilitate recovery
through the transfer of recovery images, typically over SMBus. Firmware
recovery generally follows a two-stage process: OCP recovery is first used
to deliver the Stage 1 (initial) firmware to the device, which then enables
further updates through MCTP/PLDM T5. Stage 2 involves transferring
complete device firmware using MCTP/PLDM T5, which is already supported by
the OpenBMC stack. There are also similar custom protocols for device
recovery, some of which support two stage updates while others recover with
a single-stage update.

To bring these capabilities into the OpenBMC ecosystem, the proposal is to
leverage the standard Redfish API for code updates and utilize PLDM
packaging for recovery images. Recovery protocols like OCP would be
implemented as Non-PLDM code updaters, which handle the specific recovery
protocol and parse PLDM packages to extract the appropriate recovery images
for each device. This approach builds on the current efforts to update
non-PLDM devices, such as VRs and CPLDs, with PLDM image packaging.

I welcome feedback from the community on the approach and invite any
alternative suggestions.

[1]
https://www.opencompute.org/documents/ocp-recovery-document-1p0-final-1-pdf
[2] https://gerrit.openbmc.org/c/openbmc/docs/+/76645
Regards,
Tom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20250815/ee747a17/attachment.htm>