Method for isolating third party pre-boot firmware from trusted pre-boot firmware

1. A method comprising:

determining if an isolation driver is present in a non-volatile storage of a system and if so, determining if a processor of the system supports virtualization and if so, launching the isolation driver in a first privilege level, the first privilege different than a system privilege level and user privilege level, and wherein the isolation driver is launched before third party code;

launching the isolation driver prior to a conclusion of a driver execution environment (DXE) phase of a pre-boot environment;

creating a 1:1 virtual mapping between a virtual address and a physical address, wherein the physical address is to be accessed using a page directory entry of a page directory and a page table entry of a page table using the isolation driver;

controlling access to a memory page associated with the page table entry based on a plurality of availability bits of the page table entry; and

allocating the memory page to an exclusion list by writing a predetermined code in the plurality of availability bits of the associated page table entry.

2. The method of claim 1 , further comprising preventing access to the memory page by code other than the isolation driver if the memory page is allocated in the exclusion list.

3. The method of claim 1 , further comprising preventing access to the memory page by an errant third party driver.

4. The method of claim 1 , wherein the memory page corresponds to a system table of the DXE phase.

5. The method of claim 1 , wherein the memory page corresponds to a runtime service table.

6. An article comprising a machine-accessible medium including instructions that when executed cause a system to:

determine if an isolation driver is present in a non-volatile storage and if so, determine if a processor supports virtualization and if so, launch the isolation driver in a first privilege level, the first privilege different than a system privilege level and user privilege level and at a higher privilege level than the system privilege level and the user privilege level, and wherein the isolation driver is launched before third party code;

launch the isolation driver prior to a conclusion of a driver execution environment (DXE) phase of a pre-boot environment;

create a 1:1 virtual mapping between a virtual address and a physical address, wherein the physical address is to be accessed using a page directory entry of a page directory and a page table entry of a page table using the isolation driver;

control access to a memory page associated with the page table entry based on a plurality of availability bits of the page table entry; and

allocate the memory page to an exclusion list by writing a predetermined code in the plurality of availability bits of the associated page table entry.

7. The article of claim 6 , wherein the instructions that when executed enable the system to prevent access to the memory page by code other than the isolation driver if the memory page is allocated in the exclusion list.

8. The article of claim 7 , further comprising instructions that when executed enable the system to prevent access to the memory page by an errant third party driver.

9. A system comprising:

a processor to execute instructions;

a non-volatile storage including trusted code to execute in a pre-boot environment, the trusted code including first code of a first privilege level, the first code including security code, pre-extensible firmware interface code, and driver execution environment code, second code of a second privilege level, the second code including an isolation driver to prevent third party code from execution in the second privilege level, create a 1:1 virtual mapping between a virtual address and a physical address, wherein the physical address is to be accessed using a page directory entry of a page directory and a page table entry of a page table using the isolation driver, and control access to a memory page associated with the page table entry based on a plurality of availability bits of the page table entry, first instructions that when executed enable the system to launch the isolation driver before the third party code and prior to a conclusion of the driver execution environment, and second instructions that when executed enable the system to allocate the memory page to an exclusion list by writing a predetermined code in the plurality of availability bits of the associated page table entry and prevent access to the memory page by code other than the isolation driver if the memory page is allocated in the exclusion list; and

a mass storage device coupled to the processor, the mass storage device including third code of a third privilege level, the third code including the third party code.