Both XTS and GCM encryption use hardware key rolling to automatically change the active encryption key after a configurable number of uses. There is no software involvement. Key rolling limits the amount of data encrypted under a single key, as required for cryptographic compliance.
The following per-region usage thresholds govern rolling behavior, and can be set in the ddr5_xmpu_flags page. Access this under the Subsystems section in ACE.
| Parameter | Description |
|---|---|
| max_key_usage | Start background key rolling after a key has been used this number of times. Key rolling runs concurrently with normal DRAM traffic. |
| abs_max_key_usage | If this higher threshold is exceeded before a key roll completes, key rolling is prioritized over all normal DRAM traffic until complete. |
Additionally, you can set the following key rolling characteristics by clicking the appropriate DDRMC page under Protection Units, and then locating the XMPU Flags section.
- Credit Update Interval
- Controls the pace of key rolling: credits accumulate at rate = 2^credit_update_interval × NPI clock period (default interval = 9, providing a moderate background rekey rate).
- Credit Limit (default 255)
- Caps the maximum credits that can accumulate.
- Credit Update (default 16)
- Sets credits granted per update cycle. A
credit_update_intervalvalue less than 4 disables the rate limiter entirely.
Note:
- Key rolling is fully hardware-automated and requires no software action during normal operation. Encryption region sizes and key allocations are fixed at boot time and cannot be changed without a Power-On Reset.
- Key rolling is mandatory for all AES-GCM encrypted regions.
- DDRMC5C has the following restrictions related to rekeying:
- In single channel DDR mode (1x32 or 1x16), all GCM traffic must be targeted to NoC port 0 of the DDRMC. The maximum bandwidth with GCM is 2 GB/s which can easily be provided by a single NoC port.
- Disable key-rolling in single channel mode for XTS-AES encrypted regions. Do this by setting both max_key_usage and abs_max_key_usage registers for the XTS regions to 0.