diff --git a/openpower/linux/0005-powerpc-ima-Define-trusted-boot-policy.patch b/openpower/linux/0005-powerpc-ima-Define-trusted-boot-policy.patch
new file mode 100644
index 0000000..76b1212
--- /dev/null
+++ b/openpower/linux/0005-powerpc-ima-Define-trusted-boot-policy.patch
@@ -0,0 +1,69 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nayna Jain <nayna@linux.ibm.com>
+Date: Wed, 30 Oct 2019 23:31:29 -0400
+Subject: [PATCH 05/18] powerpc/ima: Define trusted boot policy
+
+This patch defines an arch-specific trusted boot only policy and a
+combined secure and trusted boot policy.
+
+Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1572492694-6520-5-git-send-email-zohar@linux.ibm.com
+(cherry picked from commit 1917855f4e0658c313e280671ad87774dbfb7b24)
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+---
+ arch/powerpc/kernel/ima_arch.c | 33 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c
+index d88913dc0da7..0ef5956c9753 100644
+--- a/arch/powerpc/kernel/ima_arch.c
++++ b/arch/powerpc/kernel/ima_arch.c
+@@ -30,6 +30,32 @@ static const char *const secure_rules[] = {
+ 	NULL
+ };
+ 
++/*
++ * The "trusted_rules" are enabled only on "trustedboot" enabled systems.
++ * These rules add the kexec kernel image and kernel modules file hashes to
++ * the IMA measurement list.
++ */
++static const char *const trusted_rules[] = {
++	"measure func=KEXEC_KERNEL_CHECK",
++	"measure func=MODULE_CHECK",
++	NULL
++};
++
++/*
++ * The "secure_and_trusted_rules" contains rules for both the secure boot and
++ * trusted boot. The "template=ima-modsig" option includes the appended
++ * signature, when available, in the IMA measurement list.
++ */
++static const char *const secure_and_trusted_rules[] = {
++	"measure func=KEXEC_KERNEL_CHECK template=ima-modsig",
++	"measure func=MODULE_CHECK template=ima-modsig",
++	"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig",
++#ifndef CONFIG_MODULE_SIG_FORCE
++	"appraise func=MODULE_CHECK appraise_type=imasig|modsig",
++#endif
++	NULL
++};
++
+ /*
+  * Returns the relevant IMA arch-specific policies based on the system secure
+  * boot state.
+@@ -37,7 +63,12 @@ static const char *const secure_rules[] = {
+ const char *const *arch_get_ima_policy(void)
+ {
+ 	if (is_ppc_secureboot_enabled())
+-		return secure_rules;
++		if (is_ppc_trustedboot_enabled())
++			return secure_and_trusted_rules;
++		else
++			return secure_rules;
++	else if (is_ppc_trustedboot_enabled())
++		return trusted_rules;
+ 
+ 	return NULL;
+ }