Secure data protection with improved read-only memory locking during system pre-boot

1. A method for secure data protection, said method comprising:

selecting a region of system memory to be protected, said selection occurring in response to a system reset state, said selection performed by a trusted control block (TCB) comprising a trusted basic input/output system (BIOS);

programming an address decoder circuit to configure said selected region as read-write;

moving data to be secured to said selected region;

programming, through a source address decoder (SAD) register associated with a processor cache memory controller or a target address decoder (TAD) register associated with an integrated processor memory controller, said address decoder circuit to configure said selected region as read-only; and

locking said read-only configuration in said address decoder circuit.

2. The method of claim 1 , wherein said system reset state further comprises a system power up.

3. The method of claim 1 , wherein said data to be secured comprises an Advanced Configuration and Power Interface (ACPI) table.

4. The method of claim 1 , further comprising performing remaining system boot-up tasks after said locking.

5. The method of claim 4 , wherein said remaining system boot-up tasks comprise loading an operating system (OS).

6. The method of claim 1 , wherein said address decoder circuit is associated with a dynamic random access memory (DRAM) device controller.

7. The method of claim 1 , further comprising rejecting a memory write request to said selected region after said locking is performed.

8. The method of claim 7 , further comprising reporting a memory write fault error in response to said memory write request rejection.

9. A system for secure data protection, said system comprising:

a system memory;

an address decoder circuit coupled to said system memory;

a processor coupled to said address decoder circuit;

a processor cache memory controller;

an integrated processor memory controller; and

a trusted control block (TCB) associated with said processor, said TCB configured to execute a trusted basic input/output system (BIOS), wherein said trusted BIOS is configured to:

move data to be secured to a selected region of said system memory in response to a system reset state;

program said address decoder circuit through a source address decoder (SAD) register associated with the processor cache memory controller or a target address decoder (TAD) register associated with the integrated processor memory controller to configure said selected region as read-only; and

lock said read-only configuration in said address decoder circuit.

10. The system of claim 9 , wherein said system reset state further comprises a system power up.

11. The system of claim 9 , wherein said data to be secured comprises an Advanced Configuration and Power Interface (ACPI) table.

12. The system of claim 9 , further comprising a dynamic random access memory (DRAM) device controller wherein said address decoder circuit is associated with said dynamic random access memory (DRAM) device controller.

13. A non-transitory computer-readable storage medium having instructions stored thereon which when executed by a processor result in the following operations for secure data protection, said operations comprising:

selecting a region of system memory to be protected, said selection occurring in response to a system reset state, said selection performed by a trusted control block (TCB) comprising a trusted basic input/output system (BIOS);

programming an address decoder circuit through a source address decoder (SAD) register associated with a processor cache memory controller or a target address decoder (TAD) register associated with an integrated processor memory controller to configure said selected region as read-write;

moving data to be secured to said selected region;

programming said address decoder circuit to configure said selected region as read-only; and

locking said read-only configuration in said address decoder circuit.

14. The non-transitory computer-readable storage medium of claim 13 , wherein said system reset state further comprises a system power up.

15. The non-transitory computer-readable storage medium of claim 13 , wherein said data to be secured comprises an Advanced Configuration and Power Interface (ACPI) table.

16. The non-transitory computer-readable storage medium of claim 13 , further comprising the operation of performing remaining system boot-up tasks after said locking.

17. The non-transitory computer-readable storage medium of claim 16 , wherein said remaining system boot-up tasks comprise loading an operating system (OS).

18. The non-transitory computer-readable storage medium of claim 13 , wherein said address decoder circuit is associated with a dynamic random access memory (DRAM) device controller.

19. The non-transitory computer-readable storage medium of claim 13 , further comprising the operation of rejecting a memory write request to said selected region after said locking is performed.

20. The non-transitory computer-readable storage medium of claim 19 , further comprising the operation of reporting a memory write fault error in response to said memory write request rejection.