Secure boot without UEFI: booting VMs on Power(PC)

" summary

Describes work to add secure boot for Linux VMs on IBM Power systems that use OpenFirmware (IEEE1275) rather than UEFI. The approach is to extend GRUB to verify Linux-module-style appended signatures (matching existing OpenPower distro kernel signatures) and to sign GRUB itself with an appended signature so the firmware-loaded OpenFirmware can verify it.

AI-written summary · about

" related talks

• 20mExtending OpenPOWER Boot Security to GuestsGeorge Wilson · Linux Security Summit North America 2018
• 35mUsing Linux as a Secure Boot Loader for OpenPOWER ServersNayna Jain, Thiago Jung Bauermann · Linux Security Summit Europe 2018
• 33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key ManagementNayna Jain · Linux Security Summit Europe 2019
• 45mUsing Secure Boot for the powers of goodMatthew Garrett · Open Source Bridge 2013
• 38mUEFI Secure Boot in U-BootGrant Likely · Open Source Summit + Embedded Linux Conference North America 2019
• 30mEnabling UEFI Secure Boot Across Modern Build SystemsFrank Vasquez · Linux Plumbers Conference 2025
• 41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER SystemsClaudio de Carvalho · Linux Security Summit North America 2018
• 27mSecuring Arm ServersMatteo Carlini · Linaro Connect Hong Kong 2018