diff --git a/openpower/configs/witherspoon_defconfig b/openpower/configs/witherspoon_defconfig
index f98a884..7fe0481 100644
--- a/openpower/configs/witherspoon_defconfig
+++ b/openpower/configs/witherspoon_defconfig
@@ -40,7 +40,7 @@
 BR2_OPENPOWER_POWER9=y
 BR2_HOSTBOOT_CONFIG_FILE="witherspoon.config"
 BR2_OPENPOWER_MACHINE_XML_GITHUB_PROJECT_VALUE="witherspoon-xml"
-BR2_OPENPOWER_MACHINE_XML_VERSION="7bec10c197071f8fa78b108275675693bfe13403"
+BR2_OPENPOWER_MACHINE_XML_VERSION="24d2f6d98568f0b23d1eb3bb9f876a638be4ae37"
 BR2_OPENPOWER_MACHINE_XML_FILENAME="witherspoon.xml"
 BR2_OPENPOWER_SYSTEM_XML_FILENAME="WITHERSPOON_hb.system.xml"
 BR2_OPENPOWER_MRW_XML_FILENAME="WITHERSPOON_hb.mrw.xml"
@@ -57,6 +57,8 @@
 BR2_PACKAGE_PETITBOOT=y
 BR2_PACKAGE_PETITBOOT_MTD=y
 BR2_OCC_BIN_FILENAME="occ.bin"
+BR2_OCC_GPU_BIN_FILENAME="gpu_gpe1.bin"
+BR2_OCC_GPU_BIN_BUILD=y
 BR2_CAPP_UCODE_BIN_FILENAME="cappucode.bin"
 BR2_PACKAGE_LOADKEYS=y
 BR2_IMA_CATALOG_DTS="POWER9"
diff --git a/openpower/configs/zaius_defconfig b/openpower/configs/zaius_defconfig
index 3c01088..d788da0 100644
--- a/openpower/configs/zaius_defconfig
+++ b/openpower/configs/zaius_defconfig
@@ -40,7 +40,7 @@
 BR2_OPENPOWER_POWER9=y
 BR2_HOSTBOOT_CONFIG_FILE="zaius.config"
 BR2_OPENPOWER_MACHINE_XML_GITHUB_PROJECT_VALUE="zaius-xml"
-BR2_OPENPOWER_MACHINE_XML_VERSION="9325c75307807915197f4704ab7e6d8994e2c837"
+BR2_OPENPOWER_MACHINE_XML_VERSION="7b63cfae75ef13789db5c71557c24c69d854413f"
 BR2_OPENPOWER_MACHINE_XML_FILENAME="zaius.xml"
 BR2_OPENPOWER_SYSTEM_XML_FILENAME="ZAIUS_hb.system.xml"
 BR2_OPENPOWER_MRW_XML_FILENAME="ZAIUS_hb.mrw.xml"
diff --git a/openpower/package/Config.in b/openpower/package/Config.in
index 68699e0..aed88b6 100755
--- a/openpower/package/Config.in
+++ b/openpower/package/Config.in
@@ -17,4 +17,5 @@
 source "$BR2_EXTERNAL_OP_BUILD_PATH/package/ima-catalog/Config.in"
 source "$BR2_EXTERNAL_OP_BUILD_PATH/package/sbe/Config.in"
 source "$BR2_EXTERNAL_OP_BUILD_PATH/package/sb-signing-utils/Config.in"
+source "$BR2_EXTERNAL_OP_BUILD_PATH/package/sb-signing-framework/Config.in"
 
diff --git a/openpower/package/hostboot-binaries/hostboot_binaries.mk b/openpower/package/hostboot-binaries/hostboot_binaries.mk
index e65dea4..4c5b3b6 100644
--- a/openpower/package/hostboot-binaries/hostboot_binaries.mk
+++ b/openpower/package/hostboot-binaries/hostboot_binaries.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-HOSTBOOT_BINARIES_VERSION ?= d45f5e3c086decb9c437cc3c6410108487334663
+HOSTBOOT_BINARIES_VERSION ?= cddd766c40f1fbcc91dee315158438ad48a0c5ea
 HOSTBOOT_BINARIES_SITE ?= $(call github,open-power,hostboot-binaries,$(HOSTBOOT_BINARIES_VERSION))
 
 HOSTBOOT_BINARIES_LICENSE = Apache-2.0
diff --git a/openpower/package/hostboot/hostboot.mk b/openpower/package/hostboot/hostboot.mk
index 0accc0c..f67d368 100644
--- a/openpower/package/hostboot/hostboot.mk
+++ b/openpower/package/hostboot/hostboot.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 HOSTBOOT_VERSION_BRANCH_MASTER_P8 ?= 695bd891343faf1f0ef85fe53148590e58239efd
-HOSTBOOT_VERSION_BRANCH_MASTER ?= a19748cc4dbe3feff90fb95ffa7b9a474fdc7660
+HOSTBOOT_VERSION_BRANCH_MASTER ?= 8e7e2adfdfe90a1061ce87b8a657bab152a73358
 
 HOSTBOOT_VERSION ?= $(if $(BR2_OPENPOWER_POWER9),$(HOSTBOOT_VERSION_BRANCH_MASTER),$(HOSTBOOT_VERSION_BRANCH_MASTER_P8))
 HOSTBOOT_SITE ?= $(call github,open-power,hostboot,$(HOSTBOOT_VERSION))
diff --git a/openpower/package/ima-catalog/ima-catalog.mk b/openpower/package/ima-catalog/ima-catalog.mk
index 961e235..e37021d 100644
--- a/openpower/package/ima-catalog/ima-catalog.mk
+++ b/openpower/package/ima-catalog/ima-catalog.mk
@@ -3,7 +3,7 @@
 # ima-catalog.mk
 #
 ################################################################################
-IMA_CATALOG_VERSION ?= f9da5d6feb3c407cd24c88d61b73d7d01b2d1400
+IMA_CATALOG_VERSION ?= 7c7a388ae0bb734cc9e4fe10593c45d8946a8fd7
 IMA_CATALOG_SITE ?= $(call github,open-power,ima-catalog,$(IMA_CATALOG_VERSION))
 IMA_CATALOG_LICENSE = Apache-2.0
 IMA_CATALOG_DEPENDENCIES = host-dtc host-xz
diff --git a/openpower/package/libflash/libflash.mk b/openpower/package/libflash/libflash.mk
index c1c1a15..98ce0ed 100644
--- a/openpower/package/libflash/libflash.mk
+++ b/openpower/package/libflash/libflash.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBFLASH_VERSION = v5.7-76-g830fc9a0ed0a
+LIBFLASH_VERSION = v5.8-123-gc06ed583
 LIBFLASH_SITE = $(call github,open-power,skiboot,$(LIBFLASH_VERSION))
 
 LIBFLASH_INSTALL_STAGING = YES
diff --git a/openpower/package/occ/Config.in b/openpower/package/occ/Config.in
index 29b5eb4..1d77dff 100644
--- a/openpower/package/occ/Config.in
+++ b/openpower/package/occ/Config.in
@@ -9,3 +9,15 @@
         string "Name of OCC image file"
         help
             String used to define name of the OCC binary image file
+
+config BR2_OCC_GPU_BIN_BUILD
+        bool "Enables Compilation of GPU Binary Image"
+        default n
+        help
+            Boolean used to flag whether to compile OCC GPU binary
+
+config BR2_OCC_GPU_GPE_BIN_FILENAME
+        string "Name of OCC GPU GPE Binary file"
+        help
+            String used to define name of the OCC GPUE GPE binary image file
+
diff --git a/openpower/package/occ/occ.mk b/openpower/package/occ/occ.mk
index 65fd28a..92f60b3 100644
--- a/openpower/package/occ/occ.mk
+++ b/openpower/package/occ/occ.mk
@@ -23,7 +23,7 @@
 OCC_IMAGE_BIN_PATH = $(if $(BR2_OPENPOWER_POWER9),obj/image.bin,src/image.bin)
 
 OCC_DEPENDENCIES_P8 = host-binutils host-p8-pore-binutils
-OCC_DEPENDENCIES_P9 = host-binutils host-ppe42-gcc
+OCC_DEPENDENCIES_P9 = host-binutils host-ppe42-gcc hostboot-binaries
 OCC_DEPENDENCIES ?= $(if $(BR2_OPENPOWER_POWER9),$(OCC_DEPENDENCIES_P9),$(OCC_DEPENDENCIES_P8))
 
 define OCC_APPLY_PATCHES
@@ -50,8 +50,13 @@
         make combineImage
 endef
 define OCC_BUILD_CMDS_P9
-        cd $(@D)/src && \
-        make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib all 
+	if ["$(BR2_OCC_GPU_BIN_BUILD)" == "y"  ]; then \
+	    cd $(@D)/src && \
+            make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib GPE1_BIN_IMAGE_PATH=$(STAGING_DIR)/hostboot_build_images/ OPOCC_GPU_SUPPORT=1 all; \
+	else \
+            cd $(@D)/src && \
+            make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib all; \
+	fi;
 endef
 OCC_BUILD_CMDS ?= $(if $(BR2_OPENPOWER_POWER9),$(OCC_BUILD_CMDS_P9),$(OCC_BUILD_CMDS_P8))
 
diff --git a/openpower/package/openpower-pnor/Config.in b/openpower/package/openpower-pnor/Config.in
index 644d281..37c4470 100644
--- a/openpower/package/openpower-pnor/Config.in
+++ b/openpower/package/openpower-pnor/Config.in
@@ -39,6 +39,7 @@
 
 config BR2_OPENPOWER_SECUREBOOT_SIGN_MODE
         string "Secureboot signing mode"
+        default "development"
         help
             Available options [development | production]
             Indicates the signing mode when generating the PNOR image.  Only
diff --git a/openpower/package/pkg-versions.mk b/openpower/package/pkg-versions.mk
index 9a37bbb..be50245 100644
--- a/openpower/package/pkg-versions.mk
+++ b/openpower/package/pkg-versions.mk
@@ -134,7 +134,7 @@
 
 UPPER_CASE_PKG = $(call UPPERCASE,$(1))
 $$(UPPER_CASE_PKG)_VERSION_FILE = $$(OPENPOWER_VERSION_DIR)/$(1).version.txt
-
+UPPER_CASE_SIGN_MODE = $(call UPPERCASE,$$(BR2_OPENPOWER_SECUREBOOT_SIGN_MODE))
 
 $$(eval $$(foreach pkg,$$(OPENPOWER_VERSIONED_SUBPACKAGES), \
 		$$(call OPENPOWER_SUBPACKAGE_VERSION,$$(pkg),$$(call UPPERCASE,$$(pkg)))))
@@ -168,6 +168,11 @@
 	>> $$($$(UPPER_CASE_PKG)_VERSION_FILE); \
 fi
 
+# Flag whether op-build is production signed
+if [ "$$(UPPER_CASE_SIGN_MODE)" == 'PRODUCTION' ]; then \
+	echo -n "-prod" >> $$($$(UPPER_CASE_PKG)_VERSION_FILE); \
+fi
+
 # Add new line to $$($$(UPPER_CASE_PKG)_VERSION_FILE)
 echo "" >> $$($$(UPPER_CASE_PKG)_VERSION_FILE);
 
diff --git a/openpower/package/sb-signing-framework/Config.in b/openpower/package/sb-signing-framework/Config.in
new file mode 100644
index 0000000..7ac3848
--- /dev/null
+++ b/openpower/package/sb-signing-framework/Config.in
@@ -0,0 +1,5 @@
+config BR2_PACKAGE_HOST_SB_SIGNING_FRAMEWORK
+        bool "OpenPOWER secureboot signing server interface"
+        default y if BR2_OPENPOWER_PLATFORM && ((BR2_OPENPOWER_SECUREBOOT_SIGN_MODE = "production") || (BR2_OPENPOWER_SECUREBOOT_KEY_TRANSITION_TO_PROD) )
+        help
+            Client interface to signing server for signing OpenPOWER firmware images
diff --git a/openpower/package/sb-signing-framework/sb-signing-framework.mk b/openpower/package/sb-signing-framework/sb-signing-framework.mk
new file mode 100644
index 0000000..6338ae0
--- /dev/null
+++ b/openpower/package/sb-signing-framework/sb-signing-framework.mk
@@ -0,0 +1,27 @@
+################################################################################
+#
+#  sb-signing-framework
+#
+################################################################################
+
+SB_SIGNING_FRAMEWORK_SITE ?= $(call github,open-power,sb-signing-framework,$(SB_SIGNING_FRAMEWORK_VERSION))
+
+SB_SIGNING_FRAMEWORK_LICENSE = Apache-2.0
+SB_SIGNING_FRAMEWORK_LICENSE_FILES = LICENSE
+SB_SIGNING_FRAMEWORK_VERSION ?= 02ed29aa11136a6d9a6e1f075772532c43cb7289
+
+HOST_SB_SIGNING_FRAMEWORK_DEPENDENCIES = host-openssl
+
+define HOST_SB_SIGNING_FRAMEWORK_BUILD_CMDS
+	CFLAGS="-I $(HOST_DIR)/usr/include -Wl,-rpath -Wl,$(HOST_DIR)/usr/lib" \
+		$(HOST_MAKE_ENV) $(MAKE) -C $(@D)/src/client/
+endef
+
+define HOST_SB_SIGNING_FRAMEWORK_COPY_FILES
+		$(INSTALL) -m 0755 $(@D)/src/client/sf_client $(HOST_DIR)/usr/bin/
+endef
+
+HOST_SB_SIGNING_FRAMEWORK_POST_INSTALL_HOOKS += HOST_SB_SIGNING_FRAMEWORK_COPY_FILES
+
+$(eval $(host-generic-package))
+
diff --git a/openpower/package/sb-signing-utils/Config.in b/openpower/package/sb-signing-utils/Config.in
index 87df6f3..b834f46 100644
--- a/openpower/package/sb-signing-utils/Config.in
+++ b/openpower/package/sb-signing-utils/Config.in
@@ -1,5 +1,5 @@
 config BR2_PACKAGE_HOST_SB_SIGNING_UTILS
         bool "OpenPOWER secureboot signing utilities"
-        default y if (BR2_OPENPOWER_PLATFORM && BR2_OPENPOWER_SECUREBOOT_ENABLED)
+        default y if (BR2_OPENPOWER_PLATFORM)
         help
             Secureboot utilities for signing OpenPOWER firmware images
diff --git a/openpower/package/sb-signing-utils/sb-signing-utils.mk b/openpower/package/sb-signing-utils/sb-signing-utils.mk
index de8b5eb..0dbb4d0 100644
--- a/openpower/package/sb-signing-utils/sb-signing-utils.mk
+++ b/openpower/package/sb-signing-utils/sb-signing-utils.mk
@@ -12,6 +12,12 @@
 
 HOST_SB_SIGNING_UTILS_DEPENDENCIES = host-openssl
 
+ifeq ($(BR2_OPENPOWER_SECUREBOOT_SIGN_MODE),production)
+HOST_SB_SIGNING_UTILS_DEPENDENCIES += host-sb-signing-framework
+else ifeq ($(BR2_OPENPOWER_SECUREBOOT_KEY_TRANSITION_TO_PROD),y)
+HOST_SB_SIGNING_UTILS_DEPENDENCIES += host-sb-signing-framework
+endif
+
 HOST_SB_SIGNING_UTILS_AUTORECONF = YES
 HOST_SB_SIGNING_UTILS_AUTORECONF_OPTS = -i