ALXD800EEXJ2VD AMD (ADVANCED MICRO DEVICES), ALXD800EEXJ2VD Datasheet - Page 508

• Manufacturer Part Number: ALXD800EEXJ2VD
• Manufacturer: AMD (ADVANCED MICRO DEVICES)

Specifications of ALXD800EEXJ2VD

• Operating Temperature (min): 0C
• Operating Temperature (max): 85C
• Operating Temperature Classification: Commercial
• Mounting: Surface Mount
• Lead Free Status / RoHS Status: Compliant

6.11.2
The AES engine provides ECB and CBC 128-bit hardware
encryption and decryption for the Geode LX processor
using the Advanced Encryption Standard algorithm.
The Security block has two key sources. One is a hidden
128-bit key stored in non-volatile memory. It is expected
that this key is loaded into the non-volatile memory once at
the factory and the memory is locked to prevent future
writes. This key is loaded automatically by hardware after
reset and is not visible to the x86 processor, (also, these
locations in non-volatile memory cannot be read using the
non-volatile memory interface). The second key is writable,
(but not readable) by the x86 processor. It appears as a
series of four writable 32-bit QWORDs in the Security block
memory address space. Reads to these registers always
return zeros. Note that these bits are accessible via the
debug interface unless the debug interface has been
locked.
For any single operation, the Security block can work in
either encryption or decryption mode. The same two key
registers (hidden and writable) are used for both modes.
The Security block provides a mastering DMA interface to
system memory. It contains two sets of pointer registers
(contexts A and B) for controlling the DMA operations. For
each set, there is a 32-bit DMA Source register that points
to the start of the source data in memory. The lower four
MSBs are zero, forcing the address to align to a 16-byte
boundary. There is a 32-bit DMA Destination register that
points to the region in memory where the AES block writes
its results. This pointer also forces alignment to a 16-byte
boundary. For consistency with other block architecture
specifications, these registers are described as QWORDs
in the Security block memory space. In addition to the 32-
bit DMA Source register, there is a 32-bit Length register
that holds a count of the number of bytes to be encrypted/
decrypted. Again the lower four bits are zero forcing the
length to be an integer multiple of 16-byte blocks. If the
source data does not end on a 16-byte boundary, software
must pad the data out to the next 16-byte boundary. Hav-
ing two separate contexts allows the software to queue a
second encryption/decryption request while the first opera-
tion is completing. The Security block only contains a sin-
gle AES hardware block so the second request is not
processed until the first request completes.
508
Functional Description
33234C
The Control registers (SB Memory Offset 00h and 04h) are
used to configure the Security block. There are two sets of
control bits to select the key source (hidden vs. writable)
and the operational mode (encryption/decryption), and the
data coherency flags for memory accesses. There are also
two start bits (A and B) to initiate an operation once the
appropriate pointers have been configured. The Security
block can be configured to generate an interrupt on com-
pletion of an encryption/decryption operation. Alternatively,
the interrupt can be masked and the completion bit can be
polled.
For each start command, the Security block processes the
data starting at the DMA source address and continues for
the number of bytes specified in the Length register. The
results are written starting at the address in the Destination
register. For each start command, the Security block pro-
cesses the data starting at the DMA source address and
continues for the number of bytes specified in the Length
register. The results are written starting at the address in
the Destination register. For each start command, the AES
can be configured for key source, encryption/decryption
mode, and memory coherence flags. No changes to the A
registers should be made during an encryption or decryp-
tion operation for A, and no changes to the B registers
should be made during an encryption or decryption opera-
tion for B. In CBC mode, the CBC Initialization Vector reg-
ister value is used by both A and B channels.
The Geode LX processor supports AES CBC mode and a
True Random Number Generator. CBC encryption/decryp-
tion is similar to ECB. When doing CBC mode encryption/
decryption, the 128-bit initialization vector is written to the
CBC Initialization Vector registers (SB Memory Offset 40h-
4Ch) prior to the start of the encryption/decryption. The
random number generator function provides true random
numbers required for the initialization values for AES CBC
encryption. Software must read the 32-bit random number
register four times to build the 128-bit initialization vector
(IV). This can then be used to program the CBC Initializa-
tion Vector registers prior to the CBC encryption.
AMD Geode™ LX Processors Data Book
Security Block