# Configure LCP-DARE regions with QDUTT

Use QDUTT to set the protection mode and size of each LCP DRAM region, generate the configuration binary, and flash it to the device.

QDUTT is the Qualcomm DDR USB Test Tool, available from QPM. Use it to configure LCP settings and memory region sizes, then output either an `xbl_config.elf` image or an `LCP.bin` binary that you flash to the target. After you flash the configuration, verify it from HLOS before shipping.

## Prerequisites

- QDUTT installed from QPM.
- The default `Glymur_LCP.bin` from the boot build path.
- A host connection to the target and permission to flash the `XBL_CONFIG` partition.

## Configure LCP settings in QDUTT

Set the protection mode and size for each region in QDUTT, then save the configuration in the format that matches your flashing method:

1. Open QDUTT, select the **Glymur** target, and choose the **LCP** option.

    The QDUTT main window shows the Glymur target selected, with the DDI, eCDT, LCP, Log Analysis, and Eye Compare functions available.
2. To update the LCP region from the default settings, select **Open** and load the default `Glymur_LCP.bin` from the boot build path:

<bsp_root>\boot_images\boot\QcomPkg\SocPkg\<Target>\Settings\DSF\release\target\Glymur\Glymur_LCP.bin
        Copy to clipboard
3. Update the configuration as needed, select **SAVE**, and choose whether to generate `xbl_config.elf` (recommended) or `LCP.bin`.

    The QDUTT LCP window shows the MemMap version, the Open and Save controls, and the per-region protection and size table.
4. Choose the output format based on how you flash the device:

    - `xbl_config.elf`: The tool creates the binary at the specified location. Flash it onto the SPINOR `XBL_CONFIG partition`.
    - `LCP.bin`: The tool creates the binary at the specified location. Replace the default `Glymur_LCP.bin` in `boot_images`, then recompile and reflash all images.

    The QDUTT generate dialog provides options to output `xbl_config.elf` or `LCP.bin`, build path fields, and a status pane.

## Calculate LCP-DRAM TAG size

Size each region so that the authentication and replay-protection metadata, called the TAG, fits alongside the region data. The TAG size depends on the protection mode and the size of the protected memory.

Calculate the TAG memory size for DARE-configured and DAE-configured memory with the following formulas, where C2 is the size of the protected memory:

- DARE TAG size: `round_192(C2/8 + C2/8 + C2/64 + C2/512 + C2/4096 + 1 KB)`
- DAE TAG size: `round_192(C2/8 + 1 KB)`

The TAG memory in HLOS doesn’t require any update, because HLOS doesn’t treat the TAG memory as available memory and doesn’t consume it. Apply these size alignment requirements when you configure regions:

- DARE region size alignment: 6 MB
- Non-DARE regions (DE, DAE, plain DDR, and TAGS) size alignment: 192 KB

The following table lists the DARE and DAE TAG sizes for representative memory sizes.

DARE and DAE TAG sizes by memory size

| Memory size (MB) | DARE TAG size (MB) | DAE TAG size (MB) |
| --- | --- | --- |
| 1 | 0.267822 | 0.125 |
| 100 | 26.78223 | 12.5 |
| 200 | 53.56445 | 25 |
| 300 | 80.34668 | 37.5 |
| 512 | 137.125 | 64 |

### Related

- [LCP-DARE architecture](https://docs.qualcomm.com/doc/80-A0399-49/topic/lcp-dare-architecture.html)
- [Debug LCP-DARE authentication errors](https://docs.qualcomm.com/doc/80-A0399-49/topic/debug-lcp-dare-authentication-errors.html)

Last Published: Sep 08, 2026

[Previous Topic
LCP-DARE architecture](https://docs.qualcomm.com/bundle/publicresource/80-A0399-49/topics/lcp-dare-architecture.md) [Next Topic
Debug LCP-DARE authentication errors](https://docs.qualcomm.com/bundle/publicresource/80-A0399-49/topics/debug-lcp-dare-authentication-errors.md)