TSEC

2019-01-05T20:15:53Z

Mwk: cxset special infinite value

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 16-30
| Crypto fuc5 operation
0x0000: none (fuc5 opcode 0x00)
0x0010: cmov (fuc5 opcode 0x84)
0x0020: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x0030: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x0040: crng (fuc5 opcode 0x90)
0x0050: cs0begin (fuc5 opcode 0x94)
0x0060: cs0exec (fuc5 opcode 0x98)
0x0070: cs1begin (fuc5 opcode 0x9C)
0x0080: cs1exec (fuc5 opcode 0xA0)
0x0090: invalid (fuc5 opcode 0xA4)
0x00A0: cchmod (fuc5 opcode 0xA8)
0x00B0: cxor (fuc5 opcode 0xAC)
0x00C0: cadd (fuc5 opcode 0xB0)
0x00D0: cand (fuc5 opcode 0xB4)
0x00E0: crev (fuc5 opcode 0xB8)
0x00F0: cprecmac (fuc5 opcode 0xBC)
0x0100: csecret (fuc5 opcode 0xC0)
0x0110: ckeyreg (fuc5 opcode 0xC4)
0x0120: ckexp (fuc5 opcode 0xC8)
0x0130: ckrexp (fuc5 opcode 0xCC)
0x0140: cenc (fuc5 opcode 0xD0)
0x0150: cdec (fuc5 opcode 0xD4)
0x0160: csigauth (fuc5 opcode 0xD8)
0x0170: csigenc (fuc5 opcode 0xDC)
0x0180: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Register ACLs ===
Falcon tracks permission metadata about each crypto reg. Permissions include read/write ability per execution mode, as well as ability to use the reg for encrypt/decrypt, among other permissions. Permissions are propagated when registers are referenced by instructions (e.g. moving a value from read-protected $cX to $cY will result in $cY also being read-protected).

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

Under certain circumstances, it is possible to observe this instruction being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively. Also, via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

Nintendo Switch Brew - User contributions [en]

TSEC