Methods and apparatus for in-memory device access control

1. A method for indicating access pass/violation feedback to a system on chip (SOC) as part of a read/write transaction sequence of a memory device, comprising:

receiving an unlock password from the SOC;

closing at least one pass gate to allow a memory access control of the memory device to receive a configuration message in response to the received unlock password matching a password within a set of acceptable passwords;

receiving the configuration message from the SOC for configuring the memory access control of the memory device;

configuring the memory access control based on the configuration message;

receiving an access request message from the SOC requesting access to a memory base address and a memory access range of a memory cell array of the memory device, wherein the access request message includes a read/write operation;

comparing the access request message with the configured memory access control to determine whether the access request message is allowable; and

performing the read/write operation in response to determining that the access request message is allowable.

2. The method of claim 1 , wherein:

the configuration message includes a configuration security domain ID; and

the access request message includes a requested security domain ID.

3. The method of claim 2 , wherein comparing the access request message with the configured memory access control to determine whether the access request message is allowable comprises:

determining whether the configuration security domain ID matches the requested security domain ID; and

in response to determining that the configuration security domain ID matches the requested security domain ID:

determining that the access request message is allowable; and

transmitting a notification to the SOC indicating that the access request message is allowable.

4. The method of claim 3 , further comprising:

in response to determining that the configuration security domain ID does not match the requested security domain ID:

determining that the access request message is not allowable;

storing error information including the memory base address, the memory access range, and the requested security domain ID;

transmitting a notification to the SOC indicating that the access request message is not allowable; and

transmitting the error information to the SOC in response to receiving an error interrupt request from the SOC.

5. The method of claim 2 , wherein:

the configuration message is an encoded JEDEC message including the configuration security domain ID; and

the access request message is an encoded JEDEC message including the requested security domain ID.

6. The method of claim 1 , further comprising:

receiving, from the SOC, a lock command configured to set a lock bit within a register of the memory device; and

setting the lock bit to prevent configuration changes to the configured memory access control.

7. A memory device, comprising:

a memory cell array;

at least one pass gate;

a trust hardware block, wherein the trust hardware block is configured to perform operations comprising:

receiving an unlock password from a system-on-chip (SOC);

closing the at least one pass gate to allow a memory access control hardware block to receive a configuration message in response to the received unlock password matching a password within a set of acceptable passwords; and

wherein the access control hardware block is configured to perform operations comprising:

receiving the configuration message from the SOC for configuring memory access control of the memory device;

configuring memory access control based on the configuration message;

receiving an access request message from the SOC requesting access to a memory base address and a memory access range of the memory cell array, wherein the access request message includes a read/write operation;

comparing the access request message with the configured memory access control to determine whether the access request message is allowable; and

performing the read/write operation in response to determining that the access request message is allowable.

8. The memory device of claim 7 , wherein the access control hardware block is configured to perform operations such that:

receiving the configuration message from the SOC comprises receiving a configuration message that includes a configuration security domain ID; and

receiving an access request message from the SOC comprises receiving an access request message that includes a requested security domain ID.

9. The memory device of claim 8 , wherein the access control hardware block is configured to perform operations such that comparing the access request message with the configured memory access control to determine whether the access request message is allowable comprises:

determining whether the configuration security domain ID matches the requested security domain ID; and

in response to determining that the configuration security domain ID matches the requested security domain ID:

determining that the access request message is allowable; and

transmitting a notification to the SOC indicating that the access request message is allowable.

10. The memory device of claim 9 , wherein the access control hardware block is configured to perform operations further comprising:

in response to determining that the configuration security domain ID does not match the requested security domain ID:

determining that the access request message is not allowable;

storing error information including the memory base address, the memory access range, and the requested security domain ID;

transmitting a notification to the SOC indicating that the access request message is not allowable; and

transmitting the error information to the SOC in response to receiving an error interrupt request from the SOC.

11. The memory device of claim 8 , wherein the access control hardware block is configured to perform operations such that:

receiving the configuration message from the SOC comprises receiving an encoded JEDEC message including the configuration security domain ID; and

receiving an access request message from the SOC comprises receiving an encoded JEDEC message including the requested security domain ID.

12. The memory device of claim 7 , wherein the access control hardware block is configured to perform operations further comprising:

receiving, from the SOC, a lock command configured to set a lock bit within a register of the memory device; and

setting the lock bit to prevent configuration changes to the configured memory access control.

13. The memory device of claim 7 , wherein the trust hardware block comprises:

a fuse memory configured to store a set of acceptable passwords; and

a logic block coupled to the fuse memory and the at least one pass gate and configured to:

signal the at least one pass gate to unlock the memory device gate logic by closing the at least one pass gate in response to the received unlock password matching the password within the set of acceptable passwords stored in the fuse memory.

14. The memory device of claim 7 , wherein the access control hardware block comprises:

an access control configuration block;

an access violation syndrome; and

a policy enforcement block.

15. A memory device, comprising:

a memory cell array;

means for receiving an unlock password from a system-on-chip (SOC);

means for closing at least one pass gate to allow a memory access control of the memory device to receive a configuration message in response to the received unlock password matching a password within a set of acceptable passwords;

means for receiving the configuration message from the SOC for configuring the memory access control of the memory device;

means for configuring the memory access control based on the configuration message;

means for receiving an access request message from the SOC requesting access to a memory base address and a memory access range of the memory cell array, wherein the access request message includes a read/write operation;

means for comparing the access request message with the configured memory access control to determine whether the access request message is allowable; and

means for performing the read/write operation in response to determining that the access request message is allowable.

16. The memory device of claim 15 , wherein:

means for receiving the configuration message from the SOC comprises means for receiving a configuration message that includes a configuration security domain ID; and

means for receiving an access request message from the SOC comprises means for receiving an access request message that includes a requested security domain ID.

17. The memory device of claim 16 , wherein means for comparing the access request message with the configured memory access control to determine whether the access request message is allowable comprises:

means for determining whether the configuration security domain ID matches the requested security domain ID;

means for determining that the access request message is allowable in response to determining that the configuration security domain ID matches the requested security domain ID; and

means for transmitting a notification to the SOC indicating that the access request message is allowable.

18. The memory device of claim 17 , further comprising:

means for determining that the access request message is not allowable response to determining that the configuration security domain ID does not match the requested security domain ID;

means for storing error information including the memory base address, the memory access range, and the requested security domain ID;

means for transmitting a notification to the SOC indicating that the access request message is not allowable; and

means for transmitting the error information to the SOC in response to receiving an error interrupt request from the SOC.

19. The memory device of claim 16 , wherein:

means for receiving the configuration message from the SOC comprises means for receiving an encoded JEDEC message including the configuration security domain ID; and

means for receiving an access request message from the SOC comprises means for receiving an encoded JEDEC message including the requested security domain ID.

20. The memory device of claim 15 , further comprising:

means for receiving, from the SOC, a lock command configured to set a lock bit within a register of the memory device; and

means for setting the lock bit to prevent configuration changes to the configured memory access control.