# LCP-DARE architecture

LCP-DARE runs as an LLCC co-processor that encrypts and authenticates DDR traffic, using per-region keys and OEM-defined configuration applied at boot.

LCP sits between the last level cache and the memory controller. It encrypts data written to DDR and detects and corrects errors on data read back from DDR. OEMs define the protection mode, size, and layout of each region, and secure boot software programs the hardware with per-region keys
during each boot.

## Security configurations

LCP-DARE supports four protection modes so you can match the protection level to the sensitivity and size of each region. Higher protection modes add authentication and replay-protection on top of encryption, which increases metadata overhead.

- DARE applies encryption, authentication, and replay-protection.
- DAE applies encryption and authentication.
- DE applies encryption only.
- Plain DDR applies no protection.

## Authentication, replay-protection, and encryption algorithms

LCP-DARE combines three cryptographic functions to protect region data. Authentication uses the SHA-3 algorithm reduced to 12 rounds,replay-protection uses a Bonzai Merkle tree, and encryption uses the
QARMA7-64 algorithm. Each region keeps a separate key, configuration, and metadata set, and keys are regenerated on every boot by secure EL3 software.

## Boot-time OEM configuration flow

OEM configuration settings are part of an `xbl_config.elf` image that OEMs generate with QDUTT. When you flash the new `xbl_config.elf` to the device, XBL\_SC decodes the LCP-DARE OEM configuration settings and configures the OEM regions accordingly during boot.

## LCP-DARE region layout

The region layout defines which execution environments are protected and the default protection mode for each. Some regions are mandated by Qualcomm, and others are left to OEM choice.

The following table lists the protection mode assigned to each execution environment on the Snapdragon^®^ Glymur family.

LCP-DARE protection mode by execution environment

| Execution environment | Snapdragon Glymur family |
| --- | --- |
| CPUCP (DDR part) | DARE (Qualcomm mandated) |
| TZ (DDR part) | DARE (Qualcomm mandated) |
| Trusted applications (TA S1) | DARE (Qualcomm mandated) |
| Trusted applications (TA S2) | DARE, DAE, DE, or DDR (OEM choice) |
| OOB-Secure | DARE (Qualcomm mandated) |
| OOB-NS | DE (Qualcomm mandated) |
| SMMU\_PT | DE (Qualcomm mandated) |
| OEM Regions 1-N | DE or DDR (OEM choice) |

The following table lists the region ID, index, default protection mode, and default address range for each LCP-DARE region.

| ID | Index | Default type | Start address | End address |
| --- | --- | --- | --- | --- |
| CPUCP | 0 | DARE | 0x80900000 | 0x81500000 |
| DARE\_REGION\_TZ\_TA\_S1 | 1 | DARE | 0xD7000000 | 0xD9400000 |
| DARE\_REGION\_TA\_S2 | 2 | Plain DDR | 0xD9400000 | 0xD9400000-0xFC000000 (configurable) |
| OOB-Secure | 3 | DARE | 0x87170000 | 0x87D70000 |
| OOB-NS | 4 | DE | 0x87E00000 | 0x88A00000 |
| SMMU\_PT | 5 | DE | 0x85370000 | 0x85D90000 |
| ENCRYPT1 | 6 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT2 | 7 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT3 | 8 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT4 | 9 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT5 | 10 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT6 | 11 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT7 | 12 | DE | Depends on the configurable range in QDUTT |  |
| ENCRYPT8 | 13 | DE | Depends on the configurable range in QDUTT |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |

Note

For the full region configuration steps, see KBA-241230194303 SC8380XP QDUTT LCP Region Configuration Guide.

### Related

- [Configure LCP-DARE regions with QDUTT](https://docs.qualcomm.com/doc/80-A0399-49/topic/configure-lcp-dare-regions-with-qdutt.html)
- [Debug LCP-DARE authentication errors](https://docs.qualcomm.com/doc/80-A0399-49/topic/debug-lcp-dare-authentication-errors.html)

Last Published: Sep 08, 2026

[Previous Topic
Get started with LCP-DARE configuration](https://docs.qualcomm.com/bundle/publicresource/80-A0399-49/topics/get-started-with-lcp-dare-configuration.md) [Next Topic
Configure LCP-DARE regions with QDUTT](https://docs.qualcomm.com/bundle/publicresource/80-A0399-49/topics/configure-lcp-dare-regions-with-qdutt.md)

Source: [https://docs.qualcomm.com/doc/80-A0399-49/topic/lcp-dare-architecture.html](https://docs.qualcomm.com/doc/80-A0399-49/topic/lcp-dare-architecture.html)