Reconcilable Differences: Booting Linux on IBM PowerVM LPARs
summary
IBM PowerVM LPAR boot differs from UEFI: partition firmware (Open Firmware) loads a client program from a prep partition or TFTP, negotiates client architecture features that can trigger reboot loops, and uses a virtual TPM plus a constrained platform key store (PKS) for authenticated variables with no shim. Work aims for bootloader-less boot, measured and verified boot with PQC, and secure boot for KVM L2 guests (EDK2/OVMF suggested). A timing-channel bug in embed TLS and multi-signature revocation semantics are concrete obstacles to wider deployment.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:04PowerVM LPAR boot stack
- 2:31Secure boot and PKS
- 6:47Kernel keyring and module signing
- 10:21Current considerations
- 12:54Post-quantum cryptography
- 14:21EmbedTLS challenges
- 19:22Multiple signatures policy
related talks
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers
21m(Ab)using Linux as a Trusted Bootloader
20mExtending OpenPOWER Boot Security to Guests
45mDynamic Key Managed PowerPC Guest Secure Boot
33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
41mProtected Execution Facility
22mBoot Requirements and Strategies for the Edge
39mTowards Measured Boot Out of the Box