Patent ID: 8321931

Claim:
A system for protecting boot phases of a platform having virtualization technology capabilities, comprising: a processor coupled to a non-volatile firmware storage device; a trusted software module for controlling an initial boot phase of the platform, the software module stored in the non-volatile firmware storage device, wherein the trusted software module is to be executed as a privileged component in a virtual machine to control boot operations; system cache memory coupled to the processor, wherein a portion of the cache memory is to be configured as cache-as-RAM (CAR), and wherein the trusted software module is to be initially executed as resident in the CAR, prior to discovery and initialization of system random access memory (RAM), and once system RAM is initialized, the trusted software module is to be migrated to run in system RAM; a second software module to be launched by the trusted software module running in system RAM to control a next boot phase of the platform, wherein the second software module is to execute as a privileged component in a virtual machine; and a launch control policy (LCP) unit to verify that a software module is authorized before allowing the software module to be launched, wherein the LCP unit is to retrieve launch policy configuration data from non-volatile storage coupled to a trusted platform module (TPM NV); wherein the trusted software module is to be verified by microcode in the platform and successive software modules launched in a chain from the trusted software module cause the LCP unit to automatically verify the successive software modules against the policy configuration data before launching.