Load and validate OCMB FW image in istep 12.13

Adds function for loading and validating the OCMB firmware
image.

RTC: 193924
Change-Id: I398d80940710f46cf7e0b66ed663116e574e54b9
Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/76624
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP HW <op-hw-jenkins+hostboot@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Reviewed-by: Matt Derksen <mderkse1@us.ibm.com>
Reviewed-by: Ilya Smirnov <ismirno@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>

12 files changed, 868 insertions, 4 deletions

diff --git a/src/build/buildpnor/pkgOcmbFw.pl b/src/build/buildpnor/pkgOcmbFw.pl
index eb5d8f953..b7fdb90cf 100755
--- a/src/build/buildpnor/pkgOcmbFw.pl
+++ b/src/build/buildpnor/pkgOcmbFw.pl
@@ -89,6 +89,13 @@
 #
 ###############################################################################
 
+# ******************WARNING**********************
+#
+#   THIS FILE MUST BE KEPT IN SYNC WITH
+#   src/include/usr/expupd/ocmbFwImage_const.H
+#
+# ******************WARNING**********************
+
 use strict;
 use File::Basename;
 use Digest::SHA qw(sha512);
diff --git a/src/include/usr/expupd/expupd.H b/src/include/usr/expupd/expupd.H
new file mode 100644
index 000000000..a686d7f91
--- /dev/null
+++ b/src/include/usr/expupd/expupd.H
@@ -0,0 +1,45 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/include/usr/expupd/expupd.H $                             */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2019                             */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#ifndef __EXPUPD_H
+#define __EXPUPD_H
+
+#include <isteps/hwpisteperror.H>
+
+namespace expupd
+{
+
+/**
+ * @brief Check flash image SHA512 hash value of each explorer chip
+ *        and update the flash if it does not match the SHA512 hash
+ *        of the image in PNOR.
+ *
+ * @param[out] o_stepError Error handle for logging istep failures
+ *
+ */
+void updateAll(ISTEP_ERROR::IStepError& o_stepError);
+
+}//namespace expupd
+
+#endif
diff --git a/src/include/usr/expupd/expupd_reasoncodes.H b/src/include/usr/expupd/expupd_reasoncodes.H
index ed3cd2717..d5837206a 100644
--- a/src/include/usr/expupd/expupd_reasoncodes.H
+++ b/src/include/usr/expupd/expupd_reasoncodes.H
@@ -33,13 +33,20 @@ namespace EXPUPD
 
     enum ExpUpdModuleId
     {
-        MOD_UPDATE_ALL_EXP_FLASH_IMAGES = 0x01,
+        MOD_OCMB_FW_VALIDATE_IMAGE = 0x01,
+        MOD_PARSE_TAGGED_DATA_TRIPLET = 0x02,
     };
 
     enum ExpUpdReasonCode
     {
-        EXPUPD_INVALID_EYECATCHER                        = UCD_COMP_ID | 0x01,
-        EXPUPD_INVALID_MAJOR_VER                         = UCD_COMP_ID | 0x02,
+        INVALID_PARMS                             = EXPUPD_COMP_ID | 0x01,
+        INVALID_EYE_CATCHER                       = EXPUPD_COMP_ID | 0x02,
+        INVALID_HEADER_VERSION                    = EXPUPD_COMP_ID | 0x03,
+        INVALID_HEADER_SIZE                       = EXPUPD_COMP_ID | 0x04,
+        MISSING_SHA512_HASH                       = EXPUPD_COMP_ID | 0x05,
+        INVALID_DATA_TRIPLET_SIZE                 = EXPUPD_COMP_ID | 0x06,
+        INVALID_HASH_TRIPLET_SIZE                 = EXPUPD_COMP_ID | 0x07,
+        INVALID_TAG_ID                            = EXPUPD_COMP_ID | 0x08,
     };
 
 }; // namespace EXPUPD
diff --git a/src/include/usr/expupd/ocmbFwImage_const.H b/src/include/usr/expupd/ocmbFwImage_const.H
new file mode 100644
index 000000000..b97b1adcf
--- /dev/null
+++ b/src/include/usr/expupd/ocmbFwImage_const.H
@@ -0,0 +1,111 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/include/usr/expupd/ocmbFwImage_const.H $                  */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2019                             */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#ifndef __OCMBFWIMAGE_CONST_H
+#define __OCMBFWIMAGE_CONST_H
+
+namespace expupd
+{
+
+// ********************************WARNING**********************************
+//
+//   THIS FILE MUST BE KEPT IN SYNC WITH src/build/buildpnor/pkgOcmbFw.pl
+//
+// ********************************WARNING**********************************
+
+
+/**
+ * @brief Eyecatcher value is the ascii representation of the
+ *        null terminated string, "OCMBHDR".
+ */
+constexpr uint64_t EYE_CATCHER_VALUE = 0x4F434D4248445200ULL;
+
+constexpr uint32_t MAX_BIN_TRACE = 256;
+
+/**
+ * @brief Miscellaneous constants related to the OCMB firmware header
+ */
+enum OCMBFW_HEADER_CONSTS: uint32_t
+{
+    HEADER_VERSION_MAJOR = 1,
+    HEADER_VERSION_MINOR = 0,
+    HEADER_MAX_SIZE = 4096,
+};
+
+/**
+ * @brief Header for the OCMB flash image content
+ */
+typedef struct ocmbFwHeader
+{
+    // See EYE_CATCHER_VALUE above
+    uint64_t eyeCatcher;
+
+    // The major and minor version of this header
+    uint32_t majorVersion;
+    uint32_t minorVersion;
+
+    // The total size of this header (must be 8 byte aligned)
+    uint32_t headerSize;
+
+    // The number of "tagged data triplets" included
+    // in this header. (see taggedTriplet_t)
+    uint32_t numTriplets;
+
+    // Variable sized, unordered tagged data triplets start here
+}ocmbFwHeader_t;
+
+/**
+ * @brief Tag Id's for tagged triplets
+ */
+enum TRIPLET_TAG_IDS: uint32_t
+{
+    // Data contains 64 bytes of SHA512 hash data
+    TAG_SHA512 = 1,
+
+    // Data contains a null-terminated string of comma separated
+    // key/value pairs with the following format:
+    //   <key1>=<value1>,<key2>=<value2>,<key3>=<value3>
+    //
+    // Keys and values are defined by the manufacturer and must
+    // not contain the characters "=" or ","
+    TAG_KEY_VALUE_PAIRS = 2,
+};
+
+/**
+ * @brief Tagged triplet data format
+ */
+typedef struct taggedTriplet
+{
+    // Identifies the data format for this triplet
+    uint32_t tagId;
+
+    // Size of the data that follows (must be 8 byte aligned)
+    uint32_t dataSize;
+
+    // variable sized data starts here
+}taggedTriplet_t;
+
+} //namespace expupd
+
+#endif
diff --git a/src/include/usr/isteps/istep12list.H b/src/include/usr/isteps/istep12list.H
index 2fadd6fee..7041a61f1 100644
--- a/src/include/usr/isteps/istep12list.H
+++ b/src/include/usr/isteps/istep12list.H
@@ -290,6 +290,7 @@ const DepModInfo g_istep12Dependancies = {
         DEP_LIB(libnestmemutils.so),
         DEP_LIB(libisteps_io.so),
         DEP_LIB(libisteps_mss.so),
+        DEP_LIB(libexpupd.so),
         NULL
     }
 };
diff --git a/src/usr/isteps/expupd/expupd.C b/src/usr/isteps/expupd/expupd.C
new file mode 100644
index 000000000..743d77f38
--- /dev/null
+++ b/src/usr/isteps/expupd/expupd.C
@@ -0,0 +1,183 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/usr/isteps/expupd/expupd.C $                              */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2019                             */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+
+#include <expupd/expupd_reasoncodes.H>
+#include <pnor/pnorif.H>
+#include <targeting/common/commontargeting.H>
+#include <targeting/common/utilFilter.H>
+#include <errl/errlentry.H>
+#include <errl/errlmanager.H>
+#include <isteps/hwpisteperror.H>
+#include <isteps/hwpistepud.H>
+#include <fapi2.H>
+#include <fapi2/plat_hwp_invoker.H>
+#include <trace/interface.H>
+#include <hbotcompid.H>
+#include "ocmbFwImage.H"
+
+using namespace ISTEP_ERROR;
+using namespace ERRORLOG;
+using namespace TARGETING;
+
+namespace expupd
+{
+
+// Initialize the trace buffer for this component
+trace_desc_t* g_trac_expupd  = nullptr;
+TRAC_INIT(&g_trac_expupd, EXPUPD_COMP_NAME, 2*KILOBYTE);
+
+/**
+ * @brief Retrieve the SHA512 hash for the currently flashed explorer
+ *        firmware image.
+ */
+errlHndl_t expupdGetFlashedHash()
+{
+    return nullptr;
+}
+
+/**
+ * @brief Check flash image SHA512 hash value of each explorer chip
+ *        and update the flash if it does not match the SHA512 hash
+ *        of the image in PNOR.
+ *
+ */
+void updateAll(IStepError& i_StepError)
+{
+    bool l_imageLoaded = false;
+    errlHndl_t l_err = nullptr;
+
+    // Get a list of explorer chips
+    TARGETING::TargetHandleList l_ocmbTargetList;
+    getAllChips(l_ocmbTargetList, TYPE_OCMB_CHIP);
+
+    TRACFCOMP(g_trac_expupd, ENTER_MRK
+              "updateAll: %d ocmb chips found",
+              l_ocmbTargetList.size());
+
+    do
+    {
+        // If no explorer chips exist, we're done.
+        if(l_ocmbTargetList.size() == 0)
+        {
+            break;
+        }
+
+        // Read explorer fw image from pnor
+        PNOR::SectionInfo_t l_pnorSectionInfo;
+        rawImageInfo_t l_imageInfo;
+
+#ifdef CONFIG_SECUREBOOT
+        l_err = PNOR::loadSecureSection(PNOR::OCMBFW);
+        if(l_err)
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "updateAll: Failed to load OCMBFW section"
+                      " from PNOR!");
+
+            l_err->collectTrace(EXPUPD_COMP_NAME);
+
+            // Create IStep error log and cross reference to error that occurred
+            i_StepError.addErrorDetails( l_err );
+
+            // Commit Error
+            errlCommit( l_err, EXPUPD_COMP_ID );
+
+            break;
+        }
+#endif //CONFIG_SECUREBOOT
+
+        l_imageLoaded = true;
+
+        // get address and size of packaged image
+        l_err = PNOR::getSectionInfo(PNOR::OCMBFW, l_pnorSectionInfo);
+        if(l_err)
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "updateAll: Failure in getSectionInfo()");
+
+            l_err->collectTrace(EXPUPD_COMP_NAME);
+
+            // Create IStep error log and cross reference to error that occurred
+            i_StepError.addErrorDetails( l_err );
+
+            // Commit Error
+            errlCommit( l_err, EXPUPD_COMP_ID );
+            break;
+        }
+
+        // Verify the header and retrieve address, size and
+        // SHA512 hash of unpackaged image
+        l_err = ocmbFwValidateImage(l_pnorSectionInfo.vaddr,
+                                    l_pnorSectionInfo.size,
+                                    l_imageInfo);
+        if(l_err)
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "updateAll: Failure in expupdValidateImage");
+
+            l_err->collectTrace(EXPUPD_COMP_NAME);
+
+            // Create IStep error log and cross reference to error that occurred
+            i_StepError.addErrorDetails( l_err );
+
+            // Commit Error
+            errlCommit( l_err, EXPUPD_COMP_ID );
+            break;
+        }
+
+        // For each explorer chip, compare flash hash with PNOR hash and
+        // create a list of explorer chips with differing hash values
+
+        // If list not empty update each explorer in the list
+    }while(0);
+
+    // unload explorer fw image
+    if(l_imageLoaded)
+    {
+#ifdef CONFIG_SECUREBOOT
+        l_err = PNOR::unloadSecureSection(PNOR::OCMBFW);
+        if(l_err)
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "updateAll: Failed to unload OCMBFW");
+
+            l_err->collectTrace(EXPUPD_COMP_NAME);
+
+            // Create IStep error log and cross reference to error that occurred
+            i_StepError.addErrorDetails( l_err );
+
+            // Commit Error
+            errlCommit( l_err, EXPUPD_COMP_ID );
+        }
+#endif //CONFIG_SECUREBOOT
+    }
+
+    // force reboot if any updates were successful
+
+
+    TRACFCOMP(g_trac_expupd, EXIT_MRK"updateAll()");
+}
+
+}//namespace expupd
diff --git a/src/usr/isteps/expupd/expupd.mk b/src/usr/isteps/expupd/expupd.mk
index 1b824b064..595161b08 100644
--- a/src/usr/isteps/expupd/expupd.mk
+++ b/src/usr/isteps/expupd/expupd.mk
@@ -30,5 +30,8 @@ EXTRAINCDIR += ${ROOTPATH}/src/import/chips/p9/procedures/hwp/ffdc/
 EXTRAINCDIR += ${ROOTPATH}/src/import/hwpf/fapi2/include
 EXTRAINCDIR += ${ROOTPATH}/src/include/usr/fapi2
 
+OBJS += expupd.o
+OBJS += ocmbFwImage.o
+
 # Need to build exp_fw_update procedure
 OBJS += exp_fw_update.o
diff --git a/src/usr/isteps/expupd/expupd_trace.H b/src/usr/isteps/expupd/expupd_trace.H
new file mode 100644
index 000000000..a2da13a8f
--- /dev/null
+++ b/src/usr/isteps/expupd/expupd_trace.H
@@ -0,0 +1,40 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/usr/isteps/expupd/expupd_trace.H $                        */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2019                             */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#ifndef __EXPUPD_TRACE_H
+#define __EXPUPD_TRACE_H
+
+/******************************************************************************/
+// Includes
+/******************************************************************************/
+#include <trace/interface.H>
+
+namespace expupd
+{
+
+extern trace_desc_t *g_trac_expupd;
+
+}   //  end namespace
+
+#endif
diff --git a/src/usr/isteps/expupd/ocmbFwImage.C b/src/usr/isteps/expupd/ocmbFwImage.C
new file mode 100644
index 000000000..dee2affdd
--- /dev/null
+++ b/src/usr/isteps/expupd/ocmbFwImage.C
@@ -0,0 +1,391 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/usr/isteps/expupd/ocmbFwImage.C $                         */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2019                             */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#include "ocmbFwImage.H"
+#include <expupd/ocmbFwImage_const.H>
+#include <expupd/expupd_reasoncodes.H>
+#include "expupd_trace.H"
+#include <errl/errlentry.H>
+#include <errl/errlmanager.H>
+#include <hbotcompid.H>
+#include <algorithm>
+
+#define EXPUPD_8BYTE_ALIGNED(_SIZE) (!(_SIZE & 0x7))
+
+namespace expupd
+{
+
+/**
+ * @brief Validates a tagged data triplet
+ * @param[in] i_tripletPtr starting address of a tagged data triplet
+ * @param[in] i_endDataPtr ending address of the OCMB firmware header
+ * @param[out] o_imageInfo Structure will hold pointer to SHA512 hash (if found)
+ * @param[out] o_numBytes total number of bytes used by this tagged data triplet
+ * @return errlHndl_t indicating success or failure
+ *
+ */
+errlHndl_t parseTaggedDataTriplet(const uint8_t* i_tripletPtr,
+                                  const uint8_t* i_endDataPtr,
+                                  rawImageInfo_t& o_imageInfo,
+                                  uint32_t& o_numBytes)
+{
+    errlHndl_t l_err = nullptr;
+
+    // Determine start of the data for the tagged data triplet
+    const uint8_t* l_dataStartPtr = i_tripletPtr + sizeof(taggedTriplet_t);
+    const taggedTriplet_t* l_ttPtr =
+        reinterpret_cast<const taggedTriplet_t*>(i_tripletPtr);
+
+    // Assume failure and set number of bytes consumed to 0
+    o_numBytes = 0;
+
+    do
+    {
+        // Check that we have enough room for the triplet
+        if((l_dataStartPtr > i_endDataPtr) ||
+           ((l_dataStartPtr + l_ttPtr->dataSize) > i_endDataPtr) ||
+           !EXPUPD_8BYTE_ALIGNED(l_ttPtr->dataSize))
+        {
+            int64_t l_reqdSize = sizeof(taggedTriplet_t);
+            l_reqdSize += (l_dataStartPtr > i_endDataPtr)? 0: l_ttPtr->dataSize;
+
+            int64_t l_allocSize =
+                reinterpret_cast<int64_t>(i_endDataPtr - i_tripletPtr);
+
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "parseTaggedDataTriplet: Triplet does not fit or is"
+                      " misaligned.  bytesReqd[%d] bytesAllocated[%d]",
+                      l_reqdSize,
+                      l_allocSize);
+
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_PARSE_TAGGED_DATA_TRIPLET
+            * @reasoncode      EXPUPD::INVALID_DATA_TRIPLET_SIZE
+            * @userdata1       allocated size
+            * @userdata2       required size
+            * @devdesc         Tagged data triplet size is too big or misaligned
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                         EXPUPD::MOD_PARSE_TAGGED_DATA_TRIPLET,
+                                         EXPUPD::INVALID_DATA_TRIPLET_SIZE,
+                                         l_allocSize,
+                                         l_reqdSize,
+                                         ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        // Check for the SHA512 tag
+        if(l_ttPtr->tagId == TAG_SHA512)
+        {
+            // Check that hash data is complete
+            if(l_ttPtr->dataSize != HEADER_SHA512_SIZE)
+            {
+                TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "parseTaggedDataTriplet: Invalid hash triplet size."
+                      " expected[%u] actual[%u]",
+                      HEADER_SHA512_SIZE,
+                      l_ttPtr->dataSize);
+
+               /* @errorlog
+                * @errortype       ERRL_SEV_PREDICTIVE
+                * @moduleid        EXPUPD::MOD_PARSE_TAGGED_DATA_TRIPLET
+                * @reasoncode      EXPUPD::INVALID_HASH_TRIPLET_SIZE
+                * @userdata1       Expected Size
+                * @userdata2       Actual Size
+                * @devdesc         Incorrect hash size in OCMB image header
+                * @custdesc        Error occurred during system boot.
+                */
+                l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                         EXPUPD::MOD_PARSE_TAGGED_DATA_TRIPLET,
+                                         EXPUPD::INVALID_HASH_TRIPLET_SIZE,
+                                         HEADER_SHA512_SIZE,
+                                         l_ttPtr->dataSize,
+                                         ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+                break;
+            }
+
+            // Save off pointer to hash for later.
+            o_imageInfo.imageSHA512HashPtr = l_dataStartPtr;
+        }
+        else if(l_ttPtr->tagId == TAG_KEY_VALUE_PAIRS)
+        {
+            //trace up to MAX_BIN_TRACE bytes of the data in case it is useful
+            TRACFBIN(g_trac_expupd, "OCMB FW IMAGE KEY/VALUE DATA",
+                     l_dataStartPtr,
+                     std::min(l_ttPtr->dataSize, MAX_BIN_TRACE));
+        }
+        else
+        {
+            //unsupported tag id.
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "parseTaggedDataTriplet: Invalid tag id[%u].",
+                      l_ttPtr->tagId);
+
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_PARSE_TAGGED_DATA_TRIPLET
+            * @reasoncode      EXPUPD::INVALID_TAG_ID
+            * @userdata1       tag id
+            * @userdata2       <unused>
+            * @devdesc         Invalid tag id found in OCMB image header
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                         EXPUPD::MOD_PARSE_TAGGED_DATA_TRIPLET,
+                                         EXPUPD::INVALID_TAG_ID,
+                                         l_ttPtr->tagId,
+                                         0,
+                                         ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        //Parsing was successful.  Set bytes consumed.
+        o_numBytes = sizeof(taggedTriplet_t) + l_ttPtr->dataSize;
+    }while(0);
+
+    return l_err;
+}
+
+/**
+ * @brief Validates OCMB firmware header of packaged image
+ *
+ * @param[in] i_imageStart Start address of packaged image
+ * @param[in] i_imageSize Size of packaged image
+ * @param[out] o_imageInfo Information pertaining to image after
+ *             being stripped of OCMB firmware header
+ * @return errlHndl_t indicating success or failure
+ *
+ */
+errlHndl_t ocmbFwValidateImage(const uint64_t i_imageStart,
+                               const uint64_t i_imageSize,
+                               rawImageInfo_t& o_imageInfo)
+{
+    const uint8_t* l_imageStartPtr =
+        reinterpret_cast<const uint8_t*>(i_imageStart);
+    errlHndl_t l_err = nullptr;
+
+    TRACFCOMP(g_trac_expupd,
+              ENTER_MRK "ocmbFwValidateImage(): startAddr[0x%016x] size[%u]",
+                      i_imageStart, i_imageSize);
+
+    //clear out o_imageInfo
+    memset(&o_imageInfo, 0, sizeof(o_imageInfo));
+
+    do
+    {
+        const uint64_t l_minHeaderSize =
+                          sizeof(ocmbFwHeader_t) +
+                          sizeof(taggedTriplet_t) + HEADER_SHA512_SIZE;
+
+        const uint64_t l_maxHeaderSize =
+                          std::min(static_cast<const uint64_t>(HEADER_MAX_SIZE),
+                                  i_imageSize);
+
+        // Check input parameters
+        if((!l_imageStartPtr) || (i_imageSize < l_minHeaderSize))
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "ocmbFwValidateImage: Invalid image address[%p] or"
+                      " size[%u]",
+                      l_imageStartPtr, i_imageSize);
+
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE
+            * @reasoncode      EXPUPD::INVALID_PARMS
+            * @userdata1       i_imageStart
+            * @userdata2       i_imageSize
+            * @devdesc         Invalid size or address for OCMB Flash Image
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                           EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE,
+                                           EXPUPD::INVALID_PARMS,
+                                           i_imageStart,
+                                           i_imageSize,
+                                           ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        const ocmbFwHeader_t* l_header =
+            reinterpret_cast<const ocmbFwHeader_t*>(l_imageStartPtr);
+
+        // Check eye catcher value
+        if(l_header->eyeCatcher != EYE_CATCHER_VALUE)
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "ocmbFwValidateImage: Invalid eye catcher value: "
+                      "expected[0x%016llx] actual[0x%016llx]",
+                      EYE_CATCHER_VALUE, l_header->eyeCatcher);
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE
+            * @reasoncode      EXPUPD::INVALID_EYE_CATCHER
+            * @userdata1       Expected Value
+            * @userdata2       Actual Value
+            * @devdesc         Invalid eye catcher value for OCMB Flash Image
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                           EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE,
+                                           EXPUPD::INVALID_EYE_CATCHER,
+                                           EYE_CATCHER_VALUE,
+                                           l_header->eyeCatcher,
+                                           ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        // Check header version
+        if((l_header->majorVersion != HEADER_VERSION_MAJOR) ||
+           (l_header->minorVersion != HEADER_VERSION_MINOR))
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "ocmbFwValidateImage: Unsupported header version: %u.%u",
+                      l_header->majorVersion, l_header->minorVersion);
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE
+            * @reasoncode      EXPUPD::INVALID_HEADER_VERSION
+            * @userdata1       majorVersion
+            * @userdata2       minorVersion
+            * @devdesc         Invalid header version for OCMB Flash Image
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                           EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE,
+                                           EXPUPD::INVALID_HEADER_VERSION,
+                                           l_header->majorVersion,
+                                           l_header->minorVersion,
+                                           ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        //Check that header size is within min/max range and 8byte aligned
+        if((l_header->headerSize < l_minHeaderSize) ||
+           (l_header->headerSize > l_maxHeaderSize) ||
+           !EXPUPD_8BYTE_ALIGNED(l_header->headerSize))
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "ocmbFwValidateImage: Unsupported header size: %u bytes",
+                      l_header->headerSize);
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE
+            * @reasoncode      EXPUPD::INVALID_HEADER_SIZE
+            * @userdata1       header size
+            * @userdata2       maximum allowed size
+            * @devdesc         Invalid header size for OCMB Flash Image
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                           EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE,
+                                           EXPUPD::INVALID_HEADER_SIZE,
+                                           l_header->headerSize,
+                                           l_maxHeaderSize,
+                                           ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        // Trace header information.
+        TRACFCOMP(g_trac_expupd, "OCMB HEADER:  Version[%u.%u] size[%u]"
+                  " triplets[%u]",
+                 l_header->majorVersion,
+                 l_header->minorVersion,
+                 l_header->headerSize,
+                 l_header->numTriplets);
+
+        // Parse all tagged triplet data
+        const uint8_t* l_curTripletPtr = l_imageStartPtr + sizeof(*l_header);
+        const uint8_t* l_endDataPtr = l_imageStartPtr + l_header->headerSize;
+        for(uint32_t l_curTriplet = 0;
+            l_curTriplet < l_header->numTriplets;
+            l_curTriplet++)
+        {
+            uint32_t l_numBytes = 0;
+
+            // This will set o_imageInfo.imageSHA512Ptr if
+            // SHA512 hash is found
+            l_err = parseTaggedDataTriplet(l_curTripletPtr,
+                                           l_endDataPtr,
+                                           o_imageInfo,
+                                           l_numBytes);
+            if(l_err)
+            {
+                TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "ocmbFwValidateImage: Failed parsing tagged data"
+                      " triplet %u of %u",
+                      l_curTriplet + 1, l_header->numTriplets);
+                break;
+            }
+
+            // Advance to next triplet
+            l_curTripletPtr += l_numBytes;
+        }
+        if(l_err)
+        {
+            break;
+        }
+
+        // Check if we found a SHA512 hash in the header
+        if(!o_imageInfo.imageSHA512HashPtr)
+        {
+            TRACFCOMP(g_trac_expupd, ERR_MRK
+                      "ocmbFwValidateImage: No SHA512 Hash found in header!");
+           /* @errorlog
+            * @errortype       ERRL_SEV_PREDICTIVE
+            * @moduleid        EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE
+            * @reasoncode      EXPUPD::MISSING_SHA512_HASH
+            * @userdata1       <unused>
+            * @userdata2       <unused>
+            * @devdesc         Missing SHA512 hash in OCMB Flash Image
+            * @custdesc        Error occurred during system boot.
+            */
+            l_err = new ERRORLOG::ErrlEntry(ERRORLOG::ERRL_SEV_PREDICTIVE,
+                                           EXPUPD::MOD_OCMB_FW_VALIDATE_IMAGE,
+                                           EXPUPD::MISSING_SHA512_HASH,
+                                           0, 0,
+                                           ERRORLOG::ErrlEntry::ADD_SW_CALLOUT);
+            break;
+        }
+
+        //** Header is valid if we made it this far **
+
+        // Trace the SHA512 hash
+        TRACFBIN(g_trac_expupd, "OCMB FW IMAGE SHA512 HASH",
+                 o_imageInfo.imageSHA512HashPtr, HEADER_SHA512_SIZE);
+
+        // Set the image start address and size and we are done here.
+        o_imageInfo.imagePtr = l_imageStartPtr + l_header->headerSize;
+        o_imageInfo.imageSize = i_imageSize - l_header->headerSize;
+
+    }while(0);
+
+    TRACFCOMP(g_trac_expupd, EXIT_MRK "ocmbFwValidateImage()");
+    return l_err;
+}
+
+} //namespace expupd
+
diff --git a/src/usr/isteps/expupd/ocmbFwImage.H b/src/usr/isteps/expupd/ocmbFwImage.H
new file mode 100644
index 000000000..5e5de2e64
--- /dev/null
+++ b/src/usr/isteps/expupd/ocmbFwImage.H
@@ -0,0 +1,68 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/usr/isteps/expupd/ocmbFwImage.H $                         */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2019                             */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#ifndef __OCMBFWIMAGE_H
+#define __OCMBFWIMAGE_H
+
+/**
+ * @file ocmbFwImage.H
+ *
+ * Interface for validating the OCMB firmware image from PNOR
+ *
+ */
+
+#include <errl/errlentry.H>
+
+namespace expupd
+{
+
+constexpr uint32_t HEADER_SHA512_SIZE = 64;
+
+/**
+ * @brief Parameters pertaining to an unpackaged (raw) OCMB firmware image
+ */
+typedef struct rawImageInfo
+{
+    const uint8_t* imagePtr;
+    size_t         imageSize;
+    const uint8_t* imageSHA512HashPtr;
+}rawImageInfo_t;
+
+/**
+ * @brief Validates OCMB firmware header of packaged image
+ *
+ * @param[in] i_imageStart Start address of packaged image
+ * @param[in] i_imageSize Size of packaged image
+ * @param[out] o_imageInfo Information pertaining to image after
+ *             being stripped of OCMB firmware header
+ * @return errlHndl_t indicating success or failure
+ *
+ */
+errlHndl_t ocmbFwValidateImage(const uint64_t i_imageStart,
+                               const uint64_t i_imageSize,
+                               rawImageInfo_t& o_imageInfo);
+
+}//namespace expupd
+
+#endif
diff --git a/src/usr/isteps/istep12/call_cen_set_inband_addr.C b/src/usr/isteps/istep12/call_cen_set_inband_addr.C
index 196f7bed7..439dccaf6 100644
--- a/src/usr/isteps/istep12/call_cen_set_inband_addr.C
+++ b/src/usr/isteps/istep12/call_cen_set_inband_addr.C
@@ -47,6 +47,8 @@
 //HWP
 #include    <p9c_set_inband_addr.H>
 
+#include    <expupd/expupd.H>
+
 #ifdef CONFIG_AXONE
 #include    <exp_omi_init.H>
 #include    <p9a_omi_init.H>
@@ -215,6 +217,11 @@ void* call_cen_set_inband_addr (void *io_pArgs)
 
         }
     }
+
+    // Check if any explorer chips require a firmware update and update them
+    // (skipped on MPIPL)
+    expupd::updateAll(l_StepError);
+
 #endif // CONFIG_AXONE
 
 
diff --git a/src/usr/pnor/pnor_utils.C b/src/usr/pnor/pnor_utils.C
index 8858d6826..8adb715aa 100644
--- a/src/usr/pnor/pnor_utils.C
+++ b/src/usr/pnor/pnor_utils.C
@@ -354,7 +354,8 @@ bool PNOR::isEnforcedSecureSection(const uint32_t i_section)
                i_section == MEMD ||
                i_section == CAPP ||
                i_section == TESTLOAD ||
-               i_section == VERSION;
+               i_section == VERSION ||
+               i_section == OCMBFW;
     #endif
 #else
     return false;