diff --git a/openpower/package/hostboot-p10/0001-TOR-API-Refactoring-traversal-and-buffer-check-impro.patch b/openpower/package/hostboot-p10/0001-TOR-API-Refactoring-traversal-and-buffer-check-impro.patch
new file mode 100644
index 0000000..cbe3bd7
--- /dev/null
+++ b/openpower/package/hostboot-p10/0001-TOR-API-Refactoring-traversal-and-buffer-check-impro.patch
@@ -0,0 +1,1761 @@
+From c2b2d20fdf36bff21577ca6ed6703395ebad8971 Mon Sep 17 00:00:00 2001
+From: Olsen <cmolsen@us.ibm.com>
+Date: Wed, 9 Oct 2019 08:53:07 -0400
+Subject: [PATCH] TOR API : Refactoring, traversal and buffer check
+ improvements
+
+Changes made:
+- Introduced two new internal functions: _tor_access_ring()
+  and _tor_header_check().
+- Updated tor_append_ring() to pass a max ringSectionSize arg to be
+  checked for overflow in the new _tor_access_ring() function.
+- Moved the actual appending/updating of RS4 rings out of
+  tor_append_ring() into _tor_access_ring().
+- Removed tor_access_ring().
+- All TOR chiplet and ring offsets are now referenced wrt to the
+  ringSection origin (ie, where the TOR header starts).
+- Updated TOR_VERSION to v2.
+- Refactoring of various TOR APIs to use the above changes.
+- Updates to ring_apply, ipl_customize and qme_customize to support
+  the new tor_append_ring() API.
+- Updates to Sbe and Qme TOR traversal codes and extract HOMER.
+- Various cleanups in buffer handling in p10_ipl_customize.C.
+- Removed p9_ring_apply.* files (though not at all relevant to this
+  commit)
+
+Key_Cronus_Test=XIP_REGRESS_SBE_QME
+
+Change-Id: I7bb3a76ae2454a34c7c0619e928c67706cc571e4
+Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/85899
+Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
+Tested-by: PPE CI <ppe-ci+hostboot@us.ibm.com>
+Tested-by: Cronus HW CI <cronushw-ci+hostboot@us.ibm.com>
+Reviewed-by: Prem Shanker Jha <premjha2@in.ibm.com>
+Reviewed-by: Jennifer A Stofer <stofer@us.ibm.com>
+---
+ .../chips/common/utils/imageProcs/common_ringId.H  |  25 +-
+ .../procedures/hwp/customize/p10_ipl_customize.C   | 196 ++++++--
+ .../procedures/hwp/customize/p10_qme_customize.C   | 152 ++----
+ .../xml/error_info/p10_ipl_customize_errors.xml    |   3 +-
+ .../p10/utils/imageProcs/p10_infrastruct_help.H    |   1 -
+ .../p10/utils/imageProcs/p10_scan_compression.H    |   5 +-
+ src/import/chips/p10/utils/imageProcs/p10_tor.C    | 526 ++++++++++-----------
+ src/import/chips/p10/utils/imageProcs/p10_tor.H    |  97 ++--
+ 8 files changed, 483 insertions(+), 522 deletions(-)
+
+diff --git a/src/import/chips/common/utils/imageProcs/common_ringId.H b/src/import/chips/common/utils/imageProcs/common_ringId.H
+index 1fc819a..053af8c 100644
+--- a/src/import/chips/common/utils/imageProcs/common_ringId.H
++++ b/src/import/chips/common/utils/imageProcs/common_ringId.H
+@@ -48,7 +48,7 @@ typedef uint8_t   ChipletType_t;    // Type for Chiplets enum
+ typedef uint8_t   ChipId_t;         // Type for ChipId enum
+ typedef uint8_t   RingType_t;       // Type for RingType enum
+ typedef uint8_t   RingRequest_t;    // Type for RingRequest enum, e.g. GET_SINGLE_RING
+-typedef uint32_t  TorCpltOffset_t;  // Type for offset value to chiplet's CMN or INST section
++typedef uint16_t  TorOffset_t;      // Type for offset value to various TOR objects (chiplet,ring)
+ typedef uint8_t   MyBool_t;         // false:0, true:1, undefined:UNDEFINED_BOOLEAN
+ 
+ #define  UNDEFINED_RING_ID         (RingId_t)0xffff
+@@ -61,10 +61,14 @@ typedef uint8_t   MyBool_t;         // false:0, true:1, undefined:UNDEFINED_BOOL
+ 
+ #define  UNDEFINED_DD_LEVEL     (uint8_t)0xff
+ 
+-#define  MAX_TOR_RING_OFFSET    (uint16_t)(256*256-1) // Max val of uint16
+-
+ #define  MAX_RING_NAME_LENGTH   (uint8_t)50
+ 
++// Ring section defines
++#define  MAX_TOR_RING_OFFSET        (uint16_t)(256*256-1) // Max val of uint16
++#define  MAX_TOR_RING_SECTION_SIZE  (uint32_t)(256*256)
++#define  MAX_DYN_RING_SECTION_SIZE  (uint32_t)(1024*1024)
++
++// Chiplet ID defines
+ #define  CHIPLET_ID_MASK       (uint32_t)0xFF000000
+ #define  MIN_INSTANCE_ID       (uint8_t)0x01
+ #define  MAX_INSTANCE_ID       (uint8_t)0x3F
+@@ -93,12 +97,10 @@ typedef struct
+ 
+ typedef struct
+ {
+-    TorCpltOffset_t cmnOffset;
+-    TorCpltOffset_t instOffset;
++    TorOffset_t cmnOffset;
++    TorOffset_t instOffset;
+ } TorCpltBlock_t;
+ 
+-typedef uint16_t TorRingOffset_t;  // Offset value to actual ring
+-
+ //                                                                           //
+ //                     TOR layout definitions - End                          //
+ ///////////////////////////////////////////////////////////////////////////////
+@@ -118,7 +120,8 @@ typedef uint16_t TorRingOffset_t;  // Offset value to actual ring
+ //#define TOR_VERSION  7  // Added three more runtime risk levels (RL3/4/5)
+ 
+ // P10 TOR versions
+-#define TOR_VERSION  1  // Removed all ring variant support. Only BASE rings supported now.
++//#define TOR_VERSION  1  // Removed all ring variant support. Only BASE rings supported now.
++#define TOR_VERSION  2  // TOR ringSection offsets now wrt origin of ringSection at TOR header.
+ 
+ 
+ // TOR Magic values for top-level TOR ringSection and sub-ringSections
+@@ -263,8 +266,8 @@ enum RingType
+ 
+ enum RingRequest
+ {
+-    GET_SINGLE_RING     = 0x00,
+-    PUT_SINGLE_RING     = 0x01
++    GET_SINGLE_RING        = 0,
++    PUT_SINGLE_RING        = 1,
+ };
+ 
+ //
+@@ -327,7 +330,7 @@ typedef struct
+ #define TOR_INVALID_CHIP_ID                   INFRASTRUCT_NOOF_RCS + 3
+ #define TOR_INVALID_CHIPLET_TYPE              INFRASTRUCT_NOOF_RCS + 4
+ #define TOR_INVALID_RING_ID                   INFRASTRUCT_NOOF_RCS + 5
+-#define TOR_INVALID_INSTANCE_ID               INFRASTRUCT_NOOF_RCS + 6
++#define TOR_INVALID_CHIPLET_ID                INFRASTRUCT_NOOF_RCS + 6
+ #define TOR_INVALID_RING_REQUEST              INFRASTRUCT_NOOF_RCS + 7
+ #define TOR_UNSUPPORTED_RING_SECTION          INFRASTRUCT_NOOF_RCS + 8
+ #define TOR_RING_FILE_NOT_FOUND               INFRASTRUCT_NOOF_RCS + 9
+diff --git a/src/import/chips/p10/procedures/hwp/customize/p10_ipl_customize.C b/src/import/chips/p10/procedures/hwp/customize/p10_ipl_customize.C
+index 3a114f0..b36ef65 100644
+--- a/src/import/chips/p10/procedures/hwp/customize/p10_ipl_customize.C
++++ b/src/import/chips/p10/procedures/hwp/customize/p10_ipl_customize.C
+@@ -882,10 +882,10 @@ fapi2::ReturnCode _fetch_and_insert_vpd_rings(
+ 
+         l_rc = tor_append_ring(
+                    i_ringSection,
+-                   io_ringSectionSize, // In: Exact size. Out: Updated size.
++                   i_maxRingSectionSize,
+                    i_ringId,
+-                   l_chipletId,     // Chiplet ID
+-                   i_vpdRing );     // The VPD RS4 ring container
++                   l_chipletId,
++                   i_vpdRing );
+ 
+         FAPI_ASSERT( l_rc == INFRASTRUCT_RC_SUCCESS,
+                      fapi2::XIPC_TOR_APPEND_RING_FAILED().
+@@ -896,7 +896,10 @@ fapi2::ReturnCode _fetch_and_insert_vpd_rings(
+                      "tor_append_ring() failed in sysPhase=%d w/rc=%d for ringId=0x%x",
+                      i_sysPhase, l_rc, i_ringId );
+ 
+-        FAPI_IMP("Successfully appended VPD ring, (ringId,chipletId)=(0x%x,0x%02x), and now ringSectionSize=%u",
++        io_ringSectionSize = be32toh(((TorHeader_t*)i_ringSection)->size);
++
++        FAPI_IMP("Successfully appended VPD ring, (ringId,chipletId)=(0x%x,0x%02x), and"
++                 " now ringSectionSize=%u",
+                  i_ringId, l_chipletId, io_ringSectionSize);
+     }
+     else if ((uint32_t)l_fapiRc == RC_MVPD_RING_NOT_FOUND)
+@@ -907,7 +910,7 @@ fapi2::ReturnCode _fetch_and_insert_vpd_rings(
+         // No match, do nothing. But since rare, trace out as warning since all
+         // rings we're looking for in Mvpd really should be represented there.
+         FAPI_DBG("WARNING!: _fetch_and_insert_vpd_rings(): The ring w/"
+-                 "(ringId,chipletId)=(0x%02x,0x%02x) was not found. (This is not a bug)",
++                 "(ringId,chipletId)=(0x%x,0x%02x) was not found. (This is not a bug)",
+                  i_ringId, l_chipletId);
+ 
+         fapi2::current_err = fapi2::FAPI2_RC_SUCCESS;
+@@ -977,7 +980,7 @@ fapi2::ReturnCode resolve_gptr_overlays(
+     FAPI_TRY( FAPI_ATTR_GET_PRIVILEGED(fapi2::ATTR_EC,
+                                        i_procTarget,
+                                        o_ddLevel),
+-              "Error: Attribute ATTR_EC failed w/rc=0x%08x",
++              "ERROR: Attribute ATTR_EC failed w/rc=0x%08x",
+               (uint64_t)current_err );
+ 
+     l_rc = p9_xip_get_section(i_hwImage, P9_XIP_SECTION_HW_OVERLAYS, &l_xipSection, o_ddLevel);
+@@ -1848,7 +1851,7 @@ fapi2::ReturnCode process_base_and_dynamic_rings(
+                  set_RING_ID(i_ringId).
+                  set_DD_LEVEL(i_ddlevel).
+                  set_LOCAL_RC(l_rc),
+-                 "tor_get_single_ring() for Base ring: Failed w/rc=%i for "
++                 "ERROR: tor_get_single_ring() for Base ring: Failed w/rc=%i for "
+                  "ringId=0x%x, chipletId=0xff and ddLevel=0x%x",
+                  l_rc, i_ringId, i_ddlevel );
+ 
+@@ -1862,14 +1865,9 @@ fapi2::ReturnCode process_base_and_dynamic_rings(
+         baseTypeField = ((CompressedScanData*)baseRs4)->iv_type;
+     }
+ 
+-//CMO-20190902: At this point we could probably sanity check that baseTypeField ==
+-//              dynTypeField. However, it's a hit-and-miss check since we can only
+-//              make this check if both a Base AND a Dynamic ring is found. It's
+-//              better than nothing, but we postpone for now.
+-
+     if(bBaseRingFound && bDynRingFound)
+     {
+-        FAPI_DBG("Base and Dynamic rings found.");// Will delete later
++        FAPI_DBG("ringId=0x%x: Base ring found. Dynamic ring found.", i_ringId);
+ 
+         // Use baseTypeField as ref input value for iv_type, but dynTypeField would be just as good
+         finalTypeField = (baseTypeField & ~RS4_IV_TYPE_SEL_MASK) |
+@@ -1891,7 +1889,7 @@ fapi2::ReturnCode process_base_and_dynamic_rings(
+     }
+     else if(!bBaseRingFound && bDynRingFound)
+     {
+-        FAPI_DBG("No Base ring found. Dynamic ring found.");//Will delete later
++        FAPI_DBG("ringId=0x%x: No Base ring found. Dynamic ring found.", i_ringId);
+ 
+         // We'll need these temp vars below
+         RingId_t ringIdTmp = be16toh(((CompressedScanData*)finalRs4)->iv_ringId);
+@@ -1927,7 +1925,7 @@ fapi2::ReturnCode process_base_and_dynamic_rings(
+     else if(bBaseRingFound && !bDynRingFound)
+     {
+         //In this case finalRs4 = baseRs4 = io_ringBuf1 already has the final ring
+-        FAPI_DBG("Base ring found. No Dynamic ring found.");//Will delete this later
++        FAPI_DBG("ringId=0x%x: Base ring found. No Dynamic ring found.", i_ringId);
+ 
+         finalTypeField = (baseTypeField & ~RS4_IV_TYPE_SEL_MASK) |
+                          RS4_IV_TYPE_SEL_BASE | RS4_IV_TYPE_SEL_FINAL;
+@@ -1939,11 +1937,11 @@ fapi2::ReturnCode process_base_and_dynamic_rings(
+     }
+     else
+     {
+-        FAPI_DBG("No Base or Dynamic rings found."); // Delete later
++        FAPI_DBG("ringId=0x%x: No Base ring found. No Dynamic ring found.", i_ringId);
+         fapi2::current_err = RC_XIPC_NO_RING_FOUND;
+     }
+ 
+-    //io_ringBuf1 has the final ring at this point.
++    // Note that the final ring is already in io_ringBuf1 at this point.
+ 
+ fapi_try_exit:
+     FAPI_DBG("Exiting process_base_and_dynamic_rings");
+@@ -1990,8 +1988,9 @@ ReturnCode p10_ipl_customize (
+     uint32_t        l_inputImageSize;
+     uint32_t        l_imageSizeWithoutRings;
+     uint32_t        l_currentImageSize;
+-    uint32_t        l_maxImageSize = 0; // Attrib adjusted local value of MAX_SEEPROM_IMAGE_SIZE
+-    uint32_t        l_maxRingSectionSize;
++    uint32_t        l_maxImageSize = 0;   // Attrib adjusted local value of MAX_SEEPROM_IMAGE_SIZE
++    uint32_t        l_maxRingSectionSize; // Max size of ringSection
++    uint32_t        l_ringSectionBufSize; // Size of ringSection buffer
+     uint32_t        l_sectionOffset = 1;
+     uint32_t        attrMaxSbeSeepromSize = 0;
+     uint32_t        l_requestedBootCoreMask = (i_sysPhase == SYSPHASE_HB_SBE) ? io_bootCoreMask : 0xFFFFFFFF;
+@@ -2016,14 +2015,13 @@ ReturnCode p10_ipl_customize (
+     void*           baseRingSection = NULL;
+     void*           dynamicRingSection = NULL;
+     TorHeader_t*    torHeaderBase;
+-    uint32_t        customRingSectionSize = 0;
+     uint8_t*        partialKwdData = NULL;
+     uint32_t        sizeofPartialKwdData  = 0;
+     uint8_t         mvpdRtvFromCode = 0xff;
+     uint8_t         mvpdRtvFromMvpd = 0xff;
+     MvpdKeyword     mvpdKeyword;
+ 
+-    FAPI_IMP ("Entering p10_ipl_customize w/sysPhase=%d...", i_sysPhase);
++    FAPI_IMP("Entering p10_ipl_customize w/sysPhase=%d...", i_sysPhase);
+ 
+ 
+     // Make copy of the requested bootCoreMask
+@@ -2122,6 +2120,9 @@ ReturnCode p10_ipl_customize (
+                  (uintptr_t)i_ringBufSize2,
+                  (uintptr_t)i_ringBufSize3 );
+ 
++    // Make local copy of the [max] io_ringSectionBufSize before we start changing it
++    l_ringSectionBufSize = io_ringSectionBufSize;
++
+ 
+     //-------------------------------------------
+     // Verify that platform and Mvpd agree on:
+@@ -2590,17 +2591,17 @@ ReturnCode p10_ipl_customize (
+                      set_CHIP_TARGET(i_procTarget).
+                      set_INPUT_IMAGE_SIZE(l_inputImageSize).
+                      set_IMAGE_BUF_SIZE(io_imageSize).
+-                     set_RING_SECTION_BUF_SIZE(io_ringSectionBufSize).
++                     set_RING_SECTION_BUF_SIZE(l_ringSectionBufSize).
+                      set_RING_BUF_SIZE1(i_ringBufSize1).
+                      set_RING_BUF_SIZE2(i_ringBufSize2).
+                      set_OCCURRENCE(2),
+                      "One or more invalid input buffer sizes for HB_SBE phase:\n"
+                      "  l_maxImageSize=0x%016llx\n"
+                      "  io_imageSize=0x%016llx\n"
+-                     "  io_ringSectionBufSize=0x%016llx\n",
++                     "  l_ringSectionBufSize=0x%016llx\n",
+                      (uintptr_t)l_maxImageSize,
+                      (uintptr_t)io_imageSize,
+-                     (uintptr_t)io_ringSectionBufSize );
++                     (uintptr_t)l_ringSectionBufSize );
+ 
+     }
+ 
+@@ -2691,7 +2692,8 @@ ReturnCode p10_ipl_customize (
+                          set_CHIP_TARGET(i_procTarget).
+                          set_SYSPHASE(i_sysPhase).
+                          set_OCCURRENCE(1),
+-                         "Caller bug: Caller supplied unsupported value of sysPhase=%u (Occurrence 1)",
++                         "Caller bug: Caller supplied unsupported value of sysPhase=%u"
++                         " (Occurrence 1)",
+                          i_sysPhase );
+ 
+             break;
+@@ -2715,6 +2717,7 @@ ReturnCode p10_ipl_customize (
+ 
+ 
+ 
++
+     //////////////////////////////////////////////////////////////////////////
+     // CUSTOMIZE item:     Build up a new ring section in io_ringSectionBuf
+     //                     based on the TOR header info in baseRingSection.
+@@ -2734,7 +2737,64 @@ ReturnCode p10_ipl_customize (
+                  set_CHIP_TARGET(i_procTarget),
+                  "tor_skeleton_generation failed w/rc=0x%08X", (uint32_t)l_rc );
+ 
+-    customRingSectionSize = be32toh(((TorHeader_t*)io_ringSectionBuf)->size);
++    // Now, start tracking the instantaneous actual custom ring section size.
++    // (Note that we already took a copy of the [max] value of io_ringSectionBufSize
++    // earlier on into l_ringSectionBufSize, so safe to update this now.)
++    io_ringSectionBufSize = be32toh(((TorHeader_t*)io_ringSectionBuf)->size);
++
++
++
++
++    //////////////////////////////////////////////////////////////////////////
++    // CUSTOMIZE item:     Determine the max allowed ringSection size
++    // Systemp phase:      All phases
++    //////////////////////////////////////////////////////////////////////////
++
++    switch (i_sysPhase)
++    {
++
++        case SYSPHASE_HB_SBE:
++
++            // Calc the max ring section size for SBE.
++            l_maxRingSectionSize = l_maxImageSize - l_imageSizeWithoutRings;
++
++            break;
++
++        case SYSPHASE_RT_QME:
++
++            // Max ring section size for QME.
++            l_maxRingSectionSize = l_ringSectionBufSize; // l_ringSectionBufSize is actual max buf size
++
++            break;
++
++        default:
++
++            FAPI_ASSERT( false,
++                         fapi2::XIPC_INVALID_SYSPHASE_PARM().
++                         set_CHIP_TARGET(i_procTarget).
++                         set_SYSPHASE(i_sysPhase).
++                         set_OCCURRENCE(2),
++                         "Caller bug: Caller supplied unsupported value of sysPhase=%u"
++                         " (Occurrence 2)",
++                         i_sysPhase );
++
++            break;
++    }
++
++    // maxRingSectionSize should never exceed ringSectionBufSize which should always be allocated
++    // to be so large that we should be able to fill out the image to its maximum capacity.
++    FAPI_ASSERT( l_maxRingSectionSize <= l_ringSectionBufSize,
++                 fapi2::XIPC_RING_SECTION_SIZING().
++                 set_CHIP_TARGET(i_procTarget).
++                 set_RING_SECTION_SIZE(io_ringSectionBufSize).
++                 set_RING_SECTION_BUF_SIZE(l_ringSectionBufSize).
++                 set_MAX_RING_SECTION_SIZE(l_maxRingSectionSize).
++                 set_OCCURRENCE(1),
++                 "CODE BUG : maxRingSectionSize(=%u) > ringSectionBufSize(=%u) should"
++                 " never happen. Fix your assumptions/settings about ringSection"
++                 " buffer size or max image size (=%u) (Occurrence 1)",
++                 l_maxRingSectionSize, l_ringSectionBufSize, l_maxImageSize );
++
+ 
+ 
+ 
+@@ -2767,7 +2827,9 @@ ReturnCode p10_ipl_customize (
+                  set_CHIP_TARGET(i_procTarget).
+                  set_OCCURRENCE(5),
+                  "FAPI_ATTR_GET(ATTR_DYNAMIC_INIT_FEATURE_VEC) failed."
+-                 " Unable to determine featureVector." );
++                 " Unable to determine featureVec." );
++
++    FAPI_IMP("Dynamic inits featureVec = 0x%016llx (GET from plat attribute)", featureVec);
+ 
+     l_fapiRc2 = FAPI_ATTR_GET(fapi2::ATTR_SYSTEM_IPL_PHASE,
+                               FAPI_SYSTEM,
+@@ -2822,6 +2884,8 @@ ReturnCode p10_ipl_customize (
+                  set_OCCURRENCE(8),
+                  "Failed to set the dynamic init feature vector attribute" );
+ 
++    FAPI_IMP("Dynamic inits featureVec = 0x%016llx (SET to plat attribute)", featureVec);
++
+     l_rc = p9_xip_get_section(i_hwImage, P9_XIP_SECTION_HW_DYNAMIC, &iplImgSection, attrDdLevel);
+ 
+     FAPI_ASSERT( l_rc == INFRASTRUCT_RC_SUCCESS,
+@@ -2848,7 +2912,7 @@ ReturnCode p10_ipl_customize (
+ 
+ //CMO-20190825: For the RT_QME phase we will get TOR_INVALID_CHIPLET_TYPE a lot
+ //              here because we cycle through all the chiplets, when we really only
+-//              shold consider the EQ chiplet for RT_QME.  For now, we will be
++//              should consider the EQ chiplet for RT_QME. For now, we will be
+ //              mindless, but this should probably be changed.
+     for(ringId = 0; ringId < NUM_RING_IDS; ringId++)
+     {
+@@ -2880,16 +2944,16 @@ ReturnCode p10_ipl_customize (
+                      "ringId=0x%0x w/rc=0x%08x",
+                      ringId, (uint32_t)l_fapiRc);
+ 
+-        if(l_fapiRc == FAPI2_RC_SUCCESS)
++        if (l_fapiRc == FAPI2_RC_SUCCESS)
+         {
+             l_rc = tor_append_ring(
+                        io_ringSectionBuf,
+-                       customRingSectionSize,
++                       l_maxRingSectionSize,
+                        ringId,
+                        0xff,
+                        i_ringBuf1 );
+ 
+-            FAPI_ASSERT( l_rc == INFRASTRUCT_RC_SUCCESS ||
++            FAPI_ASSERT( l_rc == TOR_SUCCESS ||
+                          l_rc == TOR_INVALID_CHIPLET_TYPE ||
+                          l_rc == TOR_RING_HAS_DERIVS,
+                          fapi2::XIPC_TOR_APPEND_RING_FAILED().
+@@ -2902,12 +2966,45 @@ ReturnCode p10_ipl_customize (
+                          "for ringId=0x%x",
+                          l_rc, ringId );
+ 
+-            FAPI_DBG("A Base or Dynamic ring w/ringId=0x%x was either appended or skipped (if"
+-                     " deriv ring or invalid chiplet) and now ringSectionSize=%u",
+-                     ringId, be32toh(((TorHeader_t*)io_ringSectionBuf)->size));
++            io_ringSectionBufSize = be32toh(((TorHeader_t*)io_ringSectionBuf)->size);
++
++            switch (l_rc)
++            {
++                case TOR_SUCCESS:
++                    FAPI_IMP("A Base or Dynamic ring w/ringId=0x%x was appended"
++                             " and now ringSection->size=%u",
++                             ringId, io_ringSectionBufSize);
++                    break;
++
++                case TOR_INVALID_CHIPLET_TYPE:
++                    FAPI_IMP("A Base or Dynamic ring w/ringId=0x%x was skipped"
++                             " because its an invalid chiplet for this sysPhase=%u",
++                             ringId, i_sysPhase);
++                    break;
++
++                case TOR_RING_HAS_DERIVS:
++                    FAPI_IMP("A Base or Dynamic ring w/ringId=0x%x was skipped"
++                             " because its a [root] ring w/derivatives",
++                             ringId);
++                    break;
++
++                default:
++                    FAPI_ASSERT( false,
++                                 fapi2::XIPC_CODE_BUG().
++                                 set_CHIP_TARGET(i_procTarget).
++                                 set_OCCURRENCE(2),
++                                 "Code bug(2): Messed up RC handling in assoc code. Fix code!" );
++                    break;
++            }
++
+         }
+     }
+ 
++    // Now create the "anticipatory" dynamic init debug ring list.
++    // - This list lists all the ringIds that have received dynamic init overlays.
++    // - For each ringId, the complete final feature vector is included so it can be seen
++    //   which specific features were applied to a given ringId.
++    // - The list may come in handy in case of scanning issues with the final dynamic rings.
+     ringIdFeatListSize = ringIdFeatureVecMap.size() * (sizeof(uint64_t) + sizeof(RingId_t));
+     ringIdFeatList = new uint8_t[ringIdFeatListSize];
+ 
+@@ -2938,11 +3035,6 @@ ReturnCode p10_ipl_customize (
+                           0 );
+ 
+ 
+-    // Make a copy of the supplied max ring section buffer size before over writing it
+-    l_maxRingSectionSize = io_ringSectionBufSize;
+-
+-    // Now, start tracking the instantaneous actual custom ring section size
+-    io_ringSectionBufSize = customRingSectionSize;
+ 
+     //////////////////////////////////////////////////////////////////////////
+     // CUSTOMIZE item:     Append VPD rings to io_ringSectionBuf
+@@ -3019,12 +3111,8 @@ ReturnCode p10_ipl_customize (
+ 
+         case SYSPHASE_HB_SBE:
+ 
+-            FAPI_DBG("Size of SBE .rings section before VPD update: %d", io_ringSectionBufSize);
+-
+-            // Adjust the max ring section size
+-            l_maxRingSectionSize = l_maxImageSize - l_imageSizeWithoutRings;
+-
+-            FAPI_DBG("Max allowable size of .rings section: %d", l_maxRingSectionSize);
++            FAPI_DBG("Size of SBE .rings section before VPD update: %u (max size allowed: %u)",
++                     io_ringSectionBufSize, l_maxRingSectionSize);
+ 
+             //----------------------------------------
+             // Append VPD Rings to the .rings section
+@@ -3107,12 +3195,13 @@ ReturnCode p10_ipl_customize (
+ 
+             // More size code sanity checks of section and image sizes.
+             FAPI_ASSERT( io_ringSectionBufSize <= l_maxRingSectionSize,
+-                         fapi2::XIPC_SECTION_SIZING().
++                         fapi2::XIPC_RING_SECTION_SIZING().
+                          set_CHIP_TARGET(i_procTarget).
+                          set_RING_SECTION_SIZE(io_ringSectionBufSize).
++                         set_RING_SECTION_BUF_SIZE(l_ringSectionBufSize).
+                          set_MAX_RING_SECTION_SIZE(l_maxRingSectionSize).
+-                         set_OCCURRENCE(1),
+-                         "Code bug: ringSectionBufSize(=%d) > maxRingSectionSize(=%d) in HB_SBE(1)",
++                         set_OCCURRENCE(2),
++                         "Code bug: ringSectionBufSize(=%d) > maxRingSectionSize(=%d) in HB_SBE (Occurrence 2)",
+                          io_ringSectionBufSize, l_maxRingSectionSize );
+ 
+             FAPI_ASSERT( (l_imageSizeWithoutRings + io_ringSectionBufSize) <= l_maxImageSize,
+@@ -3219,12 +3308,14 @@ ReturnCode p10_ipl_customize (
+ 
+             // More size code sanity checks of section and image sizes.
+             FAPI_ASSERT( io_ringSectionBufSize <= l_maxRingSectionSize,
+-                         fapi2::XIPC_SECTION_SIZING().
++                         fapi2::XIPC_RING_SECTION_SIZING().
+                          set_CHIP_TARGET(i_procTarget).
+                          set_RING_SECTION_SIZE(io_ringSectionBufSize).
++                         set_RING_SECTION_BUF_SIZE(l_ringSectionBufSize).
+                          set_MAX_RING_SECTION_SIZE(l_maxRingSectionSize).
+                          set_OCCURRENCE(3),
+-                         "Code bug: QME ring section size(=%d) > maxRingSectionSize(=%d) in RT_QME(3)",
++                         "Code bug: QME ring section size(=%d) > maxRingSectionSize(=%d)"
++                         " in RT_QME (Occurrence 3)",
+                          io_ringSectionBufSize, l_maxRingSectionSize );
+ 
+             break;
+@@ -3234,8 +3325,9 @@ ReturnCode p10_ipl_customize (
+                          fapi2::XIPC_INVALID_SYSPHASE_PARM().
+                          set_CHIP_TARGET(i_procTarget).
+                          set_SYSPHASE(i_sysPhase).
+-                         set_OCCURRENCE(2),
+-                         "Caller bug: Caller supplied unsupported value of sysPhase=%u (Occurrence 2)",
++                         set_OCCURRENCE(3),
++                         "Caller bug: Caller supplied unsupported value of sysPhase=%u"
++                         " (Occurrence 3)",
+                          i_sysPhase );
+ 
+             break;
+diff --git a/src/import/chips/p10/procedures/hwp/customize/p10_qme_customize.C b/src/import/chips/p10/procedures/hwp/customize/p10_qme_customize.C
+index a87bc2b..fc645d6 100644
+--- a/src/import/chips/p10/procedures/hwp/customize/p10_qme_customize.C
++++ b/src/import/chips/p10/procedures/hwp/customize/p10_qme_customize.C
+@@ -5,7 +5,7 @@
+ /*                                                                        */
+ /* OpenPOWER HostBoot Project                                             */
+ /*                                                                        */
+-/* Contributors Listed Below - COPYRIGHT 2016,2019                        */
++/* Contributors Listed Below - COPYRIGHT 2016,2020                        */
+ /* [+] International Business Machines Corp.                              */
+ /*                                                                        */
+ /*                                                                        */
+@@ -49,11 +49,10 @@ fapi2::ReturnCode p10_qme_customize(
+     uint32_t& io_bufCustRingsSize,
+     uint32_t i_dbgl)
+ {
+-    FAPI_IMP(">> p10_qme_customize ");
+-
+     int rc = INFRASTRUCT_RC_SUCCESS;
+ 
+-    TorHeader_t* torHeader = (TorHeader_t*) i_bufQmeRings;
++    TorHeader_t* torHeaderQme  = (TorHeader_t*) i_bufQmeRings;
++    TorHeader_t* torHeaderCust = (TorHeader_t*) io_bufCustRings;
+ 
+     uint8_t ddLevel;
+     uint8_t torVersion;
+@@ -63,11 +62,13 @@ fapi2::ReturnCode p10_qme_customize(
+     ChipId_t chipId = UNDEFINED_CHIP_ID;
+     ChipletData_t* chipletData;
+ 
+-    ddLevel = torHeader->ddLevel;
+-    torVersion = torHeader->version;
+-    torMagic = be32toh(torHeader->magic);
+-    chipId = torHeader->chipId;
+-    inputQmeRingsSize = be32toh(torHeader->size);
++    FAPI_IMP(">> p10_qme_customize ");
++
++    ddLevel = torHeaderQme->ddLevel;
++    torVersion = torHeaderQme->version;
++    torMagic = be32toh(torHeaderQme->magic);
++    chipId = torHeaderQme->chipId;
++    inputQmeRingsSize = be32toh(torHeaderQme->size);
+ 
+     RingId_t numRings = UNDEFINED_RING_ID; // Number of chiplet common or instance rings
+     MyBool_t bInstCase = UNDEFINED_BOOLEAN; // 0:COMMON, 1:INSTANCE rings
+@@ -78,8 +79,11 @@ fapi2::ReturnCode p10_qme_customize(
+ 
+     uint8_t  iRing;
+     void*    nextRing = NULL;
+-    uint32_t nextRingSize;
++    uint32_t remBufSize;
+ 
++    //
++    // Step 0: Test input parameters
++    //
+     FAPI_ASSERT(i_custOp < NUM_CUSTOMIZE_QME_ENTRIES
+                 && i_bufQmeRings != NULL
+                 && io_bufCustRings != NULL,
+@@ -127,6 +131,7 @@ fapi2::ReturnCode p10_qme_customize(
+     // Step 1: Create TOR skeleton ringSection
+     // Create the complete ring skeleton, but with empty TOR ring slots (ie, no ring content).
+     //
++
+     rc = tor_skeleton_generation(io_bufCustRings,
+                                  torMagic,
+                                  torVersion,
+@@ -135,13 +140,9 @@ fapi2::ReturnCode p10_qme_customize(
+                                  i_dbgl);
+ 
+     FAPI_DBG("tor_skeleton_generation() completed w/rc=0x%08x,\n"
+-             " torMagic=0x%08x and torVersion=0x%08x,\n"
+-             " ddLevel=0x%08x and chipId=0x%08x.\n",
+-             rc,
+-             torMagic,
+-             torVersion,
+-             ddLevel,
+-             chipId);
++             " torMagic=0x%08x, torVersion=%u,\n"
++             " ddLevel=0x%02x and chipId=0x%02x.\n",
++             rc, torMagic, torVersion, ddLevel, chipId);
+ 
+     FAPI_ASSERT(rc == INFRASTRUCT_RC_SUCCESS,
+                 fapi2::QMEC_TOR_SKELETON_GEN_ERROR()
+@@ -151,20 +152,13 @@ fapi2::ReturnCode p10_qme_customize(
+                 .set_TOR_VER(torVersion)
+                 .set_DD_LEVEL(ddLevel)
+                 .set_CHIP_ID(chipId),
+-                "Error: tor_skeleton_generation() failed w/rc=0x%08x,\n"
+-                " torMagic=0x%08x and torVersion=0x%08x,\n"
+-                " ddLevel=0x%08x and chipId=0x%08x.\n",
+-                rc,
+-                torMagic,
+-                torVersion,
+-                ddLevel,
+-                chipId);
++                "Error: tor_skeleton_generation() failed w/rc=0x%08x,"
++                " torMagic=0x%08x, torVersion=%u, ddLevel=0x%02x and chipId=0x%02x\n",
++                rc, torMagic, torVersion, ddLevel, chipId);
+ 
+     //
+     // Step 2: Add ring content
+-    // Main TOR ringSection create loop
+-    // - Generate RS4 container for each ring, attaching it to end of ringSection and update
+-    //   the ring's TOR offset slot
++    // Append rings to the end of the [skeleton] TOR ring section and update TOR offset slot
+     //
+ 
+     // Get all the meta data for this chiplet and its rings
+@@ -174,13 +168,6 @@ fapi2::ReturnCode p10_qme_customize(
+                                  EQ_TYPE,
+                                  &chipletData);
+ 
+-    FAPI_DBG("ringid_get_chipletProps() completed w/rc=0x%08x,\n"
+-             " chipId=0x%08x, torMagic=0x%08x, torVersion=0x%08x.\n",
+-             rc,
+-             chipId,
+-             torMagic,
+-             torVersion);
+-
+     FAPI_ASSERT(rc == INFRASTRUCT_RC_SUCCESS,
+                 fapi2::QMEC_RINGID_GET_CHIPLETPROPS_ERROR()
+                 .set_TARGET(i_procTarget)
+@@ -188,10 +175,8 @@ fapi2::ReturnCode p10_qme_customize(
+                 .set_TOR_MAGIC(torMagic)
+                 .set_TOR_VER(torVersion),
+                 "Error: ringid_get_chipletProps() failed w/rc=0x%08x,\n"
+-                " ddLevel=0x%08x and torVersion=0x%08x.\n",
+-                rc,
+-                torMagic,
+-                torVersion);
++                " torMagic=0x%08x and torVersion=%u.\n",
++                rc, torMagic, torVersion);
+ 
+     chipletInstId = chipletData->chipletBaseId + i_custOp;
+ 
+@@ -199,13 +184,6 @@ fapi2::ReturnCode p10_qme_customize(
+                chipletData->numInstanceRings :
+                chipletData->numCommonRings;
+ 
+-    FAPI_DBG("p10_qme_customize(): chipletInstId = 0x%08x, numRings = 0x%08x,\n"
+-             " numInstanceRings = 0x%08x, numCommonRings = 0x%08x.\n",
+-             chipletInstId,
+-             numRings,
+-             chipletData->numInstanceRings,
+-             chipletData->numCommonRings);
+-
+     // Loop through all rings, get ring data for each ring and
+     // append it to cust ring section.
+     for (iRing = 0; iRing < numRings; iRing++)
+@@ -219,15 +197,6 @@ fapi2::ReturnCode p10_qme_customize(
+                               ringId,
+                               false);
+ 
+-        FAPI_DBG("ringidGetRingId2() completed w/rc=0x%08x,\n"
+-                 " torMagic=0x%08x,iRing=0x%08x,\n"
+-                 " bInstCase=%d, ringId=0x%08x.\n",
+-                 rc,
+-                 torMagic,
+-                 iRing,
+-                 bInstCase,
+-                 ringId);
+-
+         FAPI_ASSERT(rc == INFRASTRUCT_RC_SUCCESS,
+                     fapi2::QMEC_RINGID_GET_RINGID2_ERROR()
+                     .set_TARGET(i_procTarget)
+@@ -237,30 +206,26 @@ fapi2::ReturnCode p10_qme_customize(
+                     .set_INST_CASE(bInstCase)
+                     .set_RING_ID(ringId),
+                     "Error: ringidGetRingId2() failed w/rc=0x%08x,\n"
+-                    " torMagic=0x%08x,iRing=0x%08x,\n"
+-                    " bInstCase=%d, ringId=0x%08x.\n",
+-                    rc,
+-                    torMagic,
+-                    iRing,
+-                    bInstCase,
+-                    ringId);
+-
+-        io_bufCustRingsSize = be32toh(((TorHeader_t*) io_bufCustRings)->size);
++                    " torMagic=0x%08x, iRing=%u,\n"
++                    " bInstCase=%u and ringId=0x%x.\n",
++                    rc, torMagic, iRing, bInstCase, ringId);
++
++        io_bufCustRingsSize = be32toh(torHeaderCust->size);
+         nextRing = (void*) (io_bufCustRings + io_bufCustRingsSize);
+-        nextRingSize = maxCustRingsSize - io_bufCustRingsSize;
+ 
+-        // nextRing is portion of io_bufCustRings buffer, which is used as
+-        // temporary memory to pass the ring in i_bufQmeRings from the
++        // nextRing is portion of io_bufCustRings buffer which is used as
++        // temporary buffer to pass the ring in i_bufQmeRings from the
+         // tor_get_single_ring() function.
+-        // The size of nextRing is the size of temporary memory.
++        // The size of this temporary buffer is captured by remBufSize.
+         FAPI_ASSERT(maxCustRingsSize > io_bufCustRingsSize,
+                     fapi2::QMEC_RINGS_OUTPUT_BUFFER_TOO_SMALL()
+                     .set_MAX_CUST_RINGS_BUF_SIZE(maxCustRingsSize)
+                     .set_CUST_QME_RINGS_BUF_SIZE(io_bufCustRingsSize),
+                     "Error: QME rings output buffer is not large enough to use part of it for rs4Ring,\n"
+                     " maxCustRingsSize=0x%08x, io_bufCustRingsSize=0x%08x.\n",
+-                    maxCustRingsSize,
+-                    io_bufCustRingsSize);
++                    maxCustRingsSize, io_bufCustRingsSize);
++
++        remBufSize = maxCustRingsSize - io_bufCustRingsSize;
+ 
+         // Extract ring data using the ringId.
+         rc = tor_get_single_ring(i_bufQmeRings,
+@@ -268,18 +233,9 @@ fapi2::ReturnCode p10_qme_customize(
+                                  ringId,
+                                  chipletInstId, //This argument ignored for Common rings.
+                                  nextRing,
+-                                 nextRingSize,
++                                 remBufSize,
+                                  i_dbgl);
+ 
+-        FAPI_DBG("tor_get_single_ring() completed w/rc=0x%08x,\n"
+-                 " ddLevel=0x%08x, ringId=0x%08x,\n"
+-                 " chipletInstId=0x%08x, nextRs4RingSize=%d.\n",
+-                 rc,
+-                 ddLevel,
+-                 ringId,
+-                 chipletInstId,
+-                 nextRingSize);
+-
+         FAPI_ASSERT(rc == INFRASTRUCT_RC_SUCCESS ||
+                     rc == TOR_RING_IS_EMPTY,
+                     fapi2::QMEC_TOR_GET_SINGLE_RING_ERROR()
+@@ -288,17 +244,12 @@ fapi2::ReturnCode p10_qme_customize(
+                     .set_DD_LEVEL(ddLevel)
+                     .set_RING_ID(ringId)
+                     .set_CHIPLET_INST_ID(chipletInstId)
+-                    .set_NEXT_RS4RING_BUF_SIZE(nextRingSize),
+-                    "Error: tor_get_single_ring() failed w/rc=0x%08x,\n"
+-                    " ddLevel=0x%08x, ringId=0x%08x,\n"
+-                    " chipletInstId=0x%08x, nextRs4RingSize=%d.\n",
+-                    rc,
+-                    ddLevel,
+-                    ringId,
+-                    chipletInstId,
+-                    nextRingSize);
+-
+-        // if ring is empty, loop through and check next ring.
++                    .set_NEXT_RS4RING_BUF_SIZE(remBufSize),
++                    "Error: tor_get_single_ring() failed w/rc=0x%08x, ddLevel=0x%02x,"
++                    " ringId=0x%x, chipletInstId=0x%02x, remBufSize=%u.\n",
++                    rc, ddLevel, ringId, chipletInstId, remBufSize);
++
++        // If ring is empty, skip and check next ring.
+         if(rc == TOR_RING_IS_EMPTY)
+         {
+             rc = INFRASTRUCT_RC_SUCCESS;
+@@ -308,17 +259,13 @@ fapi2::ReturnCode p10_qme_customize(
+         // Append ring to ring section.
+         // Note that this API also updates the header's ring size
+         rc = tor_append_ring(io_bufCustRings,
+-                             io_bufCustRingsSize,
++                             maxCustRingsSize,
+                              ringId,
+                              chipletInstId,
+-                             (void*) nextRing,
++                             (void*)nextRing,
+                              i_dbgl);
+ 
+-        FAPI_DBG("tor_append_ring() completed w/rc=0x%08x,\n"
+-                 " io_bufCustRingsSize=0x%08x, ringId=0x%x.\n",
+-                 rc,
+-                 io_bufCustRingsSize,
+-                 ringId);
++        io_bufCustRingsSize = be32toh(torHeaderCust->size);
+ 
+         FAPI_ASSERT(rc == INFRASTRUCT_RC_SUCCESS,
+                     fapi2::QMEC_TOR_APPEND_RING_ERROR()
+@@ -328,16 +275,13 @@ fapi2::ReturnCode p10_qme_customize(
+                     .set_RING_ID(ringId),
+                     "Error: tor_append_ring() failed w/rc=0x%08x,\n"
+                     " io_bufCustRingsSize=0x%08x, ringId=0x%x.\n",
+-                    rc,
+-                    io_bufCustRingsSize,
+-                    ringId);
++                    rc, io_bufCustRingsSize, ringId);
++
+     }
+ 
+-    FAPI_DBG("p10_qme_customize(): io_bufCustRingsSize = 0x%08x\n",
+-             io_bufCustRingsSize);
++fapi_try_exit:
+ 
+     FAPI_IMP("<< p10_qme_customize ");
+ 
+-fapi_try_exit:
+     return fapi2::current_err;
+ }
+diff --git a/src/import/chips/p10/procedures/xml/error_info/p10_ipl_customize_errors.xml b/src/import/chips/p10/procedures/xml/error_info/p10_ipl_customize_errors.xml
+index eeb7016..838c3e6 100644
+--- a/src/import/chips/p10/procedures/xml/error_info/p10_ipl_customize_errors.xml
++++ b/src/import/chips/p10/procedures/xml/error_info/p10_ipl_customize_errors.xml
+@@ -353,10 +353,11 @@
+   </hwpError>
+   <!-- ********************************************************************* -->
+   <hwpError>
+-    <rc>RC_XIPC_SECTION_SIZING</rc>
++    <rc>RC_XIPC_RING_SECTION_SIZING</rc>
+     <description>Code bug: Ring section size would exceed max ring section size</description>
+     <ffdc>CHIP_TARGET</ffdc>
+     <ffdc>RING_SECTION_SIZE</ffdc>
++    <ffdc>RING_SECTION_BUF_SIZE</ffdc>
+     <ffdc>MAX_RING_SECTION_SIZE</ffdc>
+     <ffdc>OCCURRENCE</ffdc>
+     <callout>
+diff --git a/src/import/chips/p10/utils/imageProcs/p10_infrastruct_help.H b/src/import/chips/p10/utils/imageProcs/p10_infrastruct_help.H
+index 81df056..feffee2 100644
+--- a/src/import/chips/p10/utils/imageProcs/p10_infrastruct_help.H
++++ b/src/import/chips/p10/utils/imageProcs/p10_infrastruct_help.H
+@@ -49,7 +49,6 @@ const uint32_t  MAX_RT_IMAGE_SIZE       = 1024 * 1024;   // Max Runtime size.
+ const uint32_t  MAX_RING_BUF_SIZE       = 650000;        // Max ring buffer size (agreed w/HB).
+ const uint32_t  MAX_RING_BUF_SIZE_TOOL  = 450000;        // Max ring buf size for tools.
+ 
+-const uint32_t  MAX_DYN_RING_SECTION_SIZE = 1024 * 1024; // Max dynamic ring section size.
+ const uint32_t  MAX_OVERRIDES_SIZE      = 2 * 1024;      // Max overrides ring section size.
+ const uint32_t  MAX_HBBL_SIZE           = 20 * 1024;     // Max hbbl bin section size.
+ 
+diff --git a/src/import/chips/p10/utils/imageProcs/p10_scan_compression.H b/src/import/chips/p10/utils/imageProcs/p10_scan_compression.H
+index 8485543..ba38835 100644
+--- a/src/import/chips/p10/utils/imageProcs/p10_scan_compression.H
++++ b/src/import/chips/p10/utils/imageProcs/p10_scan_compression.H
+@@ -5,7 +5,7 @@
+ /*                                                                        */
+ /* OpenPOWER HostBoot Project                                             */
+ /*                                                                        */
+-/* Contributors Listed Below - COPYRIGHT 2019                             */
++/* Contributors Listed Below - COPYRIGHT 2019,2020                        */
+ /* [+] International Business Machines Corp.                              */
+ /*                                                                        */
+ /*                                                                        */
+@@ -86,7 +86,8 @@ typedef struct
+     uint16_t      iv_undefined; // Must be last (temp assumption in Mvpd accessor)
+ } CompressedScanData;
+ 
+-#define RS4_V3TOV4_SIZE_INC 4 // Header increase from V3 to V4 (needed by Mvpd accessor)
++#define RS4_V3TOV4_SIZE_INC  4 // Header increase from V3 to V4 (needed by Mvpd accessor)
++#define RS4_MIN_RING_SIZE   20 // Min value of iv_size, e.g. flush size of short ring.
+ 
+ /// Endian-translate a CompressedScanData structure
+ ///
+diff --git a/src/import/chips/p10/utils/imageProcs/p10_tor.C b/src/import/chips/p10/utils/imageProcs/p10_tor.C
+index 62f9462..c3f0e86 100644
+--- a/src/import/chips/p10/utils/imageProcs/p10_tor.C
++++ b/src/import/chips/p10/utils/imageProcs/p10_tor.C
+@@ -36,37 +36,40 @@
+ 
+ 
+ ///////////////////////////////////////////////////////////////////////////////////
+-//                       Get Ring From Ring Section function
++//                       [internal] TOR Access Ring function
+ //////////////////////////////////////////////////////////////////////////////////
+ static
+-int get_ring_from_ring_section( void*           i_ringSection,  // Ring section ptr
+-                                RingId_t        i_ringId,       // Ring ID
+-                                uint8_t&        io_instanceId,  // IO instance ID
+-                                RingRequest_t   i_ringRequest,  // {GET,PUT}_SINGLE_RING
+-                                void*           io_rs4Ring,     // IO RS4 ring buffer (caller mgd)
+-                                uint32_t&       io_ringBufSize, // Query, rs4Size, or max buf size
+-                                uint32_t        i_dbgl )
++int _tor_access_ring( void*          io_ringSection,   // Ring section ptr
++                      uint32_t       i_maxRingSectionSize, // Max ringSection size
++                      RingId_t       i_ringId,         // Ring ID to extract or append
++                      uint8_t        i_chipletId,      // Chiplet ID (ignored for Common rings)
++                      RingRequest_t  i_ringRequest,    // {GET,PUT}_SINGLE_RING
++                      void*          io_rs4Ring,       // RS4 ring buffer (caller mgd)
++                      uint32_t&      io_ringBufSize,   // Query, rs4Size, or max buf size
++                      uint32_t       i_dbgl )
+ {
+     int               rc = TOR_SUCCESS;
+     TorHeader_t*      torHeader;
+     uint32_t          torMagic;
+     ChipId_t          chipId;
+     TorCpltBlock_t*   cpltBlock;
+-    TorCpltOffset_t   cpltOffset; // Offset from ringSection to chiplet section
+-    TorRingOffset_t   ringOffset; // Offset to actual ring container
++    TorOffset_t       cpltOffsetSlot; // Offset to TOR chiplet offset slot
++    TorOffset_t       cpltOffset; // Offset from ringSection to chiplet section
++    TorOffset_t       ringOffsetSlot; // Offset to TOR ring offset slot
++    TorOffset_t       ringOffset; // Offset to actual ring container (for GET operation)
++    TorOffset_t       ringOffset16; // Offset to actual ring container (for PUT operation)
+     uint32_t          torSlotNum; // TOR slot number (within a chiplet section)
+     uint32_t          rs4Size;    // Size of RS4 ring container/block.
+     RingId_t          numRings;
+     ChipletType_t     chipletType = UNDEFINED_CHIPLET_TYPE;
+     ChipletType_t     chipletIndex = UNDEFINED_CHIPLET_TYPE; // Effective chiplet index
+     MyBool_t          bInstCase = UNDEFINED_BOOLEAN;
+-    ChipletData_t*    chipletData;
+-    uint8_t           numInstances;
+     RingProperties_t* ringProps = NULL;
++    ChipletData_t*    chipletData = NULL;
+     uint8_t           idxRingEff;      // Effective chiplet ring index
+-    uint8_t           iInst, iRing; // Index counters for instance, chiplet rings
++    uint32_t          ringSectionSize;
+ 
+-    torHeader = (TorHeader_t*)i_ringSection;
++    torHeader = (TorHeader_t*)io_ringSection;
+     torMagic  = be32toh(torHeader->magic);
+     chipId    = torHeader->chipId;
+ 
+@@ -100,7 +103,7 @@ int get_ring_from_ring_section( void*           i_ringSection,  // Ring section
+     }
+ 
+     //
+-    // Check the scope of chipletType and Get the effective chipletType's index
++    // Check the scope of chipletType and get the effective chipletType's index
+     //
+     rc = ringid_get_chipletIndex( chipId,
+                                   torMagic,
+@@ -133,20 +136,30 @@ int get_ring_from_ring_section( void*           i_ringSection,  // Ring section
+         bInstCase = 0;
+     }
+ 
+-    //
+-    // Calculate various loop upper limits
+-    //
+-    numInstances = bInstCase ?
+-                   chipletData->numChipletInstances :
+-                   1;
+-
+     numRings     = bInstCase ?
+                    chipletData->numInstanceRings :
+                    chipletData->numCommonRings;
+ 
+     idxRingEff   = ringProps[i_ringId].idxRing & INSTANCE_RING_MASK; // Always safe
+ 
++    //
++    // Check that chipletId is within chiplet's range (Note that we care only about Instance
++    // rings here so we can identify to proper slot. For Common rings, we can ignore the
++    // chipletId since there's only one instance slot, namely the 0'th.)
++    //
++    if ( bInstCase &&
++         ( i_chipletId < chipletData->chipletBaseId ||
++           i_chipletId > (chipletData->chipletBaseId + chipletData->numChipletInstances - 1) ) )
++    {
++        // TOR_INVALID_CHIPLET_ID:  This is not necessarily an error. User codes may differ
++        // in their knowledge what is an acceptable value for the chipletId. So we can't
++        // trace out here in confidence. It's up to the caller to investigate the rc.
++        return TOR_INVALID_CHIPLET_ID;
++    }
++
++    //
+     // Unless we find a ring, then the following rc will be returned
++    //
+     rc = TOR_RING_HAS_NO_TOR_SLOT;
+ 
+     //
+@@ -154,137 +167,138 @@ int get_ring_from_ring_section( void*           i_ringSection,  // Ring section
+     //
+     if (numRings) // Only proceed if chiplet has [Common/Instance] rings.
+     {
+-        // Calc offset to chiplet's CMN or INST section, cpltOffset (steps 1-3)
++        // Calc offset to chiplet's CMN or INST section, cpltOffset
++        // - Note that the TOR cpltOffset is assumed to be wrt to ringSection origin
++        //
++        // 1. Calc offset to TOR chiplet offset slot pointing to chiplet's COM or INST section
++        cpltOffsetSlot = sizeof(TorHeader_t) +
++                         chipletIndex * sizeof(TorCpltBlock_t) +
++                         bInstCase * sizeof(cpltBlock->cmnOffset);
++        // 2. Retrive chiplet offset and endian convert
++        cpltOffset = *(TorOffset_t*)( (uint8_t*)io_ringSection + cpltOffsetSlot );
++        cpltOffset = be16toh(cpltOffset); // <- This is the final TOR chiplet offset
++
++        //
++        // Calc the effective TOR offset slot index number (within the chiplet's Common
++        // or Instance ring section)
+         //
+-        // 1. Calc offset to TOR slot pointing to chiplet's COM or INST section
+-        cpltOffset = sizeof(TorHeader_t) +
+-                     chipletIndex * sizeof(TorCpltBlock_t) +
+-                     bInstCase * sizeof(cpltBlock->cmnOffset);
+-        // 2. Retrive offset, endian convert and make it relative to ring section origin
+-        cpltOffset = *(uint32_t*)( (uint8_t*)i_ringSection + cpltOffset );
+-        cpltOffset = be32toh(cpltOffset);
+-        // 3. Make offset relative to ring section origin
+-        cpltOffset = sizeof(TorHeader_t) + cpltOffset;
+-
+-        torSlotNum = 0;
+-
+-        for ( iInst = 0; iInst < numInstances; iInst++ )
++        torSlotNum = bInstCase * (i_chipletId - chipletData->chipletBaseId) * numRings + idxRingEff;
++
++        // Calc offset to actual ring, ringOffset
++        // - Note that ringOffset is assumed to be wrt to ringSection origin
++        //
++        // 1. Calc offset to the TOR ring offset slot (which points to the actual ring)
++        ringOffsetSlot = cpltOffset + torSlotNum * sizeof(ringOffset);
++        // 2. Retrieve ring offset and endian convert
++        ringOffset = *(TorOffset_t*)( (uint8_t*)io_ringSection + ringOffsetSlot );
++        ringOffset = be16toh(ringOffset); // <- This is the final TOR ring offset
++
++        if (i_ringRequest == GET_SINGLE_RING)
+         {
+-            for ( iRing = 0; iRing < numRings; iRing++ )
++            rs4Size = 0;
++
++            if (ringOffset)
+             {
+-                // Remember in the following "busy" if that we're already in the correct
+-                // chiplet ring section and that we're merely trying to determine if we have
+-                // hit the proper combination of (iRing,iInst).
+-                if ( idxRingEff == iRing  &&
+-                     ( !bInstCase ||
+-                       ( bInstCase &&
+-                         ( iInst == (io_instanceId - chipletData->chipletBaseId) ) ) ) )
+-                {
+-                    // Calc offset to actual ring, ringOffset (steps 1-3)
+-                    //
+-                    // 1. Calc offset to TOR slot pointing to actual ring
+-                    ringOffset = cpltOffset + torSlotNum * sizeof(ringOffset);
+-                    // 2. Retrieve offset and endian convert
+-                    ringOffset = *(TorRingOffset_t*)( (uint8_t*)i_ringSection + ringOffset );
+-                    ringOffset = be16toh(ringOffset);
+-
+-                    if (i_ringRequest == GET_SINGLE_RING)
+-                    {
+-                        rs4Size = 0;
+-
+-                        if (ringOffset)
+-                        {
+-                            // 3. Make offset relative to ring section origin
+-                            ringOffset = cpltOffset + ringOffset;
+-
+-                            rs4Size = be16toh( ((CompressedScanData*)
+-                                                ((uint8_t*)i_ringSection + ringOffset))->iv_size );
+-
+-                            if (io_ringBufSize < rs4Size)
+-                            {
+-                                if (i_dbgl > 0)
+-                                {
+-                                    MY_DBG("io_ringBufSize(=%u) is less than rs4Size(=%u).\n",
+-                                           io_ringBufSize, rs4Size);
+-                                }
+-
+-                                io_ringBufSize = rs4Size;
+-                                return TOR_BUFFER_TOO_SMALL;
+-                            }
+-
+-                            // Produce return parms
+-                            memcpy( io_rs4Ring,
+-                                    (void*)((uint8_t*)i_ringSection + ringOffset),
+-                                    rs4Size );
+-                            io_ringBufSize = rs4Size;
+-                            io_instanceId = bInstCase ?
+-                                            io_instanceId :
+-                                            chipletData->chipletBaseId;
+-
+-                            if (i_dbgl > 0)
+-                            {
+-                                MY_DBG("Found a ring:\n" \
+-                                       "  ringId: 0x%x\n" \
+-                                       "  rs4Size: %d\n",
+-                                       i_ringId, rs4Size);
+-                            }
+-
+-                            rc = TOR_SUCCESS;
+-                        }
+-                        else
+-                        {
+-                            if (i_dbgl > 0)
+-                            {
+-                                MY_DBG("ringId=0x%x was found but is empty\n",
+-                                       i_ringId);
+-                            }
+-
+-                            rc = TOR_RING_IS_EMPTY;
+-                        }
+-
+-                        if (i_dbgl > 0)
+-                        {
+-                            MY_DBG("Details for chiplet ring index=%d: \n"
+-                                   "  Full offset to chiplet section = 0x%08x \n"
+-                                   "  Full offset to RS4 header = 0x%08x \n"
+-                                   "  RS4 ring size = 0x%08x \n",
+-                                   iRing, cpltOffset, ringOffset, rs4Size);
+-                        }
+-
+-                        return rc;
++                rs4Size = be16toh( ((CompressedScanData*)
++                                    ((uint8_t*)io_ringSection + ringOffset))->iv_size );
+ 
+-                    }
+-                    else if (i_ringRequest == PUT_SINGLE_RING)
+-                    {
+-                        if (ringOffset)
+-                        {
+-                            MY_ERR("Ring container is already present in image\n");
+-                            MY_ERR("  Ring section addr: 0x%016lx  (First 8B: 0x%016lx)\n",
+-                                   (uintptr_t)i_ringSection,
+-                                   be64toh(*((uint64_t*)i_ringSection)));
+-                            MY_ERR("  cpltOffset=0x%08x, torSlotNum=0x%x, TOR offset=0x%04x\n",
+-                                   cpltOffset, torSlotNum, ringOffset);
+-                            return TOR_RING_IS_POPULATED;
+-                        }
+-
+-                        // Special [mis]use of io_rs4Ring and io_ringBufSize:
+-                        // Put location of chiplet's CMN or INST section into rs4Ring
+-                        memcpy(io_rs4Ring, &cpltOffset, sizeof(cpltOffset));
+-                        // Put location of ringOffset slot into ringBufSize
+-                        io_ringBufSize = cpltOffset + (torSlotNum * sizeof(ringOffset));
+-
+-                        return TOR_SUCCESS;
+-                    }
+-                    else
++                if (io_ringBufSize < rs4Size)
++                {
++                    if (i_dbgl > 0)
+                     {
+-                        MY_ERR("Ring request (i_ringRequest=%d) is not supported\n", i_ringRequest);
+-                        return TOR_INVALID_RING_REQUEST;
++                        MY_DBG("io_ringBufSize(=%u) is less than rs4Size(=%u).\n",
++                               io_ringBufSize, rs4Size);
+                     }
++
++                    io_ringBufSize = rs4Size;
++                    return TOR_BUFFER_TOO_SMALL;
++                }
++
++                // Produce return parms
++                memcpy( io_rs4Ring,
++                        (void*)((uint8_t*)io_ringSection + ringOffset),
++                        rs4Size );
++                io_ringBufSize = rs4Size;
++
++                if (i_dbgl > 0)
++                {
++                    MY_DBG("Found a ring:  ringId=0x%x and rs4Size=%u\n",
++                           i_ringId, rs4Size);
+                 }
+ 
+-                torSlotNum++; // Next TOR ring slot
++                rc = TOR_SUCCESS;
++            }
++            else
++            {
++                rc = TOR_RING_IS_EMPTY;
+             }
++
++            return rc;
++
++        }
++        else if (i_ringRequest == PUT_SINGLE_RING)
++        {
++            // We can not overwrite an existing ring
++            if (ringOffset)
++            {
++                MY_ERR("Ring container is already present in image\n");
++                MY_ERR("  Ring section addr: 0x%016lx  (First 8B: 0x%016lx)\n",
++                       (uintptr_t)io_ringSection,
++                       be64toh(*((uint64_t*)io_ringSection)));
++                MY_ERR("  cpltOffset=0x%08x, torSlotNum=0x%x, ringOffset=0x%04x\n",
++                       cpltOffset, torSlotNum, ringOffset);
++                return TOR_RING_IS_POPULATED;
++            }
++
++            // Check we can fit the ring
++            ringSectionSize = be32toh(torHeader->size);
++            rs4Size = be16toh( ((CompressedScanData*)io_rs4Ring)->iv_size );
++
++            if ( (ringSectionSize + rs4Size) > i_maxRingSectionSize )
++            {
++                MY_ERR("ERROR: _tor_access_ring() : Appending the ring would overflow"
++                       " the max ring section size:\n"
++                       " Current ringSectionSize:  %d\n"
++                       " Size of ring to be added: %d\n"
++                       " Max ringSection Size:     %d\n",
++                       ringSectionSize, rs4Size, i_maxRingSectionSize);
++                return TOR_BUFFER_TOO_SMALL;
++            }
++
++            // Then calculate the TOR ring offset value and put it into the TOR ring
++            // slot. But first, check that the offset value can be contained within
++            // the 2B of the TOR ring slot.
++            // - Note that TOR offset value to the ring is wrt to ringSection origin
++            if ( ringSectionSize <= MAX_TOR_RING_OFFSET )
++            {
++                ringOffset16 = htobe16(ringSectionSize);
++                memcpy( (uint8_t*)io_ringSection + ringOffsetSlot,
++                        &ringOffset16,
++                        sizeof(ringOffset16) );
++            }
++            else
++            {
++                MY_ERR("Code bug: Ring offset (=0x%x) exceeds MAX_TOR_RING_OFFSET (=0x%x)\n",
++                       ringSectionSize, MAX_TOR_RING_OFFSET);
++                return TOR_OFFSET_TOO_BIG;
++            }
++
++            // Finally, append the ring to the end of ringSection.
++            memcpy( (uint8_t*)io_ringSection + ringSectionSize,
++                    (uint8_t*)io_rs4Ring,
++                    rs4Size );
++
++            // Update the ring section size in the TOR header
++            torHeader->size = htobe32(ringSectionSize + rs4Size);
++
++            return TOR_SUCCESS;
++        }
++        else
++        {
++            MY_ERR("Ring request (i_ringRequest=%d) is not supported\n", i_ringRequest);
++            return TOR_INVALID_RING_REQUEST;
+         }
++
+     }
+     else
+     {
+@@ -296,31 +310,22 @@ int get_ring_from_ring_section( void*           i_ringSection,  // Ring section
+ 
+     return rc;
+ 
+-} // End of get_ring_from_ring_section()
++} // End of _tor_access_ring()
+ 
+ 
+ 
+ //////////////////////////////////////////////////////////////////////////////////////////
+-///                            TOR ACCESS RING   API
++///                       [internal] TOR Header Check function
+ //////////////////////////////////////////////////////////////////////////////////////////
+-int tor_access_ring( void*           i_ringSection,  // Ring section ptr
+-                     RingId_t        i_ringId,       // Ring ID
+-                     uint8_t         i_ddLevel,      // DD level
+-                     uint8_t&        io_instanceId,  // Instance ID
+-                     RingRequest_t   i_ringRequest,  // {GET,PUT}_SINGLE_RING
+-                     void*           io_rs4Ring,     // IO RS4 ring buffer (caller mgd)
+-                     uint32_t&       io_ringBufSize, // Query, rs4Size, or max buf size
+-                     uint32_t        i_dbgl )
++int _tor_header_check( void*           i_ringSection,  // Ring section ptr
++                       RingId_t        i_ringId,       // Ring ID
++                       uint8_t         i_ddLevel,      // DD level
++                       uint32_t        i_dbgl )
+ {
+     int            rc = TOR_SUCCESS;
+     uint32_t       torMagic;
+     TorHeader_t*   torHeader;
+ 
+-    if (i_dbgl > 1)
+-    {
+-        MY_DBG("Entering tor_access_ring()...\n");
+-    }
+-
+     torHeader = (TorHeader_t*)i_ringSection;
+     torMagic = be32toh(torHeader->magic);
+ 
+@@ -384,10 +389,10 @@ int tor_access_ring( void*           i_ringSection,  // Ring section ptr
+          torHeader->version != TOR_VERSION ||
+          torHeader->rtVersion > RING_TABLE_VERSION_HWIMG )
+     {
+-        MY_ERR("TOR header check failure:\n"
+-               "  magic:       0x%08x (!= TOR_MAGIC: 0x%08x)\n"
+-               "  version:     %u (!= TOR_VERSION: %u)\n"
+-               "  rtVersion:   %u (> RING_TABLE_VERSION_HWIMG: %u)\n"
++        MY_ERR("ERROR: TOR header check failure:\n"
++               "  magic:       0x%08x (TOR_MAGIC: 0x%08x)\n"
++               "  version:     %u (TOR_VERSION: %u)\n"
++               "  rtVersion:   %u (RING_TABLE_VERSION_HWIMG: %u)\n"
+                "  size:        %d\n",
+                torMagic, TOR_MAGIC,
+                torHeader->version, TOR_VERSION,
+@@ -400,75 +405,58 @@ int tor_access_ring( void*           i_ringSection,  // Ring section ptr
+     if ( i_ddLevel != torHeader->ddLevel &&
+          i_ddLevel != UNDEFINED_DD_LEVEL )
+     {
+-        MY_ERR("Requested DD level (=0x%x) doesn't match TOR header DD level (=0x%x) nor"
+-               " UNDEFINED_DD_LEVEL (=0x%x)\n",
++        MY_ERR("ERROR: Requested DD level (=0x%x) doesn't match TOR header DD level (=0x%x)"
++               " nor UNDEFINED_DD_LEVEL (=0x%x)\n",
+                i_ddLevel, torHeader->ddLevel, UNDEFINED_DD_LEVEL);
+         return TOR_DD_LEVEL_NOT_FOUND;
+     }
+ 
+-    rc =  get_ring_from_ring_section( i_ringSection,
+-                                      i_ringId,
+-                                      io_instanceId,
+-                                      i_ringRequest,
+-                                      io_rs4Ring,
+-                                      io_ringBufSize,
+-                                      i_dbgl );
+-
+-    // Explanation to the "list" of RCs that we exclude from tracing out:
+-    // TOR_RING_IS_EMPTY:  Normal scenario (will occur frequently).
+-    // TOR_RING_HAS_NO_TOR_SLOT:  Will be caused a lot by ipl_image_tool, but is an error if
+-    //                     called by any other user.
+-    // TOR_INVALID_CHIPLET_TYPE:  Also somewhat normal scenario since the caller should,
+-    //                     in princple, be able to mindlessly request a ringId without
+-    //                     having to figure out first if that ringId belongs to a chiplet
+-    //                     that is valid for the context. But really this is a gray area.
+-    //                     For now, we omit to trace out as we will hit this rc condition
+-    //                     in both ipl_image_tool and ipl_customize (RT_QME phase).
+-    if (rc)
+-    {
+-        if ( rc != TOR_RING_IS_EMPTY &&
+-             rc != TOR_RING_HAS_NO_TOR_SLOT &&
+-             rc != TOR_INVALID_CHIPLET_TYPE )
+-        {
+-            MY_ERR("ERROR : tor_access_ring() : get_ring_from_ring_section() failed w/rc="
+-                   "0x%08x\n", rc);
+-        }
+-
+-        return rc;
+-    }
+-
+     return rc;
+-} // End of tor_access_ring()
++} // End of _tor_header_check()
+ 
+ 
+ 
+ /////////////////////////////////////////////////////////////////////////////////////
+-//                             TOR GET SINGLE RING   API
++//                             TOR Get Single Ring API
+ /////////////////////////////////////////////////////////////////////////////////////
+ int tor_get_single_ring ( void*         i_ringSection,  // Ring section ptr
+                           uint8_t       i_ddLevel,      // DD level
+                           RingId_t      i_ringId,       // Ring ID
+-                          uint8_t       i_instanceId,   // Instance ID
++                          uint8_t       i_chipletId,    // Chiplet ID (ignored for Common rings)
+                           void*         io_rs4Ring,     // IO RS4 ring buffer (caller mgd)
+                           uint32_t&     io_ringBufSize, // Query, rs4Size, or max buf size
+                           uint32_t      i_dbgl )
+ {
++    int          rc = TOR_SUCCESS;
+ 
+-    int    rc = TOR_SUCCESS;
++    rc = _tor_header_check( i_ringSection,
++                            i_ringId,
++                            i_ddLevel,
++                            i_dbgl );
+ 
+-    rc = tor_access_ring( i_ringSection,
+-                          i_ringId,
+-                          i_ddLevel,
+-                          i_instanceId,
+-                          GET_SINGLE_RING,
+-                          io_rs4Ring,
+-                          io_ringBufSize,
+-                          i_dbgl );
++    if (rc)
++    {
++        MY_ERR("ERROR: tor_get_single_ring() : _tor_header_check() failed w/rc=0x%08x\n", rc);
++        return rc;
++    }
++
++    rc = _tor_access_ring( i_ringSection,
++                           0, // Not used. Only used when appending a ring.
++                           i_ringId,
++                           i_chipletId,
++                           GET_SINGLE_RING,
++                           io_rs4Ring,
++                           io_ringBufSize,
++                           i_dbgl );
+ 
+     // Explanation to the "list" of RCs that we exclude from tracing out:
+     // TOR_RING_IS_EMPTY:  Normal scenario (will occur frequently).
+     // TOR_HOLE_RING_ID:   Normal scenario when rings are removed from the ring list
+     //                     and leaves behind a "hole".
++    // TOR_RING_HAS_NO_TOR_SLOT:  Will be caused a lot by ipl_image_tool, but is an error if
++    //                     called by any other user.
++    // TOR_INVALID_CHIPLET_ID:  Not necessarily an error as a user may be sweeping through a
++    //                     worst case range to "get all I can get".
+     // TOR_INVALID_CHIPLET_TYPE:  Also somewhat normal scenario since the caller should,
+     //                     in princple, be able to mindlessly request a ringId without
+     //                     having to figure out first if that ringId belongs to a chiplet
+@@ -479,104 +467,82 @@ int tor_get_single_ring ( void*         i_ringSection,  // Ring section ptr
+     {
+         if ( rc != TOR_RING_IS_EMPTY &&
+              rc != TOR_HOLE_RING_ID &&
++             rc != TOR_RING_HAS_NO_TOR_SLOT &&
++             rc != TOR_INVALID_CHIPLET_ID &&
+              rc != TOR_INVALID_CHIPLET_TYPE )
+         {
+-            MY_ERR("ERROR : tor_get_single_ring() : tor_access_ring() failed w/rc=0x%08x\n", rc);
++            MY_ERR("ERROR: tor_get_single_ring() : _tor_access_ring() failed w/rc=0x%08x\n", rc);
+         }
+ 
+         return rc;
+     }
+ 
+     return rc;
+-}
++} // End of tor_get_single_ring()
+ 
+ 
+ 
+ ////////////////////////////////////////////////////////////////////////////////////////
+-//                             TOR APPEND RING   API
++//                                 TOR Append Ring API
+ ///////////////////////////////////////////////////////////////////////////////////////
+-int tor_append_ring( void*           i_ringSection,      // Ring section ptr
+-                     uint32_t&       io_ringSectionSize, // In: Exact size of ring section.
+-                     // Out: Updated size of ring section.
+-                     RingId_t        i_ringId,           // Ring ID
+-                     uint8_t         i_instanceId,       // Instance ID
+-                     void*           i_rs4Ring,          // RS4 ring
+-                     uint32_t        i_dbgl )            // Debug option
++int tor_append_ring( void*           io_ringSection,       // Ring section ptr
++                     uint32_t        i_maxRingSectionSize, // Max ringSection size
++                     RingId_t        i_ringId,             // Ring ID to append
++                     uint8_t         i_chipletId,          // Chiplet ID (ignored for Common rings)
++                     void*           i_rs4Ring,            // RS4 ring container
++                     uint32_t        i_dbgl )              // Debug option
+ {
+-    int    rc = TOR_SUCCESS;
+-    uint32_t   buf = 0;
+-    uint32_t*  cpltSection = &buf;
+-    uint32_t   rs4Size = 0;
+-    TorRingOffset_t   ringOffset16;
+-    uint32_t   torOffsetSlot;
++    int          rc = TOR_SUCCESS;
++    uint32_t     ringBufSize;
+ 
+-    if ( ringid_has_derivs( ((TorHeader_t*)i_ringSection)->chipId, i_ringId) )
++    rc = _tor_header_check( io_ringSection,
++                            i_ringId,
++                            UNDEFINED_DD_LEVEL,
++                            i_dbgl );
++
++    if (rc)
+     {
+-        MY_DBG("Can't append ringId=0x%x since it has derivatives\n",
++        MY_ERR("ERROR: tor_append_ring() : _tor_header_check() failed w/rc=0x%08x\n", rc);
++        return rc;
++    }
++
++    if ( ringid_has_derivs( ((TorHeader_t*)io_ringSection)->chipId, i_ringId) )
++    {
++        MY_DBG("Can't append ringId=0x%x since it has derivatives. Only the"
++               " derivative rings, e.g. *_bucket, can be appended.\n",
+                i_ringId);
+         return TOR_RING_HAS_DERIVS;
+     }
+ 
+-    rc = tor_access_ring( i_ringSection,
+-                          i_ringId,
+-                          UNDEFINED_DD_LEVEL,
+-                          i_instanceId,
+-                          PUT_SINGLE_RING,
+-                          (void*)cpltSection, // On return, contains offset (wrt ringSection) of
+-                          // chiplet section's common or instance section
+-                          torOffsetSlot,        // On return, contains offset (wrt ringSection) of
+-                          // TOR offset slot
+-                          i_dbgl );
++    rc =  _tor_access_ring( io_ringSection,
++                            i_maxRingSectionSize,
++                            i_ringId,
++                            i_chipletId,
++                            PUT_SINGLE_RING,
++                            i_rs4Ring,
++                            ringBufSize, // Not used here
++                            i_dbgl );
+ 
+     // Explanation to the "list" of RCs that we exclude from tracing out:
+-    // TOR_INVALID_CHIPLET_TYPE:  Not really a normal scenario though it's not unreasonable that
+-    //                     the caller should be able to mindlessly request a ringId without
+-    //                     having to figure out first if that ringId belongs to a chiplet
+-    //                     that is valid for the context. But really this is a gray area.
++    // TOR_INVALID_CHIPLET_TYPE:  Not really a normal scenario though it's possible a
++    //                     caller will mindlessly request a ringId to be appended  without
++    //                     knowing ahead of the call if the ringId belongs to the chiplet
++    //                     indicated in ringSection's torMagic. But this is a gray area.
+     //                     For now, we omit to trace out as we will hit this rc condition
+     //                     in ipl_customize (RT_QME phase).
+     if (rc)
+     {
+         if (rc != TOR_INVALID_CHIPLET_TYPE)
+         {
+-            MY_ERR("ERROR : tor_append_ring() : tor_access_ring() failed w/rc=0x%08x\n", rc);
++            MY_ERR("ERROR: tor_append_ring() : _tor_access_ring() failed w/rc=0x%08x for"
++                   " ringId=0x%x\n",
++                   rc, i_ringId);
+         }
+ 
+         return rc;
+     }
+ 
+-    // Explanation to the following:
+-    // tor_append_ring() appends a ring to the end of the ringSection. The offset value to
+-    // that ring is wrt the beginning of the chiplet's Common/Instance TOR ring offset slot
+-    // section. Below we calculate the offset value and put it into the TOR slot. But first,
+-    // check that the offset value can be contained within the 2B of the TOR slot.
+-    if ( (io_ringSectionSize - *cpltSection) <= MAX_TOR_RING_OFFSET )
+-    {
+-        ringOffset16 = htobe16(io_ringSectionSize - *cpltSection);
+-        memcpy( (uint8_t*)i_ringSection + torOffsetSlot,
+-                &ringOffset16, sizeof(ringOffset16) );
+-    }
+-    else
+-    {
+-        MY_ERR("Code bug: TOR ring offset (=0x%x) exceeds MAX_TOR_RING_OFFSET (=0x%x)\n",
+-               io_ringSectionSize - *cpltSection, MAX_TOR_RING_OFFSET);
+-        return TOR_OFFSET_TOO_BIG;
+-    }
+-
+-    // Now append the ring to the end of ringSection.
+-    rs4Size = be16toh( ((CompressedScanData*)i_rs4Ring)->iv_size );
+-    memcpy( (uint8_t*)i_ringSection + io_ringSectionSize,
+-            (uint8_t*)i_rs4Ring,
+-            rs4Size );
+-
+-    // Update the ringSectionSize
+-    io_ringSectionSize += rs4Size;
+-
+-    // Update the size in the TOR header
+-    TorHeader_t* torHeader = (TorHeader_t*)i_ringSection;
+-    torHeader->size = htobe32(be32toh(torHeader->size) + rs4Size);
+-
+-    return TOR_SUCCESS;
++    return rc;
+ }
+ 
+ 
+@@ -601,7 +567,6 @@ int tor_skeleton_generation( void*         io_ringSection,
+     uint32_t  chipletBlockStart;   // Offset from ringSection to start of chiplet offset block
+     uint32_t  sizeChipletBlock;    // Size of the chiplet offset block
+     uint32_t  sizeRingSlots;       // Size of ring offset block
+-    uint32_t  chipletRingsStart;   // Offset from ringSection to start of chiplet's ring slots
+     RingId_t  numRings = UNDEFINED_RING_ID;  // Number of a chiplet common or instance rings
+     uint8_t   numInstances = 0;    // Number of chiplet instances (=1 for COMMON case)
+     uint32_t  numRingSlots = 0;    // Number of ring slots in chiplet's Cmn/Inst ring section
+@@ -687,18 +652,15 @@ int tor_skeleton_generation( void*         io_ringSection,
+                 continue;
+             }
+ 
+-            // Save start position of current chiplet's Common or Instance ring section
+-            // (relative to start of ringSection)
+-            chipletRingsStart = ringSectionSize;
+-
+             // Update the current chiplet block's offset to the Common or Instance ring section
++            // - Note that the TOR chiplet offsets are assumed to be wrt to ringSection origin
+             if (bInstCase)
+             {
+-                torChipletBlock->instOffset = htobe32(chipletRingsStart - chipletBlockStart);
++                torChipletBlock->instOffset = htobe16(ringSectionSize);
+             }
+             else
+             {
+-                torChipletBlock->cmnOffset = htobe32(chipletRingsStart - chipletBlockStart);
++                torChipletBlock->cmnOffset = htobe16(ringSectionSize);
+             }
+ 
+             // Determine total number of Instance or Common rings (TOR slots) which involves:
+@@ -716,8 +678,8 @@ int tor_skeleton_generation( void*         io_ringSection,
+ 
+             // Allocate and init offset slots for chiplet Cmn/Inst rings
+             // Use 4B alignment of the TOR ring slots for debugging visualization.
+-            sizeRingSlots = myByteAlign(4, numRingSlots * sizeof(TorRingOffset_t));
+-            memset( (uint8_t*)io_ringSection + chipletRingsStart,
++            sizeRingSlots = myByteAlign(4, numRingSlots * sizeof(TorOffset_t));
++            memset( (uint8_t*)io_ringSection + ringSectionSize,
+                     0,
+                     sizeRingSlots );
+ 
+@@ -769,7 +731,7 @@ int dyn_append_ring( void*     io_ringSection,        // Ring section ptr
+     }
+     else
+     {
+-        MY_ERR("ERROR in dyn_append_ring: ringSectionSize(=%d) + rs4Size(=%d)"
++        MY_ERR("ERROR in dyn_append_ring: ringSectionSize(=%u) + rs4Size(=%u)"
+                " would exceed maxRingSectionSize(=%d)\n",
+                ringSectionSize, rs4Size, i_maxRingSectionSize);
+         return TOR_BUFFER_TOO_SMALL;
+diff --git a/src/import/chips/p10/utils/imageProcs/p10_tor.H b/src/import/chips/p10/utils/imageProcs/p10_tor.H
+index 929945e..093b39a 100644
+--- a/src/import/chips/p10/utils/imageProcs/p10_tor.H
++++ b/src/import/chips/p10/utils/imageProcs/p10_tor.H
+@@ -5,7 +5,7 @@
+ /*                                                                        */
+ /* OpenPOWER HostBoot Project                                             */
+ /*                                                                        */
+-/* Contributors Listed Below - COPYRIGHT 2016,2019                        */
++/* Contributors Listed Below - COPYRIGHT 2016,2020                        */
+ /* [+] International Business Machines Corp.                              */
+ /*                                                                        */
+ /*                                                                        */
+@@ -56,66 +56,25 @@ int tor_skeleton_generation( void*         io_ringSection,
+                              uint32_t      dbgl = 0 );
+ 
+ 
+-/// Access and perform various functions on a TOR ring section.
+-///
+-/// \param[in]  i_ringSection A pointer to the TOR ring section.
+-///
+-/// \param[in]  i_ringId A enum to indicate unique ID for the ring
+-///
+-/// \param[in]  i_ddLevel A variable to indicate chip DD level. TOR API
+-/// uses DD level to extract single ring or block of rings from hw_image
+-///
+-/// \param[in/out] io_instanceId A variable to indicate chiplet instance ID.
+-/// It returns Chiplet instance ID while doing get single ring operation
+-///
+-/// \param[in] i_ringRequest  A enum to indicate type of operation performed
+-/// by TOR API Option:
+-/// GET_SINGLE_RING indicates to extract single ring container.
+-/// PUT_SINGLE_RING indicates to extract ring absolute memory addres for
+-/// ringTorSlot location
+-///
+-/// \param[in/out] io_rs4Ring A void pointer to pointer. Returns data
+-/// which copied during extract ring operation and returns tor absolute address
+-/// where offset slot is located while PUT_SINGLE_RING call.
+-/// Note:- Caller's responsibility for free() to avoid memory leak
+-///
+-/// \param[in/out] io_ringBufSize A variable. Returns size of data copied
+-/// into io_rs4Ring and returns absolute offset where ring RS4 starts in
+-/// TOR during PUT_SINGLE_RING call
+-///
+-/// \param[in] i_debug Debug level [0:3].
+-///
+-/// \retval 0 Success
+-///
+-/// \retval non-0 See \ref TOR API RETURN errors
+-int tor_access_ring( void*           i_ringSection,
+-                     RingId_t        i_ringId,
+-                     uint8_t         i_ddLevel,
+-                     uint8_t&        io_instanceId,   // Chiplet instance ID
+-                     RingRequest_t   i_ringRequest,   // {GET,PUT}_SINGLE_RING
+-                     void*           io_rs4Ring,
+-                     uint32_t&       io_ringBufSize,  // Query, rs4Size, or max buf size
+-                     uint32_t        i_dbgl = 0 );
+-
+-
+ /// Retrieve a single RS4 ring from a TOR ring section
+ ///
+-/// \param[in]  i_ringSection A pointer to the ring section.
++/// \param[in] i_ringSection  A pointer to the ring section.
+ ///
+-/// \param[in]  i_ringId A enum to indicate unique ID for the ring
++/// \param[in] i_ringId  A enum to indicate unique ID for the ring
+ ///
+-/// \param[in]  i_ddLevel A variable to indicate chip DD level. TOR API
+-/// uses DD level to verify validity of ring section.
++/// \param[in] i_ddLevel  A variable to indicate chip DD level. TOR API uses
++///                       DD level to verify validity of ring section.
+ ///
+-/// \param[in] io_instanceId A variable to indicate chiplet instance ID
++/// \param[in] i_chipletId  A variable to indicate chiplet instance ID. Only
++///                         used for Instance rings. Ignored for Common rings.
+ ///
+-/// \param[in/out] io_rs4Ring A void pointer. Contains copied ring.
+-/// Note that it's caller's responsibility to manage buffer.
++/// \param[in/out] io_rs4Ring  A void pointer. Contains copied ring. Note that
++///                            it's caller's responsibility to manage buffer.
+ ///
+-/// \param[in/out] io_ringBufSize A variable that returns size of ring
+-/// copied into io_rs4Ring
++/// \param[in/out] io_ringBufSize  A variable that returns size of ring
++///                                copied into io_rs4Ring
+ ///
+-/// \param[in] i_debug Debug level [0:3].
++/// \param[in] i_debug  Debug level [0:3].
+ ///
+ /// \retval 0 Success
+ ///
+@@ -123,37 +82,36 @@ int tor_access_ring( void*           i_ringSection,
+ int tor_get_single_ring ( void*          i_ringSection,
+                           uint8_t        i_ddLevel,
+                           RingId_t       i_ringId,
+-                          uint8_t        i_instanceId,
++                          uint8_t        i_chipletId,
+                           void*          io_rs4Ring,
+                           uint32_t&      io_ringBufSize, // Query, rs4Size, or max buf size
+                           uint32_t       i_dbgl = 0 );
+ 
+ 
+-/// Append a single RS4 ring to the end of a TOR ring section.
++/// Append an RS4 ring to the end of a TOR ring section.
+ ///
+-/// \param[in] i_ringSection A pointer to a TOR ring section.
+-///                          Note that caller manages this buffer.
++/// \param[in/out] io_ringSection  A pointer to a TOR ring section.
++///                                Note that caller manages this buffer.
+ ///
+-/// \param[in/out] io_ringSectionSize   In: Exact size of i_ringSection.
+-///                                     Out: Updated size of i_ringSection.
++/// \param[in] i_maxRingSectionSize  Max ring section size
+ ///
+-/// \param[in] i_ringId The unique enum ID for the ring
++/// \param[in] i_ringId  The enum ID for the ring in rs4Ring to be appended
+ ///
+-/// \param[in] i_instanceId The chiplet instance ID. Only needed for
+-///                         Instance rings. Ignored for Common rings.
++/// \param[in] i_chipletId  The chiplet instance ID. Only needed for Instance rings.
++///                         Ignored for Common rings.
+ ///
+-/// \param[in] i_rs4Ring Pointer to the RS4 compressed ring container.
++/// \param[in] i_rs4Ring  Pointer to the RS4 compressed ring container.
+ ///
+-/// \param[in] i_debug Debug level [0:3].
++/// \param[in] i_debug  Debug level [0:3].
+ ///
+ /// \retval 0 Success
+ ///
+-/// \retval non-0 See \ref TOR API RETURN errors
++/// \retval non-0  See \ref TOR API RETURN errors
+ ///
+-int tor_append_ring( void*           i_ringSection,
+-                     uint32_t&       io_ringSectionSize,
++int tor_append_ring( void*           io_ringSection,
++                     uint32_t        i_maxRingSectionSize,
+                      RingId_t        i_ringId,
+-                     uint8_t         i_instanceId,
++                     uint8_t         i_chipletId,
+                      void*           i_rs4Ring, // Ptr to the RS4 ring container
+                      uint32_t        i_dbgl = 0 );
+ 
+@@ -201,7 +159,8 @@ int dyn_get_ring( void*         i_ringSection,
+ 
+ /// Append a single RS4 ring to the end of a Dynamic ring section (non-TOR layout).
+ ///
+-/// \param[in]  i_ringSection         A pointer to the Dynamic ring section.
++/// \param[in]  io_ringSection        A pointer to the Dynamic ring section.
++///                                   Note that caller manages buffer.
+ ///
+ /// \param[in]  i_maxRingSectionSize  Max size of i_ringSection.
+ ///
+-- 
+1.8.2.2
+
diff --git a/openpower/package/hostboot-p10/Config.in b/openpower/package/hostboot-p10/Config.in
index f0762a4..45293d1 100644
--- a/openpower/package/hostboot-p10/Config.in
+++ b/openpower/package/hostboot-p10/Config.in
@@ -25,7 +25,7 @@
 
 config BR2_HOSTBOOT_P10_VERSION
 	string
-	default "e5df1123fe36c59c0d51d9c8cde10902db834fba" if BR2_HOSTBOOT_P10_LATEST_VERSION
+	default "7f23cb6ce01a7c2eb35d85e46c4e1a404769d1f6" if BR2_HOSTBOOT_P10_LATEST_VERSION
 	default BR2_HOSTBOOT_P10_CUSTOM_VERSION_VALUE \
 		if BR2_HOSTBOOT_P10_CUSTOM_VERSION